{
"bomFormat": "CycloneDX",
"specVersion": "1.5",
"version": 1,
"vulnerabilities": [{  "bom-ref": "e90b6d1b-2d29-4e46-b645-5946ccbb57e2",  "id": "CVE-2021-47418",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47418"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: fix NULL deref in fifo_set_limit()\n\nsyzbot reported another NULL deref in fifo_set_limit() [1]\n\nI could repro the issue with :\n\nunshare -n\ntc qd add dev lo root handle 1:0 tbf limit 200000 burst 70000 rate 100Mbit\ntc qd replace dev lo parent 1:0 pfifo_fast\ntc qd change dev lo root handle 1:0 tbf limit 300000 burst 70000 rate 100Mbit\n\npfifo_fast does not have a change() operation.\nMake fifo_set_limit() more robust about this.\n\n[1]\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 1cf99067 P4D 1cf99067 PUD 7ca49067 PMD 0\nOops: 0010 [#1] PREEMPT SMP KASAN\nCPU: 1 PID: 14443 Comm: syz-executor959 Not tainted 5.15.0-rc3-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at RIP 0xffffffffffffffd6.\nRSP: 0018:ffffc9000e2f7310 EFLAGS: 00010246\nRAX: dffffc0000000000 RBX: ffffffff8d6ecc00 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff888024c27910 RDI: ffff888071e34000\nRBP: ffff888071e34000 R08: 0000000000000001 R09: ffffffff8fcfb947\nR10: 0000000000000001 R11: 0000000000000000 R12: ffff888024c27910\nR13: ffff888071e34018 R14: 0000000000000000 R15: ffff88801ef74800\nFS:  00007f321d897700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffffffffd6 CR3: 00000000722c3000 CR4: 00000000003506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n fifo_set_limit net/sched/sch_fifo.c:242 [inline]\n fifo_set_limit+0x198/0x210 net/sched/sch_fifo.c:227\n tbf_change+0x6ec/0x16d0 net/sched/sch_tbf.c:418\n qdisc_change net/sched/sch_api.c:1332 [inline]\n tc_modify_qdisc+0xd9a/0x1a60 net/sched/sch_api.c:1634\n rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572\n netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504\n netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]\n netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340\n netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929\n sock_sendmsg_nosec net/socket.c:704 [inline]\n sock_sendmsg+0xcf/0x120 net/socket.c:724\n ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409\n ___sys_sendmsg+0xf3/0x170 net/socket.c:2463\n __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "71a422c0-61a6-4887-8fcf-d65d369ea62b",  "id": "CVE-2025-37982",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wl1251: fix memory leak in wl1251_tx_work\n\nThe skb dequeued from tx_queue is lost when wl1251_ps_elp_wakeup fails\nwith a -ETIMEDOUT error. Fix that by queueing the skb back to tx_queue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d6c97e7d-1318-4a79-a1d3-5ccd8e9918bc",  "id": "CLSA-2026-1777567502",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4cb136e5-588e-4222-a11b-6db01255b251",  "id": "SUSE-SU-2026:22668-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "23103ff3-aacc-46df-9e2e-0b05e6eabdaa",  "id": "AZL-75278",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "567cb1e1-b760-4c2a-b7b9-1cac190b9c6e",  "id": "AZL-33937",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e5f77cf0-8ed0-4559-a43d-6a61798d309a",  "id": "CVE-2016-4913",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4913"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containing \\0 characters, which allows local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9f4eb818-293a-4051-b304-39acd7b7a988",  "id": "OESA-2022-1624",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a492f4d6-1acf-45a8-87de-e826045db106",  "id": "OESA-2024-2440",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7b618a8d-5661-447e-97b5-a1fcba6eaa18",  "id": "CVE-2021-47205",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47205"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: sunxi-ng: Unregister clocks/resets when unbinding\n\nCurrently, unbinding a CCU driver unmaps the device's MMIO region, while\nleaving its clocks/resets and their providers registered. This can cause\na page fault later when some clock operation tries to perform MMIO. Fix\nthis by separating the CCU initialization from the memory allocation,\nand then using a devres callback to unregister the clocks and resets.\n\nThis also fixes a memory leak of the `struct ccu_reset`, and uses the\ncorrect owner (the specific platform driver) for the clocks and resets.\n\nEarly OF clock providers are never unregistered, and limited error\nhandling is possible, so they are mostly unchanged. The error reporting\nis made more consistent by moving the message inside of_sunxi_ccu_probe.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "deb841fb-6f80-4d49-ac68-e2f8a046b1f1",  "id": "CVE-2026-31681",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_multiport: validate range encoding in checkentry\n\nports_match_v1() treats any non-zero pflags entry as the start of a\nport range and unconditionally consumes the next ports[] element as\nthe range end.\n\nThe checkentry path currently validates protocol, flags and count, but\nit does not validate the range encoding itself. As a result, malformed\nrules can mark the last slot as a range start or place two range starts\nback to back, leaving ports_match_v1() to step past the last valid\nports[] element while interpreting the rule.\n\nReject malformed multiport v1 rules in checkentry by validating that\neach range start has a following element and that the following element\nis not itself marked as another range start.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ead004b-1281-4400-a2b1-ba71fef5013e",  "id": "CVE-2022-2785",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2785"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpf_sys_bpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAP_BPF can arbitrarily read memory from anywhere on the system. We recommend upgrading past commit 86f44fcec22c",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2a73d59-019a-40e8-978c-e647a446fb91",  "id": "OESA-2026-1465",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1efd5b77-1fa6-4df5-a4c7-ba6a28280f62",  "id": "CVE-2024-38633",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: max3100: Update uart_driver_registered on driver removal\n\nThe removal of the last MAX3100 device triggers the removal of\nthe driver. However, code doesn't update the respective global\nvariable and after insmod — rmmod — insmod cycle the kernel\noopses:\n\n  max3100 spi-PRP0001:01: max3100_probe: adding port 0\n  BUG: kernel NULL pointer dereference, address: 0000000000000408\n  ...\n  RIP: 0010:serial_core_register_port+0xa0/0x840\n  ...\n   max3100_probe+0x1b6/0x280 [max3100]\n   spi_probe+0x8d/0xb0\n\nUpdate the actual state so next time UART driver will be registered\nagain.\n\nHugo also noticed, that the error path in the probe also affected\nby having the variable set, and not cleared. Instead of clearing it\nmove the assignment after the successfull uart_register_driver() call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a3f30f0b-144a-4d1b-8084-86832b9ddb27",  "id": "CVE-2024-53142",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninitramfs: avoid filename buffer overrun\n\nThe initramfs filename field is defined in\nDocumentation/driver-api/early-userspace/buffer-format.rst as:\n\n 37 cpio_file := ALGN(4) + cpio_header + filename + \"\\0\" + ALGN(4) + data\n...\n 55 ============= ================== =========================\n 56 Field name    Field size         Meaning\n 57 ============= ================== =========================\n...\n 70 c_namesize    8 bytes            Length of filename, including final \\0\n\nWhen extracting an initramfs cpio archive, the kernel's do_name() path\nhandler assumes a zero-terminated path at @collected, passing it\ndirectly to filp_open() / init_mkdir() / init_mknod().\n\nIf a specially crafted cpio entry carries a non-zero-terminated filename\nand is followed by uninitialized memory, then a file may be created with\ntrailing characters that represent the uninitialized memory. The ability\nto create an initramfs entry would imply already having full control of\nthe system, so the buffer overrun shouldn't be considered a security\nvulnerability.\n\nAppend the output of the following bash script to an existing initramfs\nand observe any created /initramfs_test_fname_overrunAA* path. E.g.\n  ./reproducer.sh | gzip >> /myinitramfs\n\nIt's easiest to observe non-zero uninitialized memory when the output is\ngzipped, as it'll overflow the heap allocated @out_buf in __gunzip(),\nrather than the initrd_start+initrd_size block.\n\n---- reproducer.sh ----\nnilchar=\"A\"\t# change to \"\\0\" to properly zero terminate / pad\nmagic=\"070701\"\nino=1\nmode=$(( 0100777 ))\nuid=0\ngid=0\nnlink=1\nmtime=1\nfilesize=0\ndevmajor=0\ndevminor=1\nrdevmajor=0\nrdevminor=0\ncsum=0\nfname=\"initramfs_test_fname_overrun\"\nnamelen=$(( ${#fname} + 1 ))\t# plus one to account for terminator\n\nprintf \"%s%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%s\" \\\n\t$magic $ino $mode $uid $gid $nlink $mtime $filesize \\\n\t$devmajor $devminor $rdevmajor $rdevminor $namelen $csum $fname\n\ntermpadlen=$(( 1 + ((4 - ((110 + $namelen) & 3)) % 4) ))\nprintf \"%.s${nilchar}\" $(seq 1 $termpadlen)\n---- reproducer.sh ----\n\nSymlink filename fields handled in do_symlink() won't overrun past the\ndata segment, due to the explicit zero-termination of the symlink\ntarget.\n\nFix filename buffer overrun by aborting the initramfs FSM if any cpio\nentry doesn't carry a zero-terminator at the expected (name_len - 1)\noffset.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4176eb2d-6067-4786-8119-bd2be4c33e02",  "id": "CVE-2022-49977",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead\n\nftrace_startup does not remove ops from ftrace_ops_list when\nftrace_startup_enable fails:\n\nregister_ftrace_function\n  ftrace_startup\n    __register_ftrace_function\n      ...\n      add_ftrace_ops(&ftrace_ops_list, ops)\n      ...\n    ...\n    ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1\n    ...\n  return 0 // ops is in the ftrace_ops_list.\n\nWhen ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:\nunregister_ftrace_function\n  ftrace_shutdown\n    if (unlikely(ftrace_disabled))\n            return -ENODEV;  // return here, __unregister_ftrace_function is not executed,\n                             // as a result, ops is still in the ftrace_ops_list\n    __unregister_ftrace_function\n    ...\n\nIf ops is dynamically allocated, it will be free later, in this case,\nis_ftrace_trampoline accesses NULL pointer:\n\nis_ftrace_trampoline\n  ftrace_ops_trampoline\n    do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL!\n\nSyzkaller reports as follows:\n[ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b\n[ 1203.508039] #PF: supervisor read access in kernel mode\n[ 1203.508798] #PF: error_code(0x0000) - not-present page\n[ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0\n[ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI\n[ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G    B   W         5.10.0 #8\n[ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0\n[ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 <48> 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00\n[ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246\n[ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866\n[ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b\n[ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07\n[ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399\n[ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008\n[ 1203.525634] FS:  00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000\n[ 1203.526801] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0\n[ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n\nTherefore, when ftrace_startup_enable fails, we need to rollback registration\nprocess and remove ops from ftrace_ops_list.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7be6d492-ab94-4a2f-9010-a51539c49c3b",  "id": "MGASA-2026-0253",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "feb0352c-2228-4840-99d8-18d18517cde8",  "id": "CVE-2017-1000251",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000251"  },  "ratings": [    {      "score": 8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:42762'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:144307/BlueBorne-BlueTooth-Buffer-Overflow-Proof-Of-Concept.html'"    }  ]},{  "bom-ref": "056688e6-a9c9-4f76-854b-4fc46550c63f",  "id": "CVE-2026-46266",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP\n\nYizhou Zhao reported that simply having one RAW socket on protocol\nIPPROTO_RAW (255) was dangerous.\n\n  socket(AF_INET, SOCK_RAW, 255);\n\nA malicious incoming ICMP packet can set the protocol field to 255\nand match this socket, leading to FNHE cache changes.\n\ninner = IP(src=\"192.168.2.1\", dst=\"8.8.8.8\", proto=255)/Raw(\"TEST\")\npkt = IP(src=\"192.168.1.1\", dst=\"192.168.2.1\")/ICMP(type=3, code=4, nexthopmtu=576)/inner\n\n\"man 7 raw\" states:\n\n  A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able\n  to send any IP protocol that is specified in the passed header.\n  Receiving of all IP protocols via IPPROTO_RAW is not possible\n  using raw sockets.\n\nMake sure we drop these malicious packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f596624b-d2e5-4a68-b03d-57d1d9f6d3ec",  "id": "CVE-2022-49156",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix scheduling while atomic\n\nThe driver makes a call into midlayer (fc_remote_port_delete) which can put\nthe thread to sleep. The thread that originates the call is in interrupt\ncontext. The combination of the two trigger a crash. Schedule the call in\nnon-interrupt context where it is more safe.\n\nkernel: BUG: scheduling while atomic: swapper/7/0/0x00010000\nkernel: Call Trace:\nkernel:  <IRQ>\nkernel:  dump_stack+0x66/0x81\nkernel:  __schedule_bug.cold.90+0x5/0x1d\nkernel:  __schedule+0x7af/0x960\nkernel:  schedule+0x28/0x80\nkernel:  schedule_timeout+0x26d/0x3b0\nkernel:  wait_for_completion+0xb4/0x140\nkernel:  ? wake_up_q+0x70/0x70\nkernel:  __wait_rcu_gp+0x12c/0x160\nkernel:  ? sdev_evt_alloc+0xc0/0x180 [scsi_mod]\nkernel:  synchronize_sched+0x6c/0x80\nkernel:  ? call_rcu_bh+0x20/0x20\nkernel:  ? __bpf_trace_rcu_invoke_callback+0x10/0x10\nkernel:  sdev_evt_alloc+0xfd/0x180 [scsi_mod]\nkernel:  starget_for_each_device+0x85/0xb0 [scsi_mod]\nkernel:  ? scsi_init_io+0x360/0x3d0 [scsi_mod]\nkernel:  scsi_init_io+0x388/0x3d0 [scsi_mod]\nkernel:  device_for_each_child+0x54/0x90\nkernel:  fc_remote_port_delete+0x70/0xe0 [scsi_transport_fc]\nkernel:  qla2x00_schedule_rport_del+0x62/0xf0 [qla2xxx]\nkernel:  qla2x00_mark_device_lost+0x9c/0xd0 [qla2xxx]\nkernel:  qla24xx_handle_plogi_done_event+0x55f/0x570 [qla2xxx]\nkernel:  qla2x00_async_login_sp_done+0xd2/0x100 [qla2xxx]\nkernel:  qla24xx_logio_entry+0x13a/0x3c0 [qla2xxx]\nkernel:  qla24xx_process_response_queue+0x306/0x400 [qla2xxx]\nkernel:  qla24xx_msix_rsp_q+0x3f/0xb0 [qla2xxx]\nkernel:  __handle_irq_event_percpu+0x40/0x180\nkernel:  handle_irq_event_percpu+0x30/0x80\nkernel:  handle_irq_event+0x36/0x60",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c9a8d9b6-042f-4768-8ff4-939e7f704b0a",  "id": "AZL-8472",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3d7dc043-7d7f-4472-89ba-27d63989bb3f",  "id": "CVE-2026-46122",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: b43: enforce bounds check on firmware key index in b43_rx()\n\nThe firmware-controlled key index in b43_rx() can exceed the dev->key[]\narray size (58 entries). The existing B43_WARN_ON is non-enforcing in\nproduction builds, allowing an out-of-bounds read.\n\nMake the B43_WARN_ON check enforcing by dropping the frame when the\nfirmware returns an invalid key index.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d9fd397-fb99-47f0-938d-26f2e60e36cb",  "id": "openSUSE-SU-2024:11738-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d9f2d860-65e1-4c2f-a723-6018ddcdd58e",  "id": "OESA-2026-2808",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3a8669d1-32cc-4c66-b446-3d7c58208768",      "versions": [        {          "component": "radvd",          "version": "1.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "02b3353f-2240-49a2-858c-75a465847e5f",  "id": "MGASA-2026-0135",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5cea61c-8fb5-4a92-a9b9-0a0c30cf032d",  "id": "CLSA-2023-1676025596",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "97c23588-cb30-4318-80a4-985b92de7eb3",  "id": "AZL-91164",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1be22b68-67a3-4cc3-9cfa-7c2ce30d73f4",  "id": "CVE-2023-52834",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natl1c: Work around the DMA RX overflow issue\n\nThis is based on alx driver commit 881d0327db37 (\"net: alx: Work around\nthe DMA RX overflow issue\").\n\nThe alx and atl1c drivers had RX overflow error which was why a custom\nallocator was created to avoid certain addresses. The simpler workaround\nthen created for alx driver, but not for atl1c due to lack of tester.\n\nInstead of using a custom allocator, check the allocated skb address and\nuse skb_reserve() to move away from problematic 0x...fc0 address.\n\nTested on AR8131 on Acer 4540.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e90fd531-fda8-417e-9b2a-50000908406a",  "id": "ALSA-2022:6224",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "744e261a-7879-4339-8556-9638ce70fca1",  "id": "SUSE-SU-2019:1136-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "70cd25cc-ee23-40e2-b7c9-850099548277",  "id": "AZL-6349",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.2,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6520a308-2487-4d89-8c59-dce5dfe1aa71",  "id": "CVE-2017-16525",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16525"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, related to disconnection and failed setup.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f518948e-74c3-406c-83b8-95b7fa60dcb3",  "id": "CVE-2013-0309",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0309"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fd300b21-5c2d-40ac-b2f2-a42fe16597d6",  "id": "CVE-2022-50105",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/spufs: Fix refcount leak in spufs_init_isolated_loader\n\nof_find_node_by_path() returns remote device nodepointer with\nrefcount incremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() to avoid refcount leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6e91dda0-b288-4583-9561-e8ae18e44552",  "id": "DSA-3773-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "993c2745-289b-4890-bad2-bd2e805c89ab",  "id": "SUSE-SU-2026:2458-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b93f6611-2f82-4f82-8703-956c2df442c7",  "id": "CVE-2021-47185",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47185"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: tty_buffer: Fix the softlockup issue in flush_to_ldisc\n\nWhen running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64, there is a soft lockup,\nwhich look like this one:\n\n  Workqueue: events_unbound flush_to_ldisc\n  Call trace:\n   dump_backtrace+0x0/0x1ec\n   show_stack+0x24/0x30\n   dump_stack+0xd0/0x128\n   panic+0x15c/0x374\n   watchdog_timer_fn+0x2b8/0x304\n   __run_hrtimer+0x88/0x2c0\n   __hrtimer_run_queues+0xa4/0x120\n   hrtimer_interrupt+0xfc/0x270\n   arch_timer_handler_phys+0x40/0x50\n   handle_percpu_devid_irq+0x94/0x220\n   __handle_domain_irq+0x88/0xf0\n   gic_handle_irq+0x84/0xfc\n   el1_irq+0xc8/0x180\n   slip_unesc+0x80/0x214 [slip]\n   tty_ldisc_receive_buf+0x64/0x80\n   tty_port_default_receive_buf+0x50/0x90\n   flush_to_ldisc+0xbc/0x110\n   process_one_work+0x1d4/0x4b0\n   worker_thread+0x180/0x430\n   kthread+0x11c/0x120\n\nIn the testcase pty04, The first process call the write syscall to send\ndata to the pty master. At the same time, the workqueue will do the\nflush_to_ldisc to pop data in a loop until there is no more data left.\nWhen the sender and workqueue running in different core, the sender sends\ndata fastly in full time which will result in workqueue doing work in loop\nfor a long time and occuring softlockup in flush_to_ldisc with kernel\nconfigured without preempt. So I add need_resched check and cond_resched\nin the flush_to_ldisc loop to avoid it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b628886-7225-4bf3-89b9-8b073aaf3c1f",  "id": "CVE-2011-1012",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1012"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "The ldm_parse_vmdb function in fs/partitions/ldm.c in the Linux kernel before 2.6.38-rc6-git6 does not validate the VBLK size value in the VMDB structure in an LDM partition table, which allows local users to cause a denial of service (divide-by-zero error and OOPS) via a crafted partition table.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "23871c14-6fa2-4770-b44a-b3240e6e1cfe",  "id": "ROOT-OS-ALPINE-317-CVE-2026-34182",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1900e62e-bdd7-444c-a840-b2f30e247ad3",  "id": "CVE-2022-48953",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: cmos: Fix event handler registration ordering issue\n\nBecause acpi_install_fixed_event_handler() enables the event\nautomatically on success, it is incorrect to call it before the\nhandler routine passed to it is ready to handle events.\n\nUnfortunately, the rtc-cmos driver does exactly the incorrect thing\nby calling cmos_wake_setup(), which passes rtc_handler() to\nacpi_install_fixed_event_handler(), before cmos_do_probe(), because\nrtc_handler() uses dev_get_drvdata() to get to the cmos object\npointer and the driver data pointer is only populated in\ncmos_do_probe().\n\nThis leads to a NULL pointer dereference in rtc_handler() on boot\nif the RTC fixed event happens to be active at the init time.\n\nTo address this issue, change the initialization ordering of the\ndriver so that cmos_wake_setup() is always called after a successful\ncmos_do_probe() call.\n\nWhile at it, change cmos_pnp_probe() to call cmos_do_probe() after\nthe initial if () statement used for computing the IRQ argument to\nbe passed to cmos_do_probe() which is cleaner than calling it in\neach branch of that if () (local variable \"irq\" can be of type int,\nbecause it is passed to that function as an argument of type int).\n\nNote that commit 6492fed7d8c9 (\"rtc: rtc-cmos: Do not check\nACPI_FADT_LOW_POWER_S0\") caused this issue to affect a larger number\nof systems, because previously it only affected systems with\nACPI_FADT_LOW_POWER_S0 set, but it is present regardless of that\ncommit.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "da590a02-a023-4eb4-8133-9a187c4c78f1",  "id": "CVE-2026-52982",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()\n\nsyzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit()\nwhen accessing skb->len for tx statistics after usb_submit_urb() has\nbeen called:\n\n  BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760\n    drivers/net/usb/rtl8150.c:712\n  Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226\n\nThe URB completion handler write_bulk_callback() frees the skb via\ndev_kfree_skb_irq(dev->tx_skb). The URB may complete on another CPU\nin softirq context before usb_submit_urb() returns in the submitter,\nso by the time the submitter reads skb->len the skb has already been\nqueued to the per-CPU completion_queue and freed by net_tx_action():\n\n  CPU A (xmit)                      CPU B (USB completion softirq)\n  ------------                      ------------------------------\n  dev->tx_skb = skb;\n  usb_submit_urb()      --+\n                          |-------> write_bulk_callback()\n                          |           dev_kfree_skb_irq(dev->tx_skb)\n                          |         net_tx_action()\n                          |           napi_skb_cache_put()   <-- free\n  netdev->stats.tx_bytes  |\n    += skb->len;          <-- UAF read\n\nFix it by caching skb->len before submitting the URB and using the\ncached value when updating the tx_bytes counter.\n\nThe pre-existing tx_bytes semantics are preserved: the counter tracks\nthe original frame length (skb->len), not the ETH_ZLEN/USB-alignment\npadded \"count\" value that is handed to the device.  Changing that\nwould be a user-visible accounting change and is out of scope for\nthis UAF fix.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "696c6113-f6d2-4bfb-a9f0-d28fd5dddb07",  "id": "CVE-2022-49978",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: fb_pm2fb: Avoid potential divide by zero error\n\nIn `do_fb_ioctl()` of fbmem.c, if cmd is FBIOPUT_VSCREENINFO, var will be\ncopied from user, then go through `fb_set_var()` and\n`info->fbops->fb_check_var()` which could may be `pm2fb_check_var()`.\nAlong the path, `var->pixclock` won't be modified. This function checks\nwhether reciprocal of `var->pixclock` is too high. If `var->pixclock` is\nzero, there will be a divide by zero error. So, it is necessary to check\nwhether denominator is zero to avoid crash. As this bug is found by\nSyzkaller, logs are listed below.\n\ndivide error in pm2fb_check_var\nCall Trace:\n <TASK>\n fb_set_var+0x367/0xeb0 drivers/video/fbdev/core/fbmem.c:1015\n do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110\n fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "16697a78-92e3-44c8-b99a-ae2e4f8065d4",  "id": "CVE-2010-2943",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2943"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:15155'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:94354/XFS-Deleted-Inode-Information-Disclosure.html'"    }  ]},{  "bom-ref": "5ff8c3c9-da53-46ea-99ee-718134f3ed9a",  "id": "CVE-2018-7995",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7995"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devices/system/machinecheck/machinecheck<cpu number> directory. NOTE: a third party has indicated that this report is not security relevant",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cc66e976-af22-4167-bf12-f72aab530301",  "id": "DLA-33-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "67332266-c947-4d3c-b0c1-694e5f60ed8a",  "id": "CVE-2011-1585",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1585"  },  "ratings": [    {      "score": 3.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The cifs_find_smb_ses function in fs/cifs/connect.c in the Linux kernel before 2.6.36 does not properly determine the associations between users and sessions, which allows local users to bypass CIFS share authentication by leveraging a mount of a share by a different user.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "77e427c9-abd5-4ea6-983e-26bb8eda7fc5",  "id": "OESA-2026-2042",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ae11b09-c89a-498b-b390-66d5e313006b",  "id": "CVE-2016-2176",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2176"  },  "ratings": [    {      "score": 8.199999999999999,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "15d723ca-93cf-410f-af5a-57cf61fd91b7",  "id": "MGASA-2017-0453",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "825055d9-745c-4924-88c2-e7d1817a0d75",  "id": "CVE-2016-2782",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2782"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:39539'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:136142/Linux-visor-treo_attach-Null-Pointer-Dereference.html'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'PSS:136218/Linux-visor-treo_attach-Null-Pointer-Dereference.html'"    }  ]},{  "bom-ref": "665907e4-0775-4d37-96e8-83e15ff8450c",  "id": "CVE-2024-56784",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Adding array index check to prevent memory corruption\n\n[Why & How]\nArray indices out of bound caused memory corruption. Adding checks to\nensure that array index stays in bound.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "af59dba7-12c8-4483-9074-1e4bf8593626",  "id": "CVE-2014-6418",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6418"  },  "ratings": [    {      "score": 7.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly validate auth replies, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via crafted data from the IP address of a Ceph Monitor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d051bb46-0364-4ae3-8c95-67d5bce15fb4",  "id": "CVE-2014-4653",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4653"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e71b476-823e-4a52-8a1d-b6c16f178e18",  "id": "MGASA-2021-0231",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f3e3a632-9221-4e83-a94e-d447d8ce45a8",  "id": "CVE-2010-3432",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3432"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The sctp_packet_config function in net/sctp/output.c in the Linux kernel before 2.6.35.6 performs extraneous initializations of packet data structures, which allows remote attackers to cause a denial of service (panic) via a certain sequence of SCTP traffic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0590cb85-d3ae-4bf5-a23e-9c4ce16e38ac",  "id": "OESA-2023-1356",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c4db99be-207d-4709-b605-931b63c7f413",  "id": "CVE-2024-41070",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()\n\nAl reported a possible use-after-free (UAF) in kvm_spapr_tce_attach_iommu_group().\n\nIt looks up `stt` from tablefd, but then continues to use it after doing\nfdput() on the returned fd. After the fdput() the tablefd is free to be\nclosed by another thread. The close calls kvm_spapr_tce_release() and\nthen release_spapr_tce_table() (via call_rcu()) which frees `stt`.\n\nAlthough there are calls to rcu_read_lock() in\nkvm_spapr_tce_attach_iommu_group() they are not sufficient to prevent\nthe UAF, because `stt` is used outside the locked regions.\n\nWith an artifcial delay after the fdput() and a userspace program which\ntriggers the race, KASAN detects the UAF:\n\n  BUG: KASAN: slab-use-after-free in kvm_spapr_tce_attach_iommu_group+0x298/0x720 [kvm]\n  Read of size 4 at addr c000200027552c30 by task kvm-vfio/2505\n  CPU: 54 PID: 2505 Comm: kvm-vfio Not tainted 6.10.0-rc3-next-20240612-dirty #1\n  Hardware name: 8335-GTH POWER9 0x4e1202 opal:skiboot-v6.5.3-35-g1851b2a06 PowerNV\n  Call Trace:\n    dump_stack_lvl+0xb4/0x108 (unreliable)\n    print_report+0x2b4/0x6ec\n    kasan_report+0x118/0x2b0\n    __asan_load4+0xb8/0xd0\n    kvm_spapr_tce_attach_iommu_group+0x298/0x720 [kvm]\n    kvm_vfio_set_attr+0x524/0xac0 [kvm]\n    kvm_device_ioctl+0x144/0x240 [kvm]\n    sys_ioctl+0x62c/0x1810\n    system_call_exception+0x190/0x440\n    system_call_vectored_common+0x15c/0x2ec\n  ...\n  Freed by task 0:\n   ...\n   kfree+0xec/0x3e0\n   release_spapr_tce_table+0xd4/0x11c [kvm]\n   rcu_core+0x568/0x16a0\n   handle_softirqs+0x23c/0x920\n   do_softirq_own_stack+0x6c/0x90\n   do_softirq_own_stack+0x58/0x90\n   __irq_exit_rcu+0x218/0x2d0\n   irq_exit+0x30/0x80\n   arch_local_irq_restore+0x128/0x230\n   arch_local_irq_enable+0x1c/0x30\n   cpuidle_enter_state+0x134/0x5cc\n   cpuidle_enter+0x6c/0xb0\n   call_cpuidle+0x7c/0x100\n   do_idle+0x394/0x410\n   cpu_startup_entry+0x60/0x70\n   start_secondary+0x3fc/0x410\n   start_secondary_prolog+0x10/0x14\n\nFix it by delaying the fdput() until `stt` is no longer in use, which\nis effectively the entire function. To keep the patch minimal add a call\nto fdput() at each of the existing return paths. Future work can convert\nthe function to goto or __cleanup style cleanup.\n\nWith the fix in place the test case no longer triggers the UAF.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dac10c2c-e346-40a4-882d-2d169e7898ba",  "id": "SUSE-SU-2026:0892-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b1a1c2ed-5751-409f-ab1a-b8ef1137f1eb",  "id": "CVE-2024-41005",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetpoll: Fix race condition in netpoll_owner_active\n\nKCSAN detected a race condition in netpoll:\n\n\tBUG: KCSAN: data-race in net_rx_action / netpoll_send_skb\n\twrite (marked) to 0xffff8881164168b0 of 4 bytes by interrupt on cpu 10:\n\tnet_rx_action (./include/linux/netpoll.h:90 net/core/dev.c:6712 net/core/dev.c:6822)\n<snip>\n\tread to 0xffff8881164168b0 of 4 bytes by task 1 on cpu 2:\n\tnetpoll_send_skb (net/core/netpoll.c:319 net/core/netpoll.c:345 net/core/netpoll.c:393)\n\tnetpoll_send_udp (net/core/netpoll.c:?)\n<snip>\n\tvalue changed: 0x0000000a -> 0xffffffff\n\nThis happens because netpoll_owner_active() needs to check if the\ncurrent CPU is the owner of the lock, touching napi->poll_owner\nnon atomically. The ->poll_owner field contains the current CPU holding\nthe lock.\n\nUse an atomic read to check if the poll owner is the current CPU.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "03bdcd1d-b11a-4eae-b3de-a2a8cac0619c",  "id": "openSUSE-SU-2024:10195-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e20e81bf-1323-4bba-b397-e10d1af86fc5",  "id": "CVE-2013-1943",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1943"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted application, related to arch/x86/kvm/paging_tmpl.h and virt/kvm/kvm_main.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b001aa8-9734-41c0-b3a0-950d781cefb6",  "id": "CVE-2024-56596",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds in jfs_readdir\n\nThe stbl might contain some invalid values. Added a check to\nreturn error code in that case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c352204a-ee39-4c41-8940-7c6b10b3e342",  "id": "CVE-2016-9685",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9685"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel before 4.5.1 allow local users to cause a denial of service (memory consumption) via crafted XFS filesystem operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d15b6ab-f44d-4746-8937-3220b381377f",  "id": "CVE-2022-49301",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8712: fix uninit-value in usb_read8() and friends\n\nWhen r8712_usbctrl_vendorreq() returns negative, 'data' in\nusb_read{8,16,32} will not be initialized.\n\nBUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:643 [inline]\nBUG: KMSAN: uninit-value in string+0x4ec/0x6f0 lib/vsprintf.c:725\n string_nocheck lib/vsprintf.c:643 [inline]\n string+0x4ec/0x6f0 lib/vsprintf.c:725\n vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806\n va_format lib/vsprintf.c:1704 [inline]\n pointer+0x18e6/0x1f70 lib/vsprintf.c:2443\n vsnprintf+0x1a9b/0x3650 lib/vsprintf.c:2810\n vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158\n vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256\n dev_vprintk_emit+0x5ef/0x6d0 drivers/base/core.c:4604\n dev_printk_emit+0x1dd/0x21f drivers/base/core.c:4615\n __dev_printk+0x3be/0x440 drivers/base/core.c:4627\n _dev_info+0x1ea/0x22f drivers/base/core.c:4673\n r871xu_drv_init+0x1929/0x3070 drivers/staging/rtl8712/usb_intf.c:401\n usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396\n really_probe+0x6c7/0x1350 drivers/base/dd.c:621\n __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752\n driver_probe_device drivers/base/dd.c:782 [inline]\n __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899\n bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427\n __device_attach+0x593/0x8e0 drivers/base/dd.c:970\n device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017\n bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487\n device_add+0x1fff/0x26e0 drivers/base/core.c:3405\n usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170\n usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238\n usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293\n really_probe+0x6c7/0x1350 drivers/base/dd.c:621\n __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752\n driver_probe_device drivers/base/dd.c:782 [inline]\n __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899\n bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427\n __device_attach+0x593/0x8e0 drivers/base/dd.c:970\n device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017\n bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487\n device_add+0x1fff/0x26e0 drivers/base/core.c:3405\n usb_new_device+0x1b91/0x2950 drivers/usb/core/hub.c:2566\n hub_port_connect drivers/usb/core/hub.c:5363 [inline]\n hub_port_connect_change drivers/usb/core/hub.c:5507 [inline]\n port_event drivers/usb/core/hub.c:5665 [inline]\n hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5747\n process_one_work+0xdb6/0x1820 kernel/workqueue.c:2289\n worker_thread+0x10d0/0x2240 kernel/workqueue.c:2436\n kthread+0x3c7/0x500 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30\n\nLocal variable data created at:\n usb_read8+0x5d/0x130 drivers/staging/rtl8712/usb_ops.c:33\n r8712_read8+0xa5/0xd0 drivers/staging/rtl8712/rtl8712_io.c:29\n\nKMSAN: uninit-value in r871xu_drv_init\nhttps://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1f5c7c37-3fbd-4d9d-be11-6876e08c3534",  "id": "CVE-2026-31521",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmodule: Fix kernel panic when a symbol st_shndx is out of bounds\n\nThe module loader doesn't check for bounds of the ELF section index in\nsimplify_symbols():\n\n       for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {\n\t\tconst char *name = info->strtab + sym[i].st_name;\n\n\t\tswitch (sym[i].st_shndx) {\n\t\tcase SHN_COMMON:\n\n\t\t[...]\n\n\t\tdefault:\n\t\t\t/* Divert to percpu allocation if a percpu var. */\n\t\t\tif (sym[i].st_shndx == info->index.pcpu)\n\t\t\t\tsecbase = (unsigned long)mod_percpu(mod);\n\t\t\telse\n  /** HERE --> **/\t\tsecbase = info->sechdrs[sym[i].st_shndx].sh_addr;\n\t\t\tsym[i].st_value += secbase;\n\t\t\tbreak;\n\t\t}\n\t}\n\nA symbol with an out-of-bounds st_shndx value, for example 0xffff\n(known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic:\n\n  BUG: unable to handle page fault for address: ...\n  RIP: 0010:simplify_symbols+0x2b2/0x480\n  ...\n  Kernel panic - not syncing: Fatal exception\n\nThis can happen when module ELF is legitimately using SHN_XINDEX or\nwhen it is corrupted.\n\nAdd a bounds check in simplify_symbols() to validate that st_shndx is\nwithin the valid range before using it.\n\nThis issue was discovered due to a bug in llvm-objcopy, see relevant\ndiscussion for details [1].\n\n[1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "83657e9a-0f0a-4634-9047-ae4f0017536a",  "id": "CVE-2024-40981",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bypass empty buckets in batadv_purge_orig_ref()\n\nMany syzbot reports are pointing to soft lockups in\nbatadv_purge_orig_ref() [1]\n\nRoot cause is unknown, but we can avoid spending too much\ntime there and perhaps get more interesting reports.\n\n[1]\n\nwatchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:6:621]\nModules linked in:\nirq event stamp: 6182794\n hardirqs last  enabled at (6182793): [<ffff8000801dae10>] __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386\n hardirqs last disabled at (6182794): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]\n hardirqs last disabled at (6182794): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551\n softirqs last  enabled at (6182792): [<ffff80008aab71c4>] spin_unlock_bh include/linux/spinlock.h:396 [inline]\n softirqs last  enabled at (6182792): [<ffff80008aab71c4>] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287\n softirqs last disabled at (6182790): [<ffff80008aab61dc>] spin_lock_bh include/linux/spinlock.h:356 [inline]\n softirqs last disabled at (6182790): [<ffff80008aab61dc>] batadv_purge_orig_ref+0x164/0x1228 net/batman-adv/originator.c:1271\nCPU: 0 PID: 621 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024\nWorkqueue: bat_events batadv_purge_orig\npstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline]\n pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388\n lr : __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386\nsp : ffff800099007970\nx29: ffff800099007980 x28: 1fffe00018fce1bd x27: dfff800000000000\nx26: ffff0000d2620008 x25: ffff0000c7e70de8 x24: 0000000000000001\nx23: 1fffe00018e57781 x22: dfff800000000000 x21: ffff80008aab71c4\nx20: ffff0001b40136c0 x19: ffff0000c72bbc08 x18: 1fffe0001a817bb0\nx17: ffff800125414000 x16: ffff80008032116c x15: 0000000000000001\nx14: 1fffe0001ee9d610 x13: 0000000000000000 x12: 0000000000000003\nx11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000\nx8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000\nx5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000\nx2 : 0000000000000006 x1 : 0000000000000080 x0 : ffff800125414000\nCall trace:\n  __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline]\n  arch_local_irq_enable arch/arm64/include/asm/irqflags.h:49 [inline]\n  __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:386\n  __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]\n  _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:210\n  spin_unlock_bh include/linux/spinlock.h:396 [inline]\n  batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287\n  batadv_purge_orig+0x20/0x70 net/batman-adv/originator.c:1300\n  process_one_work+0x694/0x1204 kernel/workqueue.c:2633\n  process_scheduled_works kernel/workqueue.c:2706 [inline]\n  worker_thread+0x938/0xef4 kernel/workqueue.c:2787\n  kthread+0x288/0x310 kernel/kthread.c:388\n  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860\nSending NMI from CPU 0 to CPUs 1:\nNMI backtrace for cpu 1\nCPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024\npstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:51\n lr : default_idle_call+0xf8/0x128 kernel/sched/idle.c:103\nsp : ffff800093a17d30\nx29: ffff800093a17d30 x28: dfff800000000000 x27: 1ffff00012742fb4\nx26: ffff80008ec9d000 x25: 0000000000000000 x24: 0000000000000002\nx23: 1ffff00011d93a74 x22: ffff80008ec9d3a0 x21: 0000000000000000\nx20: ffff0000c19dbc00 x19: ffff8000802d0fd8 x18: 1fffe00036804396\nx17: ffff80008ec9d000 x16: ffff8000802d089c x15: 0000000000000001\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fd312cd8-495e-49da-9a21-edbfc544f04d",  "id": "CVE-2024-42080",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/restrack: Fix potential invalid address access\n\nstruct rdma_restrack_entry's kern_name was set to KBUILD_MODNAME\nin ib_create_cq(), while if the module exited but forgot del this\nrdma_restrack_entry, it would cause a invalid address access in\nrdma_restrack_clean() when print the owner of this rdma_restrack_entry.\n\nThese code is used to help find one forgotten PD release in one of the\nULPs. But it is not needed anymore, so delete them.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd05a8d7-edef-40b0-bb7a-5ec0dfa776bc",  "id": "CVE-2024-47669",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix state management in error path of log writing function\n\nAfter commit a694291a6211 (\"nilfs2: separate wait function from\nnilfs_segctor_write\") was applied, the log writing function\nnilfs_segctor_do_construct() was able to issue I/O requests continuously\neven if user data blocks were split into multiple logs across segments,\nbut two potential flaws were introduced in its error handling.\n\nFirst, if nilfs_segctor_begin_construction() fails while creating the\nsecond or subsequent logs, the log writing function returns without\ncalling nilfs_segctor_abort_construction(), so the writeback flag set on\npages/folios will remain uncleared.  This causes page cache operations to\nhang waiting for the writeback flag.  For example,\ntruncate_inode_pages_final(), which is called via nilfs_evict_inode() when\nan inode is evicted from memory, will hang.\n\nSecond, the NILFS_I_COLLECTED flag set on normal inodes remain uncleared. \nAs a result, if the next log write involves checkpoint creation, that's\nfine, but if a partial log write is performed that does not, inodes with\nNILFS_I_COLLECTED set are erroneously removed from the \"sc_dirty_files\"\nlist, and their data and b-tree blocks may not be written to the device,\ncorrupting the block mapping.\n\nFix these issues by uniformly calling nilfs_segctor_abort_construction()\non failure of each step in the loop in nilfs_segctor_do_construct(),\nhaving it clean up logs and segment usages according to progress, and\ncorrecting the conditions for calling nilfs_redirty_inodes() to ensure\nthat the NILFS_I_COLLECTED flag is cleared.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c35bb08d-2ef5-4835-a69c-38248169735d",  "id": "ROOT-OS-ALPINE-317-CVE-2026-28389",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "26aee100-d11b-406d-b0e4-0e71d94bef8a",  "id": "CVE-2014-9683",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9683"  },  "ratings": [    {      "score": 3.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:P"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "74c7d462-a7e0-4738-95b7-0b838e460e2b",  "id": "CVE-2018-11232",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11232"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service (panic) because a parameter is incorrectly used as a local variable.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a08d7406-67ea-442e-853b-65b4f4061652",  "id": "RLSA-2026:1472",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ac94c495-a631-42e7-966a-9b9540486ddf",  "id": "CVE-2023-53491",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstart_kernel: Add __no_stack_protector function attribute\n\nBack during the discussion of\ncommit a9a3ed1eff36 (\"x86: Fix early boot crash on gcc-10, third try\")\nwe discussed the need for a function attribute to control the omission\nof stack protectors on a per-function basis; at the time Clang had\nsupport for no_stack_protector but GCC did not. This was fixed in\ngcc-11. Now that the function attribute is available, let's start using\nit.\n\nCallers of boot_init_stack_canary need to use this function attribute\nunless they're compiled with -fno-stack-protector, otherwise the canary\nstored in the stack slot of the caller will differ upon the call to\nboot_init_stack_canary. This will lead to a call to __stack_chk_fail()\nthen panic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a4966e3-34bd-4c36-8457-dfd43e3f921f",  "id": "CVE-2021-44879",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44879"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9dcc785e-d9f5-484b-b7af-7ac8f4e6a515",  "id": "CVE-2017-15306",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15306"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The kvm_vm_ioctl_check_extension function in arch/powerpc/kvm/powerpc.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) via a KVM_CHECK_EXTENSION KVM_CAP_PPC_HTM ioctl call to /dev/kvm.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "867c2fe2-8ace-41d9-98bf-23f9f3d16f13",  "id": "CVE-2020-29372",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29372"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORING_OP_MADVISE implementation, aka CID-bc0c4d1e176e.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "06a3d77a-c829-4776-8262-377bcfa69eb4",  "id": "CVE-2015-5257",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5257"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/usb/serial/whiteheat.c in the Linux kernel before 4.2.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a crafted USB device.  NOTE: this ID was incorrectly used for an Apache Cordova issue that has the correct ID of CVE-2015-8320.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ea6bab2f-59e0-43e6-a2ab-4f5b771dbc0f",  "id": "MGASA-2014-0416",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "94ee87a6-64ac-436e-8a61-5607df44ff0f",  "id": "CVE-2022-49318",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: remove WARN_ON in f2fs_is_valid_blkaddr\n\nSyzbot triggers two WARNs in f2fs_is_valid_blkaddr and\n__is_bitmap_valid. For example, in f2fs_is_valid_blkaddr,\nif type is DATA_GENERIC_ENHANCE or DATA_GENERIC_ENHANCE_READ,\nit invokes WARN_ON if blkaddr is not in the right range.\nThe call trace is as follows:\n\n f2fs_get_node_info+0x45f/0x1070\n read_node_page+0x577/0x1190\n __get_node_page.part.0+0x9e/0x10e0\n __get_node_page\n f2fs_get_node_page+0x109/0x180\n do_read_inode\n f2fs_iget+0x2a5/0x58b0\n f2fs_fill_super+0x3b39/0x7ca0\n\nFix these two WARNs by replacing WARN_ON with dump_stack.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4884fcd5-59b7-4a25-a44d-ad266e72c573",  "id": "AZL-89928",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c54ed93b-f5e9-4408-b34f-5edcda65ec7e",  "id": "CVE-2011-1160",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1160"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The tpm_open function in drivers/char/tpm/tpm.c in the Linux kernel before 2.6.39 does not initialize a certain buffer, which allows local users to obtain potentially sensitive information from kernel memory via unspecified vectors.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2461f262-787c-43d6-beb7-b861c940f123",  "id": "OESA-2026-2964",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "256463b8-3bf1-484f-a977-853b0346c71b",  "id": "CVE-2026-31623",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()\n\nA malicious USB device claiming to be a CDC Phonet modem can overflow\nthe skb_shared_info->frags[] array by sending an unbounded sequence of\nfull-page bulk transfers.\n\nDrop the skb and increment the length error when the frag limit is\nreached.  This matches the same fix that commit f0813bcd2d9d (\"net:\nwwan: t7xx: fix potential skb->frags overflow in RX path\") did for the\nt7xx driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18254bd9-0ef9-4ee5-ad68-aaefc4a7771f",  "id": "OESA-2024-2387",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ffa5886e-d405-4137-817b-3ff8be1df288",  "id": "CVE-2025-38478",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix initialization of data for instructions that write to subdevice\n\nSome Comedi subdevice instruction handlers are known to access\ninstruction data elements beyond the first `insn->n` elements in some\ncases.  The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions\nallocate at least `MIN_SAMPLES` (16) data elements to deal with this,\nbut they do not initialize all of that.  For Comedi instruction codes\nthat write to the subdevice, the first `insn->n` data elements are\ncopied from user-space, but the remaining elements are left\nuninitialized.  That could be a problem if the subdevice instruction\nhandler reads the uninitialized data.  Ensure that the first\n`MIN_SAMPLES` elements are initialized before calling these instruction\nhandlers, filling the uncopied elements with 0.  For\n`do_insnlist_ioctl()`, the same data buffer elements are used for\nhandling a list of instructions, so ensure the first `MIN_SAMPLES`\nelements are initialized for each instruction that writes to the\nsubdevice.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6c26f5e5-895d-488f-ba80-d510f494153e",  "id": "CVE-2020-36516",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36516"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L"    }  ],  "cwes": [    327  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8e8c1457-589f-4ec6-b3b8-2360483ea556",  "id": "CVE-2022-49279",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.199999999999999,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: prevent integer overflow on 32 bit systems\n\nOn a 32 bit system, the \"len * sizeof(*p)\" operation can have an\ninteger overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c81b9b2d-589b-4c3c-8bbc-851e328346d1",  "id": "CVE-2017-7495",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7495"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users to obtain sensitive information from other users' files in opportunistic circumstances by waiting for a hardware reset, creating a new file, making write system calls, and reading this file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "88828467-52bb-4771-99d7-e9dce88f4b75",  "id": "CVE-2026-31469",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n\nA UAF issue occurs when the virtio_net driver is configured with napi_tx=N\nand the device's IFF_XMIT_DST_RELEASE flag is cleared\n(e.g., during the configuration of tc route filter rules).\n\nWhen IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack\nexpects the driver to hold the reference to skb->dst until the packet\nis fully transmitted and freed. In virtio_net with napi_tx=N,\nskbs may remain in the virtio transmit ring for an extended period.\n\nIf the network namespace is destroyed while these skbs are still pending,\nthe corresponding dst_ops structure has freed. When a subsequent packet\nis transmitted, free_old_xmit() is triggered to clean up old skbs.\nIt then calls dst_release() on the skb associated with the stale dst_entry.\nSince the dst_ops (referenced by the dst_entry) has already been freed,\na UAF kernel paging request occurs.\n\nfix it by adds skb_dst_drop(skb) in start_xmit to explicitly release\nthe dst reference before the skb is queued in virtio_net.\n\nCall Trace:\n Unable to handle kernel paging request at virtual address ffff80007e150000\n CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT\n  ...\n  percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)\n  dst_release+0xe0/0x110  net/core/dst.c:177\n  skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177\n  sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255\n  dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469\n  napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527\n  __free_old_xmit+0x164/0x230  drivers/net/virtio_net.c:611 [virtio_net]\n  free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]\n  start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]\n  ...\n\nReproduction Steps:\nNETDEV=\"enp3s0\"\n\nconfig_qdisc_route_filter() {\n    tc qdisc del dev $NETDEV root\n    tc qdisc add dev $NETDEV root handle 1: prio\n    tc filter add dev $NETDEV parent 1:0 \\\n\tprotocol ip prio 100 route to 100 flowid 1:1\n    ip route add 192.168.1.100/32 dev $NETDEV realm 100\n}\n\ntest_ns() {\n    ip netns add testns\n    ip link set $NETDEV netns testns\n    ip netns exec testns ifconfig $NETDEV  10.0.32.46/24\n    ip netns exec testns ping -c 1 10.0.32.1\n    ip netns del testns\n}\n\nconfig_qdisc_route_filter\n\ntest_ns\nsleep 2\ntest_ns",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b32415fe-b87a-40f6-8632-ae989b90d1f8",  "id": "CVE-2011-1479",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1479"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Double free vulnerability in the inotify subsystem in the Linux kernel before 2.6.39 allows local users to cause a denial of service (system crash) via vectors involving failed attempts to create files.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-4250.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:35600'"    }  ]},{  "bom-ref": "b96d24bd-b69d-4eb5-9ae3-50235b3e4cc6",  "id": "CVE-2021-46928",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46928"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    755  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Clear stale IIR value on instruction access rights trap\n\nWhen a trap 7 (Instruction access rights) occurs, this means the CPU\ncouldn't execute an instruction due to missing execute permissions on\nthe memory region.  In this case it seems the CPU didn't even fetched\nthe instruction from memory and thus did not store it in the cr19 (IIR)\nregister before calling the trap handler. So, the trap handler will find\nsome random old stale value in cr19.\n\nThis patch simply overwrites the stale IIR value with a constant magic\n\"bad food\" value (0xbaadf00d), in the hope people don't start to try to\nunderstand the various random IIR values in trap 7 dumps.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ab0d1750-f00b-4995-9215-c951cd837f6f",  "id": "CVE-2022-49880",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix warning in 'ext4_da_release_space'\n\nSyzkaller report issue as follows:\nEXT4-fs (loop0): Free/Dirty block details\nEXT4-fs (loop0): free_blocks=0\nEXT4-fs (loop0): dirty_blocks=0\nEXT4-fs (loop0): Block reservation details\nEXT4-fs (loop0): i_reserved_data_blocks=0\nEXT4-fs warning (device loop0): ext4_da_release_space:1527: ext4_da_release_space: ino 18, to_free 1 with only 0 reserved data blocks\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 92 at fs/ext4/inode.c:1528 ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1524\nModules linked in:\nCPU: 0 PID: 92 Comm: kworker/u4:4 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022\nWorkqueue: writeback wb_workfn (flush-7:0)\nRIP: 0010:ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1528\nRSP: 0018:ffffc900015f6c90 EFLAGS: 00010296\nRAX: 42215896cd52ea00 RBX: 0000000000000000 RCX: 42215896cd52ea00\nRDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000\nRBP: 1ffff1100e907d96 R08: ffffffff816aa79d R09: fffff520002bece5\nR10: fffff520002bece5 R11: 1ffff920002bece4 R12: ffff888021fd2000\nR13: ffff88807483ecb0 R14: 0000000000000001 R15: ffff88807483e740\nFS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005555569ba628 CR3: 000000000c88e000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n ext4_es_remove_extent+0x1ab/0x260 fs/ext4/extents_status.c:1461\n mpage_release_unused_pages+0x24d/0xef0 fs/ext4/inode.c:1589\n ext4_writepages+0x12eb/0x3be0 fs/ext4/inode.c:2852\n do_writepages+0x3c3/0x680 mm/page-writeback.c:2469\n __writeback_single_inode+0xd1/0x670 fs/fs-writeback.c:1587\n writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1870\n wb_writeback+0x41f/0x7b0 fs/fs-writeback.c:2044\n wb_do_writeback fs/fs-writeback.c:2187 [inline]\n wb_workfn+0x3cb/0xef0 fs/fs-writeback.c:2227\n process_one_work+0x877/0xdb0 kernel/workqueue.c:2289\n worker_thread+0xb14/0x1330 kernel/workqueue.c:2436\n kthread+0x266/0x300 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n </TASK>\n\nAbove issue may happens as follows:\next4_da_write_begin\n  ext4_create_inline_data\n    ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);\n    ext4_set_inode_flag(inode, EXT4_INODE_INLINE_DATA);\n__ext4_ioctl\n  ext4_ext_migrate -> will lead to eh->eh_entries not zero, and set extent flag\next4_da_write_begin\n  ext4_da_convert_inline_data_to_extent\n    ext4_da_write_inline_data_begin\n      ext4_da_map_blocks\n        ext4_insert_delayed_block\n\t  if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk))\n\t    if (!ext4_es_scan_clu(inode, &ext4_es_is_mapped, lblk))\n\t      ext4_clu_mapped(inode, EXT4_B2C(sbi, lblk)); -> will return 1\n\t       allocated = true;\n          ext4_es_insert_delayed_block(inode, lblk, allocated);\next4_writepages\n  mpage_map_and_submit_extent(handle, &mpd, &give_up_on_write); -> return -ENOSPC\n  mpage_release_unused_pages(&mpd, give_up_on_write); -> give_up_on_write == 1\n    ext4_es_remove_extent\n      ext4_da_release_space(inode, reserved);\n        if (unlikely(to_free > ei->i_reserved_data_blocks))\n\t  -> to_free == 1  but ei->i_reserved_data_blocks == 0\n\t  -> then trigger warning as above\n\nTo solve above issue, forbid inode do migrate which has inline data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc471a7d-6f30-419c-9e29-fc29129ca1f4",  "id": "CVE-2024-46812",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration\n\n[Why]\nCoverity reports Memory - illegal accesses.\n\n[How]\nSkip inactive planes.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8de1b5eb-a7db-4b10-a343-2c47566da22f",  "id": "CVE-2025-37849",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Tear down vGIC on failed vCPU creation\n\nIf kvm_arch_vcpu_create() fails to share the vCPU page with the\nhypervisor, we propagate the error back to the ioctl but leave the\nvGIC vCPU data initialised. Note only does this leak the corresponding\nmemory when the vCPU is destroyed but it can also lead to use-after-free\nif the redistributor device handling tries to walk into the vCPU.\n\nAdd the missing cleanup to kvm_arch_vcpu_create(), ensuring that the\nvGIC vCPU structures are destroyed on error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "131c6098-9bfa-40c8-b9b8-ead92377f4aa",  "id": "CVE-2024-50061",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition\n\nIn the cdns_i3c_master_probe function, &master->hj_work is bound with\ncdns_i3c_master_hj. And cdns_i3c_master_interrupt can call\ncnds_i3c_master_demux_ibis function to start the work.\n\nIf we remove the module which will call cdns_i3c_master_remove to\nmake cleanup, it will free master->base through i3c_master_unregister\nwhile the work mentioned above will be used. The sequence of operations\nthat may lead to a UAF bug is as follows:\n\nCPU0                                      CPU1\n\n                                     | cdns_i3c_master_hj\ncdns_i3c_master_remove               |\ni3c_master_unregister(&master->base) |\ndevice_unregister(&master->dev)      |\ndevice_release                       |\n//free master->base                  |\n                                     | i3c_master_do_daa(&master->base)\n                                     | //use master->base\n\nFix it by ensuring that the work is canceled before proceeding with\nthe cleanup in cdns_i3c_master_remove.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b30a777b-46f4-405c-b653-727b73455236",  "id": "CVE-2023-53413",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: isp116x: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1705d597-8de7-4795-815a-59ccdc77f97b",  "id": "CVE-2021-47329",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47329"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: megaraid_sas: Fix resource leak in case of probe failure\n\nThe driver doesn't clean up all the allocated resources properly when\nscsi_add_host(), megasas_start_aen() function fails during the PCI device\nprobe.\n\nClean up all those resources.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "691abf1c-9b32-4ac6-907e-631cc7bce26c",  "id": "CVE-2026-43123",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: check return value of con2fb_acquire_newinfo()\n\nIf fbcon_open() fails when called from con2fb_acquire_newinfo() then\ninfo->fbcon_par pointer remains NULL which is later dereferenced.\n\nAdd check for return value of the function con2fb_acquire_newinfo() to\navoid it.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "68b573b7-ae9c-471a-a9ee-315fb9e55888",  "id": "MGASA-2022-0458",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "246dce76-58be-4ae6-9c59-c5355824c22e",  "id": "ROOT-OS-ALPINE-317-CVE-2026-9076",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd0be373-9735-4101-8d25-fe634d12c1e3",  "id": "CVE-2024-56601",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: inet: do not leave a dangling sk pointer in inet_create()\n\nsock_init_data() attaches the allocated sk object to the provided sock\nobject. If inet_create() fails later, the sk object is freed, but the\nsock object retains the dangling pointer, which may create use-after-free\nlater.\n\nClear the sk pointer in the sock object on error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6e9ff21f-cd53-4d3c-aa09-29ecc4bdbf73",  "id": "ALSA-2026:1472",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a0ef2f52-5cfd-484e-b10b-a4bf710441dc",  "id": "MGASA-2018-0427",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8c4f7e34-a61b-4bb4-b763-713b65a66234",  "id": "CVE-2026-53041",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix listxattr handling when the buffer is full\n\n[BUG]\nIf an OCFS2 inode has both inline and block-based xattrs, listxattr()\ncan return a size larger than the caller's buffer when the inline names\nconsume that buffer exactly.\n\nkernel BUG at mm/usercopy.c:102!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102\nCall Trace:\n __check_heap_object+0xe3/0x120 mm/slub.c:8243\n check_heap_object mm/usercopy.c:196 [inline]\n __check_object_size mm/usercopy.c:250 [inline]\n __check_object_size+0x5c5/0x780 mm/usercopy.c:215\n check_object_size include/linux/ucopysize.h:22 [inline]\n check_copy_size include/linux/ucopysize.h:59 [inline]\n copy_to_user include/linux/uaccess.h:219 [inline]\n listxattr+0xb0/0x170 fs/xattr.c:926\n filename_listxattr fs/xattr.c:958 [inline]\n path_listxattrat+0x137/0x320 fs/xattr.c:988\n __do_sys_listxattr fs/xattr.c:1001 [inline]\n __se_sys_listxattr fs/xattr.c:998 [inline]\n __x64_sys_listxattr+0x7f/0xd0 fs/xattr.c:998\n ...\n\n[CAUSE]\nCommit 936b8834366e (\"ocfs2: Refactor xattr list and remove\nocfs2_xattr_handler().\") replaced the old per-handler list accounting\nwith ocfs2_xattr_list_entry(), but it kept using size == 0 to detect\nprobe mode.\n\nThat assumption stops being true once ocfs2_listxattr() finishes the\ninline-xattr pass. If the inline names fill the caller buffer exactly,\nthe block-xattr pass runs with a non-NULL buffer and a remaining size of\nzero. ocfs2_xattr_list_entry() then skips the bounds check, keeps\ncounting block names, and returns a positive size larger than the\nsupplied buffer.\n\n[FIX]\nDetect probe mode by testing whether the destination buffer pointer is\nNULL instead of whether the remaining size is zero.\n\nThat restores the pre-refactor behavior and matches the OCFS2 getxattr\nhelpers. Once the remaining buffer reaches zero while more names are\nleft, the block-xattr pass now returns -ERANGE instead of reporting a\nsize larger than the allocated list buffer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "af19718f-0676-4892-bc04-1818dc8ca9c5",  "id": "SUSE-SU-2017:3169-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8bc8b6fb-b06b-46d9-aec5-b5de9959216b",  "id": "SUSE-SU-2022:0135-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "61dbdd6b-b56a-48ea-b86d-e9a05d63ece9",  "id": "CVE-2023-52827",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix possible out-of-bound read in ath12k_htt_pull_ppdu_stats()\n\nlen is extracted from HTT message and could be an unexpected value in\ncase errors happen, so add validation before using to avoid possible\nout-of-bound read in the following message iteration and parsing.\n\nThe same issue also applies to ppdu_info->ppdu_stats.common.num_users,\nso validate it before using too.\n\nThese are found during code review.\n\nCompile test only.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0c2063dc-1cc7-4390-a72b-8b1729aff221",  "id": "CVE-2024-7357",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7357"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    78  ],  "analysis": {    "state": "in_triage"  },  "description": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-600 up to 2.18. It has been rated as critical. This issue affects the function soapcgi_main of the file /soap.cgi. The manipulation of the argument service leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273329 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.",  "affects": [    {      "ref": "0f9017f6-bd13-4064-97b2-6cfc35c2947d",      "versions": [        {          "component": "dir-600_firmware",          "version": "2.14b01"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3769cf31-7219-45fa-81ee-b34e8a2bcb75",  "id": "CVE-2011-1593",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1593"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple integer overflows in the next_pidmap function in kernel/pid.c in the Linux kernel before 2.6.38.4 allow local users to cause a denial of service (system crash) via a crafted (1) getdents or (2) readdir system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc498c29-0031-4fe2-aabf-e3cdb879da49",  "id": "CVE-2025-38034",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref\n\nbtrfs_prelim_ref() calls the old and new reference variables in the\nincorrect order. This causes a NULL pointer dereference because oldref\nis passed as NULL to trace_btrfs_prelim_ref_insert().\n\nNote, trace_btrfs_prelim_ref_insert() is being called with newref as\noldref (and oldref as NULL) on purpose in order to print out\nthe values of newref.\n\nTo reproduce:\necho 1 > /sys/kernel/debug/tracing/events/btrfs/btrfs_prelim_ref_insert/enable\n\nPerform some writeback operations.\n\nBacktrace:\nBUG: kernel NULL pointer dereference, address: 0000000000000018\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 115949067 P4D 115949067 PUD 11594a067 PMD 0\n Oops: Oops: 0000 [#1] SMP NOPTI\n CPU: 1 UID: 0 PID: 1188 Comm: fsstress Not tainted 6.15.0-rc2-tester+ #47 PREEMPT(voluntary)  7ca2cef72d5e9c600f0c7718adb6462de8149622\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014\n RIP: 0010:trace_event_raw_event_btrfs__prelim_ref+0x72/0x130\n Code: e8 43 81 9f ff 48 85 c0 74 78 4d 85 e4 0f 84 8f 00 00 00 49 8b 94 24 c0 06 00 00 48 8b 0a 48 89 48 08 48 8b 52 08 48 89 50 10 <49> 8b 55 18 48 89 50 18 49 8b 55 20 48 89 50 20 41 0f b6 55 28 88\n RSP: 0018:ffffce44820077a0 EFLAGS: 00010286\n RAX: ffff8c6b403f9014 RBX: ffff8c6b55825730 RCX: 304994edf9cf506b\n RDX: d8b11eb7f0fdb699 RSI: ffff8c6b403f9010 RDI: ffff8c6b403f9010\n RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000010\n R10: 00000000ffffffff R11: 0000000000000000 R12: ffff8c6b4e8fb000\n R13: 0000000000000000 R14: ffffce44820077a8 R15: ffff8c6b4abd1540\n FS:  00007f4dc6813740(0000) GS:ffff8c6c1d378000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000018 CR3: 000000010eb42000 CR4: 0000000000750ef0\n PKRU: 55555554\n Call Trace:\n  <TASK>\n  prelim_ref_insert+0x1c1/0x270\n  find_parent_nodes+0x12a6/0x1ee0\n  ? __entry_text_end+0x101f06/0x101f09\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  ? srso_alias_return_thunk+0x5/0xfbef5\n  btrfs_is_data_extent_shared+0x167/0x640\n  ? fiemap_process_hole+0xd0/0x2c0\n  extent_fiemap+0xa5c/0xbc0\n  ? __entry_text_end+0x101f05/0x101f09\n  btrfs_fiemap+0x7e/0xd0\n  do_vfs_ioctl+0x425/0x9d0\n  __x64_sys_ioctl+0x75/0xc0",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "23f5b450-4967-4f71-903a-c47e9f9857f1",  "id": "CLSA-2026-1779455055",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4200b45e-2270-44f8-93a9-6cd1bee55390",  "id": "CVE-2024-44956",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/preempt_fence: enlarge the fence critical section\n\nIt is really easy to introduce subtle deadlocks in\npreempt_fence_work_func() since we operate on single global ordered-wq\nfor signalling our preempt fences behind the scenes, so even though we\nsignal a particular fence, everything in the callback should be in the\nfence critical section, since blocking in the callback will prevent\nother published fences from signalling. If we enlarge the fence critical\nsection to cover the entire callback, then lockdep should be able to\nunderstand this better, and complain if we grab a sensitive lock like\nvm->lock, which is also held when waiting on preempt fences.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e1646dfc-e260-4a80-bd2d-e9ee879b7357",  "id": "CVE-2022-48891",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: da9211: Use irq handler when ready\n\nIf the system does not come from reset (like when it is kexec()), the\nregulator might have an IRQ waiting for us.\n\nIf we enable the IRQ handler before its structures are ready, we crash.\n\nThis patch fixes:\n\n[    1.141839] Unable to handle kernel read from unreadable memory at virtual address 0000000000000078\n[    1.316096] Call trace:\n[    1.316101]  blocking_notifier_call_chain+0x20/0xa8\n[    1.322757] cpu cpu0: dummy supplies not allowed for exclusive requests\n[    1.327823]  regulator_notifier_call_chain+0x1c/0x2c\n[    1.327825]  da9211_irq_handler+0x68/0xf8\n[    1.327829]  irq_thread+0x11c/0x234\n[    1.327833]  kthread+0x13c/0x154",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ab456bc2-4a65-4663-b21e-67024625a4bf",  "id": "CVE-2021-28952",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28952"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. (This has been fixed in 5.12-rc4.)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f6d29afa-2c6c-4fb6-a417-94453f7e7798",  "id": "CVE-2023-1859",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1859"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs in the Linux Kernel. This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2529f13a-9d4e-4c97-a16c-34eac3e99d7b",  "id": "MGASA-2022-0113",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "85a55078-d8ff-4990-90a4-b698cbe2681f",  "id": "CVE-2023-52821",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panel: fix a possible null pointer dereference\n\nIn versatile_panel_get_modes(), the return value of drm_mode_duplicate()\nis assigned to mode, which will lead to a NULL pointer dereference\non failure of drm_mode_duplicate(). Add a check to avoid npd.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f3869c0a-21ab-4868-a3cb-673f3cbfc049",  "id": "CVE-2022-49741",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: smscufx: fix error handling code in ufx_usb_probe\n\nThe current error handling code in ufx_usb_probe have many unmatching\nissues, e.g., missing ufx_free_usb_list, destroy_modedb label should\nonly include framebuffer_release, fb_dealloc_cmap only matches\nfb_alloc_cmap.\n\nMy local syzkaller reports a memory leak bug:\n\nmemory leak in ufx_usb_probe\n\nBUG: memory leak\nunreferenced object 0xffff88802f879580 (size 128):\n  comm \"kworker/0:7\", pid 17416, jiffies 4295067474 (age 46.710s)\n  hex dump (first 32 bytes):\n    80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff  .!|.............\n    00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00  ................\n  backtrace:\n    [<ffffffff814c99a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045\n    [<ffffffff824d219c>] kmalloc include/linux/slab.h:553 [inline]\n    [<ffffffff824d219c>] kzalloc include/linux/slab.h:689 [inline]\n    [<ffffffff824d219c>] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]\n    [<ffffffff824d219c>] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655\n    [<ffffffff82d17927>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n    [<ffffffff827132da>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808\n    [<ffffffff82713c27>] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936\n    [<ffffffff82710137>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427\n    [<ffffffff827136b5>] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008\n    [<ffffffff82711d36>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487\n    [<ffffffff8270e242>] device_add+0x642/0xdc0 drivers/base/core.c:3517\n    [<ffffffff82d14d5f>] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170\n    [<ffffffff82d2576c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n    [<ffffffff82d16ffc>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n    [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n    [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n    [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n\nFix this bug by rewriting the error handling code in ufx_usb_probe.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "df0b2d02-86b8-4125-9453-808ac02e05f5",  "id": "CLSA-2026-1770717529",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6cfe44df-ec96-477e-8958-de094bf5c25c",  "id": "CVE-2020-11609",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11609"  },  "ratings": [    {      "score": 4.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fa2aac2f-8f2a-42e9-ac89-ee3996dc9d32",  "id": "CVE-2019-15291",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15291"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5d4ce935-5e18-42d9-9fd5-8c9f5f61e2c3",  "id": "CVE-2023-53305",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free\n\nFix potential use-after-free in l2cap_le_command_rej.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a22c3264-c4de-48ae-a8ae-014debf5d4e2",  "id": "CVE-2022-49311",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()\n\nThere is a deadlock in rtw_joinbss_event_prehandle(), which is shown\nbelow:\n\n   (Thread 1)                |      (Thread 2)\n                             | _set_timer()\nrtw_joinbss_event_prehandle()|  mod_timer()\n spin_lock_bh() //(1)        |  (wait a time)\n ...                         | _rtw_join_timeout_handler()\n del_timer_sync()            |  spin_lock_bh() //(2)\n (wait timer to stop)        |  ...\n\nWe hold pmlmepriv->lock in position (1) of thread 1 and\nuse del_timer_sync() to wait timer to stop, but timer handler\nalso need pmlmepriv->lock in position (2) of thread 2.\nAs a result, rtw_joinbss_event_prehandle() will block forever.\n\nThis patch extracts del_timer_sync() from the protection of\nspin_lock_bh(), which could let timer handler to obtain\nthe needed lock. What`s more, we change spin_lock_bh() to\nspin_lock_irq() in _rtw_join_timeout_handler() in order to\nprevent deadlock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "079b17a2-b4f2-4b4e-8f1c-2c0b5543a2bd",  "id": "CVE-2014-1438",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1438"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The restore_fpu_checking function in arch/x86/include/asm/fpu-internal.h in the Linux kernel before 3.12.8 on the AMD K7 and K8 platforms does not clear pending exceptions before proceeding to an EMMS instruction, which allows local users to cause a denial of service (task kill) or possibly gain privileges via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fdb06826-ac7d-45e8-980e-2f66e7ec7d77",  "id": "CVE-2014-2309",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2309"  },  "ratings": [    {      "score": 6.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ffa902c2-ddfa-441e-92f7-1de04573a933",  "id": "CVE-2026-46000",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix conn-level packet handling to unshare RESPONSE packets\n\nThe security operations that verify the RESPONSE packets decrypt bits of it\nin place - however, the sk_buff may be shared with a packet sniffer, which\nwould lead to the sniffer seeing an apparently corrupt packet (actually\ndecrypted).\n\nFix this by handing a copy of the packet off to the specific security\nhandler if the packet was cloned.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8bac65a7-4c4f-456e-8561-5e9977f4c91d",  "id": "CVE-2012-3430",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3430"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:37543'"    }  ]},{  "bom-ref": "c1ca8be4-93d4-4dbc-b2c2-2b21bacf9b03",  "id": "CLSA-2026-1777547052",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2002f223-892b-4007-abb1-cf8490e28715",  "id": "CVE-2016-2543",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2543"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The snd_seq_ioctl_remove_events function in sound/core/seq/seq_clientmgr.c in the Linux kernel before 4.4.1 does not verify FIFO assignment before proceeding with FIFO clearing, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed76bbc8-a0e2-47ff-906d-7c885cbbe069",  "id": "CVE-2017-9984",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9984"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The snd_msnd_interrupt function in sound/isa/msnd/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a \"double fetch\" vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d06432b6-1edb-4ed9-b78c-9a1a738c59da",  "id": "CVE-2024-43893",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: core: check uartclk for zero to avoid divide by zero\n\nCalling ioctl TIOCSSERIAL with an invalid baud_base can\nresult in uartclk being zero, which will result in a\ndivide by zero error in uart_get_divisor(). The check for\nuartclk being zero in uart_set_info() needs to be done\nbefore other settings are made as subsequent calls to\nioctl TIOCSSERIAL for the same port would be impacted if\nthe uartclk check was done where uartclk gets set.\n\nOops: divide error: 0000  PREEMPT SMP KASAN PTI\nRIP: 0010:uart_get_divisor (drivers/tty/serial/serial_core.c:580)\nCall Trace:\n <TASK>\nserial8250_get_divisor (drivers/tty/serial/8250/8250_port.c:2576\n    drivers/tty/serial/8250/8250_port.c:2589)\nserial8250_do_set_termios (drivers/tty/serial/8250/8250_port.c:502\n    drivers/tty/serial/8250/8250_port.c:2741)\nserial8250_set_termios (drivers/tty/serial/8250/8250_port.c:2862)\nuart_change_line_settings (./include/linux/spinlock.h:376\n    ./include/linux/serial_core.h:608 drivers/tty/serial/serial_core.c:222)\nuart_port_startup (drivers/tty/serial/serial_core.c:342)\nuart_startup (drivers/tty/serial/serial_core.c:368)\nuart_set_info (drivers/tty/serial/serial_core.c:1034)\nuart_set_info_user (drivers/tty/serial/serial_core.c:1059)\ntty_set_serial (drivers/tty/tty_io.c:2637)\ntty_ioctl (drivers/tty/tty_io.c:2647 drivers/tty/tty_io.c:2791)\n__x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:907\n    fs/ioctl.c:893 fs/ioctl.c:893)\ndo_syscall_64 (arch/x86/entry/common.c:52\n    (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1))\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nRule: add",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a330c91-44cb-42d0-a652-9f04e143041e",  "id": "CVE-2023-51781",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51781"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a23a6a69-fbf4-48ce-93d0-b0f6984fd5e5",  "id": "MGASA-2024-0355",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c04ef86-690c-48c5-a1db-481c0eb76c2d",  "id": "CVE-2011-0999",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0999"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "mm/huge_memory.c in the Linux kernel before 2.6.38-rc5 does not prevent creation of a transparent huge page (THP) during the existence of a temporary stack for an exec system call, which allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "709c788f-e878-41b6-94af-a69e0c76e79e",  "id": "OESA-2025-2488",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e64b816-91c8-40fc-be0b-721028a568de",  "id": "RHSA-2023:3722",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "90ff0074-e299-45d5-acf3-f6d26eb53545",  "id": "ROOT-OS-ALPINE-317-CVE-2026-28388",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2cca4957-7fcb-485c-b1bf-0dafba675304",  "id": "CVE-2026-46167",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl\n\nJust like in a previous problem in this driver, usblp_ctrl_msg() will\ncollapse the usb_control_msg() return value to 0/-errno, discarding the\nactual number of bytes transferred.\n\nIdeally that short command should be detected and error out, but many\nprinters are known to send \"incorrect\" responses back so we can't just\ndo that.\n\nstatusbuf is kmalloc(8) at probe time and never filled before the first\nLPGETSTATUS ioctl.\n\nusblp_read_status() requests 1 byte. If a malicious printer responds\nwith zero bytes, *statusbuf is one byte of stale kmalloc heap,\nsign-extended into the local int status, which the LPGETSTATUS path then\ncopy_to_user()s directly to the ioctl caller.\n\nFix this all by just zapping out the memory buffer when allocated at\nprobe time.  If a later call does a short read, the data will be\nidentical to what the device sent it the last time, so there is no\n\"leak\" of information happening.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69ec22fa-b22f-465b-a7bd-a50506e66b80",  "id": "CVE-2025-39764",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: remove refcounting in expectation dumpers\n\nSame pattern as previous patch: do not keep the expectation object\nalive via refcount, only store a cookie value and then use that\nas the skip hint for dump resumption.\n\nAFAICS this has the same issue as the one resolved in the conntrack\ndumper, when we do\n  if (!refcount_inc_not_zero(&exp->use))\n\nto increment the refcount, there is a chance that exp == last, which\ncauses a double-increment of the refcount and subsequent memory leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04eb1961-62b2-4f38-b6e2-e5d73a426478",  "id": "CVE-2015-7566",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7566"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a bulk-out endpoint.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:39540'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:136141/Linux-visor-clie_5_attach-Null-Pointer-Dereference.html'"    }  ]},{  "bom-ref": "96572982-53e7-461a-95e9-0e7a83259c4a",  "id": "CVE-2022-48901",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not start relocation until in progress drops are done\n\nWe hit a bug with a recovering relocation on mount for one of our file\nsystems in production.  I reproduced this locally by injecting errors\ninto snapshot delete with balance running at the same time.  This\npresented as an error while looking up an extent item\n\n  WARNING: CPU: 5 PID: 1501 at fs/btrfs/extent-tree.c:866 lookup_inline_extent_backref+0x647/0x680\n  CPU: 5 PID: 1501 Comm: btrfs-balance Not tainted 5.16.0-rc8+ #8\n  RIP: 0010:lookup_inline_extent_backref+0x647/0x680\n  RSP: 0018:ffffae0a023ab960 EFLAGS: 00010202\n  RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000000\n  RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000000000\n  RBP: ffff943fd2a39b60 R08: 0000000000000000 R09: 0000000000000001\n  R10: 0001434088152de0 R11: 0000000000000000 R12: 0000000001d05000\n  R13: ffff943fd2a39b60 R14: ffff943fdb96f2a0 R15: ffff9442fc923000\n  FS:  0000000000000000(0000) GS:ffff944e9eb40000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f1157b1fca8 CR3: 000000010f092000 CR4: 0000000000350ee0\n  Call Trace:\n   <TASK>\n   insert_inline_extent_backref+0x46/0xd0\n   __btrfs_inc_extent_ref.isra.0+0x5f/0x200\n   ? btrfs_merge_delayed_refs+0x164/0x190\n   __btrfs_run_delayed_refs+0x561/0xfa0\n   ? btrfs_search_slot+0x7b4/0xb30\n   ? btrfs_update_root+0x1a9/0x2c0\n   btrfs_run_delayed_refs+0x73/0x1f0\n   ? btrfs_update_root+0x1a9/0x2c0\n   btrfs_commit_transaction+0x50/0xa50\n   ? btrfs_update_reloc_root+0x122/0x220\n   prepare_to_merge+0x29f/0x320\n   relocate_block_group+0x2b8/0x550\n   btrfs_relocate_block_group+0x1a6/0x350\n   btrfs_relocate_chunk+0x27/0xe0\n   btrfs_balance+0x777/0xe60\n   balance_kthread+0x35/0x50\n   ? btrfs_balance+0xe60/0xe60\n   kthread+0x16b/0x190\n   ? set_kthread_struct+0x40/0x40\n   ret_from_fork+0x22/0x30\n   </TASK>\n\nNormally snapshot deletion and relocation are excluded from running at\nthe same time by the fs_info->cleaner_mutex.  However if we had a\npending balance waiting to get the ->cleaner_mutex, and a snapshot\ndeletion was running, and then the box crashed, we would come up in a\nstate where we have a half deleted snapshot.\n\nAgain, in the normal case the snapshot deletion needs to complete before\nrelocation can start, but in this case relocation could very well start\nbefore the snapshot deletion completes, as we simply add the root to the\ndead roots list and wait for the next time the cleaner runs to clean up\nthe snapshot.\n\nFix this by setting a bit on the fs_info if we have any DEAD_ROOT's that\nhad a pending drop_progress key.  If they do then we know we were in the\nmiddle of the drop operation and set a flag on the fs_info.  Then\nbalance can wait until this flag is cleared to start up again.\n\nIf there are DEAD_ROOT's that don't have a drop_progress set then we're\nsafe to start balance right away as we'll be properly protected by the\ncleaner_mutex.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "34c528af-82cf-4180-81a9-32b268074e62",  "id": "CVE-2024-50277",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix a crash if blk_alloc_disk fails\n\nIf blk_alloc_disk fails, the variable md->disk is set to an error value.\ncleanup_mapped_device will see that md->disk is non-NULL and it will\nattempt to access it, causing a crash on this statement\n\"md->disk->private_data = NULL;\".",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2963bce-e899-41b5-b982-cc1088a9746a",  "id": "ALSA-2022:7633",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "42522980-d458-4143-b5dd-b236fc0705de",  "id": "CVE-2026-46160",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix missing last_unlink_trans update when removing a directory\n\nWhen removing a directory we are not updating its last_unlink_trans field,\nwhich can result in incorrect fsync behaviour in case some one fsyncs the\ndirectory after it was removed because it's holding a file descriptor on\nit.\n\nExample scenario:\n\n   mkdir /mnt/dir1\n   mkdir /mnt/dir1/dir2\n   mkdir /mnt/dir3\n\n   sync -f /mnt\n\n   # Do some change to the directory and fsync it.\n   chmod 700 /mnt/dir1\n   xfs_io -c fsync /mnt/dir1\n\n   # Move dir2 out of dir1 so that dir1 becomes empty.\n   mv /mnt/dir1/dir2 /mnt/dir3/\n\n   open fd on /mnt/dir1\n   call rmdir(2) on path \"/mnt/dir1\"\n   fsync fd\n\n   <trigger power failure>\n\nWhen attempting to mount the filesystem, the log replay will fail with\nan -EIO error and dmesg/syslog has the following:\n\n   [445771.626482] BTRFS info (device dm-0): first mount of filesystem 0368bbea-6c5e-44b5-b409-09abe496e650\n   [445771.626486] BTRFS info (device dm-0): using crc32c checksum algorithm\n   [445771.627912] BTRFS info (device dm-0): start tree-log replay\n   [445771.628335] page: refcount:2 mapcount:0 mapping:0000000061443ddc index:0x1d00 pfn:0x7072a5\n   [445771.629453] memcg:ffff89f400351b00\n   [445771.629892] aops:btree_aops [btrfs] ino:1\n   [445771.630737] flags: 0x17fffc00000402a(uptodate|lru|private|writeback|node=0|zone=2|lastcpupid=0x1ffff)\n   [445771.632359] raw: 017fffc00000402a fffff47284d950c8 fffff472907b7c08 ffff89f458e412b8\n   [445771.633713] raw: 0000000000001d00 ffff89f6c51d1a90 00000002ffffffff ffff89f400351b00\n   [445771.635029] page dumped because: eb page dump\n   [445771.635825] BTRFS critical (device dm-0): corrupt leaf: root=5 block=30408704 slot=10 ino=258, invalid nlink: has 2 expect no more than 1 for dir\n   [445771.638088] BTRFS info (device dm-0): leaf 30408704 gen 10 total ptrs 17 free space 14878 owner 5\n   [445771.638091] BTRFS info (device dm-0): refs 4 lock_owner 0 current 3581087\n   [445771.638094] \titem 0 key (256 INODE_ITEM 0) itemoff 16123 itemsize 160\n   [445771.638097] \t\tinode generation 3 transid 9 size 16 nbytes 16384\n   [445771.638098] \t\tblock group 0 mode 40755 links 1 uid 0 gid 0\n   [445771.638100] \t\trdev 0 sequence 2 flags 0x0\n   [445771.638102] \t\tatime 1775744884.0\n   [445771.660056] \t\tctime 1775744885.645502983\n   [445771.660058] \t\tmtime 1775744885.645502983\n   [445771.660060] \t\totime 1775744884.0\n   [445771.660062] \titem 1 key (256 INODE_REF 256) itemoff 16111 itemsize 12\n   [445771.660064] \t\tindex 0 name_len 2\n   [445771.660066] \titem 2 key (256 DIR_ITEM 1843588421) itemoff 16077 itemsize 34\n   [445771.660068] \t\tlocation key (259 1 0) type 2\n   [445771.660070] \t\ttransid 9 data_len 0 name_len 4\n   [445771.660075] \titem 3 key (256 DIR_ITEM 2363071922) itemoff 16043 itemsize 34\n   [445771.660076] \t\tlocation key (257 1 0) type 2\n   [445771.660077] \t\ttransid 9 data_len 0 name_len 4\n   [445771.660078] \titem 4 key (256 DIR_INDEX 2) itemoff 16009 itemsize 34\n   [445771.660079] \t\tlocation key (257 1 0) type 2\n   [445771.660080] \t\ttransid 9 data_len 0 name_len 4\n   [445771.660081] \titem 5 key (256 DIR_INDEX 3) itemoff 15975 itemsize 34\n   [445771.660082] \t\tlocation key (259 1 0) type 2\n   [445771.660083] \t\ttransid 9 data_len 0 name_len 4\n   [445771.660084] \titem 6 key (257 INODE_ITEM 0) itemoff 15815 itemsize 160\n   [445771.660086] \t\tinode generation 9 transid 9 size 8 nbytes 0\n   [445771.660087] \t\tblock group 0 mode 40777 links 1 uid 0 gid 0\n   [445771.660088] \t\trdev 0 sequence 2 flags 0x0\n   [445771.660089] \t\tatime 1775744885.641174097\n   [445771.660090] \t\tctime 1775744885.645502983\n   [445771.660091] \t\tmtime 1775744885.645502983\n   [445771.660105] \t\totime 1775744885.641174097\n   [445771.660106] \titem 7 key (257 INODE_REF 256) itemoff 15801 itemsize 14\n   [445771.660107] \t\tindex 2 name_len 4\n   [445771.660108] \titem 8 key (257 DIR_ITEM 2676584006) itemoff 15767 itemsize 34\n   [445771.660109] \t\tlocation key (2\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9f87aaa9-534a-4eb8-b2f5-210a6590c475",  "id": "CVE-2019-9499",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9499"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    287,    346  ],  "analysis": {    "state": "in_triage"  },  "description": "The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c666ae0-5bc0-463d-b676-1056f91bd48e",  "id": "CVE-2010-4346",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4346"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc958503-33c6-45a2-b2d6-447dd4aa48bd",  "id": "CVE-2026-43255",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix WARNING in usb_tx_block\n\nThe function usb_tx_block() submits cardp->tx_urb without ensuring that\nany previous transmission on this URB has completed. If a second call\noccurs while the URB is still active (e.g. during rapid firmware loading),\nusb_submit_urb() detects the active state and triggers a warning:\n'URB submitted while active'.\n\nFix this by enforcing serialization: call usb_kill_urb() before\nsubmitting the new request. This ensures the URB is idle and safe to reuse.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c27f8a5-32a1-4ea3-9910-01aed2dafd20",  "id": "CVE-2014-0155",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0155"  },  "ratings": [    {      "score": 5.5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:L/Au:S/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC.  NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8277b5fa-7947-4ad4-8e5d-34387ae9ed4c",  "id": "CVE-2025-38425",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: tegra: check msg length in SMBUS block read\n\nFor SMBUS block read, do not continue to read if the message length\npassed from the device is '0' or greater than the maximum allowed bytes.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "46ceaf74-fb1d-44bf-9d65-3d89b3949ea1",  "id": "OESA-2024-1903",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "86b75af2-acb4-42c9-a024-880562c7120f",  "id": "CVE-2023-52936",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4a4f5ded-54e1-454b-a251-057505a428ea",  "id": "ALBA-2022:1938",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e22727b9-982c-4c93-865a-405a346a8908",  "id": "AZL-33336",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45a7d21a-6efb-4420-9a53-aa9dc608eaf2",  "id": "CVE-2022-45934",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45934"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b4290b93-ca60-4aa5-bbd0-7dcaba747f48",  "id": "CVE-2024-46728",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check index for aux_rd_interval before using\n\naux_rd_interval has size of 7 and should be checked.\n\nThis fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aa6f78c6-64a4-433c-8e4a-404aa94a5c1a",  "id": "CVE-2022-49529",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/pm: fix the null pointer while the smu is disabled\n\nIt needs to check if the pp_funcs is initialized while release the\ncontext, otherwise it will trigger null pointer panic while the software\nsmu is not enabled.\n\n[ 1109.404555] BUG: kernel NULL pointer dereference, address: 0000000000000078\n[ 1109.404609] #PF: supervisor read access in kernel mode\n[ 1109.404638] #PF: error_code(0x0000) - not-present page\n[ 1109.404657] PGD 0 P4D 0\n[ 1109.404672] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 1109.404701] CPU: 7 PID: 9150 Comm: amdgpu_test Tainted: G           OEL    5.16.0-custom #1\n[ 1109.404732] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006\n[ 1109.404765] RIP: 0010:amdgpu_dpm_force_performance_level+0x1d/0x170 [amdgpu]\n[ 1109.405109] Code: 5d c3 44 8b a3 f0 80 00 00 eb e5 66 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 08 4c 8b b7 f0 7d 00 00 <49> 83 7e 78 00 0f 84 f2 00 00 00 80 bf 87 80 00 00 00 48 89 fb 0f\n[ 1109.405176] RSP: 0018:ffffaf3083ad7c20 EFLAGS: 00010282\n[ 1109.405203] RAX: 0000000000000000 RBX: ffff9796b1c14600 RCX: 0000000002862007\n[ 1109.405229] RDX: ffff97968591c8c0 RSI: 0000000000000001 RDI: ffff9796a3700000\n[ 1109.405260] RBP: ffffaf3083ad7c50 R08: ffffffff9897de00 R09: ffff979688d9db60\n[ 1109.405286] R10: 0000000000000000 R11: ffff979688d9db90 R12: 0000000000000001\n[ 1109.405316] R13: ffff9796a3700000 R14: 0000000000000000 R15: ffff9796a3708fc0\n[ 1109.405345] FS:  00007ff055cff180(0000) GS:ffff9796bfdc0000(0000) knlGS:0000000000000000\n[ 1109.405378] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1109.405400] CR2: 0000000000000078 CR3: 000000000a394000 CR4: 00000000000506e0\n[ 1109.405434] Call Trace:\n[ 1109.405445]  <TASK>\n[ 1109.405456]  ? delete_object_full+0x1d/0x20\n[ 1109.405480]  amdgpu_ctx_set_stable_pstate+0x7c/0xa0 [amdgpu]\n[ 1109.405698]  amdgpu_ctx_fini.part.0+0xcb/0x100 [amdgpu]\n[ 1109.405911]  amdgpu_ctx_do_release+0x71/0x80 [amdgpu]\n[ 1109.406121]  amdgpu_ctx_ioctl+0x52d/0x550 [amdgpu]\n[ 1109.406327]  ? _raw_spin_unlock+0x1a/0x30\n[ 1109.406354]  ? drm_gem_handle_delete+0x81/0xb0 [drm]\n[ 1109.406400]  ? amdgpu_ctx_get_entity+0x2c0/0x2c0 [amdgpu]\n[ 1109.406609]  drm_ioctl_kernel+0xb6/0x140 [drm]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "59372112-4c32-4dc3-b5af-279f3d3c3444",  "id": "CLSA-2024-1709548308",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d0602314-c6cc-4f02-92d1-e9e9a3d3f1c8",  "id": "CVE-2013-7271",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7271"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The x25_recvmsg function in net/x25/af_x25.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8ae9daaf-2d76-4ff3-82ab-5ad0346d589e",  "id": "OESA-2026-2284",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "e52e445b-24d0-4150-822b-d76563b46e68",      "versions": [        {          "component": "sed",          "version": "4.0"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2f5bc5a-d54a-453e-a7fe-21feda00d838",  "id": "CVE-2024-47699",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential null-ptr-deref in nilfs_btree_insert()\n\nPatch series \"nilfs2: fix potential issues with empty b-tree nodes\".\n\nThis series addresses three potential issues with empty b-tree nodes that\ncan occur with corrupted filesystem images, including one recently\ndiscovered by syzbot.\n\n\nThis patch (of 3):\n\nIf a b-tree is broken on the device, and the b-tree height is greater than\n2 (the level of the root node is greater than 1) even if the number of\nchild nodes of the b-tree root is 0, a NULL pointer dereference occurs in\nnilfs_btree_prepare_insert(), which is called from nilfs_btree_insert().\n\nThis is because, when the number of child nodes of the b-tree root is 0,\nnilfs_btree_do_lookup() does not set the block buffer head in any of\npath[x].bp_bh, leaving it as the initial value of NULL, but if the level\nof the b-tree root node is greater than 1, nilfs_btree_get_nonroot_node(),\nwhich accesses the buffer memory of path[x].bp_bh, is called.\n\nFix this issue by adding a check to nilfs_btree_root_broken(), which\nperforms sanity checks when reading the root node from the device, to\ndetect this inconsistency.\n\nThanks to Lizhi Xu for trying to solve the bug and clarifying the cause\nearly on.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8ff6e97b-3639-441a-89cb-de55fea53ffa",  "id": "CVE-2016-3140",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3140"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:39537'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:136144/Linux-digi_acceleport-Null-Pointer-Dereference.html'"    }  ]},{  "bom-ref": "840e7790-41dc-4062-b6a9-f3e604e9c9d9",  "id": "CVE-2024-38661",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ap: Fix crash in AP internal function modify_bitmap()\n\nA system crash like this\n\n  Failing address: 200000cb7df6f000 TEID: 200000cb7df6f403\n  Fault in home space mode while using kernel ASCE.\n  AS:00000002d71bc007 R3:00000003fe5b8007 S:000000011a446000 P:000000015660c13d\n  Oops: 0038 ilc:3 [#1] PREEMPT SMP\n  Modules linked in: mlx5_ib ...\n  CPU: 8 PID: 7556 Comm: bash Not tainted 6.9.0-rc7 #8\n  Hardware name: IBM 3931 A01 704 (LPAR)\n  Krnl PSW : 0704e00180000000 0000014b75e7b606 (ap_parse_bitmap_str+0x10e/0x1f8)\n  R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3\n  Krnl GPRS: 0000000000000001 ffffffffffffffc0 0000000000000001 00000048f96b75d3\n  000000cb00000100 ffffffffffffffff ffffffffffffffff 000000cb7df6fce0\n  000000cb7df6fce0 00000000ffffffff 000000000000002b 00000048ffffffff\n  000003ff9b2dbc80 200000cb7df6fcd8 0000014bffffffc0 000000cb7df6fbc8\n  Krnl Code: 0000014b75e7b5fc: a7840047            brc     8,0000014b75e7b68a\n  0000014b75e7b600: 18b2                lr      %r11,%r2\n  #0000014b75e7b602: a7f4000a            brc     15,0000014b75e7b616\n  >0000014b75e7b606: eb22d00000e6        laog    %r2,%r2,0(%r13)\n  0000014b75e7b60c: a7680001            lhi     %r6,1\n  0000014b75e7b610: 187b                lr      %r7,%r11\n  0000014b75e7b612: 84960021            brxh    %r9,%r6,0000014b75e7b654\n  0000014b75e7b616: 18e9                lr      %r14,%r9\n  Call Trace:\n  [<0000014b75e7b606>] ap_parse_bitmap_str+0x10e/0x1f8\n  ([<0000014b75e7b5dc>] ap_parse_bitmap_str+0xe4/0x1f8)\n  [<0000014b75e7b758>] apmask_store+0x68/0x140\n  [<0000014b75679196>] kernfs_fop_write_iter+0x14e/0x1e8\n  [<0000014b75598524>] vfs_write+0x1b4/0x448\n  [<0000014b7559894c>] ksys_write+0x74/0x100\n  [<0000014b7618a440>] __do_syscall+0x268/0x328\n  [<0000014b761a3558>] system_call+0x70/0x98\n  INFO: lockdep is turned off.\n  Last Breaking-Event-Address:\n  [<0000014b75e7b636>] ap_parse_bitmap_str+0x13e/0x1f8\n  Kernel panic - not syncing: Fatal exception: panic_on_oops\n\noccured when /sys/bus/ap/a[pq]mask was updated with a relative mask value\n(like +0x10-0x12,+60,-90) with one of the numeric values exceeding INT_MAX.\n\nThe fix is simple: use unsigned long values for the internal variables. The\ncorrect checks are already in place in the function but a simple int for\nthe internal variables was used with the possibility to overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "415de206-bc28-450f-9900-292e2c77c5fd",  "id": "CVE-2025-38048",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_ring: Fix data race by tagging event_triggered as racy for KCSAN\n\nsyzbot reports a data-race when accessing the event_triggered, here is the\nsimplified stack when the issue occurred:\n\n==================================================================\nBUG: KCSAN: data-race in virtqueue_disable_cb / virtqueue_enable_cb_delayed\n\nwrite to 0xffff8881025bc452 of 1 bytes by task 3288 on cpu 0:\n virtqueue_enable_cb_delayed+0x42/0x3c0 drivers/virtio/virtio_ring.c:2653\n start_xmit+0x230/0x1310 drivers/net/virtio_net.c:3264\n __netdev_start_xmit include/linux/netdevice.h:5151 [inline]\n netdev_start_xmit include/linux/netdevice.h:5160 [inline]\n xmit_one net/core/dev.c:3800 [inline]\n\nread to 0xffff8881025bc452 of 1 bytes by interrupt on cpu 1:\n virtqueue_disable_cb_split drivers/virtio/virtio_ring.c:880 [inline]\n virtqueue_disable_cb+0x92/0x180 drivers/virtio/virtio_ring.c:2566\n skb_xmit_done+0x5f/0x140 drivers/net/virtio_net.c:777\n vring_interrupt+0x161/0x190 drivers/virtio/virtio_ring.c:2715\n __handle_irq_event_percpu+0x95/0x490 kernel/irq/handle.c:158\n handle_irq_event_percpu kernel/irq/handle.c:193 [inline]\n\nvalue changed: 0x01 -> 0x00\n==================================================================\n\nWhen the data race occurs, the function virtqueue_enable_cb_delayed() sets\nevent_triggered to false, and virtqueue_disable_cb_split/packed() reads it\nas false due to the race condition. Since event_triggered is an unreliable\nhint used for optimization, this should only cause the driver temporarily\nsuggest that the device not send an interrupt notification when the event\nindex is used.\n\nFix this KCSAN reported data-race issue by explicitly tagging the access as\ndata_racy.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b783e947-977d-4307-8917-cf59fe64cb9e",  "id": "CVE-2012-3511",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3511"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple race conditions in the madvise_remove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service (use-after-free and system crash) via vectors involving a (1) munmap or (2) close system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d0b13ec4-cfaf-4e9c-93f0-ae492881afaa",  "id": "CLSA-2024-1735119353",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "60c8170d-8870-413b-b6e4-f80451a7621f",  "id": "openSUSE-SU-2026:21400-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3a8669d1-32cc-4c66-b446-3d7c58208768",      "versions": [        {          "component": "radvd",          "version": "1.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db4e364b-54e8-43ef-8283-c8e1eb0af664",  "id": "CVE-2011-1473",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1473"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-5094.  NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "13b6f8c5-c54e-4a96-9351-20ddb8d4c016",  "id": "RLSA-2024:9333",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "22e29964-9273-4b67-bf5a-66e616b3d004",  "id": "ROOT-OS-ALPINE-317-CVE-2026-63076",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ffd04ad0-8cb5-4982-b3be-711bc8753bdf",  "id": "CVE-2021-47330",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47330"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: 8250: serial_cs: Fix a memory leak in error handling path\n\nIn the probe function, if the final 'serial_config()' fails, 'info' is\nleaking.\n\nAdd a resource handling path to free this memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fd644d8f-ed81-4c91-9cf6-62ccac931eb3",  "id": "CVE-2021-47551",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47551"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again\n\nIn SRIOV configuration, the reset may failed to bring asic back to normal but stop cpsch\nalready been called, the start_cpsch will not be called since there is no resume in this\ncase.  When reset been triggered again, driver should avoid to do uninitialization again.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dbc95eb9-2e40-4211-8d25-6b96ba48ffc6",  "id": "CVE-2023-52458",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: add check that partition length needs to be aligned with block size\n\nBefore calling add partition or resize partition, there is no check\non whether the length is aligned with the logical block size.\nIf the logical block size of the disk is larger than 512 bytes,\nthen the partition size maybe not the multiple of the logical block size,\nand when the last sector is read, bio_truncate() will adjust the bio size,\nresulting in an IO error if the size of the read command is smaller than\nthe logical block size.If integrity data is supported, this will also\nresult in a null pointer dereference when calling bio_integrity_free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "61ea1d76-7b8a-4292-bebd-34635003f84d",  "id": "CVE-2022-49349",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix use-after-free in ext4_rename_dir_prepare\n\nWe got issue as follows:\nEXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue\next4_get_first_dir_block: bh->b_data=0xffff88810bee6000 len=34478\next4_get_first_dir_block: *parent_de=0xffff88810beee6ae bh->b_data=0xffff88810bee6000\next4_rename_dir_prepare: [1] parent_de=0xffff88810beee6ae\n==================================================================\nBUG: KASAN: use-after-free in ext4_rename_dir_prepare+0x152/0x220\nRead of size 4 at addr ffff88810beee6ae by task rep/1895\n\nCPU: 13 PID: 1895 Comm: rep Not tainted 5.10.0+ #241\nCall Trace:\n dump_stack+0xbe/0xf9\n print_address_description.constprop.0+0x1e/0x220\n kasan_report.cold+0x37/0x7f\n ext4_rename_dir_prepare+0x152/0x220\n ext4_rename+0xf44/0x1ad0\n ext4_rename2+0x11c/0x170\n vfs_rename+0xa84/0x1440\n do_renameat2+0x683/0x8f0\n __x64_sys_renameat+0x53/0x60\n do_syscall_64+0x33/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\nRIP: 0033:0x7f45a6fc41c9\nRSP: 002b:00007ffc5a470218 EFLAGS: 00000246 ORIG_RAX: 0000000000000108\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f45a6fc41c9\nRDX: 0000000000000005 RSI: 0000000020000180 RDI: 0000000000000005\nRBP: 00007ffc5a470240 R08: 00007ffc5a470160 R09: 0000000020000080\nR10: 00000000200001c0 R11: 0000000000000246 R12: 0000000000400bb0\nR13: 00007ffc5a470320 R14: 0000000000000000 R15: 0000000000000000\n\nThe buggy address belongs to the page:\npage:00000000440015ce refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x10beee\nflags: 0x200000000000000()\nraw: 0200000000000000 ffffea00043ff4c8 ffffea0004325608 0000000000000000\nraw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff88810beee580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff88810beee600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n>ffff88810beee680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n                                  ^\n ffff88810beee700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff88810beee780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n==================================================================\nDisabling lock debugging due to kernel taint\next4_rename_dir_prepare: [2] parent_de->inode=3537895424\next4_rename_dir_prepare: [3] dir=0xffff888124170140\next4_rename_dir_prepare: [4] ino=2\next4_rename_dir_prepare: ent->dir->i_ino=2 parent=-757071872\n\nReason is first directory entry which 'rec_len' is 34478, then will get illegal\nparent entry. Now, we do not check directory entry after read directory block\nin 'ext4_get_first_dir_block'.\nTo solve this issue, check directory entry in 'ext4_get_first_dir_block'.\n\n[ Trigger an ext4_error() instead of just warning if the directory is\n  missing a '.' or '..' entry.   Also make sure we return an error code\n  if the file system is corrupted.  -TYT ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bd73b358-0510-4556-a78a-ddff5492beca",  "id": "CVE-2023-26607",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26607"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ccca7593-f848-43a0-af07-fd3b5b6f453d",  "id": "CVE-2013-1797",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1797"  },  "ratings": [    {      "score": 6.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69cc70ad-af1a-4af6-8eb7-5b31f8da1c48",  "id": "CVE-2013-4514",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4514"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related to the (1) wvlan_uil_put_info and (2) wvlan_set_station_nickname functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "20aedbf2-64fd-4cc0-90b4-8239807f3c73",  "id": "CVE-2024-50012",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: Avoid a bad reference count on CPU node\n\nIn the parse_perf_domain function, if the call to\nof_parse_phandle_with_args returns an error, then the reference to the\nCPU device node that was acquired at the start of the function would not\nbe properly decremented.\n\nAddress this by declaring the variable with the __free(device_node)\ncleanup attribute.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7765f581-2130-4157-9fe5-8ce6124fa36c",  "id": "CVE-2019-19769",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19769"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef44f869-9727-4e37-a6d2-992a901fb11f",  "id": "CVE-2010-4160",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4160"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp.c, and the (2) l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the PPPoL2TP and IPoL2TP implementations in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (heap memory corruption and panic) or possibly gain privileges via a crafted sendto call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "025dea4d-397f-4795-825f-d26c1664b342",  "id": "CVE-2024-50193",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/entry_32: Clear CPU buffers after register restore in NMI return\n\nCPU buffers are currently cleared after call to exc_nmi, but before\nregister state is restored. This may be okay for MDS mitigation but not for\nRDFS. Because RDFS mitigation requires CPU buffers to be cleared when\nregisters don't have any sensitive data.\n\nMove CLEAR_CPU_BUFFERS after RESTORE_ALL_NMI.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3de1afa2-0652-499c-892c-379a39f16163",  "id": "CVE-2022-49979",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix refcount bug in sk_psock_get (2)\n\nSyzkaller reports refcount bug as follows:\n------------[ cut here ]------------\nrefcount_t: saturated; leaking memory.\nWARNING: CPU: 1 PID: 3605 at lib/refcount.c:19 refcount_warn_saturate+0xf4/0x1e0 lib/refcount.c:19\nModules linked in:\nCPU: 1 PID: 3605 Comm: syz-executor208 Not tainted 5.18.0-syzkaller-03023-g7e062cda7d90 #0\n <TASK>\n __refcount_add_not_zero include/linux/refcount.h:163 [inline]\n __refcount_inc_not_zero include/linux/refcount.h:227 [inline]\n refcount_inc_not_zero include/linux/refcount.h:245 [inline]\n sk_psock_get+0x3bc/0x410 include/linux/skmsg.h:439\n tls_data_ready+0x6d/0x1b0 net/tls/tls_sw.c:2091\n tcp_data_ready+0x106/0x520 net/ipv4/tcp_input.c:4983\n tcp_data_queue+0x25f2/0x4c90 net/ipv4/tcp_input.c:5057\n tcp_rcv_state_process+0x1774/0x4e80 net/ipv4/tcp_input.c:6659\n tcp_v4_do_rcv+0x339/0x980 net/ipv4/tcp_ipv4.c:1682\n sk_backlog_rcv include/net/sock.h:1061 [inline]\n __release_sock+0x134/0x3b0 net/core/sock.c:2849\n release_sock+0x54/0x1b0 net/core/sock.c:3404\n inet_shutdown+0x1e0/0x430 net/ipv4/af_inet.c:909\n __sys_shutdown_sock net/socket.c:2331 [inline]\n __sys_shutdown_sock net/socket.c:2325 [inline]\n __sys_shutdown+0xf1/0x1b0 net/socket.c:2343\n __do_sys_shutdown net/socket.c:2351 [inline]\n __se_sys_shutdown net/socket.c:2349 [inline]\n __x64_sys_shutdown+0x50/0x70 net/socket.c:2349\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n </TASK>\n\nDuring SMC fallback process in connect syscall, kernel will\nreplaces TCP with SMC. In order to forward wakeup\nsmc socket waitqueue after fallback, kernel will sets\nclcsk->sk_user_data to origin smc socket in\nsmc_fback_replace_callbacks().\n\nLater, in shutdown syscall, kernel will calls\nsk_psock_get(), which treats the clcsk->sk_user_data\nas psock type, triggering the refcnt warning.\n\nSo, the root cause is that smc and psock, both will use\nsk_user_data field. So they will mismatch this field\neasily.\n\nThis patch solves it by using another bit(defined as\nSK_USER_DATA_PSOCK) in PTRMASK, to mark whether\nsk_user_data points to a psock object or not.\nThis patch depends on a PTRMASK introduced in commit f1ff5ce2cd5e\n(\"net, sk_msg: Clear sk_user_data pointer on clone if tagged\").\n\nFor there will possibly be more flags in the sk_user_data field,\nthis patch also refactor sk_user_data flags code to be more generic\nto improve its maintainability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c63d0daa-e6d4-4847-9316-2b3119e28c9a",  "id": "CVE-2018-16597",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16597"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    863  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cbaa17f9-b1b6-4b59-84b5-2b2c1c81fec4",  "id": "CVE-2024-46819",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: the warning dereferencing obj for nbio_v7_4\n\nif ras_manager obj null, don't print NBIO err data",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ef2639f-a679-4469-a7d5-399035b99fd0",  "id": "CVE-2014-1446",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1446"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fcbe9966-0147-4085-ac26-ce7bd46e25ba",  "id": "CVE-2022-49835",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: fix potential memleak in 'add_widget_node'\n\nAs 'kobject_add' may allocated memory for 'kobject->name' when return error.\nAnd in this function, if call 'kobject_add' failed didn't free kobject.\nSo call 'kobject_put' to recycling resources.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "606b8c80-4d78-4070-88b8-d32b3f1e3127",  "id": "CVE-2024-35805",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm snapshot: fix lockup in dm_exception_table_exit\n\nThere was reported lockup when we exit a snapshot with many exceptions.\nFix this by adding \"cond_resched\" to the loop that frees the exceptions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0a585372-397c-4bcf-879b-292dc226e828",  "id": "CVE-2019-19045",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19045"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_vector2eqn() failures, aka CID-c8c2a057fdc7.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "67d443d0-56c7-44b2-9649-3a7a95edb30b",  "id": "CVE-2026-31685",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.4,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_eui64: reject invalid MAC header for all packets\n\n`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address\nand compares it with the low 64 bits of the IPv6 source address.\n\nThe existing guard only rejects an invalid MAC header when\n`par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()`\ncan still reach `eth_hdr(skb)` even when the MAC header is not valid.\n\nFix this by removing the `par->fragoff != 0` condition so that packets\nwith an invalid MAC header are rejected before accessing `eth_hdr(skb)`.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "483c2e4e-3f3a-4152-9b90-2cd358a79450",  "id": "CVE-2024-47704",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check link_res->hpo_dp_link_enc before using it\n\n[WHAT & HOW]\nFunctions dp_enable_link_phy and dp_disable_link_phy can pass link_res\nwithout initializing hpo_dp_link_enc and it is necessary to check for\nnull before dereferencing.\n\nThis fixes 2 FORWARD_NULL issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e8582f5-7fbe-4f03-aea9-3828a7f118ba",  "id": "CVE-2017-18232",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18232"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The Serial Attached SCSI (SAS) implementation in the Linux kernel through 4.15.9 mishandles a mutex within libsas, which allows local users to cause a denial of service (deadlock) by triggering certain error-handling code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f310dcae-5535-4225-a00c-710b146d2c5f",  "id": "CVE-2023-52600",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix uaf in jfs_evict_inode\n\nWhen the execution of diMount(ipimap) fails, the object ipimap that has been\nreleased may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs\nwhen rcu_core() calls jfs_free_node().\n\nTherefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as\nipimap.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9daa4bb8-83bb-469f-a945-249d1701a3b0",  "id": "CVE-2015-0288",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0288"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "faaf1201-c685-4dce-a526-5e9399fcff3b",  "id": "CVE-2021-47210",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47210"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tipd: Remove WARN_ON in tps6598x_block_read\n\nCalling tps6598x_block_read with a higher than allowed len can be\nhandled by just returning an error. There's no need to crash systems\nwith panic-on-warn enabled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e43a4fb4-1bde-4dcc-848d-db95617333ac",  "id": "CVE-2022-49317",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: avoid infinite loop to flush node pages\n\nxfstests/generic/475 can give EIO all the time which give an infinite loop\nto flush node page like below. Let's avoid it.\n\n[16418.518551] Call Trace:\n[16418.518553]  ? dm_submit_bio+0x48/0x400\n[16418.518574]  ? submit_bio_checks+0x1ac/0x5a0\n[16418.525207]  __submit_bio+0x1a9/0x230\n[16418.525210]  ? kmem_cache_alloc+0x29e/0x3c0\n[16418.525223]  submit_bio_noacct+0xa8/0x2b0\n[16418.525226]  submit_bio+0x4d/0x130\n[16418.525238]  __submit_bio+0x49/0x310 [f2fs]\n[16418.525339]  ? bio_add_page+0x6a/0x90\n[16418.525344]  f2fs_submit_page_bio+0x134/0x1f0 [f2fs]\n[16418.525365]  read_node_page+0x125/0x1b0 [f2fs]\n[16418.525388]  __get_node_page.part.0+0x58/0x3f0 [f2fs]\n[16418.525409]  __get_node_page+0x2f/0x60 [f2fs]\n[16418.525431]  f2fs_get_dnode_of_data+0x423/0x860 [f2fs]\n[16418.525452]  ? asm_sysvec_apic_timer_interrupt+0x12/0x20\n[16418.525458]  ? __mod_memcg_state.part.0+0x2a/0x30\n[16418.525465]  ? __mod_memcg_lruvec_state+0x27/0x40\n[16418.525467]  ? __xa_set_mark+0x57/0x70\n[16418.525472]  f2fs_do_write_data_page+0x10e/0x7b0 [f2fs]\n[16418.525493]  f2fs_write_single_data_page+0x555/0x830 [f2fs]\n[16418.525514]  ? sysvec_apic_timer_interrupt+0x4e/0x90\n[16418.525518]  ? asm_sysvec_apic_timer_interrupt+0x12/0x20\n[16418.525523]  f2fs_write_cache_pages+0x303/0x880 [f2fs]\n[16418.525545]  ? blk_flush_plug_list+0x47/0x100\n[16418.525548]  f2fs_write_data_pages+0xfd/0x320 [f2fs]\n[16418.525569]  do_writepages+0xd5/0x210\n[16418.525648]  filemap_fdatawrite_wbc+0x7d/0xc0\n[16418.525655]  filemap_fdatawrite+0x50/0x70\n[16418.525658]  f2fs_sync_dirty_inodes+0xa4/0x230 [f2fs]\n[16418.525679]  f2fs_write_checkpoint+0x16d/0x1720 [f2fs]\n[16418.525699]  ? ttwu_do_wakeup+0x1c/0x160\n[16418.525709]  ? ttwu_do_activate+0x6d/0xd0\n[16418.525711]  ? __wait_for_common+0x11d/0x150\n[16418.525715]  kill_f2fs_super+0xca/0x100 [f2fs]\n[16418.525733]  deactivate_locked_super+0x3b/0xb0\n[16418.525739]  deactivate_super+0x40/0x50\n[16418.525741]  cleanup_mnt+0x139/0x190\n[16418.525747]  __cleanup_mnt+0x12/0x20\n[16418.525749]  task_work_run+0x6d/0xa0\n[16418.525765]  exit_to_user_mode_prepare+0x1ad/0x1b0\n[16418.525771]  syscall_exit_to_user_mode+0x27/0x50\n[16418.525774]  do_syscall_64+0x48/0xc0\n[16418.525776]  entry_SYSCALL_64_after_hwframe+0x44/0xae",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b0d172f6-2977-44e6-bf3d-bcd0797c57fa",  "id": "CVE-2022-0480",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0480"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX) file locks.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a312362d-1175-46ff-801b-d83ee5a77316",  "id": "CVE-2020-10732",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10732"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3d1c540b-3c70-4fa2-84fe-3affa518e012",  "id": "CVE-2023-52835",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Bail out early if the request AUX area is out of bound\n\nWhen perf-record with a large AUX area, e.g 4GB, it fails with:\n\n    #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1\n    failed to mmap with 12 (Cannot allocate memory)\n\nand it reveals a WARNING with __alloc_pages():\n\n\t------------[ cut here ]------------\n\tWARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248\n\tCall trace:\n\t __alloc_pages+0x1ec/0x248\n\t __kmalloc_large_node+0xc0/0x1f8\n\t __kmalloc_node+0x134/0x1e8\n\t rb_alloc_aux+0xe0/0x298\n\t perf_mmap+0x440/0x660\n\t mmap_region+0x308/0x8a8\n\t do_mmap+0x3c0/0x528\n\t vm_mmap_pgoff+0xf4/0x1b8\n\t ksys_mmap_pgoff+0x18c/0x218\n\t __arm64_sys_mmap+0x38/0x58\n\t invoke_syscall+0x50/0x128\n\t el0_svc_common.constprop.0+0x58/0x188\n\t do_el0_svc+0x34/0x50\n\t el0_svc+0x34/0x108\n\t el0t_64_sync_handler+0xb8/0xc0\n\t el0t_64_sync+0x1a4/0x1a8\n\n'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to\nmaintains AUX trace pages. The allocated page for this array is physically\ncontiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the\nsize of pointer array crosses the limitation set by MAX_ORDER, it reveals a\nWARNING.\n\nSo bail out early with -ENOMEM if the request AUX area is out of bound,\ne.g.:\n\n    #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1\n    failed to mmap with 12 (Cannot allocate memory)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c322592f-30ed-4dc8-a0d1-ec7b59230fd8",  "id": "CVE-2019-9498",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9498"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    287,    346  ],  "analysis": {    "state": "in_triage"  },  "description": "The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may be able to use invalid scalar/element values to complete authentication, gaining session key and network access without needing or learning the password. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8ff9a0ca-1dcb-4d0c-9a96-7acffa7d2a74",  "id": "CVE-2023-52912",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fixed bug on error when unloading amdgpu\n\nFixed bug on error when unloading amdgpu.\n\nThe error message is as follows:\n[  377.706202] kernel BUG at drivers/gpu/drm/drm_buddy.c:278!\n[  377.706215] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n[  377.706222] CPU: 4 PID: 8610 Comm: modprobe Tainted: G          IOE      6.0.0-thomas #1\n[  377.706231] Hardware name: ASUS System Product Name/PRIME Z390-A, BIOS 2004 11/02/2021\n[  377.706238] RIP: 0010:drm_buddy_free_block+0x26/0x30 [drm_buddy]\n[  377.706264] Code: 00 00 00 90 0f 1f 44 00 00 48 8b 0e 89 c8 25 00 0c 00 00 3d 00 04 00 00 75 10 48 8b 47 18 48 d3 e0 48 01 47 28 e9 fa fe ff ff <0f> 0b 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 54 55 48 89 f5 53\n[  377.706282] RSP: 0018:ffffad2dc4683cb8 EFLAGS: 00010287\n[  377.706289] RAX: 0000000000000000 RBX: ffff8b1743bd5138 RCX: 0000000000000000\n[  377.706297] RDX: ffff8b1743bd5160 RSI: ffff8b1743bd5c78 RDI: ffff8b16d1b25f70\n[  377.706304] RBP: ffff8b1743bd59e0 R08: 0000000000000001 R09: 0000000000000001\n[  377.706311] R10: ffff8b16c8572400 R11: ffffad2dc4683cf0 R12: ffff8b16d1b25f70\n[  377.706318] R13: ffff8b16d1b25fd0 R14: ffff8b1743bd59c0 R15: ffff8b16d1b25f70\n[  377.706325] FS:  00007fec56c72c40(0000) GS:ffff8b1836500000(0000) knlGS:0000000000000000\n[  377.706334] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  377.706340] CR2: 00007f9b88c1ba50 CR3: 0000000110450004 CR4: 00000000003706e0\n[  377.706347] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  377.706354] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  377.706361] Call Trace:\n[  377.706365]  <TASK>\n[  377.706369]  drm_buddy_free_list+0x2a/0x60 [drm_buddy]\n[  377.706376]  amdgpu_vram_mgr_fini+0xea/0x180 [amdgpu]\n[  377.706572]  amdgpu_ttm_fini+0x12e/0x1a0 [amdgpu]\n[  377.706650]  amdgpu_bo_fini+0x22/0x90 [amdgpu]\n[  377.706727]  gmc_v11_0_sw_fini+0x26/0x30 [amdgpu]\n[  377.706821]  amdgpu_device_fini_sw+0xa1/0x3c0 [amdgpu]\n[  377.706897]  amdgpu_driver_release_kms+0x12/0x30 [amdgpu]\n[  377.706975]  drm_dev_release+0x20/0x40 [drm]\n[  377.707006]  release_nodes+0x35/0xb0\n[  377.707014]  devres_release_all+0x8b/0xc0\n[  377.707020]  device_unbind_cleanup+0xe/0x70\n[  377.707027]  device_release_driver_internal+0xee/0x160\n[  377.707033]  driver_detach+0x44/0x90\n[  377.707039]  bus_remove_driver+0x55/0xe0\n[  377.707045]  pci_unregister_driver+0x3b/0x90\n[  377.707052]  amdgpu_exit+0x11/0x6c [amdgpu]\n[  377.707194]  __x64_sys_delete_module+0x142/0x2b0\n[  377.707201]  ? fpregs_assert_state_consistent+0x22/0x50\n[  377.707208]  ? exit_to_user_mode_prepare+0x3e/0x190\n[  377.707215]  do_syscall_64+0x38/0x90\n[  377.707221]  entry_SYSCALL_64_after_hwframe+0x63/0xcd",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6fea49c5-3422-4b3e-bf9c-ebf94137c186",  "id": "CVE-2025-39812",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: initialize more fields in sctp_v6_from_sk()\n\nsyzbot found that sin6_scope_id was not properly initialized,\nleading to undefined behavior.\n\nClear sin6_scope_id and sin6_flowinfo.\n\nBUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649\n  __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649\n  sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983\n  sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390\n  sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452\n  sctp_get_port net/sctp/socket.c:8523 [inline]\n  sctp_listen_start net/sctp/socket.c:8567 [inline]\n  sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636\n  __sys_listen_socket net/socket.c:1912 [inline]\n  __sys_listen net/socket.c:1927 [inline]\n  __do_sys_listen net/socket.c:1932 [inline]\n  __se_sys_listen net/socket.c:1930 [inline]\n  __x64_sys_listen+0x343/0x4c0 net/socket.c:1930\n  x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable addr.i.i created at:\n  sctp_get_port net/sctp/socket.c:8515 [inline]\n  sctp_listen_start net/sctp/socket.c:8567 [inline]\n  sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636\n  __sys_listen_socket net/socket.c:1912 [inline]\n  __sys_listen net/socket.c:1927 [inline]\n  __do_sys_listen net/socket.c:1932 [inline]\n  __se_sys_listen net/socket.c:1930 [inline]\n  __x64_sys_listen+0x343/0x4c0 net/socket.c:1930",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a4eb0076-7876-4279-b1d3-5c3ef8afc235",  "id": "CVE-2022-49322",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix sleeping function called from invalid context on RT kernel\n\nWhen setting bootparams=\"trace_event=initcall:initcall_start tp_printk=1\" in the\ncmdline, the output_printk() was called, and the spin_lock_irqsave() was called in the\natomic and irq disable interrupt context suitation. On the PREEMPT_RT kernel,\nthese locks are replaced with sleepable rt-spinlock, so the stack calltrace will\nbe triggered.\nFix it by raw_spin_lock_irqsave when PREEMPT_RT and \"trace_event=initcall:initcall_start\ntp_printk=1\" enabled.\n\n BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46\n in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0\n preempt_count: 2, expected: 0\n RCU nest depth: 0, expected: 0\n Preemption disabled at:\n [<ffffffff8992303e>] try_to_wake_up+0x7e/0xba0\n CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.17.1-rt17+ #19 34c5812404187a875f32bee7977f7367f9679ea7\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0x60/0x8c\n  dump_stack+0x10/0x12\n  __might_resched.cold+0x11d/0x155\n  rt_spin_lock+0x40/0x70\n  trace_event_buffer_commit+0x2fa/0x4c0\n  ? map_vsyscall+0x93/0x93\n  trace_event_raw_event_initcall_start+0xbe/0x110\n  ? perf_trace_initcall_finish+0x210/0x210\n  ? probe_sched_wakeup+0x34/0x40\n  ? ttwu_do_wakeup+0xda/0x310\n  ? trace_hardirqs_on+0x35/0x170\n  ? map_vsyscall+0x93/0x93\n  do_one_initcall+0x217/0x3c0\n  ? trace_event_raw_event_initcall_level+0x170/0x170\n  ? push_cpu_stop+0x400/0x400\n  ? cblist_init_generic+0x241/0x290\n  kernel_init_freeable+0x1ac/0x347\n  ? _raw_spin_unlock_irq+0x65/0x80\n  ? rest_init+0xf0/0xf0\n  kernel_init+0x1e/0x150\n  ret_from_fork+0x22/0x30\n  </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b3b18459-83ea-4305-97b7-71252c47e0a4",  "id": "CVE-2015-2925",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2925"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a \"double-chroot attack.\"",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9832956-b8c0-496d-bbea-5c86670a5ad2",  "id": "CVE-2026-31515",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_key: validate families in pfkey_send_migrate()\n\nsyzbot was able to trigger a crash in skb_put() [1]\n\nIssue is that pfkey_send_migrate() does not check old/new families,\nand that set_ipsecrequest() @family argument was truncated,\nthus possibly overfilling the skb.\n\nValidate families early, do not wait set_ipsecrequest().\n\n[1]\n\nskbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL>\n kernel BUG at net/core/skbuff.c:214 !\nCall Trace:\n <TASK>\n  skb_over_panic net/core/skbuff.c:219 [inline]\n  skb_put+0x159/0x210 net/core/skbuff.c:2655\n  skb_put_zero include/linux/skbuff.h:2788 [inline]\n  set_ipsecrequest net/key/af_key.c:3532 [inline]\n  pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636\n  km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848\n  xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705\n  xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6498bd0a-3fc2-457a-9626-bc4906c215d1",  "id": "OESA-2023-1466",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b5ae0d2-6c99-435f-acb9-eca9918b40d3",  "id": "OESA-2024-1697",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff35fd01-1ef8-4aba-95c7-dc2c69639ed0",  "id": "OESA-2026-1467",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "46b23609-c60b-44cc-bc78-00c36fb319dd",  "id": "CVE-2020-14331",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14331"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "54e62668-b66c-487b-b258-52af415e4e27",  "id": "CVE-2026-46002",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next2: reject inodes with zero i_nlink and valid mode in ext2_iget()\n\next2_iget() already rejects inodes with i_nlink == 0 when i_mode is\nzero or i_dtime is set, treating them as deleted. However, the case of\ni_nlink == 0 with a non-zero mode and zero dtime slips through. Since\next2 has no orphan list, such a combination can only result from\nfilesystem corruption - a legitimate inode deletion always sets either\ni_dtime or clears i_mode before freeing the inode.\n\nA crafted image can exploit this gap to present such an inode to the\nVFS, which then triggers WARN_ON inside drop_nlink() (fs/inode.c) via\next2_unlink(), ext2_rename() and ext2_rmdir():\n\nWARNING: CPU: 3 PID: 609 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336\nCPU: 3 UID: 0 PID: 609 Comm: syz-executor Not tainted 6.12.77+ #1\nCall Trace:\n <TASK>\n inode_dec_link_count include/linux/fs.h:2518 [inline]\n ext2_unlink+0x26c/0x300 fs/ext2/namei.c:295\n vfs_unlink+0x2fc/0x9b0 fs/namei.c:4477\n do_unlinkat+0x53e/0x730 fs/namei.c:4541\n __x64_sys_unlink+0xc6/0x110 fs/namei.c:4587\n do_syscall_64+0xf5/0x220 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nWARNING: CPU: 0 PID: 646 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336\nCPU: 0 UID: 0 PID: 646 Comm: syz.0.17 Not tainted 6.12.77+ #1\nCall Trace:\n <TASK>\n inode_dec_link_count include/linux/fs.h:2518 [inline]\n ext2_rename+0x35e/0x850 fs/ext2/namei.c:374\n vfs_rename+0xf2f/0x2060 fs/namei.c:5021\n do_renameat2+0xbe2/0xd50 fs/namei.c:5178\n __x64_sys_rename+0x7e/0xa0 fs/namei.c:5223\n do_syscall_64+0xf5/0x220 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nWARNING: CPU: 0 PID: 634 at fs/inode.c:336 drop_nlink+0xad/0xd0 fs/inode.c:336\nCPU: 0 UID: 0 PID: 634 Comm: syz-executor Not tainted 6.12.77+ #1\nCall Trace:\n <TASK>\n inode_dec_link_count include/linux/fs.h:2518 [inline]\n ext2_rmdir+0xca/0x110 fs/ext2/namei.c:311\n vfs_rmdir+0x204/0x690 fs/namei.c:4348\n do_rmdir+0x372/0x3e0 fs/namei.c:4407\n __x64_sys_unlinkat+0xf0/0x130 fs/namei.c:4577\n do_syscall_64+0xf5/0x220 arch/x86/entry/common.c:78\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nExtend the existing i_nlink == 0 check to also catch this case,\nreporting the corruption via ext2_error() and returning -EFSCORRUPTED.\nThis rejects the inode at load time and prevents it from reaching any\nof the namei.c paths.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bac4e95f-f275-48ea-a029-d4db0658ecff",  "id": "OESA-2024-1902",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d91d0ad6-d4c0-49ec-b4c0-f679a576c929",  "id": "CVE-2017-13086",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13086"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    323,    330  ],  "analysis": {    "state": "in_triage"  },  "description": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0263d42d-d09c-4583-98d3-7b30ce1fe161",  "id": "SUSE-SU-2022:14941-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "96385200-3829-42a1-ac09-66e49c0ff35c",  "id": "CVE-2025-22004",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.6,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atm: fix use after free in lec_send()\n\nThe ->send() operation frees skb so save the length before calling\n->send() to avoid a use after free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dbf554d1-0f33-4bd6-8c47-8754419a3317",  "id": "CVE-2022-50411",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix error code path in acpi_ds_call_control_method()\n\nA use-after-free in acpi_ps_parse_aml() after a failing invocaion of\nacpi_ds_call_control_method() is reported by KASAN [1] and code\ninspection reveals that next_walk_state pushed to the thread by\nacpi_ds_create_walk_state() is freed on errors, but it is not popped\nfrom the thread beforehand.  Thus acpi_ds_get_current_walk_state()\ncalled by acpi_ps_parse_aml() subsequently returns it as the new\nwalk state which is incorrect.\n\nTo address this, make acpi_ds_call_control_method() call\nacpi_ds_pop_walk_state() to pop next_walk_state from the thread before\nreturning an error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "353313b3-201e-407c-a0b7-60fdc0cc772a",  "id": "CVE-2014-0224",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0224"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    326  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the \"CCS Injection\" vulnerability.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'MSF:openssl_ccs'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'SNYK:SNYK-COCOAPODS-OPENSSL-470915'"    }  ]},{  "bom-ref": "7cde207d-4f8c-4c7a-8620-a40db0c48261",  "id": "CVE-2010-2962",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2962"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/gpu/drm/i915/i915_gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.36 does not properly validate pointers to blocks of memory, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via crafted use of the ioctl interface, related to (1) pwrite and (2) pread operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a4d51d10-78c4-48bf-b59c-20f119b4d224",  "id": "CVE-2026-31417",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/x25: Fix overflow when accumulating packets\n\nAdd a check to ensure that `x25_sock.fraglen` does not overflow.\n\nThe `fraglen` also needs to be resetted when purging `fragment_queue` in\n`x25_clear_queues()`.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "35a26b07-8d8d-4350-8fc1-ca90da052abe",  "id": "CVE-2024-52332",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Fix potential invalid memory access in igb_init_module()\n\nThe pci_register_driver() can fail and when this happened, the dca_notifier\nneeds to be unregistered, otherwise the dca_notifier can be called when\nigb fails to install, resulting to invalid memory access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2bbef2a4-b997-4258-80f2-6cbce71b1bb3",  "id": "CVE-2021-33624",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33624"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    843  ],  "analysis": {    "state": "in_triage"  },  "description": "In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d49a5cd-eddc-44ae-bc30-15a4fa98e497",  "id": "MGASA-2015-0022",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "12b8e6f7-85c9-4023-b416-26d59cfc056e",  "id": "CVE-2025-21712",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime\n\nAfter commit ec6bb299c7c3 (\"md/md-bitmap: add 'sync_size' into struct\nmd_bitmap_stats\"), following panic is reported:\n\nOops: general protection fault, probably for non-canonical address\nRIP: 0010:bitmap_get_stats+0x2b/0xa0\nCall Trace:\n <TASK>\n md_seq_show+0x2d2/0x5b0\n seq_read_iter+0x2b9/0x470\n seq_read+0x12f/0x180\n proc_reg_read+0x57/0xb0\n vfs_read+0xf6/0x380\n ksys_read+0x6c/0xf0\n do_syscall_64+0x82/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nRoot cause is that bitmap_get_stats() can be called at anytime if mddev\nis still there, even if bitmap is destroyed, or not fully initialized.\nDeferenceing bitmap in this case can crash the kernel. Meanwhile, the\nabove commit start to deferencing bitmap->storage, make the problem\neasier to trigger.\n\nFix the problem by protecting bitmap_get_stats() with bitmap_info.mutex.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8373db9-e3bb-4e7b-aa31-5a37cbbc787e",  "id": "CVE-2024-39485",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    665  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l: async: Properly re-initialise notifier entry in unregister\n\nThe notifier_entry of a notifier is not re-initialised after unregistering\nthe notifier. This leads to dangling pointers being left there so use\nlist_del_init() to return the notifier_entry an empty list.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d06c2c4-bb0b-4c26-999b-6ebb95ad215e",  "id": "CVE-2026-31720",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_uac1_legacy: validate control request size\n\nf_audio_complete() copies req->length bytes into a 4-byte stack\nvariable:\n\n  u32 data = 0;\n  memcpy(&data, req->buf, req->length);\n\nreq->length is derived from the host-controlled USB request path,\nwhich can lead to a stack out-of-bounds write.\n\nValidate req->actual against the expected payload size for the\nsupported control selectors and decode only the expected amount\nof data.\n\nThis avoids copying a host-influenced length into a fixed-size\nstack object.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dade5550-187b-44d0-b627-3c083a8b04b5",  "id": "CVE-2019-19077",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19077"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy to udata failures, aka CID-4a9d46a9fe14.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2fc424a0-5edd-4f03-b727-fd1b42db518f",  "id": "SUSE-SU-2016:0617-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ab7bc441-ae15-48fd-bec4-f700d6985697",  "id": "CVE-2019-19227",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19227"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer dereference because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregister_snap_client, aka CID-9804501fa122.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5f848fe9-4ee6-4ace-83ee-d49af8505b4b",  "id": "CVE-2022-45869",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45869"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crash or host OS memory corruption) when nested virtualisation and the TDP MMU are enabled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e99320a-f87b-4c31-b896-0bcde167aefc",  "id": "CVE-2017-18200",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18200"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The f2fs implementation in the Linux kernel before 4.14 mishandles reference counts associated with f2fs_wait_discard_bios calls, which allows local users to cause a denial of service (BUG), as demonstrated by fstrim.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5df129f4-a169-4372-b7bf-d6ea2a5f7a83",  "id": "CVE-2022-48628",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: drop messages from MDS when unmounting\n\nWhen unmounting all the dirty buffers will be flushed and after\nthe last osd request is finished the last reference of the i_count\nwill be released. Then it will flush the dirty cap/snap to MDSs,\nand the unmounting won't wait the possible acks, which will ihold\nthe inodes when updating the metadata locally but makes no sense\nany more, of this. This will make the evict_inodes() to skip these\ninodes.\n\nIf encrypt is enabled the kernel generate a warning when removing\nthe encrypt keys when the skipped inodes still hold the keyring:\n\nWARNING: CPU: 4 PID: 168846 at fs/crypto/keyring.c:242 fscrypt_destroy_keyring+0x7e/0xd0\nCPU: 4 PID: 168846 Comm: umount Tainted: G S  6.1.0-rc5-ceph-g72ead199864c #1\nHardware name: Supermicro SYS-5018R-WR/X10SRW-F, BIOS 2.0 12/17/2015\nRIP: 0010:fscrypt_destroy_keyring+0x7e/0xd0\nRSP: 0018:ffffc9000b277e28 EFLAGS: 00010202\nRAX: 0000000000000002 RBX: ffff88810d52ac00 RCX: ffff88810b56aa00\nRDX: 0000000080000000 RSI: ffffffff822f3a09 RDI: ffff888108f59000\nRBP: ffff8881d394fb88 R08: 0000000000000028 R09: 0000000000000000\nR10: 0000000000000001 R11: 11ff4fe6834fcd91 R12: ffff8881d394fc40\nR13: ffff888108f59000 R14: ffff8881d394f800 R15: 0000000000000000\nFS:  00007fd83f6f1080(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f918d417000 CR3: 000000017f89a005 CR4: 00000000003706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n<TASK>\ngeneric_shutdown_super+0x47/0x120\nkill_anon_super+0x14/0x30\nceph_kill_sb+0x36/0x90 [ceph]\ndeactivate_locked_super+0x29/0x60\ncleanup_mnt+0xb8/0x140\ntask_work_run+0x67/0xb0\nexit_to_user_mode_prepare+0x23d/0x240\nsyscall_exit_to_user_mode+0x25/0x60\ndo_syscall_64+0x40/0x80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7fd83dc39e9b\n\nLater the kernel will crash when iput() the inodes and dereferencing\nthe \"sb->s_master_keys\", which has been released by the\ngeneric_shutdown_super().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c11cb50c-2746-4ddd-ae35-f1c869f0084d",  "id": "OESA-2026-1312",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c233377f-935e-4815-9e28-7d7126a4efec",  "id": "CVE-2022-43945",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43945"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    131,    770  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "237be40c-3380-481a-9dab-b5c3ffb82bc8",  "id": "CVE-2026-31503",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Fix wildcard bind conflict check when using hash2\n\nWhen binding a udp_sock to a local address and port, UDP uses\ntwo hashes (udptable->hash and udptable->hash2) for collision\ndetection. The current code switches to \"hash2\" when\nhslot->count > 10.\n\n\"hash2\" is keyed by local address and local port.\n\"hash\" is keyed by local port only.\n\nThe issue can be shown in the following bind sequence (pseudo code):\n\nbind(fd1,  \"[fd00::1]:8888\")\nbind(fd2,  \"[fd00::2]:8888\")\nbind(fd3,  \"[fd00::3]:8888\")\nbind(fd4,  \"[fd00::4]:8888\")\nbind(fd5,  \"[fd00::5]:8888\")\nbind(fd6,  \"[fd00::6]:8888\")\nbind(fd7,  \"[fd00::7]:8888\")\nbind(fd8,  \"[fd00::8]:8888\")\nbind(fd9,  \"[fd00::9]:8888\")\nbind(fd10, \"[fd00::10]:8888\")\n\n/* Correctly return -EADDRINUSE because \"hash\" is used\n * instead of \"hash2\". udp_lib_lport_inuse() detects the\n * conflict.\n */\nbind(fail_fd, \"[::]:8888\")\n\n/* After one more socket is bound to \"[fd00::11]:8888\",\n * hslot->count exceeds 10 and \"hash2\" is used instead.\n */\nbind(fd11, \"[fd00::11]:8888\")\nbind(fail_fd, \"[::]:8888\")      /* succeeds unexpectedly */\n\nThe same issue applies to the IPv4 wildcard address \"0.0.0.0\"\nand the IPv4-mapped wildcard address \"::ffff:0.0.0.0\". For\nexample, if there are existing sockets bound to\n\"192.168.1.[1-11]:8888\", then binding \"0.0.0.0:8888\" or\n\"[::ffff:0.0.0.0]:8888\" can also miss the conflict when\nhslot->count > 10.\n\nTCP inet_csk_get_port() already has the correct check in\ninet_use_bhash2_on_bind(). Rename it to\ninet_use_hash2_on_bind() and move it to inet_hashtables.h\nso udp.c can reuse it in this fix.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "953083c8-f275-4246-879d-2d006887fcad",  "id": "CVE-2022-48828",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix ia_size underflow\n\niattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and\nNFSv4 both define file size as an unsigned 64-bit type. Thus there\nis a range of valid file size values an NFS client can send that is\nalready larger than Linux can handle.\n\nCurrently decode_fattr4() dumps a full u64 value into ia_size. If\nthat value happens to be larger than S64_MAX, then ia_size\nunderflows. I'm about to fix up the NFSv3 behavior as well, so let's\ncatch the underflow in the common code path: nfsd_setattr().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4c1156dc-6aa2-41c3-82c1-fe5a7e79188a",  "id": "CVE-2025-37892",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: inftlcore: Add error check for inftl_read_oob()\n\nIn INFTL_findwriteunit(), the return value of inftl_read_oob()\nneed to be checked. A proper implementation can be\nfound in INFTL_deleteblock(). The status will be set as\nSECTOR_IGNORE to break from the while-loop correctly\nif the inftl_read_oob() fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a85ccc07-f445-47aa-b372-61a8671fb059",  "id": "CVE-2019-19082",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19082"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption). This affects the dce120_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, the dce100_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, and the dce112_create_resource_pool() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, aka CID-104c307147ad.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9678aaa6-c467-4f6b-b416-87c616d8c961",  "id": "CVE-2023-53173",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: pcn_uart: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45eda17e-2af0-40c3-8a1a-a4d65a724e97",  "id": "CVE-2024-49994",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix integer overflow in BLKSECDISCARD\n\nI independently rediscovered\n\n\tcommit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155\n\tblock: fix overflow in blk_ioctl_discard()\n\nbut for secure erase.\n\nSame problem:\n\n\tuint64_t r[2] = {512, 18446744073709551104ULL};\n\tioctl(fd, BLKSECDISCARD, r);\n\nwill enter near infinite loop inside blkdev_issue_secure_erase():\n\n\ta.out: attempt to access beyond end of device\n\tloop0: rw=5, sector=3399043073, nr_sectors = 1024 limit=2048\n\tbio_check_eod: 3286214 callbacks suppressed",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d55e2df-eb0e-4c00-901c-85d13a940ac1",  "id": "CVE-2022-2503",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2503"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    287,    302  ],  "analysis": {    "state": "in_triage"  },  "description": "Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b298cd0a-2fbc-43a4-887b-e0109fb8d784",  "id": "CVE-2023-26242",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26242"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "afu_mmio_region_get_by_offset in drivers/fpga/dfl-afu-region.c in the Linux kernel through 6.1.12 has an integer overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ec10987d-e053-4731-826e-22d92012de6c",  "id": "CVE-2020-25645",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25645"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    319  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "06a4f5ed-81e9-4b29-91c0-ccf0e9dbc522",  "id": "CVE-2022-49298",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8712: fix uninit-value in r871xu_drv_init()\n\nWhen 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0,\n'mac[6]' will not be initialized.\n\nBUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541\n r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541\n usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396\n really_probe+0x653/0x14b0 drivers/base/dd.c:596\n __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752\n driver_probe_device drivers/base/dd.c:782 [inline]\n __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899\n bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427\n __device_attach+0x593/0x8e0 drivers/base/dd.c:970\n device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017\n bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487\n device_add+0x1fff/0x26e0 drivers/base/core.c:3405\n usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170\n usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238\n usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293\n really_probe+0x653/0x14b0 drivers/base/dd.c:596\n __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752\n driver_probe_device drivers/base/dd.c:782 [inline]\n __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899\n bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427\n __device_attach+0x593/0x8e0 drivers/base/dd.c:970\n device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017\n bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487\n device_add+0x1fff/0x26e0 drivers/base/core.c:3405\n usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566\n hub_port_connect drivers/usb/core/hub.c:5358 [inline]\n hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]\n port_event drivers/usb/core/hub.c:5660 [inline]\n hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742\n process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307\n worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454\n kthread+0x3c7/0x500 kernel/kthread.c:377\n ret_from_fork+0x1f/0x30\n\nLocal variable mac created at:\n r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394\n usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396\n\nKMSAN: uninit-value in r871xu_drv_init\nhttps://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4197508e-7b60-44b0-ab5a-9273de97d4d8",  "id": "CVE-2024-56787",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: imx8m: Probe the SoC driver as platform driver\n\nWith driver_async_probe=* on kernel command line, the following trace is\nproduced because on i.MX8M Plus hardware because the soc-imx8m.c driver\ncalls of_clk_get_by_name() which returns -EPROBE_DEFER because the clock\ndriver is not yet probed. This was not detected during regular testing\nwithout driver_async_probe.\n\nConvert the SoC code to platform driver and instantiate a platform device\nin its current device_initcall() to probe the platform driver. Rework\n.soc_revision callback to always return valid error code and return SoC\nrevision via parameter. This way, if anything in the .soc_revision callback\nreturn -EPROBE_DEFER, it gets propagated to .probe and the .probe will get\nretried later.\n\n\"\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 1 at drivers/soc/imx/soc-imx8m.c:115 imx8mm_soc_revision+0xdc/0x180\nCPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-next-20240924-00002-g2062bb554dea #603\nHardware name: DH electronics i.MX8M Plus DHCOM Premium Developer Kit (3) (DT)\npstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : imx8mm_soc_revision+0xdc/0x180\nlr : imx8mm_soc_revision+0xd0/0x180\nsp : ffff8000821fbcc0\nx29: ffff8000821fbce0 x28: 0000000000000000 x27: ffff800081810120\nx26: ffff8000818a9970 x25: 0000000000000006 x24: 0000000000824311\nx23: ffff8000817f42c8 x22: ffff0000df8be210 x21: fffffffffffffdfb\nx20: ffff800082780000 x19: 0000000000000001 x18: ffffffffffffffff\nx17: ffff800081fff418 x16: ffff8000823e1000 x15: ffff0000c03b65e8\nx14: ffff0000c00051b0 x13: ffff800082790000 x12: 0000000000000801\nx11: ffff80008278ffff x10: ffff80008209d3a6 x9 : ffff80008062e95c\nx8 : ffff8000821fb9a0 x7 : 0000000000000000 x6 : 00000000000080e3\nx5 : ffff0000df8c03d8 x4 : 0000000000000000 x3 : 0000000000000000\nx2 : 0000000000000000 x1 : fffffffffffffdfb x0 : fffffffffffffdfb\nCall trace:\n imx8mm_soc_revision+0xdc/0x180\n imx8_soc_init+0xb0/0x1e0\n do_one_initcall+0x94/0x1a8\n kernel_init_freeable+0x240/0x2a8\n kernel_init+0x28/0x140\n ret_from_fork+0x10/0x20\n---[ end trace 0000000000000000 ]---\nSoC: i.MX8MP revision 1.1\n\"",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "604c5162-efde-4c45-ac02-dd97dc93cf2d",  "id": "CVE-2024-26957",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: fix reference counting on zcrypt card objects\n\nTests with hot-plugging crytpo cards on KVM guests with debug\nkernel build revealed an use after free for the load field of\nthe struct zcrypt_card. The reason was an incorrect reference\nhandling of the zcrypt card object which could lead to a free\nof the zcrypt card object while it was still in use.\n\nThis is an example of the slab message:\n\n    kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b\n    kernel: Allocated in zcrypt_card_alloc+0x36/0x70 [zcrypt] age=18046 cpu=3 pid=43\n    kernel:  kmalloc_trace+0x3f2/0x470\n    kernel:  zcrypt_card_alloc+0x36/0x70 [zcrypt]\n    kernel:  zcrypt_cex4_card_probe+0x26/0x380 [zcrypt_cex4]\n    kernel:  ap_device_probe+0x15c/0x290\n    kernel:  really_probe+0xd2/0x468\n    kernel:  driver_probe_device+0x40/0xf0\n    kernel:  __device_attach_driver+0xc0/0x140\n    kernel:  bus_for_each_drv+0x8c/0xd0\n    kernel:  __device_attach+0x114/0x198\n    kernel:  bus_probe_device+0xb4/0xc8\n    kernel:  device_add+0x4d2/0x6e0\n    kernel:  ap_scan_adapter+0x3d0/0x7c0\n    kernel:  ap_scan_bus+0x5a/0x3b0\n    kernel:  ap_scan_bus_wq_callback+0x40/0x60\n    kernel:  process_one_work+0x26e/0x620\n    kernel:  worker_thread+0x21c/0x440\n    kernel: Freed in zcrypt_card_put+0x54/0x80 [zcrypt] age=9024 cpu=3 pid=43\n    kernel:  kfree+0x37e/0x418\n    kernel:  zcrypt_card_put+0x54/0x80 [zcrypt]\n    kernel:  ap_device_remove+0x4c/0xe0\n    kernel:  device_release_driver_internal+0x1c4/0x270\n    kernel:  bus_remove_device+0x100/0x188\n    kernel:  device_del+0x164/0x3c0\n    kernel:  device_unregister+0x30/0x90\n    kernel:  ap_scan_adapter+0xc8/0x7c0\n    kernel:  ap_scan_bus+0x5a/0x3b0\n    kernel:  ap_scan_bus_wq_callback+0x40/0x60\n    kernel:  process_one_work+0x26e/0x620\n    kernel:  worker_thread+0x21c/0x440\n    kernel:  kthread+0x150/0x168\n    kernel:  __ret_from_fork+0x3c/0x58\n    kernel:  ret_from_fork+0xa/0x30\n    kernel: Slab 0x00000372022169c0 objects=20 used=18 fp=0x00000000885a7c88 flags=0x3ffff00000000a00(workingset|slab|node=0|zone=1|lastcpupid=0x1ffff)\n    kernel: Object 0x00000000885a74b8 @offset=1208 fp=0x00000000885a7c88\n    kernel: Redzone  00000000885a74b0: bb bb bb bb bb bb bb bb                          ........\n    kernel: Object   00000000885a74b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n    kernel: Object   00000000885a74c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n    kernel: Object   00000000885a74d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n    kernel: Object   00000000885a74e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n    kernel: Object   00000000885a74f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n    kernel: Object   00000000885a7508: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 68 4b 6b 6b 6b a5  kkkkkkkkkkhKkkk.\n    kernel: Redzone  00000000885a7518: bb bb bb bb bb bb bb bb                          ........\n    kernel: Padding  00000000885a756c: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a              ZZZZZZZZZZZZ\n    kernel: CPU: 0 PID: 387 Comm: systemd-udevd Not tainted 6.8.0-HF #2\n    kernel: Hardware name: IBM 3931 A01 704 (KVM/Linux)\n    kernel: Call Trace:\n    kernel:  [<00000000ca5ab5b8>] dump_stack_lvl+0x90/0x120\n    kernel:  [<00000000c99d78bc>] check_bytes_and_report+0x114/0x140\n    kernel:  [<00000000c99d53cc>] check_object+0x334/0x3f8\n    kernel:  [<00000000c99d820c>] alloc_debug_processing+0xc4/0x1f8\n    kernel:  [<00000000c99d852e>] get_partial_node.part.0+0x1ee/0x3e0\n    kernel:  [<00000000c99d94ec>] ___slab_alloc+0xaf4/0x13c8\n    kernel:  [<00000000c99d9e38>] __slab_alloc.constprop.0+0x78/0xb8\n    kernel:  [<00000000c99dc8dc>] __kmalloc+0x434/0x590\n    kernel:  [<00000000c9b4c0ce>] ext4_htree_store_dirent+0x4e/0x1c0\n    kernel:  [<00000000c9b908a2>] htree_dirblock_to_tree+0x17a/0x3f0\n    kernel: \n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2c587225-52c7-477a-a574-9b6bc6679a50",  "id": "CVE-2015-7885",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7885"  },  "ratings": [    {      "score": 2.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5589dd13-d617-4a86-bd66-cd0e2b965d67",  "id": "CVE-2014-3571",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3571"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8bcd2704-6087-4153-b29a-abe980b94b8d",  "id": "CVE-2021-47328",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47328"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: iscsi: Fix conn use after free during resets\n\nIf we haven't done a unbind target call we can race where\niscsi_conn_teardown wakes up the EH thread and then frees the conn while\nthose threads are still accessing the conn ehwait.\n\nWe can only do one TMF per session so this just moves the TMF fields from\nthe conn to the session. We can then rely on the\niscsi_session_teardown->iscsi_remove_session->__iscsi_unbind_session call\nto remove the target and it's devices, and know after that point there is\nno device or scsi-ml callout trying to access the session.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0a829c7f-42d4-4ece-bf44-dc4c9818af3f",  "id": "CVE-2024-53197",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices\n\nA bogus device can provide a bNumConfigurations value that exceeds the\ninitial value used in usb_get_configuration for allocating dev->config.\n\nThis can lead to out-of-bounds accesses later, e.g. in\nusb_destroy_configuration.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9f4d313d-fd08-4e4c-9c91-384f283a5a54",  "id": "AZL-81953",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45154e87-f8eb-47b3-b87b-9ed59d39e7fa",  "id": "CVE-2025-39885",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix recursive semaphore deadlock in fiemap call\n\nsyzbot detected a OCFS2 hang due to a recursive semaphore on a\nFS_IOC_FIEMAP of the extent list on a specially crafted mmap file.\n\ncontext_switch kernel/sched/core.c:5357 [inline]\n   __schedule+0x1798/0x4cc0 kernel/sched/core.c:6961\n   __schedule_loop kernel/sched/core.c:7043 [inline]\n   schedule+0x165/0x360 kernel/sched/core.c:7058\n   schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7115\n   rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185\n   __down_write_common kernel/locking/rwsem.c:1317 [inline]\n   __down_write kernel/locking/rwsem.c:1326 [inline]\n   down_write+0x1ab/0x1f0 kernel/locking/rwsem.c:1591\n   ocfs2_page_mkwrite+0x2ff/0xc40 fs/ocfs2/mmap.c:142\n   do_page_mkwrite+0x14d/0x310 mm/memory.c:3361\n   wp_page_shared mm/memory.c:3762 [inline]\n   do_wp_page+0x268d/0x5800 mm/memory.c:3981\n   handle_pte_fault mm/memory.c:6068 [inline]\n   __handle_mm_fault+0x1033/0x5440 mm/memory.c:6195\n   handle_mm_fault+0x40a/0x8e0 mm/memory.c:6364\n   do_user_addr_fault+0x764/0x1390 arch/x86/mm/fault.c:1387\n   handle_page_fault arch/x86/mm/fault.c:1476 [inline]\n   exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532\n   asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623\nRIP: 0010:copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]\nRIP: 0010:raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline]\nRIP: 0010:_inline_copy_to_user include/linux/uaccess.h:197 [inline]\nRIP: 0010:_copy_to_user+0x85/0xb0 lib/usercopy.c:26\nCode: e8 00 bc f7 fc 4d 39 fc 72 3d 4d 39 ec 77 38 e8 91 b9 f7 fc 4c 89\nf7 89 de e8 47 25 5b fd 0f 01 cb 4c 89 ff 48 89 d9 4c 89 f6 <f3> a4 0f\n1f 00 48 89 cb 0f 01 ca 48 89 d8 5b 41 5c 41 5d 41 5e 41\nRSP: 0018:ffffc9000403f950 EFLAGS: 00050256\nRAX: ffffffff84c7f101 RBX: 0000000000000038 RCX: 0000000000000038\nRDX: 0000000000000000 RSI: ffffc9000403f9e0 RDI: 0000200000000060\nRBP: ffffc9000403fa90 R08: ffffc9000403fa17 R09: 1ffff92000807f42\nR10: dffffc0000000000 R11: fffff52000807f43 R12: 0000200000000098\nR13: 00007ffffffff000 R14: ffffc9000403f9e0 R15: 0000200000000060\n   copy_to_user include/linux/uaccess.h:225 [inline]\n   fiemap_fill_next_extent+0x1c0/0x390 fs/ioctl.c:145\n   ocfs2_fiemap+0x888/0xc90 fs/ocfs2/extent_map.c:806\n   ioctl_fiemap fs/ioctl.c:220 [inline]\n   do_vfs_ioctl+0x1173/0x1430 fs/ioctl.c:532\n   __do_sys_ioctl fs/ioctl.c:596 [inline]\n   __se_sys_ioctl+0x82/0x170 fs/ioctl.c:584\n   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f5f13850fd9\nRSP: 002b:00007ffe3b3518b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f5f13850fd9\nRDX: 0000200000000040 RSI: 00000000c020660b RDI: 0000000000000004\nRBP: 6165627472616568 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe3b3518f0\nR13: 00007ffe3b351b18 R14: 431bde82d7b634db R15: 00007f5f1389a03b\n\nocfs2_fiemap() takes a read lock of the ip_alloc_sem semaphore (since\nv2.6.22-527-g7307de80510a) and calls fiemap_fill_next_extent() to read the\nextent list of this running mmap executable.  The user supplied buffer to\nhold the fiemap information page faults calling ocfs2_page_mkwrite() which\nwill take a write lock (since v2.6.27-38-g00dc417fa3e7) of the same\nsemaphore.  This recursive semaphore will hold filesystem locks and causes\na hang of the fileystem.\n\nThe ip_alloc_sem protects the inode extent list and size.  Release the\nread semphore before calling fiemap_fill_next_extent() in ocfs2_fiemap()\nand ocfs2_fiemap_inline().  This does an unnecessary semaphore lock/unlock\non the last extent but simplifies the error path.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "274d4f2a-46a3-40ea-8f26-2698c0557faf",  "id": "CVE-2019-19076",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19076"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the nfp_abm_u32_knode_replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux kernel before 5.3.6 allows attackers to cause a denial of service (memory consumption), aka CID-78beef629fd9. NOTE: This has been argued as not a valid vulnerability. The upstream commit 78beef629fd9 was reverted",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f75fb4ec-a321-4cd1-a8a0-40185b294290",  "id": "CVE-2017-14496",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14496"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service via a crafted DNS request.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:42946'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:144462/Dnsmasq-Integer-Underflow.html'"    }  ]},{  "bom-ref": "957dc1b3-da87-48b9-865f-feddceda85b2",  "id": "CVE-2021-47432",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47432"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/generic-radix-tree.c: Don't overflow in peek()\n\nWhen we started spreading new inode numbers throughout most of the 64\nbit inode space, that triggered some corner case bugs, in particular\nsome integer overflows related to the radix tree code. Oops.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee86c508-24b8-41a9-802e-440704a34f5b",  "id": "CVE-2024-53126",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: solidrun: Fix UB bug with devres\n\nIn psnet_open_pf_bar() and snet_open_vf_bar() a string later passed to\npcim_iomap_regions() is placed on the stack. Neither\npcim_iomap_regions() nor the functions it calls copy that string.\n\nShould the string later ever be used, this, consequently, causes\nundefined behavior since the stack frame will by then have disappeared.\n\nFix the bug by allocating the strings on the heap through\ndevm_kasprintf().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "96e9990d-4606-4eb9-8954-fefdbaf31ac3",  "id": "CVE-2019-19067",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19067"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption) by triggering mfd_add_hotplug_devices() or pm_genpd_add_device() failures, aka CID-57be09c6e874. NOTE: third parties dispute the relevance of this because the attacker must already have privileges for module loading",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c6939949-b9bb-47f2-8bd6-6aaf5396a5e0",  "id": "RHSA-2026:22314",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99e3e0fd-3943-452c-a421-c9d76dce4180",  "id": "CVE-2022-49166",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: add sanity check on allocation size\n\nntfs_read_inode_mount invokes ntfs_malloc_nofs with zero allocation\nsize.  It triggers one BUG in the __ntfs_malloc function.\n\nFix this by adding sanity check on ni->attr_list_size.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6fb24868-81ce-4f74-b092-f7a0c9d6c064",  "id": "CVE-2014-4014",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4014"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:33824'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:137628/Linux-Kernel-3.13-Local-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "850496d5-875d-4212-8c8b-1793a2f08034",  "id": "RLSA-2025:1330",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0569986f-fda7-4724-8709-2599249547c4",  "id": "CVE-2012-6538",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6538"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The copy_to_user_auth function in net/xfrm/xfrm_user.c in the Linux kernel before 3.6 uses an incorrect C library function for copying a string, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0a5647e0-adb4-4c19-b297-d38b9d63a592",  "id": "RUSTSEC-2023-0023",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "307d85df-ea53-4cc3-8203-e933a93ba54c",  "id": "CVE-2017-18079",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18079"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the port->exists value can change after it is validated.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "003c66b2-dca2-45a1-bed6-9b8c5acce09e",  "id": "CVE-2023-52340",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52340"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading to a denial of service (network is unreachable errors) when IPv6 packets are sent in a loop via a raw socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "40a2f7a6-9935-4724-8611-287f1b9f9276",  "id": "CVE-2024-49933",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk_iocost: fix more out of bound shifts\n\nRecently running UBSAN caught few out of bound shifts in the\nioc_forgive_debts() function:\n\nUBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38\nshift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long\nlong')\n...\nUBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30\nshift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long\nlong')\n...\nCall Trace:\n<IRQ>\ndump_stack_lvl+0xca/0x130\n__ubsan_handle_shift_out_of_bounds+0x22c/0x280\n? __lock_acquire+0x6441/0x7c10\nioc_timer_fn+0x6cec/0x7750\n? blk_iocost_init+0x720/0x720\n? call_timer_fn+0x5d/0x470\ncall_timer_fn+0xfa/0x470\n? blk_iocost_init+0x720/0x720\n__run_timer_base+0x519/0x700\n...\n\nActual impact of this issue was not identified but I propose to fix the\nundefined behaviour.\nThe proposed fix to prevent those out of bound shifts consist of\nprecalculating exponent before using it the shift operations by taking\nmin value from the actual exponent and maximum possible number of bits.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd48f607-9cdc-4657-b54d-947bdc21badd",  "id": "CVE-2013-2636",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2636"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "net/bridge/br_mdb.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ced57c16-5e25-451b-b42a-23d7f41fa0c3",  "id": "CVE-2003-0947",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0947"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in iwconfig, when installed setuid, allows local users to execute arbitrary code via a long OUT environment variable.",  "affects": [    {      "ref": "28e56438-7ab7-42b3-ac8b-d963c9673703",      "versions": [        {          "component": "wireless_tools",          "version": "26"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:23299'"    }  ]},{  "bom-ref": "2fd67285-d658-440f-a14a-48beadab1d15",  "id": "CVE-2016-8646",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8646"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fb61b441-1bce-4ce9-8cb9-ecfa0a033337",  "id": "CVE-2022-27666",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27666"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c4d52c29-c44b-47e7-a981-4326b055c462",  "id": "CVE-2025-71118",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Avoid walking the Namespace if start_node is NULL\n\nAlthough commit 0c9992315e73 (\"ACPICA: Avoid walking the ACPI Namespace\nif it is not there\") fixed the situation when both start_node and\nacpi_gbl_root_node are NULL, the Linux kernel mainline now still crashed\non Honor Magicbook 14 Pro [1].\n\nThat happens due to the access to the member of parent_node in\nacpi_ns_get_next_node().  The NULL pointer dereference will always\nhappen, no matter whether or not the start_node is equal to\nACPI_ROOT_OBJECT, so move the check of start_node being NULL\nout of the if block.\n\nUnfortunately, all the attempts to contact Honor have failed, they\nrefused to provide any technical support for Linux.\n\nThe bad DSDT table's dump could be found on GitHub [2].\n\nDMI: HONOR FMB-P/FMB-P-PCB, BIOS 1.13 05/08/2025\n\n[ rjw: Subject adjustment, changelog edits ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c47a92c8-02ea-4ab2-8feb-5c4602a3f12c",  "id": "CVE-2023-52708",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mmc_spi: fix error handling in mmc_spi_probe()\n\nIf mmc_add_host() fails, it doesn't need to call mmc_remove_host(),\nor it will cause null-ptr-deref, because of deleting a not added\ndevice in mmc_remove_host().\n\nTo fix this, goto label 'fail_glue_init', if mmc_add_host() fails,\nand change the label 'fail_add_host' to 'fail_gpiod_request'.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eb7873cb-eeb4-43c1-bbb3-d1fddb0d0b5b",  "id": "CVE-2026-46064",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmasm: fix heap over-read in ibmasm_send_i2o_message()\n\nThe ibmasm_send_i2o_message() function uses get_dot_command_size() to\ncompute the byte count for memcpy_toio(), but this value is derived from\nuser-controlled fields in the dot_command_header (command_size: u8,\ndata_size: u16) and is never validated against the actual allocation size.\nA root user can write a small buffer with inflated header fields, causing\nmemcpy_toio() to read up to ~65 KB past the end of the allocation into\nadjacent kernel heap, which is then forwarded to the service processor\nover MMIO.\n\nSilently clamping the copy size is not sufficient: if the header fields\nclaim a larger size than the buffer, the SP receives a dot command whose\nown header is inconsistent with the I2O message length, which can cause\nthe SP to desynchronize. Reject such commands outright by returning\nfailure.\n\nValidate command_size before calling get_mfa_inbound() to avoid leaking\nan I2O message frame: reading INBOUND_QUEUE_PORT dequeues a hardware\nframe from the controller's free pool, and returning without a\ncorresponding set_mfa_inbound() call would permanently exhaust it.\n\nAdditionally, clamp command_size to I2O_COMMAND_SIZE before the\nmemcpy_toio() so the MMIO write stays within the I2O message frame,\nconsistent with the clamping already performed by outgoing_message_size()\nfor the header field.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc64c803-007d-4f0f-babe-7fe4f7ba3d29",  "id": "CVE-2022-28389",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28389"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c978c1fa-dece-40f1-918f-4b02515f2c28",  "id": "CVE-2022-49471",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtw89: cfo: check mac_id to avoid out-of-bounds\n\nSomehow, hardware reports incorrect mac_id and pollute memory. Check index\nbefore we access the array.\n\n  UBSAN: array-index-out-of-bounds in rtw89/phy.c:2517:23\n  index 188 is out of range for type 's32 [64]'\n  CPU: 1 PID: 51550 Comm: irq/35-rtw89_pc Tainted: G           OE\n  Call Trace:\n   <IRQ>\n   show_stack+0x52/0x58\n   dump_stack_lvl+0x4c/0x63\n   dump_stack+0x10/0x12\n   ubsan_epilogue+0x9/0x45\n   __ubsan_handle_out_of_bounds.cold+0x44/0x49\n   ? __alloc_skb+0x92/0x1d0\n   rtw89_phy_cfo_parse+0x44/0x7f [rtw89_core]\n   rtw89_core_rx+0x261/0x871 [rtw89_core]\n   ? __alloc_skb+0xee/0x1d0\n   rtw89_pci_napi_poll+0x3fa/0x4ea [rtw89_pci]\n   __napi_poll+0x33/0x1a0\n   net_rx_action+0x126/0x260\n   ? __queue_work+0x217/0x4c0\n   __do_softirq+0xd9/0x315\n   ? disable_irq_nosync+0x10/0x10\n   do_softirq.part.0+0x6d/0x90\n   </IRQ>\n   <TASK>\n   __local_bh_enable_ip+0x62/0x70\n   rtw89_pci_interrupt_threadfn+0x182/0x1a6 [rtw89_pci]\n   irq_thread_fn+0x28/0x60\n   irq_thread+0xc8/0x190\n   ? irq_thread_fn+0x60/0x60\n   kthread+0x16b/0x190\n   ? irq_thread_check_affinity+0xe0/0xe0\n   ? set_kthread_struct+0x50/0x50\n   ret_from_fork+0x22/0x30\n   </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "27eb24e3-d47f-4e1a-a3c5-b63c3a28403d",  "id": "CVE-2011-1172",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1172"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not place the expected '\\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10df14f6-b717-4e9c-93a6-35503838c978",  "id": "CVE-2020-28097",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28097"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a7c32ed1-7ad0-4719-a3c0-9fc4aa64fb13",  "id": "CVE-2014-3634",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3634"  },  "ratings": [    {      "score": 7.5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access.",  "affects": [    {      "ref": "ebb09eec-6bae-4a02-bcc2-06b4cb332890",      "versions": [        {          "component": "sysklogd",          "version": "0.01"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c183a5d-4e58-4884-a607-f456e78da4b5",  "id": "CVE-2010-0742",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0742"  },  "ratings": [    {      "score": 7.5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct double-free attacks, and possibly execute arbitrary code, via unspecified vectors.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6107660c-b6e3-4f7a-95e8-d8ec9537f778",  "id": "CVE-2022-24448",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24448"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    755,    908  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a89a31f-c6bc-4d28-b4a5-0b1501e6cf8f",  "id": "OESA-2024-2384",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "68b9643a-8b67-4a5e-9833-0032c7a4d5f9",  "id": "CVE-2023-53406",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b571af3e-9589-4281-8712-ef20d31f8e0e",  "id": "CVE-2022-48698",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix memory leak when using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  Fix this up by properly\ncalling dput().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be48eec5-d58f-4089-9da8-ca81174ef5a8",  "id": "CVE-2018-21008",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-21008"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 4.16.7. A use-after-free can be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7ae4e6ff-c432-4b41-ae48-d7fa4b3ead73",  "id": "CVE-2025-21672",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix merge preference rule failure condition\n\nsyzbot reported a lock held when returning to userspace[1].  This is\nbecause if argc is less than 0 and the function returns directly, the held\ninode lock is not released.\n\nFix this by store the error in ret and jump to done to clean up instead of\nreturning directly.\n\n[dh: Modified Lizhi Xu's original patch to make it honour the error code\nfrom afs_split_string()]\n\n[1]\nWARNING: lock held when returning to user space!\n6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted\n------------------------------------------------\nsyz-executor133/5823 is leaving the kernel with locks still held!\n1 lock held by syz-executor133/5823:\n #0: ffff888071cffc00 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline]\n #0: ffff888071cffc00 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: afs_proc_addr_prefs_write+0x2bb/0x14e0 fs/afs/addr_prefs.c:388",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b9f8c5da-d1d3-4346-97c5-474906324ae2",  "id": "OESA-2026-2357",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "29d07ede-2c53-49cd-b0ee-7dd1ebf3e79a",  "id": "CVE-2022-50419",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sysfs: Fix attempting to call device_add multiple times\n\ndevice_add shall not be called multiple times as stated in its\ndocumentation:\n\n 'Do not call this routine or device_register() more than once for\n any device structure'\n\nSyzkaller reports a bug as follows [1]:\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:33!\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN\n[...]\nCall Trace:\n <TASK>\n __list_add include/linux/list.h:69 [inline]\n list_add_tail include/linux/list.h:102 [inline]\n kobj_kset_join lib/kobject.c:164 [inline]\n kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214\n kobject_add_varg lib/kobject.c:358 [inline]\n kobject_add+0x150/0x1c0 lib/kobject.c:410\n device_add+0x368/0x1e90 drivers/base/core.c:3452\n hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53\n hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799\n hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110\n hci_event_func net/bluetooth/hci_event.c:7440 [inline]\n hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495\n hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007\n process_one_work+0x991/0x1610 kernel/workqueue.c:2289\n worker_thread+0x665/0x1080 kernel/workqueue.c:2436\n kthread+0x2e4/0x3a0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "595ef2ba-57d0-40da-9cac-fac181c11db9",  "id": "CVE-2021-47589",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47589"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigbvf: fix double free in `igbvf_probe`\n\nIn `igbvf_probe`, if register_netdev() fails, the program will go to\nlabel err_hw_init, and then to label err_ioremap. In free_netdev() which\nis just below label err_ioremap, there is `list_for_each_entry_safe` and\n`netif_napi_del` which aims to delete all entries in `dev->napi_list`.\nThe program has added an entry `adapter->rx_ring->napi` which is added by\n`netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has\nbeen freed below label err_hw_init. So this a UAF.\n\nIn terms of how to patch the problem, we can refer to igbvf_remove() and\ndelete the entry before `adapter->rx_ring`.\n\nThe KASAN logs are as follows:\n\n[   35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450\n[   35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366\n[   35.128360]\n[   35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14\n[   35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\n[   35.131749] Call Trace:\n[   35.132199]  dump_stack_lvl+0x59/0x7b\n[   35.132865]  print_address_description+0x7c/0x3b0\n[   35.133707]  ? free_netdev+0x1fd/0x450\n[   35.134378]  __kasan_report+0x160/0x1c0\n[   35.135063]  ? free_netdev+0x1fd/0x450\n[   35.135738]  kasan_report+0x4b/0x70\n[   35.136367]  free_netdev+0x1fd/0x450\n[   35.137006]  igbvf_probe+0x121d/0x1a10 [igbvf]\n[   35.137808]  ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf]\n[   35.138751]  local_pci_probe+0x13c/0x1f0\n[   35.139461]  pci_device_probe+0x37e/0x6c0\n[   35.165526]\n[   35.165806] Allocated by task 366:\n[   35.166414]  ____kasan_kmalloc+0xc4/0xf0\n[   35.167117]  foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf]\n[   35.168078]  igbvf_probe+0x9c5/0x1a10 [igbvf]\n[   35.168866]  local_pci_probe+0x13c/0x1f0\n[   35.169565]  pci_device_probe+0x37e/0x6c0\n[   35.179713]\n[   35.179993] Freed by task 366:\n[   35.180539]  kasan_set_track+0x4c/0x80\n[   35.181211]  kasan_set_free_info+0x1f/0x40\n[   35.181942]  ____kasan_slab_free+0x103/0x140\n[   35.182703]  kfree+0xe3/0x250\n[   35.183239]  igbvf_probe+0x1173/0x1a10 [igbvf]\n[   35.184040]  local_pci_probe+0x13c/0x1f0",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4e60d792-899e-42d4-8098-7f4f98df1392",  "id": "CVE-2024-26845",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Add TMF to tmr_list handling\n\nAn abort that is responded to by iSCSI itself is added to tmr_list but does\nnot go to target core. A LUN_RESET that goes through tmr_list takes a\nrefcounter on the abort and waits for completion. However, the abort will\nbe never complete because it was not started in target core.\n\n Unable to locate ITT: 0x05000000 on CID: 0\n Unable to locate RefTaskTag: 0x05000000 on CID: 0.\n wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop\n wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop\n...\n INFO: task kworker/0:2:49 blocked for more than 491 seconds.\n task:kworker/0:2     state:D stack:    0 pid:   49 ppid:     2 flags:0x00000800\n Workqueue: events target_tmr_work [target_core_mod]\nCall Trace:\n __switch_to+0x2c4/0x470\n _schedule+0x314/0x1730\n schedule+0x64/0x130\n schedule_timeout+0x168/0x430\n wait_for_completion+0x140/0x270\n target_put_cmd_and_wait+0x64/0xb0 [target_core_mod]\n core_tmr_lun_reset+0x30/0xa0 [target_core_mod]\n target_tmr_work+0xc8/0x1b0 [target_core_mod]\n process_one_work+0x2d4/0x5d0\n worker_thread+0x78/0x6c0\n\nTo fix this, only add abort to tmr_list if it will be handled by target\ncore.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0e0d099b-cdf1-4ce7-977b-2229bcb37dac",  "id": "CVE-2017-7346",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7346"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.7 does not validate certain levels data, which allows local users to cause a denial of service (system hang) via a crafted ioctl call for a /dev/dri/renderD* device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c49d064d-81ff-4202-8d19-f8134d15c15f",  "id": "CVE-2022-49113",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/secvar: fix refcount leak in format_show()\n\nRefcount leak will happen when format_show returns failure in multiple\ncases. Unified management of of_node_put can fix this problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e3221850-1c13-49da-b779-4adebd2f23a8",  "id": "CVE-2019-3901",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3901"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls. This issue affects kernel versions before 4.8.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9aec1763-8972-44d9-acd0-483fb430b4e5",  "id": "CVE-2022-3110",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3110"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.16-rc6. _rtw_init_xmit_priv in drivers/staging/r8188eu/core/rtw_xmit.c lacks check of the return value of rtw_alloc_hwxmits() and will cause the null pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e8b97a7b-2060-48c5-a756-4a2510abdd56",  "id": "CVE-2020-10781",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10781"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    732  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user that triggers the creation of that ZRAM device. With this vulnerability, continually reading the device may consume a large amount of system memory and cause the Out-of-Memory (OOM) killer to activate and terminate random userspace processes, possibly making the system inoperable.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "846fce7b-e643-41e6-adeb-bb9b9919a0bc",  "id": "CVE-2022-49936",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Prevent nested device-reset calls\n\nAutomatic kernel fuzzing revealed a recursive locking violation in\nusb-storage:\n\n============================================\nWARNING: possible recursive locking detected\n5.18.0 #3 Not tainted\n--------------------------------------------\nkworker/1:3/1205 is trying to acquire lock:\nffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at:\nusb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230\n\nbut task is already holding lock:\nffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at:\nusb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230\n\n...\n\nstack backtrace:\nCPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.13.0-1ubuntu1.1 04/01/2014\nWorkqueue: usb_hub_wq hub_event\nCall Trace:\n<TASK>\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\nprint_deadlock_bug kernel/locking/lockdep.c:2988 [inline]\ncheck_deadlock kernel/locking/lockdep.c:3031 [inline]\nvalidate_chain kernel/locking/lockdep.c:3816 [inline]\n__lock_acquire.cold+0x152/0x3ca kernel/locking/lockdep.c:5053\nlock_acquire kernel/locking/lockdep.c:5665 [inline]\nlock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5630\n__mutex_lock_common kernel/locking/mutex.c:603 [inline]\n__mutex_lock+0x14f/0x1610 kernel/locking/mutex.c:747\nusb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230\nusb_reset_device+0x37d/0x9a0 drivers/usb/core/hub.c:6109\nr871xu_dev_remove+0x21a/0x270 drivers/staging/rtl8712/usb_intf.c:622\nusb_unbind_interface+0x1bd/0x890 drivers/usb/core/driver.c:458\ndevice_remove drivers/base/dd.c:545 [inline]\ndevice_remove+0x11f/0x170 drivers/base/dd.c:537\n__device_release_driver drivers/base/dd.c:1222 [inline]\ndevice_release_driver_internal+0x1a7/0x2f0 drivers/base/dd.c:1248\nusb_driver_release_interface+0x102/0x180 drivers/usb/core/driver.c:627\nusb_forced_unbind_intf+0x4d/0xa0 drivers/usb/core/driver.c:1118\nusb_reset_device+0x39b/0x9a0 drivers/usb/core/hub.c:6114\n\nThis turned out not to be an error in usb-storage but rather a nested\ndevice reset attempt.  That is, as the rtl8712 driver was being\nunbound from a composite device in preparation for an unrelated USB\nreset (that driver does not have pre_reset or post_reset callbacks),\nits ->remove routine called usb_reset_device() -- thus nesting one\nreset call within another.\n\nPerforming a reset as part of disconnect processing is a questionable\npractice at best.  However, the bug report points out that the USB\ncore does not have any protection against nested resets.  Adding a\nreset_in_progress flag and testing it will prevent such errors in the\nfuture.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "005306da-2756-4d22-af39-c5fdfb3b472c",  "id": "CVE-2019-15090",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15090"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of functions, there is an out-of-bounds read.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b20b786f-5fa8-41e4-89b2-5d5298c39f4f",  "id": "CVE-2015-2041",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2041"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    17  ],  "analysis": {    "state": "in_triage"  },  "description": "net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f3b0dee3-5927-4445-b9f3-4f4ee10bbfc3",  "id": "CVE-2018-1130",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1130"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allows a local user to cause a denial of service by a number of certain crafted system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b2851c0-90af-4cac-9956-b43b3f72740d",  "id": "CVE-2011-1076",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1076"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "net/dns_resolver/dns_key.c in the Linux kernel before 2.6.38 allows remote DNS servers to cause a denial of service (NULL pointer dereference and OOPS) by not providing a valid response to a DNS query, as demonstrated by an erroneous grand.centrall.org query, which triggers improper handling of error data within a DNS resolver key.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c918b4aa-a102-4a92-b5bc-8b4c49eb48a6",  "id": "CVE-2023-53616",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount\n\nsyzbot found an invalid-free in diUnmount:\n\nBUG: KASAN: double-free in slab_free mm/slub.c:3661 [inline]\nBUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3674\nFree of addr ffff88806f410000 by task syz-executor131/3632\n\n CPU: 0 PID: 3632 Comm: syz-executor131 Not tainted 6.1.0-rc7-syzkaller-00012-gca57f02295f1 #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\n Call Trace:\n  <TASK>\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106\n  print_address_description+0x74/0x340 mm/kasan/report.c:284\n  print_report+0x107/0x1f0 mm/kasan/report.c:395\n  kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:460\n  ____kasan_slab_free+0xfb/0x120\n  kasan_slab_free include/linux/kasan.h:177 [inline]\n  slab_free_hook mm/slub.c:1724 [inline]\n  slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1750\n  slab_free mm/slub.c:3661 [inline]\n  __kmem_cache_free+0x71/0x110 mm/slub.c:3674\n  diUnmount+0xef/0x100 fs/jfs/jfs_imap.c:195\n  jfs_umount+0x108/0x370 fs/jfs/jfs_umount.c:63\n  jfs_put_super+0x86/0x190 fs/jfs/super.c:194\n  generic_shutdown_super+0x130/0x310 fs/super.c:492\n  kill_block_super+0x79/0xd0 fs/super.c:1428\n  deactivate_locked_super+0xa7/0xf0 fs/super.c:332\n  cleanup_mnt+0x494/0x520 fs/namespace.c:1186\n  task_work_run+0x243/0x300 kernel/task_work.c:179\n  exit_task_work include/linux/task_work.h:38 [inline]\n  do_exit+0x664/0x2070 kernel/exit.c:820\n  do_group_exit+0x1fd/0x2b0 kernel/exit.c:950\n  __do_sys_exit_group kernel/exit.c:961 [inline]\n  __se_sys_exit_group kernel/exit.c:959 [inline]\n  __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:959\n  do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[...]\n\nJFS_IP(ipimap)->i_imap is not setting to NULL after free in diUnmount.\nIf jfs_remount() free JFS_IP(ipimap)->i_imap but then failed at diMount().\nJFS_IP(ipimap)->i_imap will be freed once again.\nFix this problem by setting JFS_IP(ipimap)->i_imap to NULL after free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "85db96ba-ffd1-4ad4-a201-6fb8c598a50e",  "id": "AZL-8963",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "08edb3d6-d640-4f0b-b64d-99b9a4b2148f",  "id": "CVE-2016-9588",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9588"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    388  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP and #OF exceptions, which allows guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9ed2a609-ccd0-461d-a909-abb5489a30fd",  "id": "openSUSE-SU-2026:10231-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "637bda96-a29e-48ec-aa1d-889f1edcdb29",  "id": "CVE-2024-53180",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Add sanity NULL check for the default mmap fault handler\n\nA driver might allow the mmap access before initializing its\nruntime->dma_area properly.  Add a proper NULL check before passing to\nvirt_to_page() for avoiding a panic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c1b64c7a-d819-422a-97c8-0f2d00ee157b",  "id": "ALSA-2026:22312",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae4ee7bd-2bad-4c3f-a5f7-887bf36bb354",  "id": "CVE-2022-48950",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix perf_pending_task() UaF\n\nPer syzbot it is possible for perf_pending_task() to run after the\nevent is free()'d. There are two related but distinct cases:\n\n - the task_work was already queued before destroying the event;\n - destroying the event itself queues the task_work.\n\nThe first cannot be solved using task_work_cancel() since\nperf_release() itself might be called from a task_work (____fput),\nwhich means the current->task_works list is already empty and\ntask_work_cancel() won't be able to find the perf_pending_task()\nentry.\n\nThe simplest alternative is extending the perf_event lifetime to cover\nthe task_work.\n\nThe second is just silly, queueing a task_work while you know the\nevent is going away makes no sense and is easily avoided by\nre-arranging how the event is marked STATE_DEAD and ensuring it goes\nthrough STATE_OFF on the way down.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2bc4ae4-5056-4112-88d5-53caceee33f7",  "id": "CVE-2022-49429",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hfi1: Prevent panic when SDMA is disabled\n\nIf the hfi1 module is loaded with HFI1_CAP_SDMA off, a call to\nhfi1_write_iter() will dereference a NULL pointer and panic. A typical\nstack frame is:\n\n  sdma_select_user_engine [hfi1]\n  hfi1_user_sdma_process_request [hfi1]\n  hfi1_write_iter [hfi1]\n  do_iter_readv_writev\n  do_iter_write\n  vfs_writev\n  do_writev\n  do_syscall_64\n\nThe fix is to test for SDMA in hfi1_write_iter() and fail the I/O with\nEINVAL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "24cf4bed-3a70-4897-9865-341f226bedaf",  "id": "CVE-2019-19036",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19036"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node) can be zero.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9ab2ed48-f794-48f2-9666-8eb29b9b4cfb",  "id": "CVE-2024-26817",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\namdkfd: use calloc instead of kzalloc to avoid integer overflow\n\nThis uses calloc instead of doing the multiplication which might\noverflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3d2b577-e6e4-4c1b-9598-d5a88c1340b6",  "id": "CVE-2016-7042",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7042"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection (gcc) stack protector is enabled, uses an incorrect buffer size for certain timeout data, which allows local users to cause a denial of service (stack memory corruption and panic) by reading the /proc/keys file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8abc0781-08eb-42b8-bdab-df3525d444c6",  "id": "SUSE-SU-2023:2973-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f12dcedb-29eb-417e-ad71-d5a2ac13f5c2",  "id": "CVE-2024-50211",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: refactor inode_bmap() to handle error\n\nRefactor inode_bmap() to handle error since udf_next_aext() can return\nerror now. On situations like ftruncate, udf_extend_file() can now\ndetect errors and bail out early without resorting to checking for\nparticular offsets and assuming internal behavior of these functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be774f94-4b5e-43d4-9895-ff450e61020c",  "id": "CVE-2010-3081",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3081"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a \"stack pointer underflow\" issue, as exploited in the wild in September 2010.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:15024'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:137629/Linux-2.6.x-Redhat-x86_64-compat-Local-Root.html'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'PSS:109044/Linux-64-Bit-Stack-Pointer-Underflow.html'"    }  ]},{  "bom-ref": "339a5310-f5aa-4235-9c90-5a02d0d0adf9",  "id": "CVE-2022-29968",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29968"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c7b2d105-6d4e-41ca-8850-55a0c3e00cf0",  "id": "CVE-2012-6638",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6638"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a different vulnerability than CVE-2012-2663.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "12e6534a-b60c-4cbe-a107-a6c90ef770e4",  "id": "CVE-2013-3225",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3225"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fd2cfa92-8970-4fce-b06c-095d7fb8e834",  "id": "SUSE-SU-2018:0925-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18013a69-f79f-40b4-ac0d-c4f256854f49",  "id": "CLSA-2021-1614885634",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "79671853-f365-4643-ac5e-17e7c0e0b29f",  "id": "CVE-2024-46771",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: Remove proc entry when dev is unregistered.\n\nsyzkaller reported a warning in bcm_connect() below. [0]\n\nThe repro calls connect() to vxcan1, removes vxcan1, and calls\nconnect() with ifindex == 0.\n\nCalling connect() for a BCM socket allocates a proc entry.\nThen, bcm_sk(sk)->bound is set to 1 to prevent further connect().\n\nHowever, removing the bound device resets bcm_sk(sk)->bound to 0\nin bcm_notify().\n\nThe 2nd connect() tries to allocate a proc entry with the same\nname and sets NULL to bcm_sk(sk)->bcm_proc_read, leaking the\noriginal proc entry.\n\nSince the proc entry is available only for connect()ed sockets,\nlet's clean up the entry when the bound netdev is unregistered.\n\n[0]:\nproc_dir_entry 'can-bcm/2456' already registered\nWARNING: CPU: 1 PID: 394 at fs/proc/generic.c:376 proc_register+0x645/0x8f0 fs/proc/generic.c:375\nModules linked in:\nCPU: 1 PID: 394 Comm: syz-executor403 Not tainted 6.10.0-rc7-g852e42cc2dd4\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nRIP: 0010:proc_register+0x645/0x8f0 fs/proc/generic.c:375\nCode: 00 00 00 00 00 48 85 ed 0f 85 97 02 00 00 4d 85 f6 0f 85 9f 02 00 00 48 c7 c7 9b cb cf 87 48 89 de 4c 89 fa e8 1c 6f eb fe 90 <0f> 0b 90 90 48 c7 c7 98 37 99 89 e8 cb 7e 22 05 bb 00 00 00 10 48\nRSP: 0018:ffa0000000cd7c30 EFLAGS: 00010246\nRAX: 9e129be1950f0200 RBX: ff1100011b51582c RCX: ff1100011857cd80\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002\nRBP: 0000000000000000 R08: ffd400000000000f R09: ff1100013e78cac0\nR10: ffac800000cd7980 R11: ff1100013e12b1f0 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: ff1100011a99a2ec\nFS:  00007fbd7086f740(0000) GS:ff1100013fd00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000200071c0 CR3: 0000000118556004 CR4: 0000000000771ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n <TASK>\n proc_create_net_single+0x144/0x210 fs/proc/proc_net.c:220\n bcm_connect+0x472/0x840 net/can/bcm.c:1673\n __sys_connect_file net/socket.c:2049 [inline]\n __sys_connect+0x5d2/0x690 net/socket.c:2066\n __do_sys_connect net/socket.c:2076 [inline]\n __se_sys_connect net/socket.c:2073 [inline]\n __x64_sys_connect+0x8f/0x100 net/socket.c:2073\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xd9/0x1c0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\nRIP: 0033:0x7fbd708b0e5d\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48\nRSP: 002b:00007fff8cd33f08 EFLAGS: 00000246 ORIG_RAX: 000000000000002a\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fbd708b0e5d\nRDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003\nRBP: 0000000000000000 R08: 0000000000000040 R09: 0000000000000040\nR10: 0000000000000040 R11: 0000000000000246 R12: 00007fff8cd34098\nR13: 0000000000401280 R14: 0000000000406de8 R15: 00007fbd70ab9000\n </TASK>\nremove_proc_entry: removing non-empty directory 'net/can-bcm', leaking at least '2456'",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "446a15ac-3ef8-4757-8caa-7f677e545b74",  "id": "CVE-2013-0313",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0313"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The evm_update_evmxattr function in security/integrity/evm/evm_crypto.c in the Linux kernel before 3.7.5, when the Extended Verification Module (EVM) is enabled, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an attempted removexattr operation on an inode of a sockfs filesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6bb05a5f-14ce-49e0-9065-d54052224241",  "id": "RHSA-2026:38804",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc2d37a1-f739-4c94-8b83-4ac475841b9d",  "id": "MGASA-2024-0129",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "39bc5391-c95a-437b-9a22-92be92fb019a",  "id": "CVE-2021-47636",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47636"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()\n\nFunction ubifs_wbuf_write_nolock() may access buf out of bounds in\nfollowing process:\n\nubifs_wbuf_write_nolock():\n  aligned_len = ALIGN(len, 8);   // Assume len = 4089, aligned_len = 4096\n  if (aligned_len <= wbuf->avail) ... // Not satisfy\n  if (wbuf->used) {\n    ubifs_leb_write()  // Fill some data in avail wbuf\n    len -= wbuf->avail;   // len is still not 8-bytes aligned\n    aligned_len -= wbuf->avail;\n  }\n  n = aligned_len >> c->max_write_shift;\n  if (n) {\n    n <<= c->max_write_shift;\n    err = ubifs_leb_write(c, wbuf->lnum, buf + written,\n                          wbuf->offs, n);\n    // n > len, read out of bounds less than 8(n-len) bytes\n  }\n\n, which can be catched by KASAN:\n  =========================================================\n  BUG: KASAN: slab-out-of-bounds in ecc_sw_hamming_calculate+0x1dc/0x7d0\n  Read of size 4 at addr ffff888105594ff8 by task kworker/u8:4/128\n  Workqueue: writeback wb_workfn (flush-ubifs_0_0)\n  Call Trace:\n    kasan_report.cold+0x81/0x165\n    nand_write_page_swecc+0xa9/0x160\n    ubifs_leb_write+0xf2/0x1b0 [ubifs]\n    ubifs_wbuf_write_nolock+0x421/0x12c0 [ubifs]\n    write_head+0xdc/0x1c0 [ubifs]\n    ubifs_jnl_write_inode+0x627/0x960 [ubifs]\n    wb_workfn+0x8af/0xb80\n\nFunction ubifs_wbuf_write_nolock() accepts that parameter 'len' is not 8\nbytes aligned, the 'len' represents the true length of buf (which is\nallocated in 'ubifs_jnl_xxx', eg. ubifs_jnl_write_inode), so\nubifs_wbuf_write_nolock() must handle the length read from 'buf' carefully\nto write leb safely.\n\nFetch a reproducer in [Link].",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e7c8d68-a6a4-439a-9c45-ebb00a26e11a",  "id": "CVE-2024-49944",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start\n\nIn sctp_listen_start() invoked by sctp_inet_listen(), it should set the\nsk_state back to CLOSED if sctp_autobind() fails due to whatever reason.\n\nOtherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse\nis already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will\nbe dereferenced as sk_state is LISTENING, which causes a crash as bind_hash\nis NULL.\n\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617\n  Call Trace:\n   <TASK>\n   __sys_listen_socket net/socket.c:1883 [inline]\n   __sys_listen+0x1b7/0x230 net/socket.c:1894\n   __do_sys_listen net/socket.c:1902 [inline]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be807b49-c3cf-41f1-8508-89846e7c2814",  "id": "CVE-2017-12192",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12192"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated, which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4773c1aa-ff0c-43f7-88a1-a47a608bc60f",  "id": "RLSA-2026:26275",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4ca4d447-8668-45ec-a17f-66169176b9ee",  "id": "RHSA-2026:43513",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "59e10dcd-997d-4647-b70b-2156150cd3b2",  "id": "CVE-2025-37879",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p/net: fix improper handling of bogus negative read/write replies\n\nIn p9_client_write() and p9_client_read_once(), if the server\nincorrectly replies with success but a negative write/read count then we\nwould consider written (negative) <= rsize (positive) because both\nvariables were signed.\n\nMake variables unsigned to avoid this problem.\n\nThe reproducer linked below now fails with the following error instead\nof a null pointer deref:\n9pnet: bogus RWRITE count (4294967295 > 3)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dff561ef-a314-4a88-af99-fe87bac2f43b",  "id": "CVE-2024-36901",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent NULL dereference in ip6_output()\n\nAccording to syzbot, there is a chance that ip6_dst_idev()\nreturns NULL in ip6_output(). Most places in IPv6 stack\ndeal with a NULL idev just fine, but not here.\n\nsyzbot reported:\n\ngeneral protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]\nCPU: 0 PID: 9775 Comm: syz-executor.4 Not tainted 6.9.0-rc5-syzkaller-00157-g6a30653b604a #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:ip6_output+0x231/0x3f0 net/ipv6/ip6_output.c:237\nCode: 3c 1e 00 49 89 df 74 08 4c 89 ef e8 19 58 db f7 48 8b 44 24 20 49 89 45 00 49 89 c5 48 8d 9d e0 05 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 4c 8b 74 24 28 0f 85 61 01 00 00 8b 1b 31 ff\nRSP: 0018:ffffc9000927f0d8 EFLAGS: 00010202\nRAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000040000\nRDX: ffffc900131f9000 RSI: 0000000000004f47 RDI: 0000000000004f48\nRBP: 0000000000000000 R08: ffffffff8a1f0b9a R09: 1ffffffff1f51fad\nR10: dffffc0000000000 R11: fffffbfff1f51fae R12: ffff8880293ec8c0\nR13: ffff88805d7fc000 R14: 1ffff1100527d91a R15: dffffc0000000000\nFS:  00007f135c6856c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000080 CR3: 0000000064096000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_xmit+0xefe/0x17f0 net/ipv6/ip6_output.c:358\n  sctp_v6_xmit+0x9f2/0x13f0 net/sctp/ipv6.c:248\n  sctp_packet_transmit+0x26ad/0x2ca0 net/sctp/output.c:653\n  sctp_packet_singleton+0x22c/0x320 net/sctp/outqueue.c:783\n  sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline]\n  sctp_outq_flush+0x6d5/0x3e20 net/sctp/outqueue.c:1212\n  sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]\n  sctp_do_sm+0x59cc/0x60c0 net/sctp/sm_sideeffect.c:1169\n  sctp_primitive_ASSOCIATE+0x95/0xc0 net/sctp/primitive.c:73\n  __sctp_connect+0x9cd/0xe30 net/sctp/socket.c:1234\n  sctp_connect net/sctp/socket.c:4819 [inline]\n  sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834\n  __sys_connect_file net/socket.c:2048 [inline]\n  __sys_connect+0x2df/0x310 net/socket.c:2065\n  __do_sys_connect net/socket.c:2075 [inline]\n  __se_sys_connect net/socket.c:2072 [inline]\n  __x64_sys_connect+0x7a/0x90 net/socket.c:2072\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5511ed5-2929-477f-bcb0-9d7296bdd1fc",  "id": "CVE-2021-47477",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47477"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: dt9812: fix DMA buffers on stack\n\nUSB transfer buffers are typically mapped for DMA and must not be\nallocated on the stack or transfers will fail.\n\nAllocate proper transfer buffers in the various command helpers and\nreturn an error on short transfers instead of acting on random stack\ndata.\n\nNote that this also fixes a stack info leak on systems where DMA is not\nused as 32 bytes are always sent to the device regardless of how short\nthe command is.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "215cc3e6-03ae-4087-9607-f4761b01583b",  "id": "CVE-2024-50112",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/lam: Disable ADDRESS_MASKING in most cases\n\nLinear Address Masking (LAM) has a weakness related to transient\nexecution as described in the SLAM paper[1]. Unless Linear Address\nSpace Separation (LASS) is enabled this weakness may be exploitable.\n\nUntil kernel adds support for LASS[2], only allow LAM for COMPILE_TEST,\nor when speculation mitigations have been disabled at compile time,\notherwise keep LAM disabled.\n\nThere are no processors in market that support LAM yet, so currently\nnobody is affected by this issue.\n\n[1] SLAM: https://download.vusec.net/papers/slam_sp24.pdf\n[2] LASS: https://lore.kernel.org/lkml/20230609183632.48706-1-alexander.shishkin@linux.intel.com/\n\n[ dhansen: update SPECULATION_MITIGATIONS -> CPU_MITIGATIONS ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f524c7da-04d3-4367-a3f0-7a7dfd7d107c",  "id": "AZL-8962",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6cf5c224-8bc1-457f-b7ac-577cdc94f243",  "id": "CVE-2021-4002",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4002"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    401,    459  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6c5c8858-1254-45bf-9c0a-a72da87fc6ec",  "id": "CVE-2024-54458",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: bsg: Set bsg_queue to NULL after removal\n\nCurrently, this does not cause any issues, but I believe it is necessary to\nset bsg_queue to NULL after removing it to prevent potential use-after-free\n(UAF) access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d0c8e1db-2e58-4e18-9e6b-550193bf45a3",  "id": "CVE-2024-42079",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix NULL pointer dereference in gfs2_log_flush\n\nIn gfs2_jindex_free(), set sdp->sd_jdesc to NULL under the log flush\nlock to provide exclusion against gfs2_log_flush().\n\nIn gfs2_log_flush(), check if sdp->sd_jdesc is non-NULL before\ndereferencing it.  Otherwise, we could run into a NULL pointer\ndereference when outstanding glock work races with an unmount\n(glock_work_func -> run_queue -> do_xmote -> inode_go_sync ->\ngfs2_log_flush).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b417a663-1286-46bc-b51f-794ed20e0850",  "id": "CVE-2022-42703",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42703"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "282d6a31-976f-4b42-b48f-3553875f4f38",  "id": "CVE-2024-46716",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor\n\nRemove list_del call in msgdma_chan_desc_cleanup, this should be the role\nof msgdma_free_descriptor. In consequence replace list_add_tail with\nlist_move_tail in msgdma_free_descriptor.\n\nThis fixes the path:\n   msgdma_free_chan_resources -> msgdma_free_descriptors ->\n   msgdma_free_desc_list -> msgdma_free_descriptor\n\nwhich does not correctly free the descriptors as first nodes were not\nremoved from the list.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2cab0b23-471d-49a2-a577-7bee6347494d",  "id": "CLSA-2023-1700593692",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "11598855-885a-4922-80d2-921f2733b798",  "id": "CVE-2024-35943",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: ti: Add a null pointer check to the omap_prm_domain_init\n\ndevm_kasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure. Ensure the allocation was successful\nby checking the pointer validity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "22fd6135-8731-45a1-966b-4f4b418aafad",  "id": "CVE-2022-1199",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1199"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff5415b8-7453-4397-99da-947f9415dd1a",  "id": "SUSE-SU-2023:1930-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e5f0e0d8-3316-4d73-9466-abfb4cb59d2f",  "id": "CVE-2015-7550",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7550"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f5cd0dc6-0071-45ea-8e54-2ad3cf41be83",  "id": "CVE-2015-8952",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8952"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    19  ],  "analysis": {    "state": "in_triage"  },  "description": "The mbcache feature in the ext2 and ext4 filesystem implementations in the Linux kernel before 4.6 mishandles xattr block caching, which allows local users to cause a denial of service (soft lockup) via filesystem operations in environments that use many attributes, as demonstrated by Ceph and Samba.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b3c50c8a-b30f-452c-8ee1-f852e552b264",  "id": "MGASA-2016-0338",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a02cc508-39d9-431a-beb8-cfd52bee4fd2",  "id": "CVE-2011-2484",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2484"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The add_del_listener function in kernel/taskstats.c in the Linux kernel 2.6.39.1 and earlier does not prevent multiple registrations of exit handlers, which allows local users to cause a denial of service (memory and CPU consumption), and bypass the OOM Killer, via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8df86dc-b477-4fdb-81c9-c33da432d8ec",  "id": "CVE-2011-1170",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1170"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a4e8c58-e216-4f48-82aa-e9eaba7dcca1",  "id": "CVE-2019-20908",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20908"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "253f3da0-ccc2-4f7d-978e-93c2041f66ca",  "id": "CVE-2024-26949",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/pm: Fix NULL pointer dereference when get power limit\n\nBecause powerplay_table initialization is skipped under\nsriov case, We check and set default lower and upper OD\nvalue if powerplay_table is NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8af98ff7-9324-4b19-8a14-7d75de88a3f6",  "id": "CVE-2020-27777",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27777"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    862  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "79542959-8003-4747-82b4-072d0b0a790c",  "id": "CVE-2013-7263",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7263"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0cd9d20d-4515-4033-8c3c-fb5acb606023",  "id": "CVE-2013-1959",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1959"  },  "ratings": [    {      "score": 3.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uid_map and gid_map files, which allows local users to gain privileges by opening a file within an unprivileged process and then modifying the file within a privileged process.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:25450'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:121561/Linux-Kernel-open-time-Capability-file_ns_capable-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "7e8d866c-c4bc-45f5-a222-83cfe42e324b",  "id": "MGASA-2021-0429",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ee66568-9753-4900-a185-226ddcd7ba17",  "id": "CVE-2024-49924",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: pxafb: Fix possible use after free in pxafb_task()\n\nIn the pxafb_probe function, it calls the pxafb_init_fbinfo function,\nafter which &fbi->task is associated with pxafb_task. Moreover,\nwithin this pxafb_init_fbinfo function, the pxafb_blank function\nwithin the &pxafb_ops struct is capable of scheduling work.\n\nIf we remove the module which will call pxafb_remove to make cleanup,\nit will call unregister_framebuffer function which can call\ndo_unregister_framebuffer to free fbi->fb through\nput_fb_info(fb_info), while the work mentioned above will be used.\nThe sequence of operations that may lead to a UAF bug is as follows:\n\nCPU0                                                CPU1\n\n                                   | pxafb_task\npxafb_remove                       |\nunregister_framebuffer(info)       |\ndo_unregister_framebuffer(fb_info) |\nput_fb_info(fb_info)               |\n// free fbi->fb                    | set_ctrlr_state(fbi, state)\n                                   | __pxafb_lcd_power(fbi, 0)\n                                   | fbi->lcd_power(on, &fbi->fb.var)\n                                   | //use fbi->fb\n\nFix it by ensuring that the work is canceled before proceeding\nwith the cleanup in pxafb_remove.\n\nNote that only root user can remove the driver at runtime.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31319de0-a0db-4ea5-90bf-7e7b3656e094",  "id": "CVE-2021-3679",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3679"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400,    835  ],  "analysis": {    "state": "in_triage"  },  "description": "A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "957d7a77-5566-43f5-88f7-319239831d2d",  "id": "CVE-2010-1162",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1162"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The release_one_tty function in drivers/char/tty_io.c in the Linux kernel before 2.6.34-rc4 omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1ce3ce85-7afd-454d-84ac-9a57c6b17ba9",  "id": "CVE-2024-42078",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    665  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: initialise nfsd_info.mutex early.\n\nnfsd_info.mutex can be dereferenced by svc_pool_stats_start()\nimmediately after the new netns is created.  Currently this can\ntrigger an oops.\n\nMove the initialisation earlier before it can possibly be dereferenced.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d8588d4-7b93-4577-bd2d-75d4f0a0f21a",  "id": "SUSE-SU-2026:3028-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aec15526-df02-4a08-8d30-fae5f457b9d9",  "id": "MGASA-2014-0351",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f7a6fcbd-eeed-4bb4-a7d8-362cbbb502e6",  "id": "CVE-2021-47173",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47173"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc/uss720: fix memory leak in uss720_probe\n\nuss720_probe forgets to decrease the refcount of usbdev in uss720_probe.\nFix this by decreasing the refcount of usbdev by usb_put_dev.\n\nBUG: memory leak\nunreferenced object 0xffff888101113800 (size 2048):\n  comm \"kworker/0:1\", pid 7, jiffies 4294956777 (age 28.870s)\n  hex dump (first 32 bytes):\n    ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00  ....1...........\n    00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00  ................\n  backtrace:\n    [<ffffffff82b8e822>] kmalloc include/linux/slab.h:554 [inline]\n    [<ffffffff82b8e822>] kzalloc include/linux/slab.h:684 [inline]\n    [<ffffffff82b8e822>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582\n    [<ffffffff82b98441>] hub_port_connect drivers/usb/core/hub.c:5129 [inline]\n    [<ffffffff82b98441>] hub_port_connect_change drivers/usb/core/hub.c:5363 [inline]\n    [<ffffffff82b98441>] port_event drivers/usb/core/hub.c:5509 [inline]\n    [<ffffffff82b98441>] hub_event+0x1171/0x20c0 drivers/usb/core/hub.c:5591\n    [<ffffffff81259229>] process_one_work+0x2c9/0x600 kernel/workqueue.c:2275\n    [<ffffffff81259b19>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2421\n    [<ffffffff81261228>] kthread+0x178/0x1b0 kernel/kthread.c:292\n    [<ffffffff8100227f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "834f860f-f0bf-4825-96c5-bd1702170722",  "id": "CVE-2018-10124",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10124"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be2dd1e2-c882-4484-ad39-d2e51127dd29",  "id": "RHSA-2026:1349",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6682b4cd-197e-46ec-831a-b7a74798f61d",  "id": "CVE-2023-52751",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in smb2_query_info_compound()\n\nThe following UAF was triggered when running fstests generic/072 with\nKASAN enabled against Windows Server 2022 and mount options\n'multichannel,max_channels=2,vers=3.1.1,mfsymlinks,noperm'\n\n  BUG: KASAN: slab-use-after-free in smb2_query_info_compound+0x423/0x6d0 [cifs]\n  Read of size 8 at addr ffff888014941048 by task xfs_io/27534\n\n  CPU: 0 PID: 27534 Comm: xfs_io Not tainted 6.6.0-rc7 #1\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n  rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\n  Call Trace:\n   dump_stack_lvl+0x4a/0x80\n   print_report+0xcf/0x650\n   ? srso_alias_return_thunk+0x5/0x7f\n   ? srso_alias_return_thunk+0x5/0x7f\n   ? __phys_addr+0x46/0x90\n   kasan_report+0xda/0x110\n   ? smb2_query_info_compound+0x423/0x6d0 [cifs]\n   ? smb2_query_info_compound+0x423/0x6d0 [cifs]\n   smb2_query_info_compound+0x423/0x6d0 [cifs]\n   ? __pfx_smb2_query_info_compound+0x10/0x10 [cifs]\n   ? srso_alias_return_thunk+0x5/0x7f\n   ? __stack_depot_save+0x39/0x480\n   ? kasan_save_stack+0x33/0x60\n   ? kasan_set_track+0x25/0x30\n   ? ____kasan_slab_free+0x126/0x170\n   smb2_queryfs+0xc2/0x2c0 [cifs]\n   ? __pfx_smb2_queryfs+0x10/0x10 [cifs]\n   ? __pfx___lock_acquire+0x10/0x10\n   smb311_queryfs+0x210/0x220 [cifs]\n   ? __pfx_smb311_queryfs+0x10/0x10 [cifs]\n   ? srso_alias_return_thunk+0x5/0x7f\n   ? __lock_acquire+0x480/0x26c0\n   ? lock_release+0x1ed/0x640\n   ? srso_alias_return_thunk+0x5/0x7f\n   ? do_raw_spin_unlock+0x9b/0x100\n   cifs_statfs+0x18c/0x4b0 [cifs]\n   statfs_by_dentry+0x9b/0xf0\n   fd_statfs+0x4e/0xb0\n   __do_sys_fstatfs+0x7f/0xe0\n   ? __pfx___do_sys_fstatfs+0x10/0x10\n   ? srso_alias_return_thunk+0x5/0x7f\n   ? lockdep_hardirqs_on_prepare+0x136/0x200\n   ? srso_alias_return_thunk+0x5/0x7f\n   do_syscall_64+0x3f/0x90\n   entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\n  Allocated by task 27534:\n   kasan_save_stack+0x33/0x60\n   kasan_set_track+0x25/0x30\n   __kasan_kmalloc+0x8f/0xa0\n   open_cached_dir+0x71b/0x1240 [cifs]\n   smb2_query_info_compound+0x5c3/0x6d0 [cifs]\n   smb2_queryfs+0xc2/0x2c0 [cifs]\n   smb311_queryfs+0x210/0x220 [cifs]\n   cifs_statfs+0x18c/0x4b0 [cifs]\n   statfs_by_dentry+0x9b/0xf0\n   fd_statfs+0x4e/0xb0\n   __do_sys_fstatfs+0x7f/0xe0\n   do_syscall_64+0x3f/0x90\n   entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\n  Freed by task 27534:\n   kasan_save_stack+0x33/0x60\n   kasan_set_track+0x25/0x30\n   kasan_save_free_info+0x2b/0x50\n   ____kasan_slab_free+0x126/0x170\n   slab_free_freelist_hook+0xd0/0x1e0\n   __kmem_cache_free+0x9d/0x1b0\n   open_cached_dir+0xff5/0x1240 [cifs]\n   smb2_query_info_compound+0x5c3/0x6d0 [cifs]\n   smb2_queryfs+0xc2/0x2c0 [cifs]\n\nThis is a race between open_cached_dir() and cached_dir_lease_break()\nwhere the cache entry for the open directory handle receives a lease\nbreak while creating it.  And before returning from open_cached_dir(),\nwe put the last reference of the new @cfid because of\n!@cfid->has_lease.\n\nBesides the UAF, while running xfstests a lot of missed lease breaks\nhave been noticed in tests that run several concurrent statfs(2) calls\non those cached fids\n\n  CIFS: VFS: \\\\w22-root1.gandalf.test No task to wake, unknown frame...\n  CIFS: VFS: \\\\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1...\n  CIFS: VFS: \\\\w22-root1.gandalf.test smb buf 00000000715bfe83 len 108\n  CIFS: VFS: Dump pending requests:\n  CIFS: VFS: \\\\w22-root1.gandalf.test No task to wake, unknown frame...\n  CIFS: VFS: \\\\w22-root1.gandalf.test Cmd: 18 Err: 0x0 Flags: 0x1...\n  CIFS: VFS: \\\\w22-root1.gandalf.test smb buf 000000005aa7316e len 108\n  ...\n\nTo fix both, in open_cached_dir() ensure that @cfid->has_lease is set\nright before sending out compounded request so that any potential\nlease break will be get processed by demultiplex thread while we're\nstill caching @cfid.  And, if open failed for some reason, re-check\n@cfid->has_lease to decide whether or not put lease reference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "239be9e8-e975-49dd-a630-2edcd60997d7",  "id": "CVE-2024-46773",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check denominator pbn_div before used\n\n[WHAT & HOW]\nA denominator cannot be 0, and is checked before used.\n\nThis fixes 1 DIVIDE_BY_ZERO issue reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8486266e-f1c8-40c0-bdff-6eda0335cecd",  "id": "GHSA-v6rp-3r3v-hf4p",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "21f666e0-b16f-46cb-88f3-67f6b789eefc",  "id": "CVE-2024-49922",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before using them\n\n[WHAT & HOW]\nThese pointers are null checked previously in the same function,\nindicating they might be null as reported by Coverity. As a result,\nthey need to be checked when used again.\n\nThis fixes 3 FORWARD_NULL issue reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "603f2f64-4069-449d-be1d-76f7c568fac2",  "id": "CLSA-2026-1770136337",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5ba15a39-feb8-4c3e-a1a8-562bb4a2cb07",  "id": "OESA-2026-2701",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "731da47d-90bf-4e8c-863b-61cfb38d78b5",  "id": "CVE-2022-48659",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: fix to return errno if kmalloc() fails\n\nIn create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to\nout-of-memory, if it fails, return errno correctly rather than\ntriggering panic via BUG_ON();\n\nkernel BUG at mm/slub.c:5893!\nInternal error: Oops - BUG: 0 [#1] PREEMPT SMP\n\nCall trace:\n sysfs_slab_add+0x258/0x260 mm/slub.c:5973\n __kmem_cache_create+0x60/0x118 mm/slub.c:4899\n create_cache mm/slab_common.c:229 [inline]\n kmem_cache_create_usercopy+0x19c/0x31c mm/slab_common.c:335\n kmem_cache_create+0x1c/0x28 mm/slab_common.c:390\n f2fs_kmem_cache_create fs/f2fs/f2fs.h:2766 [inline]\n f2fs_init_xattr_caches+0x78/0xb4 fs/f2fs/xattr.c:808\n f2fs_fill_super+0x1050/0x1e0c fs/f2fs/super.c:4149\n mount_bdev+0x1b8/0x210 fs/super.c:1400\n f2fs_mount+0x44/0x58 fs/f2fs/super.c:4512\n legacy_get_tree+0x30/0x74 fs/fs_context.c:610\n vfs_get_tree+0x40/0x140 fs/super.c:1530\n do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040\n path_mount+0x358/0x914 fs/namespace.c:3370\n do_mount fs/namespace.c:3383 [inline]\n __do_sys_mount fs/namespace.c:3591 [inline]\n __se_sys_mount fs/namespace.c:3568 [inline]\n __arm64_sys_mount+0x2f8/0x408 fs/namespace.c:3568",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "50e58737-7382-4d0f-a5c9-6b1eccd7b612",  "id": "CVE-2026-31618",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO\n\nMuch like commit 19f953e74356 (\"fbdev: fb_pm2fb: Avoid potential divide\nby zero error\"), we also need to prevent that same crash from happening\nin the udlfb driver as it uses pixclock directly when dividing, which\nwill crash.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ba55e32d-00ac-450f-9788-2a2abc314af8",  "id": "CVE-2023-42752",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42752"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since `skb_shared_info` contains references to function pointers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f8a3489-123c-4bbd-92e2-8d125650bf43",  "id": "CVE-2024-38619",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb-storage: alauda: Check whether the media is initialized\n\nThe member \"uzonesize\" of struct alauda_info will remain 0\nif alauda_init_media() fails, potentially causing divide errors\nin alauda_read_data() and alauda_write_lba().\n- Add a member \"media_initialized\" to struct alauda_info.\n- Change a condition in alauda_check_media() to ensure the\n  first initialization.\n- Add an error check for the return value of alauda_init_media().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f045f7dd-5a91-4e3c-8fe7-ccf8d324359c",  "id": "CVE-2014-4508",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4508"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "36cb0776-652c-41c8-bb41-51c85ab74b92",  "id": "CLSA-2026-1777542789",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d9a87f15-f48f-4ec0-adc7-1a26fa003903",  "id": "CVE-2025-38714",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()\n\nThe hfsplus_bnode_read() method can trigger the issue:\n\n[  174.852007][ T9784] ==================================================================\n[  174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360\n[  174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784\n[  174.854059][ T9784]\n[  174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full)\n[  174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  174.854286][ T9784] Call Trace:\n[  174.854289][ T9784]  <TASK>\n[  174.854292][ T9784]  dump_stack_lvl+0x10e/0x1f0\n[  174.854305][ T9784]  print_report+0xd0/0x660\n[  174.854315][ T9784]  ? __virt_addr_valid+0x81/0x610\n[  174.854323][ T9784]  ? __phys_addr+0xe8/0x180\n[  174.854330][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360\n[  174.854337][ T9784]  kasan_report+0xc6/0x100\n[  174.854346][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360\n[  174.854354][ T9784]  hfsplus_bnode_read+0x2f4/0x360\n[  174.854362][ T9784]  hfsplus_bnode_dump+0x2ec/0x380\n[  174.854370][ T9784]  ? __pfx_hfsplus_bnode_dump+0x10/0x10\n[  174.854377][ T9784]  ? hfsplus_bnode_write_u16+0x83/0xb0\n[  174.854385][ T9784]  ? srcu_gp_start+0xd0/0x310\n[  174.854393][ T9784]  ? __mark_inode_dirty+0x29e/0xe40\n[  174.854402][ T9784]  hfsplus_brec_remove+0x3d2/0x4e0\n[  174.854411][ T9784]  __hfsplus_delete_attr+0x290/0x3a0\n[  174.854419][ T9784]  ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10\n[  174.854427][ T9784]  ? __pfx___hfsplus_delete_attr+0x10/0x10\n[  174.854436][ T9784]  ? __asan_memset+0x23/0x50\n[  174.854450][ T9784]  hfsplus_delete_all_attrs+0x262/0x320\n[  174.854459][ T9784]  ? __pfx_hfsplus_delete_all_attrs+0x10/0x10\n[  174.854469][ T9784]  ? rcu_is_watching+0x12/0xc0\n[  174.854476][ T9784]  ? __mark_inode_dirty+0x29e/0xe40\n[  174.854483][ T9784]  hfsplus_delete_cat+0x845/0xde0\n[  174.854493][ T9784]  ? __pfx_hfsplus_delete_cat+0x10/0x10\n[  174.854507][ T9784]  hfsplus_unlink+0x1ca/0x7c0\n[  174.854516][ T9784]  ? __pfx_hfsplus_unlink+0x10/0x10\n[  174.854525][ T9784]  ? down_write+0x148/0x200\n[  174.854532][ T9784]  ? __pfx_down_write+0x10/0x10\n[  174.854540][ T9784]  vfs_unlink+0x2fe/0x9b0\n[  174.854549][ T9784]  do_unlinkat+0x490/0x670\n[  174.854557][ T9784]  ? __pfx_do_unlinkat+0x10/0x10\n[  174.854565][ T9784]  ? __might_fault+0xbc/0x130\n[  174.854576][ T9784]  ? getname_flags.part.0+0x1c5/0x550\n[  174.854584][ T9784]  __x64_sys_unlink+0xc5/0x110\n[  174.854592][ T9784]  do_syscall_64+0xc9/0x480\n[  174.854600][ T9784]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167\n[  174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08\n[  174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057\n[  174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167\n[  174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50\n[  174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40\n[  174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0\n[  174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[  174.854658][ T9784]  </TASK>\n[  174.854661][ T9784]\n[  174.879281][ T9784] Allocated by task 9784:\n[  174.879664][ T9784]  kasan_save_stack+0x20/0x40\n[  174.880082][ T9784]  kasan_save_track+0x14/0x30\n[  174.880500][ T9784]  __kasan_kmalloc+0xaa/0xb0\n[  174.880908][ T9784]  __kmalloc_noprof+0x205/0x550\n[  174.881337][ T9784]  __hfs_bnode_create+0x107/0x890\n[  174.881779][ T9784]  hfsplus_bnode_find+0x2d0/0xd10\n[  174.882222][ T9784]  hfsplus_brec_find+0x2b0/0x520\n[  174.882659][ T9784]  hfsplus_delete_all_attrs+0x23b/0x3\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5299b56f-8124-4110-9ea5-dbf6a7fd9aa4",  "id": "CVE-2025-21763",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nneighbour: use RCU protection in __neigh_notify()\n\n__neigh_notify() can be called without RTNL or RCU protection.\n\nUse RCU protection to avoid potential UAF.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1dc7930c-5d95-4d42-9260-914fa13478dd",  "id": "CVE-2024-46772",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check denominator crb_pipes before used\n\n[WHAT & HOW]\nA denominator cannot be 0, and is checked before used.\n\nThis fixes 2 DIVIDE_BY_ZERO issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a2f44798-dd16-4c9a-b5ac-1407d14e155f",  "id": "CLSA-2026-1777553052",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a5c3c325-eef2-4739-8eb5-f62c86143332",  "id": "CVE-2021-29155",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29155"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer arithmetic operations, the pointer modification performed by the first operation is not correctly accounted for when restricting subsequent operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "227587c7-acd8-44b2-86bd-0c46c1c07ed7",  "id": "CVE-2019-17666",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17666"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b1238378-e8bd-4941-a4b3-00f9085ebc11",  "id": "CVE-2024-49920",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before multiple uses\n\n[WHAT & HOW]\nPoniters, such as stream_enc and dc->bw_vbios, are null checked previously\nin the same function, so Coverity warns \"implies that stream_enc and\ndc->bw_vbios might be null\". They are used multiple times in the\nsubsequent code and need to be checked.\n\nThis fixes 10 FORWARD_NULL issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "679b2615-c42c-44ec-b169-99921fe0e0b1",  "id": "CVE-2021-47631",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47631"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: davinci: da850-evm: Avoid NULL pointer dereference\n\nWith newer versions of GCC, there is a panic in da850_evm_config_emac()\nwhen booting multi_v5_defconfig in QEMU under the palmetto-bmc machine:\n\nUnable to handle kernel NULL pointer dereference at virtual address 00000020\npgd = (ptrval)\n[00000020] *pgd=00000000\nInternal error: Oops: 5 [#1] PREEMPT ARM\nModules linked in:\nCPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1\nHardware name: Generic DT based system\nPC is at da850_evm_config_emac+0x1c/0x120\nLR is at do_one_initcall+0x50/0x1e0\n\nThe emac_pdata pointer in soc_info is NULL because davinci_soc_info only\ngets populated on davinci machines but da850_evm_config_emac() is called\non all machines via device_initcall().\n\nMove the rmii_en assignment below the machine check so that it is only\ndereferenced when running on a supported SoC.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db1b5638-fb9f-4f2d-8eed-de4b7a698743",  "id": "CVE-2021-47340",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47340"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix GPF in diFree\n\nAvoid passing inode with\nJFS_SBI(inode->i_sb)->ipimap == NULL to\ndiFree()[1]. GFP will appear:\n\n\tstruct inode *ipimap = JFS_SBI(ip->i_sb)->ipimap;\n\tstruct inomap *imap = JFS_IP(ipimap)->i_imap;\n\nJFS_IP() will return invalid pointer when ipimap == NULL\n\nCall Trace:\n diFree+0x13d/0x2dc0 fs/jfs/jfs_imap.c:853 [1]\n jfs_evict_inode+0x2c9/0x370 fs/jfs/inode.c:154\n evict+0x2ed/0x750 fs/inode.c:578\n iput_final fs/inode.c:1654 [inline]\n iput.part.0+0x3fe/0x820 fs/inode.c:1680\n iput+0x58/0x70 fs/inode.c:1670",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a3ae084b-24e1-41ce-8e03-2abd94db57f8",  "id": "CVE-2010-4180",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4180"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "11f0cca7-c9f0-44cc-a2e7-f6bd283b556a",  "id": "CVE-2015-8953",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8953"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/overlayfs/copy_up.c in the Linux kernel before 4.2.6 uses an incorrect cleanup code path, which allows local users to cause a denial of service (dentry reference leak) via filesystem operations on a large file in a lower overlayfs layer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f9ee84d-7ac4-40ed-818b-c5c4cb5b5280",  "id": "CVE-2026-31637",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: reject undecryptable rxkad response tickets\n\nrxkad_decrypt_ticket() decrypts the RXKAD response ticket and then\nparses the buffer as plaintext without checking whether\ncrypto_skcipher_decrypt() succeeded.\n\nA malformed RESPONSE can therefore use a non-block-aligned ticket\nlength, make the decrypt operation fail, and still drive the ticket\nparser with attacker-controlled bytes.\n\nCheck the decrypt result and abort the connection with RXKADBADTICKET\nwhen ticket decryption fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a1d0933c-b8b7-4dea-ba55-4f3f97b5d6c3",  "id": "CVE-2018-20511",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20511"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in drivers/net/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f41a5d98-f919-42b4-9cae-7aa711d9d32e",  "id": "CVE-2025-38680",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()\n\nThe buffer length check before calling uvc_parse_format() only ensured\nthat the buffer has at least 3 bytes (buflen > 2), buf the function\naccesses buffer[3], requiring at least 4 bytes.\n\nThis can lead to an out-of-bounds read if the buffer has exactly 3 bytes.\n\nFix it by checking that the buffer has at least 4 bytes in\nuvc_parse_format().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6bda6633-fdb6-4b62-b343-73be089774b0",  "id": "SUSE-SU-2020:0419-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d28a7117-14f6-4bd4-8b82-5db9c894799b",  "id": "CVE-2011-4112",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4112"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The net subsystem in the Linux kernel before 3.1 does not properly restrict use of the IFF_TX_SKB_SHARING flag, which allows local users to cause a denial of service (panic) by leveraging the CAP_NET_ADMIN capability to access /proc/net/pktgen/pgctrl, and then using the pktgen package in conjunction with a bridge device for a VLAN interface.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3900d411-b653-4fe9-bf87-f2bfd505079f",  "id": "CVE-2011-0712",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0712"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple buffer overflows in the caiaq Native Instruments USB audio functionality in the Linux kernel before 2.6.38-rc4-next-20110215 might allow attackers to cause a denial of service or possibly have unspecified other impact via a long USB device name, related to (1) the snd_usb_caiaq_audio_init function in sound/usb/caiaq/audio.c and (2) the snd_usb_caiaq_midi_init function in sound/usb/caiaq/midi.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef4ac972-d4cc-4a19-ba94-8c404bb67ac6",  "id": "AZL-6343",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5d65bff7-d670-4f23-ad9c-145f0b7ae714",  "id": "CVE-2019-19535",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19535"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    908,    909  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driver, aka CID-30a8beeb3042.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f37f36b-404d-45e7-abc0-d731bc6a7c32",  "id": "CVE-2022-49055",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check for potential null return of kmalloc_array()\n\nAs the kmalloc_array() may return null, the 'event_waiters[i].wait' would lead to null-pointer dereference.\nTherefore, it is better to check the return value of kmalloc_array() to avoid this confusion.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff87d39e-b21b-424a-aca9-b9b3f362f3b5",  "id": "CVE-2026-43080",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    674  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: Drop large packets with UDP encap\n\nsyzbot reported a WARN on my patch series [1]. The actual issue is an\noverflow of 16-bit UDP length field, and it exists in the upstream code.\nMy series added a debug WARN with an overflow check that exposed the\nissue, that's why syzbot tripped on my patches, rather than on upstream\ncode.\n\nsyzbot's repro:\n\nr0 = socket$pppl2tp(0x18, 0x1, 0x1)\nr1 = socket$inet6_udp(0xa, 0x2, 0x0)\nconnect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0xfffffffc}, 0x1c)\nconnect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @ipv4={'\\x00', '\\xff\\xff', @empty}}}}, 0x32)\nwritev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)=\"ee\", 0x34000}], 0x1)\n\nIt basically sends an oversized (0x34000 bytes) PPPoL2TP packet with UDP\nencapsulation, and l2tp_xmit_core doesn't check for overflows when it\nassigns the UDP length field. The value gets trimmed to 16 bites.\n\nAdd an overflow check that drops oversized packets and avoids sending\npackets with trimmed UDP length to the wire.\n\nsyzbot's stack trace (with my patch applied):\n\nlen >= 65536u\nWARNING: ./include/linux/udp.h:38 at udp_set_len_short include/linux/udp.h:38 [inline], CPU#1: syz.0.17/5957\nWARNING: ./include/linux/udp.h:38 at l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline], CPU#1: syz.0.17/5957\nWARNING: ./include/linux/udp.h:38 at l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327, CPU#1: syz.0.17/5957\nModules linked in:\nCPU: 1 UID: 0 PID: 5957 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\nRIP: 0010:udp_set_len_short include/linux/udp.h:38 [inline]\nRIP: 0010:l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline]\nRIP: 0010:l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327\nCode: 0f 0b 90 e9 21 f9 ff ff e8 e9 05 ec f6 90 0f 0b 90 e9 8d f9 ff ff e8 db 05 ec f6 90 0f 0b 90 e9 cc f9 ff ff e8 cd 05 ec f6 90 <0f> 0b 90 e9 de fa ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 4f\nRSP: 0018:ffffc90003d67878 EFLAGS: 00010293\nRAX: ffffffff8ad985e3 RBX: ffff8881a6400090 RCX: ffff8881697f0000\nRDX: 0000000000000000 RSI: 0000000000034010 RDI: 000000000000ffff\nRBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004\nR10: dffffc0000000000 R11: fffff520007acf00 R12: ffff8881baf20900\nR13: 0000000000034010 R14: ffff8881a640008e R15: ffff8881760f7000\nFS:  000055557e81f500(0000) GS:ffff8882a9467000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000033000 CR3: 00000001612f4000 CR4: 00000000000006f0\nCall Trace:\n <TASK>\n pppol2tp_sendmsg+0x40a/0x5f0 net/l2tp/l2tp_ppp.c:302\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n sock_write_iter+0x503/0x550 net/socket.c:1195\n do_iter_readv_writev+0x619/0x8c0 fs/read_write.c:-1\n vfs_writev+0x33c/0x990 fs/read_write.c:1059\n do_writev+0x154/0x2e0 fs/read_write.c:1105\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f636479c629\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffffd4241c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014\nRAX: ffffffffffffffda RBX: 00007f6364a15fa0 RCX: 00007f636479c629\nRDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003\nRBP: 00007f6364832b39 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f6364a15fac R14: 00007f6364a15fa0 R15: 00007f6364a15fa0\n </TASK>\n\n[1]: https://lore.kernel.org/all/20260226201600.222044-1-alice.kernel@fastmail.im/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bfb7f31a-d082-4213-9aaf-c4e132306657",  "id": "CVE-2013-6432",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6432"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:S/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The ping_recvmsg function in net/ipv4/ping.c in the Linux kernel before 3.12.4 does not properly interact with read system calls on ping sockets, which allows local users to cause a denial of service (NULL pointer dereference and system crash) by leveraging unspecified privileges to execute a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8ebd1909-0b14-4b30-bf69-8398fdda0d36",  "id": "CVE-2016-3137",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3137"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the cypress_generic_port_probe and cypress_open functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:136139/Linux-cypress_m8-Null-Pointer-Dereference.html'"    }  ]},{  "bom-ref": "36ccd405-6b07-4c17-b4de-258bccc98b3c",  "id": "CVE-2015-4700",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4700"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    17  ],  "analysis": {    "state": "in_triage"  },  "description": "The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48c858c9-0bd2-4e8d-b4ff-dcfe3c072997",  "id": "CVE-2021-23134",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23134"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48031881-3b25-467b-82b4-ae0175d3ed5f",  "id": "MGASA-2020-0467",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "39492db6-1abe-4d55-a2be-730ffcae44d4",  "id": "RHSA-2026:22312",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f5e969ef-5260-4ce4-bbcf-4327aa28ca49",  "id": "CVE-2022-50261",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()\n\nWith clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),\nindirect call targets are validated against the expected function\npointer prototype to make sure the call target is valid to help mitigate\nROP attacks. If they are not identical, there is a failure at run time,\nwhich manifests as either a kernel panic or thread getting killed. A\nproposed warning in clang aims to catch these at compile time, which\nreveals:\n\n  drivers/gpu/drm/sti/sti_hda.c:637:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict]\n          .mode_valid = sti_hda_connector_mode_valid,\n                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~\n  drivers/gpu/drm/sti/sti_dvo.c:376:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict]\n          .mode_valid = sti_dvo_connector_mode_valid,\n                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~\n  drivers/gpu/drm/sti/sti_hdmi.c:1035:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict]\n          .mode_valid = sti_hdmi_connector_mode_valid,\n                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n->mode_valid() in 'struct drm_connector_helper_funcs' expects a return\ntype of 'enum drm_mode_status', not 'int'. Adjust the return type of\nsti_{dvo,hda,hdmi}_connector_mode_valid() to match the prototype's to\nresolve the warning and CFI failure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "22ff5d54-213b-49fa-8a86-3fb411d3bfd2",  "id": "OESA-2024-1740",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f8e5982e-f069-485d-89ec-3b2eb6536d47",  "id": "CVE-2022-48863",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: Fix memory leak in dsp_pipeline_build()\n\ndsp_pipeline_build() allocates dup pointer by kstrdup(cfg),\nbut then it updates dup variable by strsep(&dup, \"|\").\nAs a result when it calls kfree(dup), the dup variable contains NULL.\n\nFound by Linux Driver Verification project (linuxtesting.org) with SVACE.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7602df6a-23bb-47de-9847-0f472ade0050",  "id": "CVE-2012-6541",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6541"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The ccid3_hc_tx_getsockopt function in net/dccp/ccids/ccid3.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "506fade8-0707-43ef-92cf-57a5114fca1e",  "id": "CVE-2014-9090",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9090"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    17  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ab5420e0-ac7b-4d7d-a808-e7f6dd899f5c",  "id": "CVE-2024-49928",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: avoid reading out of bounds when loading TX power FW elements\n\nBecause the loop-expression will do one more time before getting false from\ncond-expression, the original code copied one more entry size beyond valid\nregion.\n\nFix it by moving the entry copy to loop-body.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "00ff5720-1815-4342-8c6d-50c8fdd33b2c",  "id": "CVE-2021-47375",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47375"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblktrace: Fix uaf in blk_trace access after removing by sysfs\n\nThere is an use-after-free problem triggered by following process:\n\n      P1(sda)\t\t\t\tP2(sdb)\n\t\t\techo 0 > /sys/block/sdb/trace/enable\n\t\t\t  blk_trace_remove_queue\n\t\t\t    synchronize_rcu\n\t\t\t    blk_trace_free\n\t\t\t      relay_close\nrcu_read_lock\n__blk_add_trace\n  trace_note_tsk\n  (Iterate running_trace_list)\n\t\t\t        relay_close_buf\n\t\t\t\t  relay_destroy_buf\n\t\t\t\t    kfree(buf)\n    trace_note(sdb's bt)\n      relay_reserve\n        buf->offset <- nullptr deference (use-after-free) !!!\nrcu_read_unlock\n\n[  502.714379] BUG: kernel NULL pointer dereference, address:\n0000000000000010\n[  502.715260] #PF: supervisor read access in kernel mode\n[  502.715903] #PF: error_code(0x0000) - not-present page\n[  502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0\n[  502.717252] Oops: 0000 [#1] SMP\n[  502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360\n[  502.732872] Call Trace:\n[  502.733193]  __blk_add_trace.cold+0x137/0x1a3\n[  502.733734]  blk_add_trace_rq+0x7b/0xd0\n[  502.734207]  blk_add_trace_rq_issue+0x54/0xa0\n[  502.734755]  blk_mq_start_request+0xde/0x1b0\n[  502.735287]  scsi_queue_rq+0x528/0x1140\n...\n[  502.742704]  sg_new_write.isra.0+0x16e/0x3e0\n[  502.747501]  sg_ioctl+0x466/0x1100\n\nReproduce method:\n  ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\n  ioctl(/dev/sda, BLKTRACESTART)\n  ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])\n  ioctl(/dev/sdb, BLKTRACESTART)\n\n  echo 0 > /sys/block/sdb/trace/enable &\n  // Add delay(mdelay/msleep) before kernel enters blk_trace_free()\n\n  ioctl$SG_IO(/dev/sda, SG_IO, ...)\n  // Enters trace_note_tsk() after blk_trace_free() returned\n  // Use mdelay in rcu region rather than msleep(which may schedule out)\n\nRemove blk_trace from running_list before calling blk_trace_free() by\nsysfs if blk_trace is at Blktrace_running state.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "41a95979-6a4e-4f38-98d8-8ffe2af5debf",  "id": "CVE-2017-2636",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2636"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    415  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e89442fa-9240-4c2d-8cc6-120476a96ad3",  "id": "CVE-2011-1083",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1083"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The epoll implementation in the Linux kernel 2.6.37.2 and earlier does not properly traverse a tree of epoll file descriptors, which allows local users to cause a denial of service (CPU consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:35403'"    }  ]},{  "bom-ref": "32a02243-4c76-4604-8745-0d4910fd31c2",  "id": "CVE-2023-3111",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3111"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e7f6af74-00b7-40d3-9710-29f6e6c339ff",  "id": "OESA-2026-2478",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "e52e445b-24d0-4150-822b-d76563b46e68",      "versions": [        {          "component": "sed",          "version": "4.0"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5869f041-926e-4241-9b38-84a617f7d901",  "id": "CVE-2016-5696",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5696"  },  "ratings": [    {      "score": 4.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "66355309-693f-4575-8ff1-5074b9c847dc",  "id": "CVE-2022-0850",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0850"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5bc2810f-e74a-4bdf-a9d0-1638b7fc7fa3",  "id": "CVE-2014-3567",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3567"  },  "ratings": [    {      "score": 7.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20,    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3fd7b19-56ed-4802-95e9-037bfd31880d",  "id": "CVE-2014-9322",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9322"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    269  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:44205'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:130593/Linux-CVE-2014-9322-Proof-Of-Concept.html'"    }  ]},{  "bom-ref": "91f11eb1-4c56-4c9d-8df7-f1ba263499e4",  "id": "CVE-2025-21862",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix incorrect initialization order\n\nSyzkaller reports the following bug:\n\nBUG: spinlock bad magic on CPU#1, syz-executor.0/7995\n lock: 0xffff88805303f3e0, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0\nCPU: 1 PID: 7995 Comm: syz-executor.0 Tainted: G            E     5.10.209+ #1\nHardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x119/0x179 lib/dump_stack.c:118\n debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline]\n do_raw_spin_lock+0x1f6/0x270 kernel/locking/spinlock_debug.c:112\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline]\n _raw_spin_lock_irqsave+0x50/0x70 kernel/locking/spinlock.c:159\n reset_per_cpu_data+0xe6/0x240 [drop_monitor]\n net_dm_cmd_trace+0x43d/0x17a0 [drop_monitor]\n genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739\n genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]\n genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800\n netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2497\n genl_rcv+0x29/0x40 net/netlink/genetlink.c:811\n netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]\n netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1348\n netlink_sendmsg+0x914/0xe00 net/netlink/af_netlink.c:1916\n sock_sendmsg_nosec net/socket.c:651 [inline]\n __sock_sendmsg+0x157/0x190 net/socket.c:663\n ____sys_sendmsg+0x712/0x870 net/socket.c:2378\n ___sys_sendmsg+0xf8/0x170 net/socket.c:2432\n __sys_sendmsg+0xea/0x1b0 net/socket.c:2461\n do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x62/0xc7\nRIP: 0033:0x7f3f9815aee9\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f3f972bf0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f3f9826d050 RCX: 00007f3f9815aee9\nRDX: 0000000020000000 RSI: 0000000020001300 RDI: 0000000000000007\nRBP: 00007f3f981b63bd R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000006e R14: 00007f3f9826d050 R15: 00007ffe01ee6768\n\nIf drop_monitor is built as a kernel module, syzkaller may have time\nto send a netlink NET_DM_CMD_START message during the module loading.\nThis will call the net_dm_monitor_start() function that uses\na spinlock that has not yet been initialized.\n\nTo fix this, let's place resource initialization above the registration\nof a generic netlink family.\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f1408872-4a8f-4232-9337-bc777ed64a08",  "id": "CVE-2017-14954",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14954"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4 accesses rusage data structures in unintended cases, which allows local users to obtain sensitive information, and bypass the KASLR protection mechanism, via a crafted system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "469b23ca-54b3-488c-aee4-2826bd0b47ae",  "id": "CVE-2023-3359",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3359"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel brcm_nvram_parse in drivers/nvmem/brcm_nvram.c. Lacks for the check of the return value of kzalloc() can cause the NULL Pointer Dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f33a48c-e74f-4512-bc77-0fff5b5d6b37",  "id": "CVE-2022-48978",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: fix shift-out-of-bounds in hid_report_raw_event\n\nSyzbot reported shift-out-of-bounds in hid_report_raw_event.\n\nmicrosoft 0003:045E:07DA.0001: hid_field_extract() called with n (128) >\n32! (swapper/0)\n======================================================================\nUBSAN: shift-out-of-bounds in drivers/hid/hid-core.c:1323:20\nshift exponent 127 is too large for 32-bit type 'int'\nCPU: 0 PID: 0 Comm: swapper/0 Not tainted\n6.1.0-rc4-syzkaller-00159-g4bbf3422df78 #0\nHardware name: Google Compute Engine/Google Compute Engine, BIOS\nGoogle 10/26/2022\nCall Trace:\n <IRQ>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:151 [inline]\n __ubsan_handle_shift_out_of_bounds+0x3a6/0x420 lib/ubsan.c:322\n snto32 drivers/hid/hid-core.c:1323 [inline]\n hid_input_fetch_field drivers/hid/hid-core.c:1572 [inline]\n hid_process_report drivers/hid/hid-core.c:1665 [inline]\n hid_report_raw_event+0xd56/0x18b0 drivers/hid/hid-core.c:1998\n hid_input_report+0x408/0x4f0 drivers/hid/hid-core.c:2066\n hid_irq_in+0x459/0x690 drivers/hid/usbhid/hid-core.c:284\n __usb_hcd_giveback_urb+0x369/0x530 drivers/usb/core/hcd.c:1671\n dummy_timer+0x86b/0x3110 drivers/usb/gadget/udc/dummy_hcd.c:1988\n call_timer_fn+0xf5/0x210 kernel/time/timer.c:1474\n expire_timers kernel/time/timer.c:1519 [inline]\n __run_timers+0x76a/0x980 kernel/time/timer.c:1790\n run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1803\n __do_softirq+0x277/0x75b kernel/softirq.c:571\n __irq_exit_rcu+0xec/0x170 kernel/softirq.c:650\n irq_exit_rcu+0x5/0x20 kernel/softirq.c:662\n sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1107\n======================================================================\n\nIf the size of the integer (unsigned n) is bigger than 32 in snto32(),\nshift exponent will be too large for 32-bit type 'int', resulting in a\nshift-out-of-bounds bug.\nFix this by adding a check on the size of the integer (unsigned n) in\nsnto32(). To add support for n greater than 32 bits, set n to 32, if n\nis greater than 32.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "57d589e1-0317-4a8b-b9ef-97f8ac67ebb0",  "id": "CVE-2010-3865",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3865"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the rds_rdma_pages function in net/rds/rdma.c in the Linux kernel allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted iovec struct in a Reliable Datagram Sockets (RDS) request, which triggers a buffer overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95dc26d3-802d-4178-b58d-eebe1ea13aa3",  "id": "CVE-2024-49898",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null-initialized variables\n\n[WHAT & HOW]\ndrr_timing and subvp_pipe are initialized to null and they are not\nalways assigned new values. It is necessary to check for null before\ndereferencing.\n\nThis fixes 2 FORWARD_NULL issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d15d88ec-f562-405c-9871-d3d3606c14db",  "id": "RUSTSEC-2025-0004",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f0f1abd9-c1c7-4652-a176-09fa2db9ba24",  "id": "DSA-2998-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a9f522c7-b850-4191-aa17-b673413b40a3",  "id": "CVE-2021-47082",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47082"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: avoid double free in tun_free_netdev\n\nAvoid double free in tun_free_netdev() by moving the\ndev->tstats and tun->security allocs to a new ndo_init routine\n(tun_net_init()) that will be called by register_netdevice().\nndo_init is paired with the desctructor (tun_free_netdev()),\nso if there's an error in register_netdevice() the destructor\nwill handle the frees.\n\nBUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\n\nCPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1\nHardware name: Red Hat KVM, BIOS\nCall Trace:\n<TASK>\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106\nprint_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:247\nkasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372\n____kasan_slab_free mm/kasan/common.c:346 [inline]\n__kasan_slab_free+0x107/0x120 mm/kasan/common.c:374\nkasan_slab_free include/linux/kasan.h:235 [inline]\nslab_free_hook mm/slub.c:1723 [inline]\nslab_free_freelist_hook mm/slub.c:1749 [inline]\nslab_free mm/slub.c:3513 [inline]\nkfree+0xac/0x2d0 mm/slub.c:4561\nselinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605\nsecurity_tun_dev_free_security+0x4f/0x90 security/security.c:2342\ntun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215\nnetdev_run_todo+0x4df/0x840 net/core/dev.c:10627\nrtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112\n__tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302\ntun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_sys_ioctl fs/ioctl.c:874 [inline]\n__se_sys_ioctl fs/ioctl.c:860 [inline]\n__x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x44/0xae",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3fe32a1-ed7f-41c8-8755-cbd0a3dddb67",  "id": "CVE-2011-2716",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2716"  },  "ratings": [    {      "score": 6.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8467ba6f-0292-44dd-aa93-fc8c80b64d1d",  "id": "CVE-2015-8955",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8955"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/arm64/kernel/perf_event.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via vectors involving events that are mishandled during a span of multiple HW PMUs.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d6e34167-daa3-44b7-8a4f-33e2ee614a04",  "id": "CVE-2025-38345",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: fix acpi operand cache leak in dswstate.c\n\nACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732\n\nI found an ACPI cache leak in ACPI early termination and boot continuing case.\n\nWhen early termination occurs due to malicious ACPI table, Linux kernel\nterminates ACPI function and continues to boot process. While kernel terminates\nACPI function, kmem_cache_destroy() reports Acpi-Operand cache leak.\n\nBoot log of ACPI operand cache leak is as follows:\n>[    0.585957] ACPI: Added _OSI(Module Device)\n>[    0.587218] ACPI: Added _OSI(Processor Device)\n>[    0.588530] ACPI: Added _OSI(3.0 _SCP Extensions)\n>[    0.589790] ACPI: Added _OSI(Processor Aggregator Device)\n>[    0.591534] ACPI Error: Illegal I/O port address/length above 64K: C806E00000004002/0x2 (20170303/hwvalid-155)\n>[    0.594351] ACPI Exception: AE_LIMIT, Unable to initialize fixed events (20170303/evevent-88)\n>[    0.597858] ACPI: Unable to start the ACPI Interpreter\n>[    0.599162] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n>[    0.601836] kmem_cache_destroy Acpi-Operand: Slab cache still has objects\n>[    0.603556] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc5 #26\n>[    0.605159] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006\n>[    0.609177] Call Trace:\n>[    0.610063]  ? dump_stack+0x5c/0x81\n>[    0.611118]  ? kmem_cache_destroy+0x1aa/0x1c0\n>[    0.612632]  ? acpi_sleep_proc_init+0x27/0x27\n>[    0.613906]  ? acpi_os_delete_cache+0xa/0x10\n>[    0.617986]  ? acpi_ut_delete_caches+0x3f/0x7b\n>[    0.619293]  ? acpi_terminate+0xa/0x14\n>[    0.620394]  ? acpi_init+0x2af/0x34f\n>[    0.621616]  ? __class_create+0x4c/0x80\n>[    0.623412]  ? video_setup+0x7f/0x7f\n>[    0.624585]  ? acpi_sleep_proc_init+0x27/0x27\n>[    0.625861]  ? do_one_initcall+0x4e/0x1a0\n>[    0.627513]  ? kernel_init_freeable+0x19e/0x21f\n>[    0.628972]  ? rest_init+0x80/0x80\n>[    0.630043]  ? kernel_init+0xa/0x100\n>[    0.631084]  ? ret_from_fork+0x25/0x30\n>[    0.633343] vgaarb: loaded\n>[    0.635036] EDAC MC: Ver: 3.0.0\n>[    0.638601] PCI: Probing PCI hardware\n>[    0.639833] PCI host bridge to bus 0000:00\n>[    0.641031] pci_bus 0000:00: root bus resource [io  0x0000-0xffff]\n> ... Continue to boot and log is omitted ...\n\nI analyzed this memory leak in detail and found acpi_ds_obj_stack_pop_and_\ndelete() function miscalculated the top of the stack. acpi_ds_obj_stack_push()\nfunction uses walk_state->operand_index for start position of the top, but\nacpi_ds_obj_stack_pop_and_delete() function considers index 0 for it.\nTherefore, this causes acpi operand memory leak.\n\nThis cache leak causes a security threat because an old kernel (<= 4.9) shows\nmemory locations of kernel functions in stack dump. Some malicious users\ncould use this information to neutralize kernel ASLR.\n\nI made a patch to fix ACPI operand cache leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "917d96bd-1639-452c-81b6-677204d6bd29",  "id": "CVE-2024-35821",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    772  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Set page uptodate in the correct place\n\nPage cache reads are lockless, so setting the freshly allocated page\nuptodate before we've overwritten it with the data it's supposed to have\nin it will allow a simultaneous reader to see old data.  Move the call\nto SetPageUptodate into ubifs_write_end(), which is after we copied the\nnew data into the page.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99ef70e5-a1cb-4dab-98b1-e53be836e705",  "id": "CVE-2022-49765",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/9p: use a dedicated spinlock for trans_fd\n\nShamelessly copying the explanation from Tetsuo Handa's suggested\npatch[1] (slightly reworded):\nsyzbot is reporting inconsistent lock state in p9_req_put()[2],\nfor p9_tag_remove() from p9_req_put() from IRQ context is using\nspin_lock_irqsave() on \"struct p9_client\"->lock but trans_fd\n(not from IRQ context) is using spin_lock().\n\nSince the locks actually protect different things in client.c and in\ntrans_fd.c, just replace trans_fd.c's lock by a new one specific to the\ntransport (client.c's protect the idr for fid/tag allocations,\nwhile trans_fd.c's protects its own req list and request status field\nthat acts as the transport's state machine)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "05e39db2-6685-4ea3-8e4d-f7281366f064",  "id": "OESA-2026-1881",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "298af178-c180-4243-9010-d64853688bc6",  "id": "DLA-2766-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "233ccf3c-174c-47e9-b7fa-641435902ac1",  "id": "OESA-2023-1583",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2fd985f-d86a-4d14-9804-62c3b9d97c3d",  "id": "CVE-2022-49728",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix signed integer overflow in __ip6_append_data\n\nResurrect ubsan overflow checks and ubsan report this warning,\nfix it by change the variable [length] type to size_t.\n\nUBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19\n2147479552 + 8567 cannot be represented in type 'int'\nCPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1\nHardware name: linux,dummy-virt (DT)\nCall trace:\n  dump_backtrace+0x214/0x230\n  show_stack+0x30/0x78\n  dump_stack_lvl+0xf8/0x118\n  dump_stack+0x18/0x30\n  ubsan_epilogue+0x18/0x60\n  handle_overflow+0xd0/0xf0\n  __ubsan_handle_add_overflow+0x34/0x44\n  __ip6_append_data.isra.48+0x1598/0x1688\n  ip6_append_data+0x128/0x260\n  udpv6_sendmsg+0x680/0xdd0\n  inet6_sendmsg+0x54/0x90\n  sock_sendmsg+0x70/0x88\n  ____sys_sendmsg+0xe8/0x368\n  ___sys_sendmsg+0x98/0xe0\n  __sys_sendmmsg+0xf4/0x3b8\n  __arm64_sys_sendmmsg+0x34/0x48\n  invoke_syscall+0x64/0x160\n  el0_svc_common.constprop.4+0x124/0x300\n  do_el0_svc+0x44/0xc8\n  el0_svc+0x3c/0x1e8\n  el0t_64_sync_handler+0x88/0xb0\n  el0t_64_sync+0x16c/0x170\n\nChanges since v1:\n-Change the variable [length] type to unsigned, as Eric Dumazet suggested.\nChanges since v2:\n-Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested.\nChanges since v3:\n-Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as\nJakub Kicinski suggested.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ec989942-54b2-4f39-9acf-1de9eca56778",  "id": "CVE-2024-50196",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    754  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: ocelot: fix system hang on level based interrupts\n\nThe current implementation only calls chained_irq_enter() and\nchained_irq_exit() if it detects pending interrupts.\n\n```\nfor (i = 0; i < info->stride; i++) {\n\turegmap_read(info->map, id_reg + 4 * i, &reg);\n\tif (!reg)\n\t\tcontinue;\n\n\tchained_irq_enter(parent_chip, desc);\n```\n\nHowever, in case of GPIO pin configured in level mode and the parent\ncontroller configured in edge mode, GPIO interrupt might be lowered by the\nhardware. In the result, if the interrupt is short enough, the parent\ninterrupt is still pending while the GPIO interrupt is cleared;\nchained_irq_enter() never gets called and the system hangs trying to\nservice the parent interrupt.\n\nMoving chained_irq_enter() and chained_irq_exit() outside the for loop\nensures that they are called even when GPIO interrupt is lowered by the\nhardware.\n\nThe similar code with chained_irq_enter() / chained_irq_exit() functions\nwrapping interrupt checking loop may be found in many other drivers:\n```\ngrep -r -A 10 chained_irq_enter drivers/pinctrl\n```",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2a33745-deac-429b-9e8c-ee8935085056",  "id": "CVE-2024-50004",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: update DML2 policy EnhancedPrefetchScheduleAccelerationFinal DCN35\n\n[WHY & HOW]\nMismatch in DCN35 DML2 cause bw validation failed to acquire unexpected DPP pipe to cause\ngrey screen and system hang. Remove EnhancedPrefetchScheduleAccelerationFinal value override\nto match HW spec.\n\n(cherry picked from commit 9dad21f910fcea2bdcff4af46159101d7f9cd8ba)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6c50fb74-5f59-4772-b2c1-35eeae89cd0d",  "id": "CVE-2010-4075",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4075"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The uart_get_count function in drivers/serial/serial_core.c in the Linux kernel before 2.6.37-rc1 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e5db3d2e-2991-4348-a431-40b73116b633",  "id": "CVE-2024-35877",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: fix VM_PAT handling in COW mappings\n\nPAT handling won't do the right thing in COW mappings: the first PTE (or,\nin fact, all PTEs) can be replaced during write faults to point at anon\nfolios.  Reliably recovering the correct PFN and cachemode using\nfollow_phys() from PTEs will not work in COW mappings.\n\nUsing follow_phys(), we might just get the address+protection of the anon\nfolio (which is very wrong), or fail on swap/nonswap entries, failing\nfollow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and\ntrack_pfn_copy(), not properly calling free_pfn_range().\n\nIn free_pfn_range(), we either wouldn't call memtype_free() or would call\nit with the wrong range, possibly leaking memory.\n\nTo fix that, let's update follow_phys() to refuse returning anon folios,\nand fallback to using the stored PFN inside vma->vm_pgoff for COW mappings\nif we run into that.\n\nWe will now properly handle untrack_pfn() with COW mappings, where we\ndon't need the cachemode.  We'll have to fail fork()->track_pfn_copy() if\nthe first page was replaced by an anon folio, though: we'd have to store\nthe cachemode in the VMA to make this work, likely growing the VMA size.\n\nFor now, lets keep it simple and let track_pfn_copy() just fail in that\ncase: it would have failed in the past with swap/nonswap entries already,\nand it would have done the wrong thing with anon folios.\n\nSimple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn():\n\n<--- C reproducer --->\n #include <stdio.h>\n #include <sys/mman.h>\n #include <unistd.h>\n #include <liburing.h>\n\n int main(void)\n {\n         struct io_uring_params p = {};\n         int ring_fd;\n         size_t size;\n         char *map;\n\n         ring_fd = io_uring_setup(1, &p);\n         if (ring_fd < 0) {\n                 perror(\"io_uring_setup\");\n                 return 1;\n         }\n         size = p.sq_off.array + p.sq_entries * sizeof(unsigned);\n\n         /* Map the submission queue ring MAP_PRIVATE */\n         map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE,\n                    ring_fd, IORING_OFF_SQ_RING);\n         if (map == MAP_FAILED) {\n                 perror(\"mmap\");\n                 return 1;\n         }\n\n         /* We have at least one page. Let's COW it. */\n         *map = 0;\n         pause();\n         return 0;\n }\n<--- C reproducer --->\n\nOn a system with 16 GiB RAM and swap configured:\n # ./iouring &\n # memhog 16G\n # killall iouring\n[  301.552930] ------------[ cut here ]------------\n[  301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100\n[  301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g\n[  301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1\n[  301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4\n[  301.559569] RIP: 0010:untrack_pfn+0xf4/0x100\n[  301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000\n[  301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282\n[  301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047\n[  301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200\n[  301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000\n[  301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000\n[  301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000\n[  301.564186] FS:  0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000\n[  301.564773] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0\n[  301.565725] PKRU: 55555554\n[  301.565944] Call Trace:\n[  301.566148]  <TASK>\n[  301.566325]  ? untrack_pfn+0xf4/0x100\n[  301.566618]  ? __warn+0x81/0x130\n[  301.566876]  ? untrack_pfn+0xf4/0x100\n[  3\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ad7eab9c-9c06-4977-b922-87627a877d2b",  "id": "CVE-2011-2723",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2723"  },  "ratings": [    {      "score": 5.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The skb_gro_header_slow function in include/linux/netdevice.h in the Linux kernel before 2.6.39.4, when Generic Receive Offload (GRO) is enabled, resets certain fields in incorrect situations, which allows remote attackers to cause a denial of service (system crash) via crafted network traffic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f93544fb-7f20-41c6-a4fd-a93cb88f09dc",  "id": "AZL-6344",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a78c3c84-69b1-4c90-a56e-ec055aecb115",  "id": "CVE-2024-26606",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: signal epoll threads of self-work\n\nIn (e)poll mode, threads often depend on I/O events to determine when\ndata is ready for consumption. Within binder, a thread may initiate a\ncommand via BINDER_WRITE_READ without a read buffer and then make use\nof epoll_wait() or similar to consume any responses afterwards.\n\nIt is then crucial that epoll threads are signaled via wakeup when they\nqueue their own work. Otherwise, they risk waiting indefinitely for an\nevent leaving their work unhandled. What is worse, subsequent commands\nwon't trigger a wakeup either as the thread has pending work.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c29b9496-fea7-442f-9aae-b554d222f4c8",  "id": "CVE-2024-46777",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Avoid excessive partition lengths\n\nAvoid mounting filesystems where the partition would overflow the\n32-bits used for block number. Also refuse to mount filesystems where\nthe partition length is so large we cannot safely index bits in a\nblock bitmap.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "94a9db98-fe65-46c3-94b0-952dea10bd4e",  "id": "CVE-2022-50007",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix refcount leak in __xfrm_policy_check()\n\nThe issue happens on an error path in __xfrm_policy_check(). When the\nfetching process of the object `pols[1]` fails, the function simply\nreturns 0, forgetting to decrement the reference count of `pols[0]`,\nwhich is incremented earlier by either xfrm_sk_policy_lookup() or\nxfrm_policy_lookup(). This may result in memory leaks.\n\nFix it by decreasing the reference count of `pols[0]` in that path.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "30ef156e-269b-4743-95e5-0a03d3349046",  "id": "CVE-2026-46049",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Add fallback to default RSR for S/PDIF\n\nspdif_passthru_playback_get_resources() uses atc->pll_rate as the RSR\nfor the MSR calculation loop. However, pll_rate is only updated in\natc_pll_init() and not in hw_pll_init(), so it remains 0 after the\ncard init.\n\nWhen spdif_passthru_playback_setup() skips atc_pll_init() for\n32000 Hz, (rsr * desc.msr) always becomes 0, causing the loop to spin\nindefinitely.\n\nAdd fallback to use atc->rsr when atc->pll_rate is 0. This reflects\nthe hardware state, since hw_card_init() already configures the PLL\nto the default RSR.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b03a323-1e45-47b4-b6d4-8fb1837c8570",  "id": "CVE-2019-18814",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18814"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a0aab7d3-f9b3-450c-b9e0-f27cf917ec5c",  "id": "CVE-2023-53317",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix WARNING in mb_find_extent\n\nSyzbot found the following issue:\n\nEXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!\nEXT4-fs (loop0): orphan cleanup on readonly fs\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 5067 at fs/ext4/mballoc.c:1869 mb_find_extent+0x8a1/0xe30\nModules linked in:\nCPU: 1 PID: 5067 Comm: syz-executor307 Not tainted 6.2.0-rc1-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nRIP: 0010:mb_find_extent+0x8a1/0xe30 fs/ext4/mballoc.c:1869\nRSP: 0018:ffffc90003c9e098 EFLAGS: 00010293\nRAX: ffffffff82405731 RBX: 0000000000000041 RCX: ffff8880783457c0\nRDX: 0000000000000000 RSI: 0000000000000041 RDI: 0000000000000040\nRBP: 0000000000000040 R08: ffffffff82405723 R09: ffffed10053c9402\nR10: ffffed10053c9402 R11: 1ffff110053c9401 R12: 0000000000000000\nR13: ffffc90003c9e538 R14: dffffc0000000000 R15: ffffc90003c9e2cc\nFS:  0000555556665300(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000056312f6796f8 CR3: 0000000022437000 CR4: 00000000003506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n ext4_mb_complex_scan_group+0x353/0x1100 fs/ext4/mballoc.c:2307\n ext4_mb_regular_allocator+0x1533/0x3860 fs/ext4/mballoc.c:2735\n ext4_mb_new_blocks+0xddf/0x3db0 fs/ext4/mballoc.c:5605\n ext4_ext_map_blocks+0x1868/0x6880 fs/ext4/extents.c:4286\n ext4_map_blocks+0xa49/0x1cc0 fs/ext4/inode.c:651\n ext4_getblk+0x1b9/0x770 fs/ext4/inode.c:864\n ext4_bread+0x2a/0x170 fs/ext4/inode.c:920\n ext4_quota_write+0x225/0x570 fs/ext4/super.c:7105\n write_blk fs/quota/quota_tree.c:64 [inline]\n get_free_dqblk+0x34a/0x6d0 fs/quota/quota_tree.c:130\n do_insert_tree+0x26b/0x1aa0 fs/quota/quota_tree.c:340\n do_insert_tree+0x722/0x1aa0 fs/quota/quota_tree.c:375\n do_insert_tree+0x722/0x1aa0 fs/quota/quota_tree.c:375\n do_insert_tree+0x722/0x1aa0 fs/quota/quota_tree.c:375\n dq_insert_tree fs/quota/quota_tree.c:401 [inline]\n qtree_write_dquot+0x3b6/0x530 fs/quota/quota_tree.c:420\n v2_write_dquot+0x11b/0x190 fs/quota/quota_v2.c:358\n dquot_acquire+0x348/0x670 fs/quota/dquot.c:444\n ext4_acquire_dquot+0x2dc/0x400 fs/ext4/super.c:6740\n dqget+0x999/0xdc0 fs/quota/dquot.c:914\n __dquot_initialize+0x3d0/0xcf0 fs/quota/dquot.c:1492\n ext4_process_orphan+0x57/0x2d0 fs/ext4/orphan.c:329\n ext4_orphan_cleanup+0xb60/0x1340 fs/ext4/orphan.c:474\n __ext4_fill_super fs/ext4/super.c:5516 [inline]\n ext4_fill_super+0x81cd/0x8700 fs/ext4/super.c:5644\n get_tree_bdev+0x400/0x620 fs/super.c:1282\n vfs_get_tree+0x88/0x270 fs/super.c:1489\n do_new_mount+0x289/0xad0 fs/namespace.c:3145\n do_mount fs/namespace.c:3488 [inline]\n __do_sys_mount fs/namespace.c:3697 [inline]\n __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nAdd some debug information:\nmb_find_extent: mb_find_extent block=41, order=0 needed=64 next=0 ex=0/41/1@3735929054 64 64 7\nblock_bitmap: ff 3f 0c 00 fc 01 00 00 d2 3d 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n\nAcctually, blocks per group is 64, but block bitmap indicate at least has\n128 blocks. Now, ext4_validate_block_bitmap() didn't check invalid block's\nbitmap if set.\nTo resolve above issue, add check like fsck \"Padding at end of block bitmap is\nnot set\".",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae1bdb54-ecb9-4622-98c1-f25da0798768",  "id": "CVE-2023-2177",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2177"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A local user could use this flaw to crash the system or potentially cause a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e379618a-c4b8-43f8-976f-bbed85e6f88b",  "id": "CVE-2025-21751",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, change error flow on matcher disconnect\n\nCurrently, when firmware failure occurs during matcher disconnect flow,\nthe error flow of the function reconnects the matcher back and returns\nan error, which continues running the calling function and eventually\nfrees the matcher that is being disconnected.\nThis leads to a case where we have a freed matcher on the matchers list,\nwhich in turn leads to use-after-free and eventual crash.\n\nThis patch fixes that by not trying to reconnect the matcher back when\nsome FW command fails during disconnect.\n\nNote that we're dealing here with FW error. We can't overcome this\nproblem. This might lead to bad steering state (e.g. wrong connection\nbetween matchers), and will also lead to resource leakage, as it is\nthe case with any other error handling during resource destruction.\n\nHowever, the goal here is to allow the driver to continue and not crash\nthe machine with use-after-free error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69803766-c5a8-485c-8a6e-637fa17b0577",  "id": "CVE-2013-3229",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3229"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The iucv_sock_recvmsg function in net/iucv/af_iucv.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "88b9dd15-7cd0-47a5-a987-a7daf6e1689c",  "id": "CVE-2019-19965",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19965"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "36fed136-a1bf-4fc5-a1f9-a4a7b3432d5e",  "id": "CVE-2014-4652",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4652"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1dd65c93-3f4c-4fa1-b764-3466e02fd1b3",  "id": "CVE-2010-4080",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4080"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c7683d77-c35a-486f-a462-4fe2dcecb5a5",  "id": "DLA-3530-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "057f54d7-daab-4d7d-af4c-fd4e7982584d",  "id": "CVE-2026-46128",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: Check event message buffer response for bad data\n\nThe event message buffer response data size got checked later when\nprocessing, but check it right after the response comes back.  It\nappears some BMCs may return an empty message instead of an error\nwhen fetching events.\n\nThere are apparently some new BMCs that make this error, so we need to\ncompensate.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2a28ef4-5d10-4349-a739-7df907b95734",  "id": "CVE-2017-13087",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13087"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    330  ],  "analysis": {    "state": "in_triage"  },  "description": "Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0bac85f1-18f4-46fb-bb9a-3af5e36e72a7",  "id": "CVE-2025-38705",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix null pointer access\n\nWriting a string without delimiters (' ', '\\n', '\\0') to the under\ngpu_od/fan_ctrl sysfs or pp_power_profile_mode for the CUSTOM profile\nwill result in a null pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b260f8ca-bc28-4ec1-a6de-8cc2a1229959",  "id": "CVE-2021-47353",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47353"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix NULL pointer dereference in udf_symlink function\n\nIn function udf_symlink, epos.bh is assigned with the value returned\nby udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c\nand returns the value of sb_getblk function that could be NULL.\nThen, epos.bh is used without any check, causing a possible\nNULL pointer dereference when sb_getblk fails.\n\nThis fix adds a check to validate the value of epos.bh.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e4761380-69ad-48dc-9cb4-af8c43958a82",  "id": "CVE-2022-48804",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt_ioctl: fix array_index_nospec in vt_setactivate\n\narray_index_nospec ensures that an out-of-bounds value is set to zero\non the transient path. Decreasing the value by one afterwards causes\na transient integer underflow. vsa.console should be decreased first\nand then sanitized with array_index_nospec.\n\nKasper Acknowledgements: Jakob Koschel, Brian Johannesmeyer, Kaveh\nRazavi, Herbert Bos, Cristiano Giuffrida from the VUSec group at VU\nAmsterdam.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be6f2706-7acf-439f-a5a8-a8390d64efac",  "id": "CVE-2015-1339",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1339"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in the cuse_channel_release function in fs/fuse/cuse.c in the Linux kernel before 4.4 allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact by opening /dev/cuse many times.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "730f0bbb-0e72-4ac4-a62f-d0cf8eed0145",  "id": "CVE-2024-35999",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: missing lock when picking channel\n\nCoverity spotted a place where we should have been holding the\nchannel lock when accessing the ses channel index.\n\nAddresses-Coverity: 1582039 (\"Data race condition (MISSING_LOCK)\")",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d27afc2-3659-486b-a0c5-b7aab479a53f",  "id": "CVE-2021-47149",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47149"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fujitsu: fix potential null-ptr-deref\n\nIn fmvj18x_get_hwinfo(), if ioremap fails there will be NULL pointer\nderef. To fix this, check the return value of ioremap and return -1\nto the caller in case of failure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "048063e5-0acc-493f-8809-2efd43b8bca0",  "id": "CVE-2024-40988",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix UBSAN warning in kv_dpm.c\n\nAdds bounds check for sumo_vid_mapping_entry.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "05b22f87-19af-4387-9630-15c204a67272",  "id": "CVE-2022-49540",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Fix race in schedule and flush work\n\nWhile booting secondary CPUs, cpus_read_[lock/unlock] is not keeping\nonline cpumask stable. The transient online mask results in below\ncalltrace.\n\n[    0.324121] CPU1: Booted secondary processor 0x0000000001 [0x410fd083]\n[    0.346652] Detected PIPT I-cache on CPU2\n[    0.347212] CPU2: Booted secondary processor 0x0000000002 [0x410fd083]\n[    0.377255] Detected PIPT I-cache on CPU3\n[    0.377823] CPU3: Booted secondary processor 0x0000000003 [0x410fd083]\n[    0.379040] ------------[ cut here ]------------\n[    0.383662] WARNING: CPU: 0 PID: 10 at kernel/workqueue.c:3084 __flush_work+0x12c/0x138\n[    0.384850] Modules linked in:\n[    0.385403] CPU: 0 PID: 10 Comm: rcu_tasks_rude_ Not tainted 5.17.0-rc3-v8+ #13\n[    0.386473] Hardware name: Raspberry Pi 4 Model B Rev 1.4 (DT)\n[    0.387289] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[    0.388308] pc : __flush_work+0x12c/0x138\n[    0.388970] lr : __flush_work+0x80/0x138\n[    0.389620] sp : ffffffc00aaf3c60\n[    0.390139] x29: ffffffc00aaf3d20 x28: ffffffc009c16af0 x27: ffffff80f761df48\n[    0.391316] x26: 0000000000000004 x25: 0000000000000003 x24: 0000000000000100\n[    0.392493] x23: ffffffffffffffff x22: ffffffc009c16b10 x21: ffffffc009c16b28\n[    0.393668] x20: ffffffc009e53861 x19: ffffff80f77fbf40 x18: 00000000d744fcc9\n[    0.394842] x17: 000000000000000b x16: 00000000000001c2 x15: ffffffc009e57550\n[    0.396016] x14: 0000000000000000 x13: ffffffffffffffff x12: 0000000100000000\n[    0.397190] x11: 0000000000000462 x10: ffffff8040258008 x9 : 0000000100000000\n[    0.398364] x8 : 0000000000000000 x7 : ffffffc0093c8bf4 x6 : 0000000000000000\n[    0.399538] x5 : 0000000000000000 x4 : ffffffc00a976e40 x3 : ffffffc00810444c\n[    0.400711] x2 : 0000000000000004 x1 : 0000000000000000 x0 : 0000000000000000\n[    0.401886] Call trace:\n[    0.402309]  __flush_work+0x12c/0x138\n[    0.402941]  schedule_on_each_cpu+0x228/0x278\n[    0.403693]  rcu_tasks_rude_wait_gp+0x130/0x144\n[    0.404502]  rcu_tasks_kthread+0x220/0x254\n[    0.405264]  kthread+0x174/0x1ac\n[    0.405837]  ret_from_fork+0x10/0x20\n[    0.406456] irq event stamp: 102\n[    0.406966] hardirqs last  enabled at (101): [<ffffffc0093c8468>] _raw_spin_unlock_irq+0x78/0xb4\n[    0.408304] hardirqs last disabled at (102): [<ffffffc0093b8270>] el1_dbg+0x24/0x5c\n[    0.409410] softirqs last  enabled at (54): [<ffffffc0081b80c8>] local_bh_enable+0xc/0x2c\n[    0.410645] softirqs last disabled at (50): [<ffffffc0081b809c>] local_bh_disable+0xc/0x2c\n[    0.411890] ---[ end trace 0000000000000000 ]---\n[    0.413000] smp: Brought up 1 node, 4 CPUs\n[    0.413762] SMP: Total of 4 processors activated.\n[    0.414566] CPU features: detected: 32-bit EL0 Support\n[    0.415414] CPU features: detected: 32-bit EL1 Support\n[    0.416278] CPU features: detected: CRC32 instructions\n[    0.447021] Callback from call_rcu_tasks_rude() invoked.\n[    0.506693] Callback from call_rcu_tasks() invoked.\n\nThis commit therefore fixes this issue by applying a single-CPU\noptimization to the RCU Tasks Rude grace-period process.  The key point\nhere is that the purpose of this RCU flavor is to force a schedule on\neach online CPU since some past event.  But the rcu_tasks_rude_wait_gp()\nfunction runs in the context of the RCU Tasks Rude's grace-period kthread,\nso there must already have been a context switch on the current CPU since\nthe call to either synchronize_rcu_tasks_rude() or call_rcu_tasks_rude().\nSo if there is only a single CPU online, RCU Tasks Rude's grace-period\nkthread does not need to anything at all.\n\nIt turns out that the rcu_tasks_rude_wait_gp() function's call to\nschedule_on_each_cpu() causes problems during early boot.  During that\ntime, there is only one online CPU, namely the boot CPU.  Therefore,\napplying this single-CPU optimization fixes early-boot instances of\nthis problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3436974-8822-4c35-a4a8-885dc98f67c2",  "id": "CVE-2015-8374",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8374"  },  "ratings": [    {      "score": 4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local users to obtain sensitive pre-truncation information from a file via a clone action.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b1b0a25d-70fb-4f37-bf86-0db5ee4148d1",  "id": "CLSA-2022-1660238929",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d89f5b6-6749-4cda-ba0d-c51b73c93596",  "id": "CVE-2026-43258",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nalpha: fix user-space corruption during memory compaction\n\nAlpha systems can suffer sporadic user-space crashes and heap\ncorruption when memory compaction is enabled.\n\nSymptoms include SIGSEGV, glibc allocator failures (e.g. \"unaligned\ntcache chunk\"), and compiler internal errors. The failures disappear\nwhen compaction is disabled or when using global TLB invalidation.\n\nThe root cause is insufficient TLB shootdown during page migration.\nAlpha relies on ASN-based MM context rollover for instruction cache\ncoherency, but this alone is not sufficient to prevent stale data or\ninstruction translations from surviving migration.\n\nFix this by introducing a migration-specific helper that combines:\n  - MM context invalidation (ASN rollover),\n  - immediate per-CPU TLB invalidation (TBI),\n  - synchronous cross-CPU shootdown when required.\n\nThe helper is used only by migration/compaction paths to avoid changing\nglobal TLB semantics.\n\nAdditionally, update flush_tlb_other(), pte_clear(), to use\nREAD_ONCE()/WRITE_ONCE() for correct SMP memory ordering.\n\nThis fixes observed crashes on both UP and SMP Alpha systems.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84489f31-724a-4e32-9b15-ef38e044af0b",  "id": "CVE-2024-41064",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/eeh: avoid possible crash when edev->pdev changes\n\nIf a PCI device is removed during eeh_pe_report_edev(), edev->pdev\nwill change and can cause a crash, hold the PCI rescan/remove lock\nwhile taking a copy of edev->pdev->bus.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "60e16fba-3d98-4b16-8b60-cf307989790c",  "id": "CVE-2024-26675",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp_async: limit MRU to 64K\n\nsyzbot triggered a warning [1] in __alloc_pages():\n\nWARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)\n\nWillem fixed a similar issue in commit c0a2a1b0d631 (\"ppp: limit MRU to 64K\")\n\nAdopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)\n\n[1]:\n\n WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\nModules linked in:\nCPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\nWorkqueue: events_unbound flush_to_ldisc\npstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537\nsp : ffff800093967580\nx29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000\nx26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0\nx23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8\nx20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120\nx17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005\nx14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000\nx11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001\nx8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f\nx5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020\nx2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0\nCall trace:\n  __alloc_pages+0x308/0x698 mm/page_alloc.c:4543\n  __alloc_pages_node include/linux/gfp.h:238 [inline]\n  alloc_pages_node include/linux/gfp.h:261 [inline]\n  __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926\n  __do_kmalloc_node mm/slub.c:3969 [inline]\n  __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001\n  kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590\n  __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651\n  __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715\n  netdev_alloc_skb include/linux/skbuff.h:3235 [inline]\n  dev_alloc_skb include/linux/skbuff.h:3248 [inline]\n  ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline]\n  ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341\n  tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390\n  tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37\n  receive_buf drivers/tty/tty_buffer.c:444 [inline]\n  flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494\n  process_one_work+0x694/0x1204 kernel/workqueue.c:2633\n  process_scheduled_works kernel/workqueue.c:2706 [inline]\n  worker_thread+0x938/0xef4 kernel/workqueue.c:2787\n  kthread+0x288/0x310 kernel/kthread.c:388\n  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84191a40-fa9d-4086-8448-64b0f2823e14",  "id": "CVE-2012-0058",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0058"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The kiocb_batch_free function in fs/aio.c in the Linux kernel before 3.2.2 allows local users to cause a denial of service (OOPS) via vectors that trigger incorrect iocb management.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04750910-8ae7-4176-97b3-1ea10ec33a4b",  "id": "CVE-2017-12190",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12190"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    400,    772  ],  "analysis": {    "state": "in_triage"  },  "description": "The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ab0e353c-dd53-46bb-b80a-58f08e1cea74",  "id": "CVE-2023-35824",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35824"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "631975d7-2768-47ef-a744-88a4b4e01e4e",  "id": "OESA-2025-2328",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f665e654-a85b-4bf1-bf97-3288b0735e4a",  "id": "CVE-2024-56759",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free when COWing tree bock and tracing is enabled\n\nWhen a COWing a tree block, at btrfs_cow_block(), and we have the\ntracepoint trace_btrfs_cow_block() enabled and preemption is also enabled\n(CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent\nbuffer while inside the tracepoint code. This is because in some paths\nthat call btrfs_cow_block(), such as btrfs_search_slot(), we are holding\nthe last reference on the extent buffer @buf so btrfs_force_cow_block()\ndrops the last reference on the @buf extent buffer when it calls\nfree_extent_buffer_stale(buf), which schedules the release of the extent\nbuffer with RCU. This means that if we are on a kernel with preemption,\nthe current task may be preempted before calling trace_btrfs_cow_block()\nand the extent buffer already released by the time trace_btrfs_cow_block()\nis called, resulting in a use-after-free.\n\nFix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to\nbtrfs_force_cow_block() before the COWed extent buffer is freed.\nThis also has a side effect of invoking the tracepoint in the tree defrag\ncode, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is\ncalled there, but this is fine and it was actually missing there.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "05012672-89ec-468b-873b-36b591a844c9",  "id": "CVE-2011-1927",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1927"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The ip_expire function in net/ipv4/ip_fragment.c in the Linux kernel before 2.6.39 does not properly construct ICMP_TIME_EXCEEDED packets after a timeout, which allows remote attackers to cause a denial of service (invalid pointer dereference) via crafted fragmented packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3f7801d-b75b-46ed-b925-5e81fd1c5b5c",  "id": "CVE-2023-52644",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled\n\nWhen QoS is disabled, the queue priority value will not map to the correct\nieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS\nis disabled to prevent trying to stop/wake a non-existent queue and failing\nto stop/wake the actual queue instantiated.\n\nLog of issue before change (with kernel parameter qos=0):\n    [  +5.112651] ------------[ cut here ]------------\n    [  +0.000005] WARNING: CPU: 7 PID: 25513 at net/mac80211/util.c:449 __ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000067] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3\n    [  +0.000044]  videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common\n    [  +0.000055]  usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43(O)]\n    [  +0.000009] CPU: 7 PID: 25513 Comm: irq/17-b43 Tainted: G        W  O       6.6.7 #1-NixOS\n    [  +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019\n    [  +0.000001] RIP: 0010:__ieee80211_wake_queue+0xd5/0x180 [mac80211]\n    [  +0.000046] Code: 00 45 85 e4 0f 85 9b 00 00 00 48 8d bd 40 09 00 00 f0 48 0f ba ad 48 09 00 00 00 72 0f 5b 5d 41 5c 41 5d 41 5e e9 cb 6d 3c d0 <0f> 0b 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8d b4 16 94 00 00\n    [  +0.000002] RSP: 0018:ffffc90003c77d60 EFLAGS: 00010097\n    [  +0.000001] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000\n    [  +0.000001] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88820b924900\n    [  +0.000002] RBP: ffff88820b924900 R08: ffffc90003c77d90 R09: 000000000003bfd0\n    [  +0.000001] R10: ffff88820b924900 R11: ffffc90003c77c68 R12: 0000000000000000\n    [  +0.000001] R13: 0000000000000000 R14: ffffc90003c77d90 R15: ffffffffc0fa6f40\n    [  +0.000001] FS:  0000000000000000(0000) GS:ffff88846fb80000(0000) knlGS:0000000000000000\n    [  +0.000001] CS:  0010 DS: 0\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c6d2b356-877f-4951-b46b-69f90e06cbad",  "id": "CVE-2022-49106",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: vchiq_arm: Avoid NULL ptr deref in vchiq_dump_platform_instances\n\nvchiq_get_state() can return a NULL pointer. So handle this cases and\navoid a NULL pointer derefence in vchiq_dump_platform_instances.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4f9a9443-6390-4103-a2a0-9352b86452d9",  "id": "CVE-2010-4252",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4252"  },  "ratings": [    {      "score": 7.5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    287  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "06adf402-efa3-4d33-89ea-347c7a856d82",  "id": "CVE-2010-2248",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2248"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel before 2.6.34-rc4 allows remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value, as demonstrated by a response from an OS/2 server, related to the CIFSSMBWrite and CIFSSMBWrite2 functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18451a11-941b-428b-8039-7ef8beefd101",  "id": "CVE-2011-4081",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4081"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "crypto/ghash-generic.c in the Linux kernel before 3.1 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by triggering a failed or missing ghash_setkey function call, followed by a (1) ghash_update function call or (2) ghash_final function call, as demonstrated by a write operation on an AF_ALG socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31971dea-056a-46fd-9137-83cfc3275279",  "id": "CVE-2023-53098",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rc: gpio-ir-recv: add remove function\n\nIn case runtime PM is enabled, do runtime PM clean up to remove\ncpu latency qos request, otherwise driver removal may have below\nkernel dump:\n\n[   19.463299] Unable to handle kernel NULL pointer dereference at\nvirtual address 0000000000000048\n[   19.472161] Mem abort info:\n[   19.474985]   ESR = 0x0000000096000004\n[   19.478754]   EC = 0x25: DABT (current EL), IL = 32 bits\n[   19.484081]   SET = 0, FnV = 0\n[   19.487149]   EA = 0, S1PTW = 0\n[   19.490361]   FSC = 0x04: level 0 translation fault\n[   19.495256] Data abort info:\n[   19.498149]   ISV = 0, ISS = 0x00000004\n[   19.501997]   CM = 0, WnR = 0\n[   19.504977] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000049f81000\n[   19.511432] [0000000000000048] pgd=0000000000000000,\np4d=0000000000000000\n[   19.518245] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[   19.524520] Modules linked in: gpio_ir_recv(+) rc_core [last\nunloaded: rc_core]\n[   19.531845] CPU: 0 PID: 445 Comm: insmod Not tainted\n6.2.0-rc1-00028-g2c397a46d47c #72\n[   19.531854] Hardware name: FSL i.MX8MM EVK board (DT)\n[   19.531859] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS\nBTYPE=--)\n[   19.551777] pc : cpu_latency_qos_remove_request+0x20/0x110\n[   19.557277] lr : gpio_ir_recv_runtime_suspend+0x18/0x30\n[gpio_ir_recv]\n[   19.557294] sp : ffff800008ce3740\n[   19.557297] x29: ffff800008ce3740 x28: 0000000000000000 x27:\nffff800008ce3d50\n[   19.574270] x26: ffffc7e3e9cea100 x25: 00000000000f4240 x24:\nffffc7e3f9ef0e30\n[   19.574284] x23: 0000000000000000 x22: ffff0061803820f4 x21:\n0000000000000008\n[   19.574296] x20: ffffc7e3fa75df30 x19: 0000000000000020 x18:\nffffffffffffffff\n[   19.588570] x17: 0000000000000000 x16: ffffc7e3f9efab70 x15:\nffffffffffffffff\n[   19.595712] x14: ffff800008ce37b8 x13: ffff800008ce37aa x12:\n0000000000000001\n[   19.602853] x11: 0000000000000001 x10: ffffcbe3ec0dff87 x9 :\n0000000000000008\n[   19.609991] x8 : 0101010101010101 x7 : 0000000000000000 x6 :\n000000000f0bfe9f\n[   19.624261] x5 : 00ffffffffffffff x4 : 0025ab8e00000000 x3 :\nffff006180382010\n[   19.631405] x2 : ffffc7e3e9ce8030 x1 : ffffc7e3fc3eb810 x0 :\n0000000000000020\n[   19.638548] Call trace:\n[   19.640995]  cpu_latency_qos_remove_request+0x20/0x110\n[   19.646142]  gpio_ir_recv_runtime_suspend+0x18/0x30 [gpio_ir_recv]\n[   19.652339]  pm_generic_runtime_suspend+0x2c/0x44\n[   19.657055]  __rpm_callback+0x48/0x1dc\n[   19.660807]  rpm_callback+0x6c/0x80\n[   19.664301]  rpm_suspend+0x10c/0x640\n[   19.667880]  rpm_idle+0x250/0x2d0\n[   19.671198]  update_autosuspend+0x38/0xe0\n[   19.675213]  pm_runtime_set_autosuspend_delay+0x40/0x60\n[   19.680442]  gpio_ir_recv_probe+0x1b4/0x21c [gpio_ir_recv]\n[   19.685941]  platform_probe+0x68/0xc0\n[   19.689610]  really_probe+0xc0/0x3dc\n[   19.693189]  __driver_probe_device+0x7c/0x190\n[   19.697550]  driver_probe_device+0x3c/0x110\n[   19.701739]  __driver_attach+0xf4/0x200\n[   19.705578]  bus_for_each_dev+0x70/0xd0\n[   19.709417]  driver_attach+0x24/0x30\n[   19.712998]  bus_add_driver+0x17c/0x240\n[   19.716834]  driver_register+0x78/0x130\n[   19.720676]  __platform_driver_register+0x28/0x34\n[   19.725386]  gpio_ir_recv_driver_init+0x20/0x1000 [gpio_ir_recv]\n[   19.731404]  do_one_initcall+0x44/0x2ac\n[   19.735243]  do_init_module+0x48/0x1d0\n[   19.739003]  load_module+0x19fc/0x2034\n[   19.742759]  __do_sys_finit_module+0xac/0x12c\n[   19.747124]  __arm64_sys_finit_module+0x20/0x30\n[   19.751664]  invoke_syscall+0x48/0x114\n[   19.755420]  el0_svc_common.constprop.0+0xcc/0xec\n[   19.760132]  do_el0_svc+0x38/0xb0\n[   19.763456]  el0_svc+0x2c/0x84\n[   19.766516]  el0t_64_sync_handler+0xf4/0x120\n[   19.770789]  el0t_64_sync+0x190/0x194\n[   19.774460] Code: 910003fd a90153f3 aa0003f3 91204021 (f9401400)\n[   19.780556] ---[ end trace 0000000000000000 ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b109b114-ae1c-4dcf-b0a1-61d76ca95f91",  "id": "CLSA-2026-1770820398",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "50778e8e-9d87-4b2e-be02-6a182b9fdbab",  "id": "DSA-4475-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dfa0f163-de46-41bb-8eca-b44bc587161d",  "id": "CVE-2025-38039",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled\n\nWhen attempting to enable MQPRIO while HTB offload is already\nconfigured, the driver currently returns `-EINVAL` and triggers a\n`WARN_ON`, leading to an unnecessary call trace.\n\nUpdate the code to handle this case more gracefully by returning\n`-EOPNOTSUPP` instead, while also providing a helpful user message.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99906c8a-a492-4a5e-bb13-cab0c6d89f11",  "id": "CVE-2023-52836",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/ww_mutex/test: Fix potential workqueue corruption\n\nIn some cases running with the test-ww_mutex code, I was seeing\nodd behavior where sometimes it seemed flush_workqueue was\nreturning before all the work threads were finished.\n\nOften this would cause strange crashes as the mutexes would be\nfreed while they were being used.\n\nLooking at the code, there is a lifetime problem as the\ncontrolling thread that spawns the work allocates the\n\"struct stress\" structures that are passed to the workqueue\nthreads. Then when the workqueue threads are finished,\nthey free the stress struct that was passed to them.\n\nUnfortunately the workqueue work_struct node is in the stress\nstruct. Which means the work_struct is freed before the work\nthread returns and while flush_workqueue is waiting.\n\nIt seems like a better idea to have the controlling thread\nboth allocate and free the stress structures, so that we can\nbe sure we don't corrupt the workqueue by freeing the structure\nprematurely.\n\nSo this patch reworks the test to do so, and with this change\nI no longer see the early flush_workqueue returns.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "28ea6d1d-1c88-4260-af1c-e571f0f040f2",  "id": "CVE-2022-49067",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit\n\nmpe: On 64-bit Book3E vmalloc space starts at 0x8000000000000000.\n\nBecause of the way __pa() works we have:\n  __pa(0x8000000000000000) == 0, and therefore\n  virt_to_pfn(0x8000000000000000) == 0, and therefore\n  virt_addr_valid(0x8000000000000000) == true\n\nWhich is wrong, virt_addr_valid() should be false for vmalloc space.\nIn fact all vmalloc addresses that alias with a valid PFN will return\ntrue from virt_addr_valid(). That can cause bugs with hardened usercopy\nas described below by Kefeng Wang:\n\n  When running ethtool eth0 on 64-bit Book3E, a BUG occurred:\n\n    usercopy: Kernel memory exposure attempt detected from SLUB object not in SLUB page?! (offset 0, size 1048)!\n    kernel BUG at mm/usercopy.c:99\n    ...\n    usercopy_abort+0x64/0xa0 (unreliable)\n    __check_heap_object+0x168/0x190\n    __check_object_size+0x1a0/0x200\n    dev_ethtool+0x2494/0x2b20\n    dev_ioctl+0x5d0/0x770\n    sock_do_ioctl+0xf0/0x1d0\n    sock_ioctl+0x3ec/0x5a0\n    __se_sys_ioctl+0xf0/0x160\n    system_call_exception+0xfc/0x1f0\n    system_call_common+0xf8/0x200\n\n  The code shows below,\n\n    data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));\n    copy_to_user(useraddr, data, gstrings.len * ETH_GSTRING_LEN))\n\n  The data is alloced by vmalloc(), virt_addr_valid(ptr) will return true\n  on 64-bit Book3E, which leads to the panic.\n\n  As commit 4dd7554a6456 (\"powerpc/64: Add VIRTUAL_BUG_ON checks for __va\n  and __pa addresses\") does, make sure the virt addr above PAGE_OFFSET in\n  the virt_addr_valid() for 64-bit, also add upper limit check to make\n  sure the virt is below high_memory.\n\n  Meanwhile, for 32-bit PAGE_OFFSET is the virtual address of the start\n  of lowmem, high_memory is the upper low virtual address, the check is\n  suitable for 32-bit, this will fix the issue mentioned in commit\n  602946ec2f90 (\"powerpc: Set max_mapnr correctly\") too.\n\nOn 32-bit there is a similar problem with high memory, that was fixed in\ncommit 602946ec2f90 (\"powerpc: Set max_mapnr correctly\"), but that\ncommit breaks highmem and needs to be reverted.\n\nWe can't easily fix __pa(), we have code that relies on its current\nbehaviour. So for now add extra checks to virt_addr_valid().\n\nFor 64-bit Book3S the extra checks are not necessary, the combination of\nvirt_to_pfn() and pfn_valid() should yield the correct result, but they\nare harmless.\n\n[mpe: Add additional change log detail]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "44d90367-9587-475d-8533-b553da48c18c",  "id": "DSA-2621-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d6583f83-b368-4c44-a67c-60811c2304fd",  "id": "MGASA-2015-0041",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0098e073-02c2-45e3-8666-e8d0ddadee54",  "id": "CVE-2014-3145",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3145"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions.  NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "02069ad5-63f4-4b64-9e5c-753ba9322bee",  "id": "CVE-2025-38066",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: prevent BUG_ON by blocking retries on failed device resumes\n\nA cache device failing to resume due to mapping errors should not be\nretried, as the failure leaves a partially initialized policy object.\nRepeating the resume operation risks triggering BUG_ON when reloading\ncache mappings into the incomplete policy object.\n\nReproduce steps:\n\n1. create a cache metadata consisting of 512 or more cache blocks,\n   with some mappings stored in the first array block of the mapping\n   array. Here we use cache_restore v1.0 to build the metadata.\n\ncat <<EOF >> cmeta.xml\n<superblock uuid=\"\" block_size=\"128\" nr_cache_blocks=\"512\" \\\npolicy=\"smq\" hint_width=\"4\">\n  <mappings>\n    <mapping cache_block=\"0\" origin_block=\"0\" dirty=\"false\"/>\n  </mappings>\n</superblock>\nEOF\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ncache_restore -i cmeta.xml -o /dev/mapper/cmeta --metadata-version=2\ndmsetup remove cmeta\n\n2. wipe the second array block of the mapping array to simulate\n   data degradations.\n\nmapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \\\n2>/dev/null | hexdump -e '1/8 \"%u\\n\"')\nablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \\\n2>/dev/null | hexdump -e '1/8 \"%u\\n\"')\ndd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock\n\n3. try bringing up the cache device. The resume is expected to fail\n   due to the broken array block.\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 65536 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 524288 linear /dev/sdc 262144\"\ndmsetup create cache --notable\ndmsetup load cache --table \"0 524288 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\ndmsetup resume cache\n\n4. try resuming the cache again. An unexpected BUG_ON is triggered\n   while loading cache mappings.\n\ndmsetup resume cache\n\nKernel logs:\n\n(snip)\n------------[ cut here ]------------\nkernel BUG at drivers/md/dm-cache-policy-smq.c:752!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 332 Comm: dmsetup Not tainted 6.13.4 #3\nRIP: 0010:smq_load_mapping+0x3e5/0x570\n\nFix by disallowing resume operations for devices that failed the\ninitial attempt.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b417c391-984e-4fc1-af86-df40623e70f0",  "id": "CVE-2022-50367",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: fix UAF/GPF bug in nilfs_mdt_destroy\n\nIn alloc_inode, inode_init_always() could return -ENOMEM if\nsecurity_inode_alloc() fails, which causes inode->i_private\nuninitialized. Then nilfs_is_metadata_file_inode() returns\ntrue and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(),\nwhich frees the uninitialized inode->i_private\nand leads to crashes(e.g., UAF/GPF).\n\nFix this by moving security_inode_alloc just prior to\nthis_cpu_inc(nr_inodes)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b642b6fc-10b7-4f1d-b526-187d38788230",  "id": "CVE-2022-21546",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix WRITE_SAME No Data Buffer crash\n\nIn newer version of the SBC specs, we have a NDOB bit that indicates there\nis no data buffer that gets written out. If this bit is set using commands\nlike \"sg_write_same --ndob\" we will crash in target_core_iblock/file's\nexecute_write_same handlers when we go to access the se_cmd->t_data_sg\nbecause its NULL.\n\nThis patch adds a check for the NDOB bit in the common WRITE SAME code\nbecause we don't support it. And, it adds a check for zero SG elements in\neach handler in case the initiator tries to send a normal WRITE SAME with\nno data buffer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "62c5f0f9-911d-49d5-9146-76e4d93e90ce",  "id": "CVE-2022-0168",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0168"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "678ffabc-609c-4dc8-831e-7839c34b9027",  "id": "CVE-2018-18021",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18021"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation does not prevent unintended execution modes.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2723701c-ede7-4ab8-ac47-5946f99f3536",  "id": "CVE-2018-10883",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10883"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "30e8cac2-5534-4032-bcbd-1cafae7a84d1",  "id": "CVE-2024-42122",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL pointer check for kzalloc\n\n[Why & How]\nCheck return pointer of kzalloc before using it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8903ef3f-80c7-44d8-97a6-e2ad9b532980",  "id": "CVE-2021-29265",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29265"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f7676fa-a124-4e80-b7c1-21d1d733df52",  "id": "CVE-2021-47644",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47644"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: staging: media: zoran: move videodev alloc\n\nMove some code out of zr36057_init() and create new functions for handling\nzr->video_dev. This permit to ease code reading and fix a zr->video_dev\nmemory leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f259f7e4-ac01-4b2a-8076-7c3ab4a38a13",  "id": "CVE-2024-46760",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: usb: schedule rx work after everything is set up\n\nRight now it's possible to hit NULL pointer dereference in\nrtw_rx_fill_rx_status on hw object and/or its fields because\ninitialization routine can start getting USB replies before\nrtw_dev is fully setup.\n\nThe stack trace looks like this:\n\nrtw_rx_fill_rx_status\nrtw8821c_query_rx_desc\nrtw_usb_rx_handler\n...\nqueue_work\nrtw_usb_read_port_complete\n...\nusb_submit_urb\nrtw_usb_rx_resubmit\nrtw_usb_init_rx\nrtw_usb_probe\n\nSo while we do the async stuff rtw_usb_probe continues and calls\nrtw_register_hw, which does all kinds of initialization (e.g.\nvia ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.\n\nFix this by moving the first usb_submit_urb after everything\nis set up.\n\nFor me, this bug manifested as:\n[    8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped\n[    8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status\nbecause I'm using Larry's backport of rtw88 driver with the NULL\nchecks in rtw_rx_fill_rx_status.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "58eee340-dba1-40bc-977e-6a8704b557d6",  "id": "CVE-2021-47334",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47334"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc/libmasm/module: Fix two use after free in ibmasm_init_one\n\nIn ibmasm_init_one, it calls ibmasm_init_remote_input_dev().\nInside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are\nallocated by input_allocate_device(), and assigned to\nsp->remote.mouse_dev and sp->remote.keybd_dev respectively.\n\nIn the err_free_devices error branch of ibmasm_init_one,\nmouse_dev and keybd_dev are freed by input_free_device(), and return\nerror. Then the execution runs into error_send_message error branch\nof ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called\nto unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev.\n\nMy patch add a \"error_init_remote\" label to handle the error of\nibmasm_init_remote_input_dev(), to avoid the uaf bugs.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bea2f9a6-a423-46ef-96f8-843bc603f8ec",  "id": "CVE-2024-57980",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Fix double free in error path\n\nIf the uvc_status_init() function fails to allocate the int_urb, it will\nfree the dev->status pointer but doesn't reset the pointer to NULL. This\nresults in the kfree() call in uvc_status_cleanup() trying to\ndouble-free the memory. Fix it by resetting the dev->status pointer to\nNULL after freeing it.\n\nReviewed by: Ricardo Ribalda <ribalda@chromium.org>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9c59d11-2e4d-4150-99ff-158005626649",  "id": "CVE-2026-53249",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: restrict IPOPT_SSRR and IPOPT_LSRR options\n\nThis patch restricts setting Loose Source and Record Route (LSRR)\nand Strict Source and Record Route (SSRR) IP options to users\nwith CAP_NET_RAW capability.\n\nThis prevents unprivileged applications from forcing packets to route\nthrough attacker-controlled nodes to leak TCP ISN and possibly other\nprotocol information.\n\nWhile LSRR and SSRR are commonly filtered in many network environments,\nthey may still be supported and forwarded along some network paths.\n\nRFC 7126 (Recommendations on Filtering of IPv4 Packets Containing\nIPv4 Options) recommend to drop these options in 4.3 and 4.4.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d9c2c1d1-33f1-402d-8361-c1042aa94463",  "id": "CVE-2024-27402",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphonet/pep: fix racy skb_queue_empty() use\n\nThe receive queues are protected by their respective spin-lock, not\nthe socket lock. This could lead to skb_peek() unexpectedly\nreturning NULL or a pointer to an already dequeued socket buffer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ec7bacf6-9f14-4442-abad-35429a9fba68",  "id": "CVE-2024-46753",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: handle errors from btrfs_dec_ref() properly\n\nIn walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref().  This is\nincorrect, we have proper error handling here, return the error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "649fe961-f3d1-464f-a670-2f53b27ec32f",  "id": "CVE-2024-50283",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp\n\nksmbd_user_session_put should be called under smb3_preauth_hash_rsp().\nIt will avoid freeing session before calling smb3_preauth_hash_rsp().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "703f70ad-b182-439e-b650-6c2865acb583",  "id": "CVE-2021-47582",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47582"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Make do_proc_control() and do_proc_bulk() killable\n\nThe USBDEVFS_CONTROL and USBDEVFS_BULK ioctls invoke\nusb_start_wait_urb(), which contains an uninterruptible wait with a\nuser-specified timeout value.  If timeout value is very large and the\ndevice being accessed does not respond in a reasonable amount of time,\nthe kernel will complain about \"Task X blocked for more than N\nseconds\", as found in testing by syzbot:\n\nINFO: task syz-executor.0:8700 blocked for more than 143 seconds.\n      Not tainted 5.14.0-rc7-syzkaller #0\n\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:syz-executor.0  state:D stack:23192 pid: 8700 ppid:  8455 flags:0x00004004\nCall Trace:\n context_switch kernel/sched/core.c:4681 [inline]\n __schedule+0xc07/0x11f0 kernel/sched/core.c:5938\n schedule+0x14b/0x210 kernel/sched/core.c:6017\n schedule_timeout+0x98/0x2f0 kernel/time/timer.c:1857\n do_wait_for_common+0x2da/0x480 kernel/sched/completion.c:85\n __wait_for_common kernel/sched/completion.c:106 [inline]\n wait_for_common kernel/sched/completion.c:117 [inline]\n wait_for_completion_timeout+0x46/0x60 kernel/sched/completion.c:157\n usb_start_wait_urb+0x167/0x550 drivers/usb/core/message.c:63\n do_proc_bulk+0x978/0x1080 drivers/usb/core/devio.c:1236\n proc_bulk drivers/usb/core/devio.c:1273 [inline]\n usbdev_do_ioctl drivers/usb/core/devio.c:2547 [inline]\n usbdev_ioctl+0x3441/0x6b10 drivers/usb/core/devio.c:2713\n...\n\nTo fix this problem, this patch replaces usbfs's calls to\nusb_control_msg() and usb_bulk_msg() with special-purpose code that\ndoes essentially the same thing (as recommended in the comment for\nusb_start_wait_urb()), except that it always uses a killable wait and\nit uses GFP_KERNEL rather than GFP_NOIO.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10c7efb7-7713-4d15-9641-ac3add76d218",  "id": "CVE-2019-19039",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19039"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    532  ],  "analysis": {    "state": "in_triage"  },  "description": "__btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program. NOTE: The BTRFS development team disputes this issues as not being a vulnerability because “1) The kernel provide facilities to restrict access to dmesg - dmesg_restrict=1 sysctl option. So it's really up to the system administrator to judge whether dmesg access shall be disallowed or not. 2) WARN/WARN_ON are widely used macros in the linux kernel. If this CVE is considered valid this would mean there are literally thousands CVE lurking in the kernel - something which clearly is not the case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b47b10e9-6b1b-4476-85f0-0b68097b45b4",  "id": "CVE-2023-53521",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ses: Fix slab-out-of-bounds in ses_intf_remove()\n\nA fix for:\n\nBUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses]\nRead of size 8 at addr ffff88a10d32e5d8 by task rmmod/12013\n\nWhen edev->components is zero, accessing edev->component[0] members is\nwrong.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3505483-371c-4cb2-965d-3c5540b40b01",  "id": "CVE-2026-41677",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125,    1284  ],  "analysis": {    "state": "in_triage"  },  "description": "rust-openssl provides OpenSSL bindings for the Rust programming language.  From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this. This vulnerability is fixed in 0.10.78.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e940cac-b53d-43c8-9dbb-ccce836702e5",  "id": "CVE-2015-7509",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7509"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/ext4/namei.c in the Linux kernel before 3.7 allows physically proximate attackers to cause a denial of service (system crash) via a crafted no-journal filesystem, a related issue to CVE-2013-2015.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d20afd7-d67a-4c11-87e1-d7ff3963ec9a",  "id": "CVE-2014-3184",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3184"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The report_fixup functions in the HID subsystem in the Linux kernel before 3.16.2 might allow physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f138738-d37b-4541-ba62-72f79fd2b231",  "id": "CVE-2024-41069",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: topology: Fix references to freed memory\n\nMost users after parsing a topology file, release memory used by it, so\nhaving pointer references directly into topology file contents is wrong.\nUse devm_kmemdup(), to allocate memory as needed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7425ca39-82c4-4a7e-8366-077228c6d8e9",  "id": "CVE-2012-2390",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2390"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in mm/hugetlb.c in the Linux kernel before 3.4.2 allows local users to cause a denial of service (memory consumption or system crash) via invalid MAP_HUGETLB mmap operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "234e26d5-08d5-48d1-8959-3c962b50a962",  "id": "CVE-2024-49937",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: Set correct chandef when starting CAC\n\nWhen starting CAC in a mode other than AP mode, it return a\n\"WARNING: CPU: 0 PID: 63 at cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\"\ncaused by the chandef.chan being null at the end of CAC.\n\nSolution: Ensure the channel definition is set for the different modes\nwhen starting CAC to avoid getting a NULL 'chan' at the end of CAC.\n\n Call Trace:\n  ? show_regs.part.0+0x14/0x16\n  ? __warn+0x67/0xc0\n  ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\n  ? report_bug+0xa7/0x130\n  ? exc_overflow+0x30/0x30\n  ? handle_bug+0x27/0x50\n  ? exc_invalid_op+0x18/0x60\n  ? handle_exception+0xf6/0xf6\n  ? exc_overflow+0x30/0x30\n  ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\n  ? exc_overflow+0x30/0x30\n  ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\n  ? regulatory_propagate_dfs_state.cold+0x1b/0x4c [cfg80211]\n  ? cfg80211_propagate_cac_done_wk+0x1a/0x30 [cfg80211]\n  ? process_one_work+0x165/0x280\n  ? worker_thread+0x120/0x3f0\n  ? kthread+0xc2/0xf0\n  ? process_one_work+0x280/0x280\n  ? kthread_complete_and_exit+0x20/0x20\n  ? ret_from_fork+0x19/0x24\n\n[shorten subject, remove OCB, reorder cases to match previous list]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef287879-61ef-412b-9599-fab6fe8219b2",  "id": "CVE-2019-15505",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15505"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via usbip or usbredir).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a6409984-d16f-4b8d-8f66-703846ff033e",  "id": "CVE-2023-6546",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6546"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    366  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "34e1a093-fc88-4f97-ab1e-9199feacb3f9",  "id": "ALSA-2021:4153",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8bd3fe71-73e9-401f-b39b-813408e0071a",  "id": "CVE-2011-2928",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2928"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The befs_follow_link function in fs/befs/linuxvfs.c in the Linux kernel before 3.1-rc3 does not validate the length attribute of long symlinks, which allows local users to cause a denial of service (incorrect pointer dereference and OOPS) by accessing a long symlink on a malformed Be filesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7f7fb35f-3a37-4584-afed-d4fe7421fb78",  "id": "RHSA-2026:1733",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31eda384-e0fd-4ba1-90ff-95c2781938b1",  "id": "CVE-2024-57996",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: don't allow 1 packet limit\n\nThe current implementation does not work correctly with a limit of\n1. iproute2 actually checks for this and this patch adds the check in\nkernel as well.\n\nThis fixes the following syzkaller reported crash:\n\nUBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6\nindex 65535 is out of range for type 'struct sfq_head[128]'\nCPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n  __dump_stack lib/dump_stack.c:79 [inline]\n  dump_stack+0x125/0x19f lib/dump_stack.c:120\n  ubsan_epilogue lib/ubsan.c:148 [inline]\n  __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347\n  sfq_link net/sched/sch_sfq.c:210 [inline]\n  sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238\n  sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500\n  sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525\n  qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026\n  tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319\n  qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026\n  dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296\n  netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline]\n  dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362\n  __dev_close_many+0x214/0x350 net/core/dev.c:1468\n  dev_close_many+0x207/0x510 net/core/dev.c:1506\n  unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738\n  unregister_netdevice_queue+0x2be/0x310 net/core/dev.c:10695\n  unregister_netdevice include/linux/netdevice.h:2893 [inline]\n  __tun_detach+0x6b6/0x1600 drivers/net/tun.c:689\n  tun_detach drivers/net/tun.c:705 [inline]\n  tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3640\n  __fput+0x203/0x840 fs/file_table.c:280\n  task_work_run+0x129/0x1b0 kernel/task_work.c:185\n  exit_task_work include/linux/task_work.h:33 [inline]\n  do_exit+0x5ce/0x2200 kernel/exit.c:931\n  do_group_exit+0x144/0x310 kernel/exit.c:1046\n  __do_sys_exit_group kernel/exit.c:1057 [inline]\n  __se_sys_exit_group kernel/exit.c:1055 [inline]\n  __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1055\n do_syscall_64+0x6c/0xd0\n entry_SYSCALL_64_after_hwframe+0x61/0xcb\nRIP: 0033:0x7fe5e7b52479\nCode: Unable to access opcode bytes at RIP 0x7fe5e7b5244f.\nRSP: 002b:00007ffd3c800398 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe5e7b52479\nRDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000\nRBP: 00007fe5e7bcd2d0 R08: ffffffffffffffb8 R09: 0000000000000014\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007fe5e7bcd2d0\nR13: 0000000000000000 R14: 00007fe5e7bcdd20 R15: 00007fe5e7b24270\n\nThe crash can be also be reproduced with the following (with a tc\nrecompiled to allow for sfq limits of 1):\n\ntc qdisc add dev dummy0 handle 1: root tbf rate 1Kbit burst 100b lat 1s\n../iproute2-6.9.0/tc/tc qdisc add dev dummy0 handle 2: parent 1:10 sfq limit 1\nifconfig dummy0 up\nping -I dummy0 -f -c2 -W0.1 8.8.8.8\nsleep 1\n\nScenario that triggers the crash:\n\n* the first packet is sent and queued in TBF and SFQ; qdisc qlen is 1\n\n* TBF dequeues: it peeks from SFQ which moves the packet to the\n  gso_skb list and keeps qdisc qlen set to 1. TBF is out of tokens so\n  it schedules itself for later.\n\n* the second packet is sent and TBF tries to queues it to SFQ. qdisc\n  qlen is now 2 and because the SFQ limit is 1 the packet is dropped\n  by SFQ. At this point qlen is 1, and all of the SFQ slots are empty,\n  however q->tail is not NULL.\n\nAt this point, assuming no more packets are queued, when sch_dequeue\nruns again it will decrement the qlen for the current empty slot\ncausing an underflow and the subsequent out of bounds access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2dd54482-f0e7-4a53-9358-6b1719908bed",  "id": "openSUSE-SU-2026:21024-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "e52e445b-24d0-4150-822b-d76563b46e68",      "versions": [        {          "component": "sed",          "version": "4.0"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e7c5653b-e4ff-472c-abc8-7819e2cd3ef4",  "id": "CVE-2026-31415",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: avoid overflows in ip6_datagram_send_ctl()\n\nYiming Qian reported :\n<quote>\n I believe I found a locally triggerable kernel bug in the IPv6 sendmsg\n ancillary-data path that can panic the kernel via `skb_under_panic()`\n (local DoS).\n\n The core issue is a mismatch between:\n\n - a 16-bit length accumulator (`struct ipv6_txoptions::opt_flen`, type\n `__u16`) and\n - a pointer to the *last* provided destination-options header (`opt->dst1opt`)\n\n when multiple `IPV6_DSTOPTS` control messages (cmsgs) are provided.\n\n - `include/net/ipv6.h`:\n   - `struct ipv6_txoptions::opt_flen` is `__u16` (wrap possible).\n (lines 291-307, especially 298)\n - `net/ipv6/datagram.c:ip6_datagram_send_ctl()`:\n   - Accepts repeated `IPV6_DSTOPTS` and accumulates into `opt_flen`\n without rejecting duplicates. (lines 909-933)\n - `net/ipv6/ip6_output.c:__ip6_append_data()`:\n   - Uses `opt->opt_flen + opt->opt_nflen` to compute header\n sizes/headroom decisions. (lines 1448-1466, especially 1463-1465)\n - `net/ipv6/ip6_output.c:__ip6_make_skb()`:\n   - Calls `ipv6_push_frag_opts()` if `opt->opt_flen` is non-zero.\n (lines 1930-1934)\n - `net/ipv6/exthdrs.c:ipv6_push_frag_opts()` / `ipv6_push_exthdr()`:\n   - Push size comes from `ipv6_optlen(opt->dst1opt)` (based on the\n pointed-to header). (lines 1179-1185 and 1206-1211)\n\n 1. `opt_flen` is a 16-bit accumulator:\n\n - `include/net/ipv6.h:298` defines `__u16 opt_flen; /* after fragment hdr */`.\n\n 2. `ip6_datagram_send_ctl()` accepts *repeated* `IPV6_DSTOPTS` cmsgs\n and increments `opt_flen` each time:\n\n - In `net/ipv6/datagram.c:909-933`, for `IPV6_DSTOPTS`:\n   - It computes `len = ((hdr->hdrlen + 1) << 3);`\n   - It checks `CAP_NET_RAW` using `ns_capable(net->user_ns,\n CAP_NET_RAW)`. (line 922)\n   - Then it does:\n     - `opt->opt_flen += len;` (line 927)\n     - `opt->dst1opt = hdr;` (line 928)\n\n There is no duplicate rejection here (unlike the legacy\n `IPV6_2292DSTOPTS` path which rejects duplicates at\n `net/ipv6/datagram.c:901-904`).\n\n If enough large `IPV6_DSTOPTS` cmsgs are provided, `opt_flen` wraps\n while `dst1opt` still points to a large (2048-byte)\n destination-options header.\n\n In the attached PoC (`poc.c`):\n\n - 32 cmsgs with `hdrlen=255` => `len = (255+1)*8 = 2048`\n - 1 cmsg with `hdrlen=0` => `len = 8`\n - Total increment: `32*2048 + 8 = 65544`, so `(__u16)opt_flen == 8`\n - The last cmsg is 2048 bytes, so `dst1opt` points to a 2048-byte header.\n\n 3. The transmit path sizes headers using the wrapped `opt_flen`:\n\n- In `net/ipv6/ip6_output.c:1463-1465`:\n  - `headersize = sizeof(struct ipv6hdr) + (opt ? opt->opt_flen +\n opt->opt_nflen : 0) + ...;`\n\n With wrapped `opt_flen`, `headersize`/headroom decisions underestimate\n what will be pushed later.\n\n 4. When building the final skb, the actual push length comes from\n `dst1opt` and is not limited by wrapped `opt_flen`:\n\n - In `net/ipv6/ip6_output.c:1930-1934`:\n   - `if (opt->opt_flen) proto = ipv6_push_frag_opts(skb, opt, proto);`\n - In `net/ipv6/exthdrs.c:1206-1211`, `ipv6_push_frag_opts()` pushes\n `dst1opt` via `ipv6_push_exthdr()`.\n - In `net/ipv6/exthdrs.c:1179-1184`, `ipv6_push_exthdr()` does:\n   - `skb_push(skb, ipv6_optlen(opt));`\n   - `memcpy(h, opt, ipv6_optlen(opt));`\n\n With insufficient headroom, `skb_push()` underflows and triggers\n `skb_under_panic()` -> `BUG()`:\n\n - `net/core/skbuff.c:2669-2675` (`skb_push()` calls `skb_under_panic()`)\n - `net/core/skbuff.c:207-214` (`skb_panic()` ends in `BUG()`)\n\n - The `IPV6_DSTOPTS` cmsg path requires `CAP_NET_RAW` in the target\n netns user namespace (`ns_capable(net->user_ns, CAP_NET_RAW)`).\n - Root (or any task with `CAP_NET_RAW`) can trigger this without user\n namespaces.\n - An unprivileged `uid=1000` user can trigger this if unprivileged\n user namespaces are enabled and it can create a userns+netns to obtain\n namespaced `CAP_NET_RAW` (the attached PoC does this).\n\n - Local denial of service: kernel BUG/panic (system crash).\n -\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'SNYK:SNYK-RHEL6-PERF-16077007'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'SNYK:SNYK-RHEL6-KERNELKDUMPDEVEL-16077013'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'SNYK:SNYK-RHEL6-KERNELDOC-16077011'"    },    {      "name": "EMBA:sbom:4:exploit",      "value": "'SNYK:SNYK-RHEL6-KERNELBOOTWRAPPER-16077015'"    },    {      "name": "EMBA:sbom:5:exploit",      "value": "'SNYK:SNYK-RHEL6-KERNEL-16077009'"    }  ]},{  "bom-ref": "cfadb692-d6d6-4c7e-86de-fa3b507a8246",  "id": "CVE-2023-45863",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45863"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "88cee2e1-a6fa-4b1f-abbf-38b1ccc930b6",  "id": "CVE-2010-3080",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3080"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "Double free vulnerability in the snd_seq_oss_open function in sound/core/seq/oss/seq_oss_init.c in the Linux kernel before 2.6.36-rc4 might allow local users to cause a denial of service or possibly have unspecified other impact via an unsuccessful attempt to open the /dev/sequencer device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ea29a23f-4133-438e-b1ac-74ec25f1ca15",  "id": "CVE-2022-49531",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nloop: implement ->free_disk\n\nEnsure that the lo_device which is stored in the gendisk private\ndata is valid until the gendisk is freed.  Currently the loop driver\nuses a lot of effort to make sure a device is not freed when it is\nstill in use, but to to fix a potential deadlock this will be relaxed\na bit soon.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "59c97e90-b8fd-4065-a46d-a666df589866",  "id": "CVE-2014-3647",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3647"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b7c4a71-21af-4a1c-82f7-424d7ea3f469",  "id": "CVE-2024-53184",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: ubd: Do not use drvdata in release\n\nThe drvdata is not available in release. Let's just use container_of()\nto get the ubd instance. Otherwise, removing a ubd device will result\nin a crash:\n\nRIP: 0033:blk_mq_free_tag_set+0x1f/0xba\nRSP: 00000000e2083bf0  EFLAGS: 00010246\nRAX: 000000006021463a RBX: 0000000000000348 RCX: 0000000062604d00\nRDX: 0000000004208060 RSI: 00000000605241a0 RDI: 0000000000000348\nRBP: 00000000e2083c10 R08: 0000000062414010 R09: 00000000601603f7\nR10: 000000000000133a R11: 000000006038c4bd R12: 0000000000000000\nR13: 0000000060213a5c R14: 0000000062405d20 R15: 00000000604f7aa0\nKernel panic - not syncing: Segfault with no mm\nCPU: 0 PID: 17 Comm: kworker/0:1 Not tainted 6.8.0-rc3-00107-gba3f67c11638 #1\nWorkqueue: events mc_work_proc\nStack:\n 00000000 604f7ef0 62c5d000 62405d20\n e2083c30 6002c776 6002c755 600e47ff\n e2083c60 6025ffe3 04208060 603d36e0\nCall Trace:\n [<6002c776>] ubd_device_release+0x21/0x55\n [<6002c755>] ? ubd_device_release+0x0/0x55\n [<600e47ff>] ? kfree+0x0/0x100\n [<6025ffe3>] device_release+0x70/0xba\n [<60381d6a>] kobject_put+0xb5/0xe2\n [<6026027b>] put_device+0x19/0x1c\n [<6026a036>] platform_device_put+0x26/0x29\n [<6026ac5a>] platform_device_unregister+0x2c/0x2e\n [<6002c52e>] ubd_remove+0xb8/0xd6\n [<6002bb74>] ? mconsole_reply+0x0/0x50\n [<6002b926>] mconsole_remove+0x160/0x1cc\n [<6002bbbc>] ? mconsole_reply+0x48/0x50\n [<6003379c>] ? um_set_signals+0x3b/0x43\n [<60061c55>] ? update_min_vruntime+0x14/0x70\n [<6006251f>] ? dequeue_task_fair+0x164/0x235\n [<600620aa>] ? update_cfs_group+0x0/0x40\n [<603a0e77>] ? __schedule+0x0/0x3ed\n [<60033761>] ? um_set_signals+0x0/0x43\n [<6002af6a>] mc_work_proc+0x77/0x91\n [<600520b4>] process_scheduled_works+0x1af/0x2c3\n [<6004ede3>] ? assign_work+0x0/0x58\n [<600527a1>] worker_thread+0x2f7/0x37a\n [<6004ee3b>] ? set_pf_worker+0x0/0x64\n [<6005765d>] ? arch_local_irq_save+0x0/0x2d\n [<60058e07>] ? kthread_exit+0x0/0x3a\n [<600524aa>] ? worker_thread+0x0/0x37a\n [<60058f9f>] kthread+0x130/0x135\n [<6002068e>] new_thread_handler+0x85/0xb6",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "abd884d3-03cf-4892-9887-51d93fb1de32",  "id": "MGASA-2015-0111",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4579d81f-35b1-49ce-a185-421cfa709559",  "id": "CVE-2010-1641",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1641"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel before 2.6.34-git10 does not verify the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS ioctl request.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "46386530-1bdd-4fe7-999f-246c63a0d7a8",  "id": "CVE-2019-19529",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19529"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.3.11, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c driver, aka CID-4d6636498c41.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "54061f54-0b6a-4a0b-b321-947dfada86a2",  "id": "CVE-2024-41095",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes\n\nIn nv17_tv_get_ld_modes(), the return value of drm_mode_duplicate() is\nassigned to mode, which will lead to a possible NULL pointer dereference\non failure of drm_mode_duplicate(). Add a check to avoid npd.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99a125a9-73f1-4164-a29e-d4c6786e282e",  "id": "CVE-2013-2891",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2891"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/hid/hid-steelseries.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_STEELSERIES is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5fcaca73-0e18-4d2d-9b15-732bd94492e3",  "id": "CVE-2025-38685",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix vmalloc out-of-bounds write in fast_imageblit\n\nThis issue triggers when a userspace program does an ioctl\nFBIOPUT_CON2FBMAP by passing console number and frame buffer number.\nIdeally this maps console to frame buffer and updates the screen if\nconsole is visible.\n\nAs part of mapping it has to do resize of console according to frame\nbuffer info. if this resize fails and returns from vc_do_resize() and\ncontinues further. At this point console and new frame buffer are mapped\nand sets display vars. Despite failure still it continue to proceed\nupdating the screen at later stages where vc_data is related to previous\nframe buffer and frame buffer info and display vars are mapped to new\nframe buffer and eventully leading to out-of-bounds write in\nfast_imageblit(). This bheviour is excepted only when fg_console is\nequal to requested console which is a visible console and updates screen\nwith invalid struct references in fbcon_putcs().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "270ceb87-022e-4314-93ad-c23b945bd26e",  "id": "CVE-2024-44939",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix null ptr deref in dtInsertEntry\n\n[syzbot reported]\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 0 PID: 5061 Comm: syz-executor404 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nRIP: 0010:dtInsertEntry+0xd0c/0x1780 fs/jfs/jfs_dtree.c:3713\n...\n[Analyze]\nIn dtInsertEntry(), when the pointer h has the same value as p, after writing\nname in UniStrncpy_to_le(), p->header.flag will be cleared. This will cause the\npreviously true judgment \"p->header.flag & BT-LEAF\" to change to no after writing\nthe name operation, this leads to entering an incorrect branch and accessing the\nuninitialized object ih when judging this condition for the second time.\n\n[Fix]\nAfter got the page, check freelist first, if freelist == 0 then exit dtInsert()\nand return -EINVAL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b7f017a4-e7d0-4109-8051-0485b831adeb",  "id": "CVE-2013-4591",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4591"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a getxattr system call for the system.nfs4_acl extended attribute of a pathname on an NFSv4 filesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e60b78fc-128c-4de0-ad71-6014985a7c68",  "id": "DLA-814-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e757a6d1-f9c4-480e-9c9c-bb702e59928f",  "id": "RHSA-2025:21248",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8c9805d2-1827-49b0-98b2-81cde77140e0",  "id": "CLSA-2025-1744368964",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "af586418-e5ea-4cb4-896c-0d4cd6047e26",  "id": "SUSE-SU-2019:1124-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b6b3a373-061a-4df0-8eea-8e157354c6c1",  "id": "CVE-2023-38409",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38409"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4e5d5b31-949e-46f7-9e5b-4518de64f602",  "id": "CVE-2019-17055",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17055"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    862  ],  "analysis": {    "state": "in_triage"  },  "description": "base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8be1c927-928e-43f6-bd65-4c77a75a27d3",  "id": "CVE-2022-0854",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0854"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200,    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04bb35d1-58c3-488f-8d27-2d7f22adc33b",  "id": "CVE-2012-6547",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6547"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The __tun_chr_ioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f4e4c85f-45d1-4ed4-a5b5-4d4f5c18242e",  "id": "MGASA-2024-0020",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c745d127-89b5-4d84-84c6-25c2909c0795",  "id": "CVE-2022-48790",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix a possible use-after-free in controller reset during load\n\nUnlike .queue_rq, in .submit_async_event drivers may not check the ctrl\nreadiness for AER submission. This may lead to a use-after-free\ncondition that was observed with nvme-tcp.\n\nThe race condition may happen in the following scenario:\n1. driver executes its reset_ctrl_work\n2. -> nvme_stop_ctrl - flushes ctrl async_event_work\n3. ctrl sends AEN which is received by the host, which in turn\n   schedules AEN handling\n4. teardown admin queue (which releases the queue socket)\n5. AEN processed, submits another AER, calling the driver to submit\n6. driver attempts to send the cmd\n==> use-after-free\n\nIn order to fix that, add ctrl state check to validate the ctrl\nis actually able to accept the AER submission.\n\nThis addresses the above race in controller resets because the driver\nduring teardown should:\n1. change ctrl state to RESETTING\n2. flush async_event_work (as well as other async work elements)\n\nSo after 1,2, any other AER command will find the\nctrl state to be RESETTING and bail out without submitting the AER.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b567c19-2136-4b7a-9622-8db94aaabf10",  "id": "CVE-2026-53325",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nagp/amd64: Fix broken error propagation in agp_amd64_probe()\n\nA NULL pointer dereference was observed in the AMD64 AGP driver when\nrunning in a virtualized environment (e.g. qemu/kvm) without a physical\nAMD northbridge. The crash occurs in amd64_fetch_size() when attempting\nto dereference the pointer returned by node_to_amd_nb(0).\n\nThe root cause of this crash is broken error propagation in\nagp_amd64_probe(): When no AMD northbridges are found, cache_nbs()\ncorrectly returns -ENODEV. However, the probe function erroneously\nchecks the return value against exactly -1, rather than < 0.\n\nAs a result, the hardware absence error is masked, allowing the driver\nto improperly proceed with initialization. It eventually calls\nagp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware\ndoes not exist, node_to_amd_nb(0) returns NULL, leading to a General\nProtection Fault (GPF) when accessing its ->misc member.\n\nFix the issue by correcting the error check in agp_amd64_probe() to\nabort properly when cache_nbs() returns any negative error code. This\nprevents the driver from erroneously proceeding without hardware, thereby\navoiding the subsequent NULL pointer dereference at its source.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6291071b-af2c-47fe-9d1d-2fce8af418df",  "id": "CVE-2017-16650",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16650"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c530803b-3670-479f-9eff-cc11721c9db4",  "id": "CVE-2023-53402",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernel/printk/index.c: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e4cfa31-e677-419b-a985-53b3a89d61fd",  "id": "CVE-2025-38348",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()\n\nRobert Morris reported:\n\n|If a malicious USB device pretends to be an Intersil p54 wifi\n|interface and generates an eeprom_readback message with a large\n|eeprom->v1.len, p54_rx_eeprom_readback() will copy data from the\n|message beyond the end of priv->eeprom.\n|\n|static void p54_rx_eeprom_readback(struct p54_common *priv,\n|                                   struct sk_buff *skb)\n|{\n|        struct p54_hdr *hdr = (struct p54_hdr *) skb->data;\n|        struct p54_eeprom_lm86 *eeprom = (struct p54_eeprom_lm86 *) hdr->data;\n|\n|        if (priv->fw_var >= 0x509) {\n|                memcpy(priv->eeprom, eeprom->v2.data,\n|                       le16_to_cpu(eeprom->v2.len));\n|        } else {\n|                memcpy(priv->eeprom, eeprom->v1.data,\n|                       le16_to_cpu(eeprom->v1.len));\n|        }\n| [...]\n\nThe eeprom->v{1,2}.len is set by the driver in p54_download_eeprom().\nThe device is supposed to provide the same length back to the driver.\nBut yes, it's possible (like shown in the report) to alter the value\nto something that causes a crash/panic due to overrun.\n\nThis patch addresses the issue by adding the size to the common device\ncontext, so p54_rx_eeprom_readback no longer relies on possibly tampered\nvalues... That said, it also checks if the \"firmware\" altered the value\nand no longer copies them.\n\nThe one, small saving grace is: Before the driver tries to read the eeprom,\nit needs to upload >a< firmware. the vendor firmware has a proprietary\nlicense and as a reason, it is not present on most distributions by\ndefault.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "63560f78-4dcb-4a60-b83a-ee1021887487",  "id": "CVE-2011-2707",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2707"  },  "ratings": [    {      "score": 6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The ptrace_setxregs function in arch/xtensa/kernel/ptrace.c in the Linux kernel before 3.1 does not validate user-space pointers, which allows local users to obtain sensitive information from kernel memory locations via a crafted PTRACE_SETXTREGS request.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5f1a6528-2216-4045-9e54-4ca0cc955ebb",  "id": "CVE-2025-38449",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gem: Acquire references on GEM handles for framebuffers\n\nA GEM handle can be released while the GEM buffer object is attached\nto a DRM framebuffer. This leads to the release of the dma-buf backing\nthe buffer object, if any. [1] Trying to use the framebuffer in further\nmode-setting operations leads to a segmentation fault. Most easily\nhappens with driver that use shadow planes for vmap-ing the dma-buf\nduring a page flip. An example is shown below.\n\n[  156.791968] ------------[ cut here ]------------\n[  156.796830] WARNING: CPU: 2 PID: 2255 at drivers/dma-buf/dma-buf.c:1527 dma_buf_vmap+0x224/0x430\n[...]\n[  156.942028] RIP: 0010:dma_buf_vmap+0x224/0x430\n[  157.043420] Call Trace:\n[  157.045898]  <TASK>\n[  157.048030]  ? show_trace_log_lvl+0x1af/0x2c0\n[  157.052436]  ? show_trace_log_lvl+0x1af/0x2c0\n[  157.056836]  ? show_trace_log_lvl+0x1af/0x2c0\n[  157.061253]  ? drm_gem_shmem_vmap+0x74/0x710\n[  157.065567]  ? dma_buf_vmap+0x224/0x430\n[  157.069446]  ? __warn.cold+0x58/0xe4\n[  157.073061]  ? dma_buf_vmap+0x224/0x430\n[  157.077111]  ? report_bug+0x1dd/0x390\n[  157.080842]  ? handle_bug+0x5e/0xa0\n[  157.084389]  ? exc_invalid_op+0x14/0x50\n[  157.088291]  ? asm_exc_invalid_op+0x16/0x20\n[  157.092548]  ? dma_buf_vmap+0x224/0x430\n[  157.096663]  ? dma_resv_get_singleton+0x6d/0x230\n[  157.101341]  ? __pfx_dma_buf_vmap+0x10/0x10\n[  157.105588]  ? __pfx_dma_resv_get_singleton+0x10/0x10\n[  157.110697]  drm_gem_shmem_vmap+0x74/0x710\n[  157.114866]  drm_gem_vmap+0xa9/0x1b0\n[  157.118763]  drm_gem_vmap_unlocked+0x46/0xa0\n[  157.123086]  drm_gem_fb_vmap+0xab/0x300\n[  157.126979]  drm_atomic_helper_prepare_planes.part.0+0x487/0xb10\n[  157.133032]  ? lockdep_init_map_type+0x19d/0x880\n[  157.137701]  drm_atomic_helper_commit+0x13d/0x2e0\n[  157.142671]  ? drm_atomic_nonblocking_commit+0xa0/0x180\n[  157.147988]  drm_mode_atomic_ioctl+0x766/0xe40\n[...]\n[  157.346424] ---[ end trace 0000000000000000 ]---\n\nAcquiring GEM handles for the framebuffer's GEM buffer objects prevents\nthis from happening. The framebuffer's cleanup later puts the handle\nreferences.\n\nCommit 1a148af06000 (\"drm/gem-shmem: Use dma_buf from GEM object\ninstance\") triggers the segmentation fault easily by using the dma-buf\nfield more widely. The underlying issue with reference counting has\nbeen present before.\n\nv2:\n- acquire the handle instead of the BO (Christian)\n- fix comment style (Christian)\n- drop the Fixes tag (Christian)\n- rename err_ gotos\n- add missing Link tag",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9a362c88-5c64-4a2b-b54d-f159c6e39a40",  "id": "RHSA-2026:25237",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f7945a1-dc30-4b7a-bd18-e7baf4dc5f6a",  "id": "CVE-2014-4654",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4654"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d94477ec-35a3-4ffc-b5b3-355d6f71bfa3",  "id": "CVE-2012-2333",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2333"  },  "ratings": [    {      "score": 6.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted TLS packet that is not properly handled during a certain explicit IV calculation.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fbd0aac2-f2ec-408c-8683-9bff46ac01b1",  "id": "CVE-2022-50294",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix memory leak in lbs_init_adapter()\n\nWhen kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not\nreleased. Add free memory to processing error path.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fd1137a4-e4d2-4adc-aa35-bc5e70fe61fc",  "id": "CVE-2015-4002",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4002"  },  "ratings": [    {      "score": 9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e458f52-425e-4d54-b06e-2869e74e759b",  "id": "CVE-2023-52449",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: Fix gluebi NULL pointer dereference caused by ftl notifier\n\nIf both ftl.ko and gluebi.ko are loaded, the notifier of ftl\ntriggers NULL pointer dereference when trying to access\n‘gluebi->desc’ in gluebi_read().\n\nubi_gluebi_init\n  ubi_register_volume_notifier\n    ubi_enumerate_volumes\n      ubi_notify_all\n        gluebi_notify    nb->notifier_call()\n          gluebi_create\n            mtd_device_register\n              mtd_device_parse_register\n                add_mtd_device\n                  blktrans_notify_add   not->add()\n                    ftl_add_mtd         tr->add_mtd()\n                      scan_header\n                        mtd_read\n                          mtd_read_oob\n                            mtd_read_oob_std\n                              gluebi_read   mtd->read()\n                                gluebi->desc - NULL\n\nDetailed reproduction information available at the Link [1],\n\nIn the normal case, obtain gluebi->desc in the gluebi_get_device(),\nand access gluebi->desc in the gluebi_read(). However,\ngluebi_get_device() is not executed in advance in the\nftl_add_mtd() process, which leads to NULL pointer dereference.\n\nThe solution for the gluebi module is to run jffs2 on the UBI\nvolume without considering working with ftl or mtdblock [2].\nTherefore, this problem can be avoided by preventing gluebi from\ncreating the mtdblock device after creating mtd partition of the\ntype MTD_UBIVOLUME.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "584be35b-e436-4c5a-a246-acd957d8d20f",  "id": "CVE-2023-52810",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    1335  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/jfs: Add check for negative db_l2nbperpage\n\nl2nbperpage is log2(number of blks per page), and the minimum legal\nvalue should be 0, not negative.\n\nIn the case of l2nbperpage being negative, an error will occur\nwhen subsequently used as shift exponent.\n\nSyzbot reported this bug:\n\nUBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:799:12\nshift exponent -16777216 is negative",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f838548a-f724-4e97-811e-746cc62016a2",  "id": "CVE-2012-2136",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2136"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel before 3.4.5 does not properly validate a certain length value, which allows local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging access to a TUN/TAP device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5033b114-42f6-4eb4-af7e-392c2b28cc97",  "id": "MGASA-2023-0153",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3e3a4ac6-9e25-4718-ae7b-d60f11c1cdd6",  "id": "CVE-2013-7270",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7270"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The packet_recvmsg function in net/packet/af_packet.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "202e840e-83d3-4e92-98c1-5def42a79d23",  "id": "CVE-2023-52597",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: fix setting of fpc register\n\nkvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control\n(fpc) register of a guest cpu. The new value is tested for validity by\ntemporarily loading it into the fpc register.\n\nThis may lead to corruption of the fpc register of the host process:\nif an interrupt happens while the value is temporarily loaded into the fpc\nregister, and within interrupt context floating point or vector registers\nare used, the current fp/vx registers are saved with save_fpu_regs()\nassuming they belong to user space and will be loaded into fp/vx registers\nwhen returning to user space.\n\ntest_fp_ctl() restores the original user space / host process fpc register\nvalue, however it will be discarded, when returning to user space.\n\nIn result the host process will incorrectly continue to run with the value\nthat was supposed to be used for a guest cpu.\n\nFix this by simply removing the test. There is another test right before\nthe SIE context is entered which will handles invalid values.\n\nThis results in a change of behaviour: invalid values will now be accepted\ninstead of that the ioctl fails with -EINVAL. This seems to be acceptable,\ngiven that this interface is most likely not used anymore, and this is in\naddition the same behaviour implemented with the memory mapped interface\n(replace invalid values with zero) - see sync_regs() in kvm-s390.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "40d23266-4090-4f95-9f3f-dbe1ce7e5878",  "id": "CVE-2025-71075",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: aic94xx: fix use-after-free in device removal path\n\nThe asd_pci_remove() function fails to synchronize with pending tasklets\nbefore freeing the asd_ha structure, leading to a potential\nuse-after-free vulnerability.\n\nWhen a device removal is triggered (via hot-unplug or module unload),\nrace condition can occur.\n\nThe fix adds tasklet_kill() before freeing the asd_ha structure,\nensuring all scheduled tasklets complete before cleanup proceeds.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e11d6fc0-c407-4a80-8298-5254d94cf76d",  "id": "CVE-2011-1770",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1770"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer underflow in the dccp_parse_options function (net/dccp/options.c) in the Linux kernel before 2.6.33.14 allows remote attackers to cause a denial of service via a Datagram Congestion Control Protocol (DCCP) packet with an invalid feature options length, which triggers a buffer over-read.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "93480fe1-6284-4bb8-906d-7d46237718d7",  "id": "CVE-2011-2491",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2491"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The Network Lock Manager (NLM) protocol implementation in the NFS client functionality in the Linux kernel before 3.0 allows local users to cause a denial of service (system hang) via a LOCK_UN flock system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "33a48d23-e12a-4c02-8f3b-e0620925d6ae",  "id": "CVE-2026-46153",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\n8021q: delete cleared egress QoS mappings\n\nvlan_dev_set_egress_priority() currently keeps cleared egress\npriority mappings in the hash as tombstones. Repeated set/clear cycles\nwith distinct skb priorities therefore accumulate mapping nodes until\ndevice teardown and leak memory.\n\nDelete mappings when vlan_prio is cleared instead of keeping tombstones.\nNow that the egress mapping lists are RCU protected, the node can be\nunlinked safely and freed after a grace period.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2376f0a1-7e94-45d0-aa03-f920bb30148e",  "id": "CVE-2011-1079",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1079"  },  "ratings": [    {      "score": 5.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The bnep_sock_ioctl function in net/bluetooth/bnep/sock.c in the Linux kernel before 2.6.39 does not ensure that a certain device field ends with a '\\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory, or cause a denial of service (BUG and system crash), via a BNEPCONNADD command.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff478c4e-ecd1-41fc-8d3e-9195762112fd",  "id": "DSA-2837-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae40ad5a-4b95-4090-9505-3d32690373d5",  "id": "CVE-2022-1205",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1205"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3200bc7-99bf-4c2e-943f-4d31056c949b",  "id": "CVE-2019-20806",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20806"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.2. There is a NULL pointer dereference in tw5864_handle_frame() in drivers/media/pci/tw5864/tw5864-video.c, which may cause denial of service, aka CID-2e7682ebfc75.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "21b179b8-adcf-45f0-b368-9162d943c555",  "id": "CVE-2022-49865",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network\n\nWhen copying a `struct ifaddrlblmsg` to the network, __ifal_reserved\nremained uninitialized, resulting in a 1-byte infoleak:\n\n  BUG: KMSAN: kernel-network-infoleak in __netdev_start_xmit ./include/linux/netdevice.h:4841\n   __netdev_start_xmit ./include/linux/netdevice.h:4841\n   netdev_start_xmit ./include/linux/netdevice.h:4857\n   xmit_one net/core/dev.c:3590\n   dev_hard_start_xmit+0x1dc/0x800 net/core/dev.c:3606\n   __dev_queue_xmit+0x17e8/0x4350 net/core/dev.c:4256\n   dev_queue_xmit ./include/linux/netdevice.h:3009\n   __netlink_deliver_tap_skb net/netlink/af_netlink.c:307\n   __netlink_deliver_tap+0x728/0xad0 net/netlink/af_netlink.c:325\n   netlink_deliver_tap net/netlink/af_netlink.c:338\n   __netlink_sendskb net/netlink/af_netlink.c:1263\n   netlink_sendskb+0x1d9/0x200 net/netlink/af_netlink.c:1272\n   netlink_unicast+0x56d/0xf50 net/netlink/af_netlink.c:1360\n   nlmsg_unicast ./include/net/netlink.h:1061\n   rtnl_unicast+0x5a/0x80 net/core/rtnetlink.c:758\n   ip6addrlbl_get+0xfad/0x10f0 net/ipv6/addrlabel.c:628\n   rtnetlink_rcv_msg+0xb33/0x1570 net/core/rtnetlink.c:6082\n  ...\n  Uninit was created at:\n   slab_post_alloc_hook+0x118/0xb00 mm/slab.h:742\n   slab_alloc_node mm/slub.c:3398\n   __kmem_cache_alloc_node+0x4f2/0x930 mm/slub.c:3437\n   __do_kmalloc_node mm/slab_common.c:954\n   __kmalloc_node_track_caller+0x117/0x3d0 mm/slab_common.c:975\n   kmalloc_reserve net/core/skbuff.c:437\n   __alloc_skb+0x27a/0xab0 net/core/skbuff.c:509\n   alloc_skb ./include/linux/skbuff.h:1267\n   nlmsg_new ./include/net/netlink.h:964\n   ip6addrlbl_get+0x490/0x10f0 net/ipv6/addrlabel.c:608\n   rtnetlink_rcv_msg+0xb33/0x1570 net/core/rtnetlink.c:6082\n   netlink_rcv_skb+0x299/0x550 net/netlink/af_netlink.c:2540\n   rtnetlink_rcv+0x26/0x30 net/core/rtnetlink.c:6109\n   netlink_unicast_kernel net/netlink/af_netlink.c:1319\n   netlink_unicast+0x9ab/0xf50 net/netlink/af_netlink.c:1345\n   netlink_sendmsg+0xebc/0x10f0 net/netlink/af_netlink.c:1921\n  ...\n\nThis patch ensures that the reserved field is always initialized.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cefe2419-31f6-4513-8f51-6aa8cabf6b31",  "id": "SUSE-SU-2018:2956-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "80cb291d-9dc8-4a86-8a07-37360ba67fa2",  "id": "CVE-2023-52603",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUBSAN: array-index-out-of-bounds in dtSplitRoot\n\nSyzkaller reported the following issue:\n\noop0: detected capacity change from 0 to 32768\n\nUBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9\nindex -2 is out of range for type 'struct dtslot [128]'\nCPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:151 [inline]\n __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283\n dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971\n dtSplitUp fs/jfs/jfs_dtree.c:985 [inline]\n dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863\n jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270\n vfs_mkdir+0x3b3/0x590 fs/namei.c:4013\n do_mkdirat+0x279/0x550 fs/namei.c:4038\n __do_sys_mkdirat fs/namei.c:4053 [inline]\n __se_sys_mkdirat fs/namei.c:4051 [inline]\n __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7fcdc0113fd9\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9\nRDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003\nRBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0\nR10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000\nR13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000\n </TASK>\n\nThe issue is caused when the value of fsi becomes less than -1.\nThe check to break the loop when fsi value becomes -1 is present\nbut syzbot was able to produce value less than -1 which cause the error.\nThis patch simply add the change for the values less than 0.\n\nThe patch is tested via syzbot.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0d54a4bb-a2c5-4fb5-97cf-a4bac57238b5",  "id": "CVE-2018-5332",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5332"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e768a29a-2582-4dc2-88dd-9707ce4689a4",  "id": "CVE-2024-56604",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()\n\nbt_sock_alloc() attaches allocated sk object to the provided sock object.\nIf rfcomm_dlc_alloc() fails, we release the sk object, but leave the\ndangling pointer in the sock object, which may cause use-after-free.\n\nFix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "81a91657-7be6-43dd-b769-970ce282dee3",  "id": "CVE-2014-8481",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8481"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel before 3.18-rc2 does not properly handle invalid instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application that triggers (1) an improperly fetched instruction or (2) an instruction that occupies too many bytes.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8480.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "abc83b95-a345-4354-8ffb-b99729a6df28",  "id": "CVE-2022-48703",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR\n\nIn some case, the GDDV returns a package with a buffer which has\nzero length. It causes that kmemdup() returns ZERO_SIZE_PTR (0x10).\n\nThen the data_vault_read() got NULL point dereference problem when\naccessing the 0x10 value in data_vault.\n\n[   71.024560] BUG: kernel NULL pointer dereference, address:\n0000000000000010\n\nThis patch uses ZERO_OR_NULL_PTR() for checking ZERO_SIZE_PTR or\nNULL value in data_vault.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "738d97b9-bc81-4f1f-b3f2-9c7b0f5f8e8c",  "id": "CVE-2023-52752",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free bug in cifs_debug_data_proc_show()\n\nSkip SMB sessions that are being teared down\n(e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show()\nto avoid use-after-free in @ses.\n\nThis fixes the following GPF when reading from /proc/fs/cifs/DebugData\nwhile mounting and umounting\n\n  [ 816.251274] general protection fault, probably for non-canonical\n  address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI\n  ...\n  [  816.260138] Call Trace:\n  [  816.260329]  <TASK>\n  [  816.260499]  ? die_addr+0x36/0x90\n  [  816.260762]  ? exc_general_protection+0x1b3/0x410\n  [  816.261126]  ? asm_exc_general_protection+0x26/0x30\n  [  816.261502]  ? cifs_debug_tcon+0xbd/0x240 [cifs]\n  [  816.261878]  ? cifs_debug_tcon+0xab/0x240 [cifs]\n  [  816.262249]  cifs_debug_data_proc_show+0x516/0xdb0 [cifs]\n  [  816.262689]  ? seq_read_iter+0x379/0x470\n  [  816.262995]  seq_read_iter+0x118/0x470\n  [  816.263291]  proc_reg_read_iter+0x53/0x90\n  [  816.263596]  ? srso_alias_return_thunk+0x5/0x7f\n  [  816.263945]  vfs_read+0x201/0x350\n  [  816.264211]  ksys_read+0x75/0x100\n  [  816.264472]  do_syscall_64+0x3f/0x90\n  [  816.264750]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n  [  816.265135] RIP: 0033:0x7fd5e669d381",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aea47d32-69eb-49e8-a985-6222b27a4df2",  "id": "CVE-2015-1421",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1421"  },  "ratings": [    {      "score": 10,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "42a8598f-620f-46d9-875c-809670686bc2",  "id": "CVE-2024-44970",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: SHAMPO, Fix invalid WQ linked list unlink\n\nWhen all the strides in a WQE have been consumed, the WQE is unlinked\nfrom the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible\nto receive CQEs with 0 consumed strides for the same WQE even after the\nWQE is fully consumed and unlinked. This triggers an additional unlink\nfor the same wqe which corrupts the linked list.\n\nFix this scenario by accepting 0 sized consumed strides without\nunlinking the WQE again.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e2bd509-1427-472c-8c60-f9218ae4765e",  "id": "CVE-2018-14734",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14734"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/infiniband/core/ucma.c in the Linux kernel through 4.17.11 allows ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allows attackers to cause a denial of service (use-after-free).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "15ae1149-7fab-4323-9980-48fb45026dbd",  "id": "CVE-2022-50478",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()\n\nPatch series \"nilfs2: fix UBSAN shift-out-of-bounds warnings on mount\ntime\".\n\nThe first patch fixes a bug reported by syzbot, and the second one fixes\nthe remaining bug of the same kind.  Although they are triggered by the\nsame super block data anomaly, I divided it into the above two because the\ndetails of the issues and how to fix it are different.\n\nBoth are required to eliminate the shift-out-of-bounds issues at mount\ntime.\n\n\nThis patch (of 2):\n\nIf the block size exponent information written in an on-disk superblock is\ncorrupted, nilfs_sb2_bad_offset helper function can trigger\nshift-out-of-bounds warning followed by a kernel panic (if panic_on_warn\nis set):\n\n shift exponent 38983 is too large for 64-bit type 'unsigned long long'\n Call Trace:\n  <TASK>\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106\n  ubsan_epilogue lib/ubsan.c:151 [inline]\n  __ubsan_handle_shift_out_of_bounds+0x33d/0x3b0 lib/ubsan.c:322\n  nilfs_sb2_bad_offset fs/nilfs2/the_nilfs.c:449 [inline]\n  nilfs_load_super_block+0xdf5/0xe00 fs/nilfs2/the_nilfs.c:523\n  init_nilfs+0xb7/0x7d0 fs/nilfs2/the_nilfs.c:577\n  nilfs_fill_super+0xb1/0x5d0 fs/nilfs2/super.c:1047\n  nilfs_mount+0x613/0x9b0 fs/nilfs2/super.c:1317\n  ...\n\nIn addition, since nilfs_sb2_bad_offset() performs multiplication without\nconsidering the upper bound, the computation may overflow if the disk\nlayout parameters are not normal.\n\nThis fixes these issues by inserting preliminary sanity checks for those\nparameters and by converting the comparison from one involving\nmultiplication and left bit-shifting to one using division and right\nbit-shifting.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04c26572-b4a8-4a65-8827-c4dc7da54127",  "id": "CVE-2012-6546",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6546"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The ATM implementation in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9d7ae56-18e5-443c-a55d-e0463af79ed0",  "id": "CVE-2023-52818",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd: Fix UBSAN array-index-out-of-bounds for SMU7\n\nFor pptable structs that use flexible array sizes, use flexible arrays.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c05f06e7-f5f7-4557-8d3d-df0db61c8a11",  "id": "CVE-2015-3212",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3212"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial of service (list corruption and panic) via a rapid series of system calls related to sockets, as demonstrated by setsockopt calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fa670a5f-b400-48b2-80eb-1c264399eb87",  "id": "CVE-2023-52742",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    670  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: USB: Fix wrong-direction WARNING in plusb.c\n\nThe syzbot fuzzer detected a bug in the plusb network driver: A\nzero-length control-OUT transfer was treated as a read instead of a\nwrite.  In modern kernels this error provokes a WARNING:\n\nusb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0\nWARNING: CPU: 0 PID: 4645 at drivers/usb/core/urb.c:411\nusb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411\nModules linked in:\nCPU: 1 PID: 4645 Comm: dhcpcd Not tainted\n6.2.0-rc6-syzkaller-00050-g9f266ccaa2f5 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google\n01/12/2023\nRIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411\n...\nCall Trace:\n <TASK>\n usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58\n usb_internal_control_msg drivers/usb/core/message.c:102 [inline]\n usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153\n __usbnet_read_cmd+0xb9/0x390 drivers/net/usb/usbnet.c:2010\n usbnet_read_cmd+0x96/0xf0 drivers/net/usb/usbnet.c:2068\n pl_vendor_req drivers/net/usb/plusb.c:60 [inline]\n pl_set_QuickLink_features drivers/net/usb/plusb.c:75 [inline]\n pl_reset+0x2f/0xf0 drivers/net/usb/plusb.c:85\n usbnet_open+0xcc/0x5d0 drivers/net/usb/usbnet.c:889\n __dev_open+0x297/0x4d0 net/core/dev.c:1417\n __dev_change_flags+0x587/0x750 net/core/dev.c:8530\n dev_change_flags+0x97/0x170 net/core/dev.c:8602\n devinet_ioctl+0x15a2/0x1d70 net/ipv4/devinet.c:1147\n inet_ioctl+0x33f/0x380 net/ipv4/af_inet.c:979\n sock_do_ioctl+0xcc/0x230 net/socket.c:1169\n sock_ioctl+0x1f8/0x680 net/socket.c:1286\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe fix is to call usbnet_write_cmd() instead of usbnet_read_cmd() and\nremove the USB_DIR_IN flag.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "63850736-0f1a-4faf-8f6b-a1d11dc3c79d",  "id": "CVE-2022-25375",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25375"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    1284  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b27eb15-9e18-41b5-888f-070331fa0c9b",  "id": "CVE-2016-3689",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3689"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "62b329d7-0a95-4625-b7c1-3b09b1346d7c",  "id": "CVE-2010-4083",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4083"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "The copy_semid_to_user function in ipc/sem.c in the Linux kernel before 2.6.36 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) IPC_INFO, (2) SEM_INFO, (3) IPC_STAT, or (4) SEM_STAT command in a semctl system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7f23805b-3af5-4a08-ae42-d2b11db87d87",  "id": "CVE-2024-44954",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: Fix racy access to midibuf\n\nThere can be concurrent accesses to line6 midibuf from both the URB\ncompletion callback and the rawmidi API access.  This could be a cause\nof KMSAN warning triggered by syzkaller below (so put as reported-by\nhere).\n\nThis patch protects the midibuf call of the former code path with a\nspinlock for avoiding the possible races.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1904da4b-d90d-4753-94de-f02d6ec686f0",  "id": "CVE-2024-46762",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen: privcmd: Fix possible access to a freed kirqfd instance\n\nNothing prevents simultaneous ioctl calls to privcmd_irqfd_assign() and\nprivcmd_irqfd_deassign(). If that happens, it is possible that a kirqfd\ncreated and added to the irqfds_list by privcmd_irqfd_assign() may get\nremoved by another thread executing privcmd_irqfd_deassign(), while the\nformer is still using it after dropping the locks.\n\nThis can lead to a situation where an already freed kirqfd instance may\nbe accessed and cause kernel oops.\n\nUse SRCU locking to prevent the same, as is done for the KVM\nimplementation for irqfds.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf15ba75-8987-4b5d-be37-4884a5751dd8",  "id": "CVE-2023-52799",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds in dbFindLeaf\n\nCurrently while searching for dmtree_t for sufficient free blocks there\nis an array out of bounds while getting element in tp->dm_stree. To add\nthe required check for out of bound we first need to determine the type\nof dmtree. Thus added an extra parameter to dbFindLeaf so that the type\nof tree can be determined and the required check can be applied.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "42467132-f4c6-4a37-84dc-47a1f24d70a7",  "id": "CVE-2026-45960",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: return error when node already exists in hfs_bnode_create\n\nWhen hfs_bnode_create() finds that a node is already hashed (which should\nnot happen in normal operation), it currently returns the existing node\nwithout incrementing its reference count. This causes a reference count\ninconsistency that leads to a kernel panic when the node is later freed\nin hfs_bnode_put():\n\n    kernel BUG at fs/hfsplus/bnode.c:676!\n    BUG_ON(!atomic_read(&node->refcnt))\n\nThis scenario can occur when hfs_bmap_alloc() attempts to allocate a node\nthat is already in use (e.g., when node 0's bitmap bit is incorrectly\nunset), or due to filesystem corruption.\n\nReturning an existing node from a create path is not normal operation.\n\nFix this by returning ERR_PTR(-EEXIST) instead of the node when it's\nalready hashed. This properly signals the error condition to callers,\nwhich already check for IS_ERR() return values.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5f2a4e20-eeb2-4327-83e6-78ac20e8ed28",  "id": "openSUSE-SU-2024:11998-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cbe81e75-547e-4b6f-a85c-fd8af5db776b",  "id": "AZL-75290",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f0b9dec7-193c-40b7-b1af-fb18dd90862d",  "id": "CVE-2019-19338",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19338"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    203,    385  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf02f601-690b-4440-a5b4-2dd1da36e51b",  "id": "CVE-2023-4385",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4385"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "baf63535-f69f-4102-be99-94df0eaf9965",  "id": "CVE-2022-49907",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mdio: fix undefined behavior in bit shift for __mdiobus_register\n\nShifting signed 32-bit value by 31 bits is undefined, so changing\nsignificant bit to unsigned. The UBSAN warning calltrace like below:\n\nUBSAN: shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27\nleft shift of 1 by 31 places cannot be represented in type 'int'\nCall Trace:\n <TASK>\n dump_stack_lvl+0x7d/0xa5\n dump_stack+0x15/0x1b\n ubsan_epilogue+0xe/0x4e\n __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c\n __mdiobus_register+0x49d/0x4e0\n fixed_mdio_bus_init+0xd8/0x12d\n do_one_initcall+0x76/0x430\n kernel_init_freeable+0x3b3/0x422\n kernel_init+0x24/0x1e0\n ret_from_fork+0x1f/0x30\n </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9272a9a8-2020-4b3c-a396-3a41356d7dd9",  "id": "CLSA-2024-1720026957",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "751ef0aa-f0ff-4688-a2ce-fe5a1193bc8a",  "id": "CVE-2024-42236",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: configfs: Prevent OOB read/write in usb_string_copy()\n\nUserspace provided string 's' could trivially have the length zero. Left\nunchecked this will firstly result in an OOB read in the form\n`if (str[0 - 1] == '\\n') followed closely by an OOB write in the form\n`str[0 - 1] = '\\0'`.\n\nThere is already a validating check to catch strings that are too long.\nLet's supply an additional check for invalid strings that are too short.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "654cf705-3e58-41e7-bd73-b95bb17faa03",  "id": "CVE-2025-38715",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix slab-out-of-bounds in hfs_bnode_read()\n\nThis patch introduces is_bnode_offset_valid() method that checks\nthe requested offset value. Also, it introduces\ncheck_and_correct_requested_length() method that checks and\ncorrect the requested length (if it is necessary). These methods\nare used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(),\nhfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent\nthe access out of allocated memory and triggering the crash.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fdb89f5c-ad8c-4e73-88a5-b384ad50a604",  "id": "CVE-2019-16994",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16994"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails to register sitn->fb_tunnel_dev, which may cause denial of service, aka CID-07f12b26e21a.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4a1d4a44-9a50-4c3b-9583-1114c076d3a2",  "id": "CVE-2017-9985",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9985"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The snd_msndmidi_input_read function in sound/isa/msnd/msnd_midi.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a \"double fetch\" vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee488cf0-8792-4609-a4fe-fa1290346621",  "id": "SUSE-SU-2015:0979-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "033412c2-d21c-40a4-aee2-137732a3c785",  "id": "OESA-2026-2966",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1be5be14-f457-464c-a6bb-a936d3f12c91",  "id": "CLSA-2023-1683236532",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dadf7f28-1848-4117-bb3b-cccc2a91a161",  "id": "openSUSE-SU-2025:15834-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "340257a8-cc64-4867-a93d-9f3f90887322",  "id": "CVE-2022-49197",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_netlink: Fix shift out of bounds in group mask calculation\n\nWhen a netlink message is received, netlink_recvmsg() fills in the address\nof the sender. One of the fields is the 32-bit bitfield nl_groups, which\ncarries the multicast group on which the message was received. The least\nsignificant bit corresponds to group 1, and therefore the highest group\nthat the field can represent is 32. Above that, the UB sanitizer flags the\nout-of-bounds shift attempts.\n\nWhich bits end up being set in such case is implementation defined, but\nit's either going to be a wrong non-zero value, or zero, which is at least\nnot misleading. Make the latter choice deterministic by always setting to 0\nfor higher-numbered multicast groups.\n\nTo get information about membership in groups >= 32, userspace is expected\nto use nl_pktinfo control messages[0], which are enabled by NETLINK_PKTINFO\nsocket option.\n[0] https://lwn.net/Articles/147608/\n\nThe way to trigger this issue is e.g. through monitoring the BRVLAN group:\n\n\t# bridge monitor vlan &\n\t# ip link add name br type bridge\n\nWhich produces the following citation:\n\n\tUBSAN: shift-out-of-bounds in net/netlink/af_netlink.c:162:19\n\tshift exponent 32 is too large for 32-bit type 'int'",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c0e1555b-c736-47f5-92f6-623aa28fe038",  "id": "CLSA-2023-1676026276",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ba4a84c-775f-4d6a-9e56-4a675f090ed5",  "id": "MGASA-2019-0082",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3a8669d1-32cc-4c66-b446-3d7c58208768",      "versions": [        {          "component": "radvd",          "version": "1.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5b0de1b7-2acf-4bbc-ba2e-3690bf3685d3",  "id": "CVE-2023-52932",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/swapfile: add cond_resched() in get_swap_pages()\n\nThe softlockup still occurs in get_swap_pages() under memory pressure.  64\nCPU cores, 64GB memory, and 28 zram devices, the disksize of each zram\ndevice is 50MB with same priority as si.  Use the stress-ng tool to\nincrease memory pressure, causing the system to oom frequently.\n\nThe plist_for_each_entry_safe() loops in get_swap_pages() could reach tens\nof thousands of times to find available space (extreme case:\ncond_resched() is not called in scan_swap_map_slots()).  Let's add\ncond_resched() into get_swap_pages() when failed to find available space\nto avoid softlockup.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "26a96b03-730c-4354-a00f-7903c69e8d9a",  "id": "SUSE-SU-2018:2928-2",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b98380c5-1b69-4a8d-aaae-8176bfdd527c",  "id": "CVE-2025-38460",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: Fix potential null-ptr-deref in to_atmarpd().\n\natmarpd is protected by RTNL since commit f3a0592b37b8 (\"[ATM]: clip\ncauses unregister hang\").\n\nHowever, it is not enough because to_atmarpd() is called without RTNL,\nespecially clip_neigh_solicit() / neigh_ops->solicit() is unsleepable.\n\nAlso, there is no RTNL dependency around atmarpd.\n\nLet's use a private mutex and RCU to protect access to atmarpd in\nto_atmarpd().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c7d03f2c-4971-4da6-bebf-fc71b2af8ee7",  "id": "CVE-2022-27950",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27950"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error condition.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c61b407-f746-4af8-ba6c-50bd11026911",  "id": "CVE-2024-57922",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add check for granularity in dml ceil/floor helpers\n\n[Why]\nWrapper functions for dcn_bw_ceil2() and dcn_bw_floor2()\nshould check for granularity is non zero to avoid assert and\ndivide-by-zero error in dcn_bw_ functions.\n\n[How]\nAdd check for granularity 0.\n\n(cherry picked from commit f6e09701c3eb2ccb8cb0518e0b67f1c69742a4ec)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "27a4acd6-8c32-4397-a697-e64fb7ddd93f",  "id": "CLSA-2026-1779179759",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04be37ee-4c90-495c-a47e-5c60609010da",  "id": "DSA-5103-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "14b53691-8662-4f28-a3d2-ab182c01a3ed",  "id": "CVE-2026-31670",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rfkill: prevent unlimited numbers of rfkill events from being created\n\nUserspace can create an unlimited number of rfkill events if the system\nis so configured, while not consuming them from the rfkill file\ndescriptor, causing a potential out of memory situation.  Prevent this\nfrom bounding the number of pending rfkill events at a \"large\" number\n(i.e. 1000) to prevent abuses like this.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5c78e140-30b9-4290-838a-e00d45c83a52",  "id": "CVE-2024-26996",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error\n\nWhen ncm function is working and then stop usb0 interface for link down,\neth_stop() is called. At this piont, accidentally if usb transport error\nshould happen in usb_ep_enable(), 'in_ep' and/or 'out_ep' may not be enabled.\n\nAfter that, ncm_disable() is called to disable for ncm unbind\nbut gether_disconnect() is never called since 'in_ep' is not enabled.\n\nAs the result, ncm object is released in ncm unbind\nbut 'dev->port_usb' associated to 'ncm->port' is not NULL.\n\nAnd when ncm bind again to recover netdev, ncm object is reallocated\nbut usb0 interface is already associated to previous released ncm object.\n\nTherefore, once usb0 interface is up and eth_start_xmit() is called,\nreleased ncm object is dereferrenced and it might cause use-after-free memory.\n\n[function unlink via configfs]\n  usb0: eth_stop dev->port_usb=ffffff9b179c3200\n  --> error happens in usb_ep_enable().\n  NCM: ncm_disable: ncm=ffffff9b179c3200\n  --> no gether_disconnect() since ncm->port.in_ep->enabled is false.\n  NCM: ncm_unbind: ncm unbind ncm=ffffff9b179c3200\n  NCM: ncm_free: ncm free ncm=ffffff9b179c3200   <-- released ncm\n\n[function link via configfs]\n  NCM: ncm_alloc: ncm alloc ncm=ffffff9ac4f8a000\n  NCM: ncm_bind: ncm bind ncm=ffffff9ac4f8a000\n  NCM: ncm_set_alt: ncm=ffffff9ac4f8a000 alt=0\n  usb0: eth_open dev->port_usb=ffffff9b179c3200  <-- previous released ncm\n  usb0: eth_start dev->port_usb=ffffff9b179c3200 <--\n  eth_start_xmit()\n  --> dev->wrap()\n  Unable to handle kernel paging request at virtual address dead00000000014f\n\nThis patch addresses the issue by checking if 'ncm->netdev' is not NULL at\nncm_disable() to call gether_disconnect() to deassociate 'dev->port_usb'.\nIt's more reasonable to check 'ncm->netdev' to call gether_connect/disconnect\nrather than check 'ncm->port.in_ep->enabled' since it might not be enabled\nbut the gether connection might be established.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d359776c-9a79-4d25-812e-043500070058",  "id": "CVE-2022-50024",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-axi-dmac: do not print NULL LLI during error\n\nDuring debugging we have seen an issue where axi_chan_dump_lli()\nis passed a NULL LLI pointer which ends up causing an OOPS due\nto trying to get fields from it. Simply print NULL LLI and exit\nto avoid this.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f2c37bb1-196c-47b3-ac35-73bed3d0d8ab",  "id": "CVE-2010-3298",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3298"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The hso_get_count function in drivers/net/usb/hso.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "103f3f6e-a434-4d49-950d-8465b2de8ab1",  "id": "CVE-2022-48951",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()\n\nThe bounds checks in snd_soc_put_volsw_sx() are only being applied to the\nfirst channel, meaning it is possible to write out of bounds values to the\nsecond channel in stereo controls. Add appropriate checks.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04d63e45-5ddb-4c14-9c69-34f3ec111d6b",  "id": "CVE-2021-28964",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28964"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "545b89ce-fe94-45e7-a35e-c983a828efef",  "id": "CVE-2019-9857",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9857"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.0.2, the function inotify_update_existing_watch() in fs/notify/inotify/inotify_user.c neglects to call fsnotify_put_mark() with IN_MASK_CREATE after fsnotify_find_mark(), which will cause a memory leak (aka refcount leak). Finally, this will cause a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e7558485-2321-4b37-8bc8-b20153a1994e",  "id": "CVE-2022-1263",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1263"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8e9ed507-ecd6-4aa2-b6b3-b66e5fe4e4f4",  "id": "CVE-2010-4805",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4805"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The socket implementation in net/core/sock.c in the Linux kernel before 2.6.35 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service by sending a large amount of network traffic, related to the sk_add_backlog function and the sk_rmem_alloc socket field.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4251.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2a954383-16dd-4ac3-a554-75fedb3da799",  "id": "SUSE-SU-2026:0759-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "505c949c-22c6-4b00-8377-b8ed6717b21d",  "id": "ROOT-OS-DEBIAN-12-CVE-2026-63072",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3bc54296-b023-4c2a-8df5-2c299590bd89",  "id": "CVE-2024-53052",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rw: fix missing NOWAIT check for O_DIRECT start write\n\nWhen io_uring starts a write, it'll call kiocb_start_write() to bump the\nsuper block rwsem, preventing any freezes from happening while that\nwrite is in-flight. The freeze side will grab that rwsem for writing,\nexcluding any new writers from happening and waiting for existing writes\nto finish. But io_uring unconditionally uses kiocb_start_write(), which\nwill block if someone is currently attempting to freeze the mount point.\nThis causes a deadlock where freeze is waiting for previous writes to\ncomplete, but the previous writes cannot complete, as the task that is\nsupposed to complete them is blocked waiting on starting a new write.\nThis results in the following stuck trace showing that dependency with\nthe write blocked starting a new write:\n\ntask:fio             state:D stack:0     pid:886   tgid:886   ppid:876\nCall trace:\n __switch_to+0x1d8/0x348\n __schedule+0x8e8/0x2248\n schedule+0x110/0x3f0\n percpu_rwsem_wait+0x1e8/0x3f8\n __percpu_down_read+0xe8/0x500\n io_write+0xbb8/0xff8\n io_issue_sqe+0x10c/0x1020\n io_submit_sqes+0x614/0x2110\n __arm64_sys_io_uring_enter+0x524/0x1038\n invoke_syscall+0x74/0x268\n el0_svc_common.constprop.0+0x160/0x238\n do_el0_svc+0x44/0x60\n el0_svc+0x44/0xb0\n el0t_64_sync_handler+0x118/0x128\n el0t_64_sync+0x168/0x170\nINFO: task fsfreeze:7364 blocked for more than 15 seconds.\n      Not tainted 6.12.0-rc5-00063-g76aaf945701c #7963\n\nwith the attempting freezer stuck trying to grab the rwsem:\n\ntask:fsfreeze        state:D stack:0     pid:7364  tgid:7364  ppid:995\nCall trace:\n __switch_to+0x1d8/0x348\n __schedule+0x8e8/0x2248\n schedule+0x110/0x3f0\n percpu_down_write+0x2b0/0x680\n freeze_super+0x248/0x8a8\n do_vfs_ioctl+0x149c/0x1b18\n __arm64_sys_ioctl+0xd0/0x1a0\n invoke_syscall+0x74/0x268\n el0_svc_common.constprop.0+0x160/0x238\n do_el0_svc+0x44/0x60\n el0_svc+0x44/0xb0\n el0t_64_sync_handler+0x118/0x128\n el0t_64_sync+0x168/0x170\n\nFix this by having the io_uring side honor IOCB_NOWAIT, and only attempt a\nblocking grab of the super block rwsem if it isn't set. For normal issue\nwhere IOCB_NOWAIT would always be set, this returns -EAGAIN which will\nhave io_uring core issue a blocking attempt of the write. That will in\nturn also get completions run, ensuring forward progress.\n\nSince freezing requires CAP_SYS_ADMIN in the first place, this isn't\nsomething that can be triggered by a regular user.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "22516f65-370c-4c70-a0a9-8b0f7a0cc974",  "id": "CVE-2021-46926",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46926"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: intel-sdw-acpi: harden detection of controller\n\nThe existing code currently sets a pointer to an ACPI handle before\nchecking that it's actually a SoundWire controller. This can lead to\nissues where the graph walk continues and eventually fails, but the\npointer was set already.\n\nThis patch changes the logic so that the information provided to\nthe caller is set when a controller is found.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a5841e3d-5a44-4477-a5e6-439eab3dbb45",  "id": "CVE-2023-53431",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ses: Handle enclosure with just a primary component gracefully\n\nThis reverts commit 3fe97ff3d949 (\"scsi: ses: Don't attach if enclosure\nhas no components\") and introduces proper handling of case where there are\nno detected secondary components, but primary component (enumerated in\nnum_enclosures) does exist. That fix was originally proposed by Ding Hui\n<dinghui@sangfor.com.cn>.\n\nCompletely ignoring devices that have one primary enclosure and no\nsecondary one results in ses_intf_add() bailing completely\n\n\tscsi 2:0:0:254: enclosure has no enumerated components\n        scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such\n\neven on valid configurations with 1 primary and 0 secondary enclosures as\nbelow:\n\n\t# sg_ses /dev/sg0\n\t  3PARdata  SES               3321\n\tSupported diagnostic pages:\n\t  Supported Diagnostic Pages [sdp] [0x0]\n\t  Configuration (SES) [cf] [0x1]\n\t  Short Enclosure Status (SES) [ses] [0x8]\n\t# sg_ses -p cf /dev/sg0\n\t  3PARdata  SES               3321\n\tConfiguration diagnostic page:\n\t  number of secondary subenclosures: 0\n\t  generation code: 0x0\n\t  enclosure descriptor list\n\t    Subenclosure identifier: 0 [primary]\n\t      relative ES process id: 0, number of ES processes: 1\n\t      number of type descriptor headers: 1\n\t      enclosure logical identifier (hex): 20000002ac02068d\n\t      enclosure vendor: 3PARdata  product: VV                rev: 3321\n\t  type descriptor header and text list\n\t    Element type: Unspecified, subenclosure id: 0\n\t      number of possible elements: 1\n\nThe changelog for the original fix follows\n\n=====\nWe can get a crash when disconnecting the iSCSI session,\nthe call trace like this:\n\n  [ffff00002a00fb70] kfree at ffff00000830e224\n  [ffff00002a00fba0] ses_intf_remove at ffff000001f200e4\n  [ffff00002a00fbd0] device_del at ffff0000086b6a98\n  [ffff00002a00fc50] device_unregister at ffff0000086b6d58\n  [ffff00002a00fc70] __scsi_remove_device at ffff00000870608c\n  [ffff00002a00fca0] scsi_remove_device at ffff000008706134\n  [ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4\n  [ffff00002a00fd10] scsi_remove_target at ffff0000087064c0\n  [ffff00002a00fd70] __iscsi_unbind_session at ffff000001c872c4\n  [ffff00002a00fdb0] process_one_work at ffff00000810f35c\n  [ffff00002a00fe00] worker_thread at ffff00000810f648\n  [ffff00002a00fe70] kthread at ffff000008116e98\n\nIn ses_intf_add, components count could be 0, and kcalloc 0 size scomp,\nbut not saved in edev->component[i].scratch\n\nIn this situation, edev->component[0].scratch is an invalid pointer,\nwhen kfree it in ses_intf_remove_enclosure, a crash like above would happen\nThe call trace also could be other random cases when kfree cannot catch\nthe invalid pointer\n\nWe should not use edev->component[] array when the components count is 0\nWe also need check index when use edev->component[] array in\nses_enclosure_data_process\n=====",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b5a6f93-1a83-474d-bca2-2f0fda6f4d85",  "id": "CVE-2026-31578",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: as102: fix to not free memory after the device is registered in as102_usb_probe()\n\nIn as102_usb driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nas102_usb_probe()\n  kzalloc(); // alloc as102_dev_t\n  ....\n  usb_register_dev();\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open as102 fd\n\t\t\t\t\t\t....\n  usb_deregister_dev();\n  ....\n  kfree(); // free as102_dev_t\n  ....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t  as102_release() // UAF!!\n\t\t\t\t\t\t    as102_usb_release()\n\t\t\t\t\t\t      kfree(); // DFB!!\n```\n\nWhen a USB character device registered with usb_register_dev() is later\nunregistered (via usb_deregister_dev() or disconnect), the device node is\nremoved so new open() calls fail. However, file descriptors that are\nalready open do not go away immediately: they remain valid until the last\nreference is dropped and the driver's .release() is invoked.\n\nIn as102, as102_usb_probe() calls usb_register_dev() and then, on an\nerror path, does usb_deregister_dev() and frees as102_dev_t right away.\nIf userspace raced a successful open() before the deregistration, that\nopen FD will later hit as102_release() --> as102_usb_release() and access\nor free as102_dev_t again, occur a race to use-after-free and\ndouble-free vuln.\n\nThe fix is to never kfree(as102_dev_t) directly once usb_register_dev()\nhas succeeded. After deregistration, defer freeing memory to .release().\n\nIn other words, let release() perform the last kfree when the final open\nFD is closed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "530589ab-b9a8-4ae7-b3ba-7113e8033120",  "id": "CVE-2021-47307",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47307"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: prevent NULL deref in cifs_compose_mount_options()\n\nThe optional @ref parameter might contain an NULL node_name, so\nprevent dereferencing it in cifs_compose_mount_options().\n\nAddresses-Coverity: 1476408 (\"Explicit null dereferenced\")",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d89ef8b3-a112-4976-94e9-16789d7d45fd",  "id": "AZL-31880",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "03716422-b0a0-4897-828e-22366cc0f9a9",  "id": "CVE-2021-47380",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47380"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: amd_sfh: Fix potential NULL pointer dereference\n\ndevm_add_action_or_reset() can suddenly invoke amd_mp2_pci_remove() at\nregistration that will cause NULL pointer dereference since\ncorresponding data is not initialized yet. The patch moves\ninitialization of data before devm_add_action_or_reset().\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[jkosina@suse.cz: rebase]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "11492ef7-f4ad-4a53-a115-c3b529385e3e",  "id": "CVE-2024-56769",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg\n\nSyzbot reports [1] an uninitialized value issue found by KMSAN in\ndib3000_read_reg().\n\nLocal u8 rb[2] is used in i2c_transfer() as a read buffer; in case\nthat call fails, the buffer may end up with some undefined values.\n\nSince no elaborate error handling is expected in dib3000_write_reg(),\nsimply zero out rb buffer to mitigate the problem.\n\n[1] Syzkaller report\ndvb-usb: bulk message failed: -22 (6/0)\n=====================================================\nBUG: KMSAN: uninit-value in dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758\n dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758\n dibusb_dib3000mb_frontend_attach+0x155/0x2f0 drivers/media/usb/dvb-usb/dibusb-mb.c:31\n dvb_usb_adapter_frontend_init+0xed/0x9a0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290\n dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:90 [inline]\n dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:186 [inline]\n dvb_usb_device_init+0x25a8/0x3760 drivers/media/usb/dvb-usb/dvb-usb-init.c:310\n dibusb_probe+0x46/0x250 drivers/media/usb/dvb-usb/dibusb-mb.c:110\n...\nLocal variable rb created at:\n dib3000_read_reg+0x86/0x4e0 drivers/media/dvb-frontends/dib3000mb.c:54\n dib3000mb_attach+0x123/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758\n...",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ccd367d9-09c8-4ba2-bc3c-0af2e4290d00",  "id": "CVE-2014-8172",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8172"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    17  ],  "analysis": {    "state": "in_triage"  },  "description": "The filesystem implementation in the Linux kernel before 3.13 performs certain operations on lists of files with an inappropriate locking approach, which allows local users to cause a denial of service (soft lockup or system crash) via unspecified use of Asynchronous I/O (AIO) operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48310595-c352-4346-9745-db6c5d1f551d",  "id": "CVE-2022-32296",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32296"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    330  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 (\"Double-Hash Port Selection Algorithm\") of RFC 6056.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f29525b3-9633-4401-9076-fa3036e17ed5",  "id": "CVE-2013-7445",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7445"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated by JavaScript code that creates many CANVAS elements for rendering by Chrome or Firefox.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2fc1a810-5956-4f14-87b9-1d543609136e",  "id": "CVE-2022-41849",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41849"  },  "ratings": [    {      "score": 4.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4845dfae-b936-4052-a8a4-7ad055b0e972",  "id": "CVE-2025-22072",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspufs: fix gang directory lifetimes\n\nprior to \"[POWERPC] spufs: Fix gang destroy leaks\" we used to have\na problem with gang lifetimes - creation of a gang returns opened\ngang directory, which normally gets removed when that gets closed,\nbut if somebody has created a context belonging to that gang and\nkept it alive until the gang got closed, removal failed and we\nended up with a leak.\n\nUnfortunately, it had been fixed the wrong way.  Dentry of gang\ndirectory was no longer pinned, and rmdir on close was gone.\nOne problem was that failure of open kept calling simple_rmdir()\nas cleanup, which meant an unbalanced dput().  Another bug was\nin the success case - gang creation incremented link count on\nroot directory, but that was no longer undone when gang got\ndestroyed.\n\nFix consists of\n\t* reverting the commit in question\n\t* adding a counter to gang, protected by ->i_rwsem\nof gang directory inode.\n\t* having it set to 1 at creation time, dropped\nin both spufs_dir_close() and spufs_gang_close() and bumped\nin spufs_create_context(), provided that it's not 0.\n\t* using simple_recursive_removal() to take the gang\ndirectory out when counter reaches zero.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d774a01a-2128-4288-aca9-ec6a78570e8a",  "id": "CVE-2025-38078",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Fix race of buffer access at PCM OSS layer\n\nThe PCM OSS layer tries to clear the buffer with the silence data at\ninitialization (or reconfiguration) of a stream with the explicit call\nof snd_pcm_format_set_silence() with runtime->dma_area.  But this may\nlead to a UAF because the accessed runtime->dma_area might be freed\nconcurrently, as it's performed outside the PCM ops.\n\nFor avoiding it, move the code into the PCM core and perform it inside\nthe buffer access lock, so that it won't be changed during the\noperation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "63def2c6-101d-4dfb-b542-67e04bf0244d",  "id": "CVE-2019-19528",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19528"  },  "ratings": [    {      "score": 6.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver, aka CID-edc4746f253d.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aa98eda1-93cd-4f8c-b4ef-8e13ec5fe603",  "id": "CVE-2024-56595",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: add a check to prevent array-index-out-of-bounds in dbAdjTree\n\nWhen the value of lp is 0 at the beginning of the for loop, it will\nbecome negative in the next assignment and we should bail out.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7b254801-9b28-4e51-bd57-97be4f9387de",  "id": "CVE-2021-47289",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47289"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: fix NULL pointer dereference\n\nCommit 71f642833284 (\"ACPI: utils: Fix reference counting in\nfor_each_acpi_dev_match()\") started doing \"acpi_dev_put()\" on a pointer\nthat was possibly NULL.  That fails miserably, because that helper\ninline function is not set up to handle that case.\n\nJust make acpi_dev_put() silently accept a NULL pointer, rather than\ncalling down to put_device() with an invalid offset off that NULL\npointer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9550727-6a86-4e49-b147-e6f35350288c",  "id": "CVE-2013-2146",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2146"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kernel/cpu/perf_event_intel.c in the Linux kernel before 3.8.9, when the Performance Events Subsystem is enabled, specifies an incorrect bitmask, which allows local users to cause a denial of service (general protection fault and system crash) by attempting to set a reserved bit.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "60181845-20e9-4720-bc14-6157dbf44a9c",  "id": "CVE-2021-4135",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4135"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200,    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7526cf5a-48a2-4135-b7ee-2798454154a9",  "id": "CVE-2022-49504",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Inhibit aborts if external loopback plug is inserted\n\nAfter running a short external loopback test, when the external loopback is\nremoved and a normal cable inserted that is directly connected to a target\ndevice, the system oops in the llpfc_set_rrq_active() routine.\n\nWhen the loopback was inserted an FLOGI was transmit. As we're looped back,\nwe receive the FLOGI request. The FLOGI is ABTS'd as we recognize the same\nwppn thus understand it's a loopback. However, as the ABTS sends address\ninformation the port is not set to (fffffe), the ABTS is dropped on the\nwire. A short 1 frame loopback test is run and completes before the ABTS\ntimes out. The looback is unplugged and the new cable plugged in, and the\nan FLOGI to the new device occurs and completes. Due to a mixup in ref\ncounting the completion of the new FLOGI releases the fabric ndlp. Then the\noriginal ABTS completes and references the released ndlp generating the\noops.\n\nCorrect by no-op'ing the ABTS when in loopback mode (it will be dropped\nanyway). Added a flag to track the mode to recognize when it should be\nno-op'd.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6603d52a-7229-47a4-8798-e762f596bcf7",  "id": "CLSA-2026-1777396609",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "67723dcf-220e-4069-b17a-f00aaed2dee0",  "id": "CVE-2014-6416",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6416"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, allows remote attackers to cause a denial of service (memory corruption and panic) or possibly have unspecified other impact via a long unencrypted auth ticket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c57042e-8073-4998-a115-50ab83f0c8cc",  "id": "OESA-2026-1464",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8e56ea3-ab58-4948-87c6-f24c7f59a126",  "id": "CVE-2024-46755",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()\n\nmwifiex_get_priv_by_id() returns the priv pointer corresponding to\nthe bss_num and bss_type, but without checking if the priv is actually\ncurrently in use.\nUnused priv pointers do not have a wiphy attached to them which can\nlead to NULL pointer dereferences further down the callstack.  Fix\nthis by returning only used priv pointers which have priv->bss_mode\nset to something else than NL80211_IFTYPE_UNSPECIFIED.\n\nSaid NULL pointer dereference happened when an Accesspoint was started\nwith wpa_supplicant -i mlan0 with this config:\n\nnetwork={\n        ssid=\"somessid\"\n        mode=2\n        frequency=2412\n        key_mgmt=WPA-PSK WPA-PSK-SHA256\n        proto=RSN\n        group=CCMP\n        pairwise=CCMP\n        psk=\"12345678\"\n}\n\nWhen waiting for the AP to be established, interrupting wpa_supplicant\nwith <ctrl-c> and starting it again this happens:\n\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000140\n| Mem abort info:\n|   ESR = 0x0000000096000004\n|   EC = 0x25: DABT (current EL), IL = 32 bits\n|   SET = 0, FnV = 0\n|   EA = 0, S1PTW = 0\n|   FSC = 0x04: level 0 translation fault\n| Data abort info:\n|   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n|   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n|   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n| user pgtable: 4k pages, 48-bit VAs, pgdp=0000000046d96000\n| [0000000000000140] pgd=0000000000000000, p4d=0000000000000000\n| Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n| Modules linked in: caam_jr caamhash_desc spidev caamalg_desc crypto_engine authenc libdes mwifiex_sdio\n+mwifiex crct10dif_ce cdc_acm onboard_usb_hub fsl_imx8_ddr_perf imx8m_ddrc rtc_ds1307 lm75 rtc_snvs\n+imx_sdma caam imx8mm_thermal spi_imx error imx_cpufreq_dt fuse ip_tables x_tables ipv6\n| CPU: 0 PID: 8 Comm: kworker/0:1 Not tainted 6.9.0-00007-g937242013fce-dirty #18\n| Hardware name: somemachine (DT)\n| Workqueue: events sdio_irq_work\n| pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n| pc : mwifiex_get_cfp+0xd8/0x15c [mwifiex]\n| lr : mwifiex_get_cfp+0x34/0x15c [mwifiex]\n| sp : ffff8000818b3a70\n| x29: ffff8000818b3a70 x28: ffff000006bfd8a5 x27: 0000000000000004\n| x26: 000000000000002c x25: 0000000000001511 x24: 0000000002e86bc9\n| x23: ffff000006bfd996 x22: 0000000000000004 x21: ffff000007bec000\n| x20: 000000000000002c x19: 0000000000000000 x18: 0000000000000000\n| x17: 000000040044ffff x16: 00500072b5503510 x15: ccc283740681e517\n| x14: 0201000101006d15 x13: 0000000002e8ff43 x12: 002c01000000ffb1\n| x11: 0100000000000000 x10: 02e8ff43002c0100 x9 : 0000ffb100100157\n| x8 : ffff000003d20000 x7 : 00000000000002f1 x6 : 00000000ffffe124\n| x5 : 0000000000000001 x4 : 0000000000000003 x3 : 0000000000000000\n| x2 : 0000000000000000 x1 : 0001000000011001 x0 : 0000000000000000\n| Call trace:\n|  mwifiex_get_cfp+0xd8/0x15c [mwifiex]\n|  mwifiex_parse_single_response_buf+0x1d0/0x504 [mwifiex]\n|  mwifiex_handle_event_ext_scan_report+0x19c/0x2f8 [mwifiex]\n|  mwifiex_process_sta_event+0x298/0xf0c [mwifiex]\n|  mwifiex_process_event+0x110/0x238 [mwifiex]\n|  mwifiex_main_process+0x428/0xa44 [mwifiex]\n|  mwifiex_sdio_interrupt+0x64/0x12c [mwifiex_sdio]\n|  process_sdio_pending_irqs+0x64/0x1b8\n|  sdio_irq_work+0x4c/0x7c\n|  process_one_work+0x148/0x2a0\n|  worker_thread+0x2fc/0x40c\n|  kthread+0x110/0x114\n|  ret_from_fork+0x10/0x20\n| Code: a94153f3 a8c37bfd d50323bf d65f03c0 (f940a000)\n| ---[ end trace 0000000000000000 ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "59daa4e3-2744-4c97-91d3-7db628bf3f46",  "id": "CVE-2024-43856",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma: fix call order in dmam_free_coherent\n\ndmam_free_coherent() frees a DMA allocation, which makes the\nfreed vaddr available for reuse, then calls devres_destroy()\nto remove and free the data structure used to track the DMA\nallocation. Between the two calls, it is possible for a\nconcurrent task to make an allocation with the same vaddr\nand add it to the devres list.\n\nIf this happens, there will be two entries in the devres list\nwith the same vaddr and devres_destroy() can free the wrong\nentry, triggering the WARN_ON() in dmam_match.\n\nFix by destroying the devres entry before freeing the DMA\nallocation.\n\n  kokonut //net/encryption\n    http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "66efe095-804f-4e09-978e-668ec0400ac1",  "id": "RHBA-2025:6314",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2fba6cc9-261b-4d40-a3f3-b3454ffc8656",  "id": "CVE-2021-47257",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47257"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ieee802154: fix null deref in parse dev addr\n\nFix a logic error that could result in a null deref if the user sets\nthe mode incorrectly for the given addr type.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fcd5e5c2-5bd5-4d2f-a9bc-25c22a013aae",  "id": "CVE-2023-53457",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nFS: JFS: Fix null-ptr-deref Read in txBegin\n\n Syzkaller reported an issue where txBegin may be called\n on a superblock in a read-only mounted filesystem which leads\n to NULL pointer deref. This could be solved by checking if\n the filesystem is read-only before calling txBegin, and returning\n with appropiate error code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "616e4179-60cf-473d-9853-f7ec13d2b816",  "id": "CVE-2013-0198",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0198"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via spoofed TCP based DNS queries.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3411.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32b2d79a-feb1-4d11-91c0-944a88ce5036",  "id": "RHSA-2022:7288",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6729f13a-488e-4d96-b31d-1621f3ee1c18",  "id": "CLSA-2025-1742661821",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3cc3819d-7527-4b89-8475-57a5e4336619",  "id": "CVE-2024-46749",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Fix Null pointer dereference in btnxpuart_flush()\n\nThis adds a check before freeing the rx->skb in flush and close\nfunctions to handle the kernel crash seen while removing driver after FW\ndownload fails or before FW download completes.\n\ndmesg log:\n[   54.634586] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000080\n[   54.643398] Mem abort info:\n[   54.646204]   ESR = 0x0000000096000004\n[   54.649964]   EC = 0x25: DABT (current EL), IL = 32 bits\n[   54.655286]   SET = 0, FnV = 0\n[   54.658348]   EA = 0, S1PTW = 0\n[   54.661498]   FSC = 0x04: level 0 translation fault\n[   54.666391] Data abort info:\n[   54.669273]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[   54.674768]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[   54.674771]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[   54.674775] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000048860000\n[   54.674780] [0000000000000080] pgd=0000000000000000, p4d=0000000000000000\n[   54.703880] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[   54.710152] Modules linked in: btnxpuart(-) overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce polyval_generic snd_soc_imx_spdif snd_soc_imx_card snd_soc_ak5558 snd_soc_ak4458 caam secvio error snd_soc_fsl_micfil snd_soc_fsl_spdif snd_soc_fsl_sai snd_soc_fsl_utils imx_pcm_dma gpio_ir_recv rc_core sch_fq_codel fuse\n[   54.744357] CPU: 3 PID: 72 Comm: kworker/u9:0 Not tainted 6.6.3-otbr-g128004619037 #2\n[   54.744364] Hardware name: FSL i.MX8MM EVK board (DT)\n[   54.744368] Workqueue: hci0 hci_power_on\n[   54.757244] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[   54.757249] pc : kfree_skb_reason+0x18/0xb0\n[   54.772299] lr : btnxpuart_flush+0x40/0x58 [btnxpuart]\n[   54.782921] sp : ffff8000805ebca0\n[   54.782923] x29: ffff8000805ebca0 x28: ffffa5c6cf1869c0 x27: ffffa5c6cf186000\n[   54.782931] x26: ffff377b84852400 x25: ffff377b848523c0 x24: ffff377b845e7230\n[   54.782938] x23: ffffa5c6ce8dbe08 x22: ffffa5c6ceb65410 x21: 00000000ffffff92\n[   54.782945] x20: ffffa5c6ce8dbe98 x19: ffffffffffffffac x18: ffffffffffffffff\n[   54.807651] x17: 0000000000000000 x16: ffffa5c6ce2824ec x15: ffff8001005eb857\n[   54.821917] x14: 0000000000000000 x13: ffffa5c6cf1a02e0 x12: 0000000000000642\n[   54.821924] x11: 0000000000000040 x10: ffffa5c6cf19d690 x9 : ffffa5c6cf19d688\n[   54.821931] x8 : ffff377b86000028 x7 : 0000000000000000 x6 : 0000000000000000\n[   54.821938] x5 : ffff377b86000000 x4 : 0000000000000000 x3 : 0000000000000000\n[   54.843331] x2 : 0000000000000000 x1 : 0000000000000002 x0 : ffffffffffffffac\n[   54.857599] Call trace:\n[   54.857601]  kfree_skb_reason+0x18/0xb0\n[   54.863878]  btnxpuart_flush+0x40/0x58 [btnxpuart]\n[   54.863888]  hci_dev_open_sync+0x3a8/0xa04\n[   54.872773]  hci_power_on+0x54/0x2e4\n[   54.881832]  process_one_work+0x138/0x260\n[   54.881842]  worker_thread+0x32c/0x438\n[   54.881847]  kthread+0x118/0x11c\n[   54.881853]  ret_from_fork+0x10/0x20\n[   54.896406] Code: a9be7bfd 910003fd f9000bf3 aa0003f3 (b940d400)\n[   54.896410] ---[ end trace 0000000000000000 ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f227165d-a40b-4ff8-8e48-1b615d149cdf",  "id": "CVE-2018-11574",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11574"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190,    20  ],  "analysis": {    "state": "in_triage"  },  "description": "Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. This implementation is distributed as a patch for PPPD 0.91, and includes the affected eap.c and eap-tls.c files. Configurations that use the `refuse-app` option are unaffected.",  "affects": [    {      "ref": "73881d6c-a776-4513-80a9-27bcf656c60d",      "versions": [        {          "component": "point-to-point_protocol",          "version": "2.4.2b3"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "174d33ca-a3a2-48d7-8bb4-4552db4cdb0c",  "id": "CVE-2022-3078",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3078"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.16-rc6. There is a lack of check after calling vzalloc() and lack of free after allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5517b19c-60a5-4c72-af71-2cd31fe8b21d",  "id": "CVE-2025-21877",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: gl620a: fix endpoint checking in genelink_bind()\n\nSyzbot reports [1] a warning in usb_submit_urb() triggered by\ninconsistencies between expected and actually present endpoints\nin gl620a driver. Since genelink_bind() does not properly\nverify whether specified eps are in fact provided by the device,\nin this case, an artificially manufactured one, one may get a\nmismatch.\n\nFix the issue by resorting to a usbnet utility function\nusbnet_get_endpoints(), usually reserved for this very problem.\nCheck for endpoints and return early before proceeding further if\nany are missing.\n\n[1] Syzbot report:\nusb 5-1: Manufacturer: syz\nusb 5-1: SerialNumber: syz\nusb 5-1: config 0 descriptor??\ngl620a 5-1:0.23 usb0: register 'gl620a' at usb-dummy_hcd.0-1, ...\n------------[ cut here ]------------\nusb 5-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 2 PID: 1841 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503\nModules linked in:\nCPU: 2 UID: 0 PID: 1841 Comm: kworker/2:2 Not tainted 6.12.0-syzkaller-07834-g06afb0f36106 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nWorkqueue: mld mld_ifc_work\nRIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503\n...\nCall Trace:\n <TASK>\n usbnet_start_xmit+0x6be/0x2780 drivers/net/usb/usbnet.c:1467\n __netdev_start_xmit include/linux/netdevice.h:5002 [inline]\n netdev_start_xmit include/linux/netdevice.h:5011 [inline]\n xmit_one net/core/dev.c:3590 [inline]\n dev_hard_start_xmit+0x9a/0x7b0 net/core/dev.c:3606\n sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343\n __dev_xmit_skb net/core/dev.c:3827 [inline]\n __dev_queue_xmit+0x13d4/0x43e0 net/core/dev.c:4400\n dev_queue_xmit include/linux/netdevice.h:3168 [inline]\n neigh_resolve_output net/core/neighbour.c:1514 [inline]\n neigh_resolve_output+0x5bc/0x950 net/core/neighbour.c:1494\n neigh_output include/net/neighbour.h:539 [inline]\n ip6_finish_output2+0xb1b/0x2070 net/ipv6/ip6_output.c:141\n __ip6_finish_output net/ipv6/ip6_output.c:215 [inline]\n ip6_finish_output+0x3f9/0x1360 net/ipv6/ip6_output.c:226\n NF_HOOK_COND include/linux/netfilter.h:303 [inline]\n ip6_output+0x1f8/0x540 net/ipv6/ip6_output.c:247\n dst_output include/net/dst.h:450 [inline]\n NF_HOOK include/linux/netfilter.h:314 [inline]\n NF_HOOK include/linux/netfilter.h:308 [inline]\n mld_sendpack+0x9f0/0x11d0 net/ipv6/mcast.c:1819\n mld_send_cr net/ipv6/mcast.c:2120 [inline]\n mld_ifc_work+0x740/0xca0 net/ipv6/mcast.c:2651\n process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229\n process_scheduled_works kernel/workqueue.c:3310 [inline]\n worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391\n kthread+0x2c1/0x3a0 kernel/kthread.c:389\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "92cd4be9-2e5b-4396-a574-233e984736ee",  "id": "CVE-2022-48701",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()\n\nThere may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and\nthe number of it's interfaces less than 4, an out-of-bounds read bug occurs\nwhen parsing the interface descriptor for this device.\n\nFix this by checking the number of interfaces.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "173f6849-c8d5-425f-89d3-7aff2a39b120",  "id": "CVE-2026-64114",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: raw: reject IP_HDRINCL packets with ihl < 5\n\nraw_send_hdrinc() validates that the caller-supplied IPv4 header\nfits within the message length:\n\n    iphlen = iph->ihl * 4;\n    err = -EINVAL;\n    if (iphlen > length)\n        goto error_free;\n\n    if (iphlen >= sizeof(*iph)) {\n        /* fix up saddr, tot_len, id, csum, transport_header */\n    }\n\nIt does not, however, reject ihl < 5.  For such a packet the\n\"if (iphlen >= sizeof(*iph))\" branch is skipped, leaving the\ncrafted iphdr untouched, but the packet is still handed to\n__ip_local_out() and onward.  Downstream consumers that read\niph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in\nparticular subtracts sizeof(struct iphdr) from top_iph->ihl * 4\nand passes the (signed-int-negative, then cast to size_t)\nresult to memcpy(), producing an OOB access of length close to\nSIZE_MAX and a host kernel panic.\n\nAn IPv4 header with ihl < 5 is malformed by definition (RFC 791:\n\"Internet Header Length is the length of the internet header in\n32 bit words ... Note that the minimum value for a correct header\nis 5.\").  The kernel should not be willing to inject such a\npacket into its own output path.\n\nReject \"iphlen < sizeof(*iph)\" alongside the existing\n\"iphlen > length\" check.  This matches the principle that locally\nconstructed packets that re-enter the IP stack must pass the same\nbasic sanity tests that a foreign packet would be subjected to.\n\nOnce this lands, the \"if (iphlen >= sizeof(*iph))\" wrapper around\nthe fixup branch becomes redundant; left in place to keep the\npatch minimal and backport-friendly.  A follow-up can unwrap it.\n\nNote that commit 86f4c90a1c5c (\"ipv4, ipv6: ensure raw socket\nmessage is big enough to hold an IP header\") ensures the message\nbuffer is large enough to hold an iphdr, but does not constrain\nthe self-reported iph->ihl.\n\nReachability: the malformed packet source is any caller with\nCAP_NET_RAW, including an unprivileged process in a user+net\nnamespace on a kernel with CONFIG_USER_NS=y.  The reproduced AH\ncrash also requires a matching xfrm AH policy on the outgoing\nroute; a container granted CAP_NET_ADMIN can install that state\nand policy in its netns.  Loopback bypasses xfrm_output, so the\ntrigger uses a real netdev.\n\nReproduced on UML + KASAN: kernel-mode fault at addr 0x0 with\nmemcpy_orig at the crash site.  Same shape reproduces inside a\nrootless Docker container with --cap-add NET_ADMIN on a stock\ndistro kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5d03d261-281a-49d6-ba36-3fbf7d445b83",  "id": "MGASA-2024-0322",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bc2a1d86-62d9-4cbd-b89b-af549a5c9c23",  "id": "CVE-2013-2896",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2896"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/hid/hid-ntrig.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_NTRIG is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e7123be5-e504-4e29-a2fa-19763dc99b5f",  "id": "CVE-2024-57850",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: Prevent rtime decompress memory corruption\n\nThe rtime decompression routine does not fully check bounds during the\nentirety of the decompression pass and can corrupt memory outside the\ndecompression buffer if the compressed data is corrupted. This adds the\nrequired check to prevent this failure mode.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d1beba2-64ea-43ba-891a-b26b6f9e6c53",  "id": "CVE-2021-20219",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20219"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    697  ],  "analysis": {    "state": "in_triage"  },  "description": "A denial of service vulnerability was found in n_tty_receive_char_special in drivers/tty/n_tty.c of the Linux kernel. In this flaw a local attacker with a normal user privilege could delay the loop (due to a changing ldata->read_head, and a missing sanity check) and cause a threat to the system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e933c239-1bd7-4fd4-8cb2-99b4248aabd7",  "id": "CVE-2020-12771",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12771"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "814926e4-2957-4dbc-b3c0-f78e9be18923",  "id": "CLSA-2023-1687268961",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4532df19-fdf8-436b-9951-3928d90fda0b",  "id": "CVE-2024-56599",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath10k: avoid NULL pointer error during sdio remove\n\nWhen running 'rmmod ath10k', ath10k_sdio_remove() will free sdio\nworkqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON\nis set to yes, kernel panic will happen:\nCall trace:\n destroy_workqueue+0x1c/0x258\n ath10k_sdio_remove+0x84/0x94\n sdio_bus_remove+0x50/0x16c\n device_release_driver_internal+0x188/0x25c\n device_driver_detach+0x20/0x2c\n\nThis is because during 'rmmod ath10k', ath10k_sdio_remove() will call\nath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release()\nwill finally be called in ath10k_core_destroy(). This function will free\nstruct cfg80211_registered_device *rdev and all its members, including\nwiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio\nworkqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON.\n\nAfter device release, destroy_workqueue() will use NULL pointer then the\nkernel panic happen.\n\nCall trace:\nath10k_sdio_remove\n  ->ath10k_core_unregister\n    ……\n    ->ath10k_core_stop\n      ->ath10k_hif_stop\n        ->ath10k_sdio_irq_disable\n    ->ath10k_hif_power_down\n      ->del_timer_sync(&ar_sdio->sleep_timer)\n  ->ath10k_core_destroy\n    ->ath10k_mac_destroy\n      ->ieee80211_free_hw\n        ->wiphy_free\n    ……\n          ->wiphy_dev_release\n  ->destroy_workqueue\n\nNeed to call destroy_workqueue() before ath10k_core_destroy(), free\nthe work queue buffer first and then free pointer of work queue by\nath10k_core_destroy(). This order matches the error path order in\nath10k_sdio_probe().\n\nNo work will be queued on sdio workqueue between it is destroyed and\nath10k_core_destroy() is called. Based on the call_stack above, the\nreason is:\nOnly ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() and\nath10k_sdio_irq_disable() will queue work on sdio workqueue.\nSleep timer will be deleted before ath10k_core_destroy() in\nath10k_hif_power_down().\nath10k_sdio_irq_disable() only be called in ath10k_hif_stop().\nath10k_core_unregister() will call ath10k_hif_power_down() to stop hif\nbus, so ath10k_sdio_hif_tx_sg() won't be called anymore.\n\nTested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bdc7b5dd-a938-473d-ae51-37a95ebcb6de",  "id": "CVE-2023-2019",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2019"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    911  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95aa777a-3bc6-416d-88a6-53f8f1123ae5",  "id": "CVE-2022-50082",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix warning in ext4_iomap_begin as race between bmap and write\n\nWe got issue as follows:\n------------[ cut here ]------------\nWARNING: CPU: 3 PID: 9310 at fs/ext4/inode.c:3441 ext4_iomap_begin+0x182/0x5d0\nRIP: 0010:ext4_iomap_begin+0x182/0x5d0\nRSP: 0018:ffff88812460fa08 EFLAGS: 00010293\nRAX: ffff88811f168000 RBX: 0000000000000000 RCX: ffffffff97793c12\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: ffff88812c669160 R08: ffff88811f168000 R09: ffffed10258cd20f\nR10: ffff88812c669077 R11: ffffed10258cd20e R12: 0000000000000001\nR13: 00000000000000a4 R14: 000000000000000c R15: ffff88812c6691ee\nFS:  00007fd0d6ff3740(0000) GS:ffff8883af180000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fd0d6dda290 CR3: 0000000104a62000 CR4: 00000000000006e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n iomap_apply+0x119/0x570\n iomap_bmap+0x124/0x150\n ext4_bmap+0x14f/0x250\n bmap+0x55/0x80\n do_vfs_ioctl+0x952/0xbd0\n __x64_sys_ioctl+0xc6/0x170\n do_syscall_64+0x33/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nAbove issue may happen as follows:\n          bmap                    write\nbmap\n  ext4_bmap\n    iomap_bmap\n      ext4_iomap_begin\n                            ext4_file_write_iter\n\t\t\t      ext4_buffered_write_iter\n\t\t\t        generic_perform_write\n\t\t\t\t  ext4_da_write_begin\n\t\t\t\t    ext4_da_write_inline_data_begin\n\t\t\t\t      ext4_prepare_inline_data\n\t\t\t\t        ext4_create_inline_data\n\t\t\t\t\t  ext4_set_inode_flag(inode,\n\t\t\t\t\t\tEXT4_INODE_INLINE_DATA);\n      if (WARN_ON_ONCE(ext4_has_inline_data(inode))) ->trigger bug_on\n\nTo solved above issue hold inode lock in ext4_bamp.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8844fb91-6c79-4cfd-95ee-54de714357e3",  "id": "openSUSE-SU-2026:20387-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "caed4623-66c5-4258-94d6-98cf2a78bc5a",  "id": "CVE-2025-37807",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix kmemleak warning for percpu hashmap\n\nVlad Poenaru reported the following kmemleak issue:\n\n  unreferenced object 0x606fd7c44ac8 (size 32):\n    backtrace (crc 0):\n      pcpu_alloc_noprof+0x730/0xeb0\n      bpf_map_alloc_percpu+0x69/0xc0\n      prealloc_init+0x9d/0x1b0\n      htab_map_alloc+0x363/0x510\n      map_create+0x215/0x3a0\n      __sys_bpf+0x16b/0x3e0\n      __x64_sys_bpf+0x18/0x20\n      do_syscall_64+0x7b/0x150\n      entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nFurther investigation shows the reason is due to not 8-byte aligned\nstore of percpu pointer in htab_elem_set_ptr():\n  *(void __percpu **)(l->key + key_size) = pptr;\n\nNote that the whole htab_elem alignment is 8 (for x86_64). If the key_size\nis 4, that means pptr is stored in a location which is 4 byte aligned but\nnot 8 byte aligned. In mm/kmemleak.c, scan_block() scans the memory based\non 8 byte stride, so it won't detect above pptr, hence reporting the memory\nleak.\n\nIn htab_map_alloc(), we already have\n\n        htab->elem_size = sizeof(struct htab_elem) +\n                          round_up(htab->map.key_size, 8);\n        if (percpu)\n                htab->elem_size += sizeof(void *);\n        else\n                htab->elem_size += round_up(htab->map.value_size, 8);\n\nSo storing pptr with 8-byte alignment won't cause any problem and can fix\nkmemleak too.\n\nThe issue can be reproduced with bpf selftest as well:\n  1. Enable CONFIG_DEBUG_KMEMLEAK config\n  2. Add a getchar() before skel destroy in test_hash_map() in prog_tests/for_each.c.\n     The purpose is to keep map available so kmemleak can be detected.\n  3. run './test_progs -t for_each/hash_map &' and a kmemleak should be reported.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bb8565a0-a89c-4438-b877-72f25ae68cd1",  "id": "CVE-2023-52664",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atlantic: eliminate double free in error handling logic\n\nDriver has a logic leak in ring data allocation/free,\nwhere aq_ring_free could be called multiple times on same ring,\nif system is under stress and got memory allocation error.\n\nRing pointer was used as an indicator of failure, but this is\nnot correct since only ring data is allocated/deallocated.\nRing itself is an array member.\n\nChanging ring allocation functions to return error code directly.\nThis simplifies error handling and eliminates aq_ring_free\non higher layer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "62dcb89d-4eca-44b8-9688-bfd93b2ca908",  "id": "CVE-2017-17448",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17448"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    862  ],  "analysis": {    "state": "in_triage"  },  "description": "net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a639e4fb-0a41-436c-b0ce-699bdf34b38c",  "id": "CVE-2026-52915",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_hbh: reject oversized option lists\n\nstruct ip6t_opts stores at most IP6T_OPTS_OPTSNR option descriptors,\nbut hbh_mt6_check() does not reject larger optsnr values supplied from\nuserspace.\n\nValidate optsnr in the rule setup path so only match data that fits the\nfixed-size opts array can be installed. This follows the existing xtables\npattern of rejecting invalid user-provided counts in checkentry() and\nkeeps the packet matching path unchanged.\n\n`struct ip6t_opts` has a fixed `opts[IP6T_OPTS_OPTSNR]` array,\nwhere `IP6T_OPTS_OPTSNR` is 16, then off-by-one array access is possible:\n\n[  137.924693][ T8692] UBSAN: array-index-out-of-bounds in ../net/ipv6/netfilter/ip6t_hbh.c:110:29\n[  137.926167][ T8692] index 16 is out of range for type '__u16 [16]'",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b37c8aa7-9bd1-420c-81ff-e6747e86dcd2",  "id": "CVE-2012-4542",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4542"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c42d79f-8a07-455b-bc7c-fa6d34fb95e9",  "id": "CVE-2021-47219",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47219"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()\n\nThe following issue was observed running syzkaller:\n\nBUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:377 [inline]\nBUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831\nRead of size 2132 at addr ffff8880aea95dc8 by task syz-executor.0/9815\n\nCPU: 0 PID: 9815 Comm: syz-executor.0 Not tainted 4.19.202-00874-gfc0fe04215a9 #2\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0xe4/0x14a lib/dump_stack.c:118\n print_address_description+0x73/0x280 mm/kasan/report.c:253\n kasan_report_error mm/kasan/report.c:352 [inline]\n kasan_report+0x272/0x370 mm/kasan/report.c:410\n memcpy+0x1f/0x50 mm/kasan/kasan.c:302\n memcpy include/linux/string.h:377 [inline]\n sg_copy_buffer+0x150/0x1c0 lib/scatterlist.c:831\n fill_from_dev_buffer+0x14f/0x340 drivers/scsi/scsi_debug.c:1021\n resp_report_tgtpgs+0x5aa/0x770 drivers/scsi/scsi_debug.c:1772\n schedule_resp+0x464/0x12f0 drivers/scsi/scsi_debug.c:4429\n scsi_debug_queuecommand+0x467/0x1390 drivers/scsi/scsi_debug.c:5835\n scsi_dispatch_cmd+0x3fc/0x9b0 drivers/scsi/scsi_lib.c:1896\n scsi_request_fn+0x1042/0x1810 drivers/scsi/scsi_lib.c:2034\n __blk_run_queue_uncond block/blk-core.c:464 [inline]\n __blk_run_queue+0x1a4/0x380 block/blk-core.c:484\n blk_execute_rq_nowait+0x1c2/0x2d0 block/blk-exec.c:78\n sg_common_write.isra.19+0xd74/0x1dc0 drivers/scsi/sg.c:847\n sg_write.part.23+0x6e0/0xd00 drivers/scsi/sg.c:716\n sg_write+0x64/0xa0 drivers/scsi/sg.c:622\n __vfs_write+0xed/0x690 fs/read_write.c:485\nkill_bdev:block_device:00000000e138492c\n vfs_write+0x184/0x4c0 fs/read_write.c:549\n ksys_write+0x107/0x240 fs/read_write.c:599\n do_syscall_64+0xc2/0x560 arch/x86/entry/common.c:293\n entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nWe get 'alen' from command its type is int. If userspace passes a large\nlength we will get a negative 'alen'.\n\nSwitch n, alen, and rlen to u32.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d2a7e97-16be-486c-a6c6-e9282caa8f33",  "id": "CVE-2023-3022",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3022"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    843  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the IPv6 module of the Linux kernel. The arg.result was not used consistently in fib6_rule_lookup, sometimes holding rt6_info and other times fib6_info. This was not accounted for in other parts of the code where rt6_info was expected unconditionally, potentially leading to a kernel panic in fib6_rule_suppress.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db3b0ea2-0d71-40e5-b087-34994d6f7d1e",  "id": "CVE-2006-2935",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-2935"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom.c in Linux kernel 2.2.16, and later versions, assigns the wrong value to a length variable, which allows local users to execute arbitrary code via a crafted USB Storage device that triggers a buffer overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "68ff36f4-091d-4e4d-a06d-af92bd92f7bb",  "id": "MGASA-2026-0353",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d4d5a86a-9edb-4961-81ab-bf8eec984828",  "id": "CVE-2021-3635",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3635"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with root (CAP_SYS_ADMIN) access is able to panic the system when issuing netfilter netflow commands.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "97499ffc-f144-4974-9f6e-6db7cca69d06",  "id": "ALSA-2022:5818",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e7b03cd-95d8-4407-ba04-aa6f6f91175a",  "id": "CVE-2024-40942",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: mesh: Fix leak of mesh_preq_queue objects\n\nThe hwmp code use objects of type mesh_preq_queue, added to a list in\nieee80211_if_mesh, to keep track of mpath we need to resolve. If the mpath\ngets deleted, ex mesh interface is removed, the entries in that list will\nnever get cleaned. Fix this by flushing all corresponding items of the\npreq_queue in mesh_path_flush_pending().\n\nThis should take care of KASAN reports like this:\n\nunreferenced object 0xffff00000668d800 (size 128):\n  comm \"kworker/u8:4\", pid 67, jiffies 4295419552 (age 1836.444s)\n  hex dump (first 32 bytes):\n    00 1f 05 09 00 00 ff ff 00 d5 68 06 00 00 ff ff  ..........h.....\n    8e 97 ea eb 3e b8 01 00 00 00 00 00 00 00 00 00  ....>...........\n  backtrace:\n    [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c\n    [<00000000049bd418>] kmalloc_trace+0x34/0x80\n    [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8\n    [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c\n    [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4\n    [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764\n    [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4\n    [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440\n    [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c\n    [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4\n    [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508\n    [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c\n    [<00000000b36425d1>] worker_thread+0x9c/0x634\n    [<0000000005852dd5>] kthread+0x1bc/0x1c4\n    [<000000005fccd770>] ret_from_fork+0x10/0x20\nunreferenced object 0xffff000009051f00 (size 128):\n  comm \"kworker/u8:4\", pid 67, jiffies 4295419553 (age 1836.440s)\n  hex dump (first 32 bytes):\n    90 d6 92 0d 00 00 ff ff 00 d8 68 06 00 00 ff ff  ..........h.....\n    36 27 92 e4 02 e0 01 00 00 58 79 06 00 00 ff ff  6'.......Xy.....\n  backtrace:\n    [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c\n    [<00000000049bd418>] kmalloc_trace+0x34/0x80\n    [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8\n    [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c\n    [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4\n    [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764\n    [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4\n    [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440\n    [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c\n    [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4\n    [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508\n    [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c\n    [<00000000b36425d1>] worker_thread+0x9c/0x634\n    [<0000000005852dd5>] kthread+0x1bc/0x1c4\n    [<000000005fccd770>] ret_from_fork+0x10/0x20",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6c624a1b-ae9a-4f26-9bde-8d839dbaf348",  "id": "CVE-2020-12652",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12652"  },  "ratings": [    {      "score": 4.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The __mptctl_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect lock during the ioctl operation and trigger a race condition, i.e., a \"double fetch\" vulnerability, aka CID-28d76df18f0a. NOTE: the vendor states \"The security impact of this bug is not as bad as it could have been because these operations are all privileged and root already has enormous destructive power.\"",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a3eca85e-4c07-448e-a46b-9522ada0a4f9",  "id": "CVE-2025-21821",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omap: use threaded IRQ for LCD DMA\n\nWhen using touchscreen and framebuffer, Nokia 770 crashes easily with:\n\n    BUG: scheduling while atomic: irq/144-ads7846/82/0x00010000\n    Modules linked in: usb_f_ecm g_ether usb_f_rndis u_ether libcomposite configfs omap_udc ohci_omap ohci_hcd\n    CPU: 0 UID: 0 PID: 82 Comm: irq/144-ads7846 Not tainted 6.12.7-770 #2\n    Hardware name: Nokia 770\n    Call trace:\n     unwind_backtrace from show_stack+0x10/0x14\n     show_stack from dump_stack_lvl+0x54/0x5c\n     dump_stack_lvl from __schedule_bug+0x50/0x70\n     __schedule_bug from __schedule+0x4d4/0x5bc\n     __schedule from schedule+0x34/0xa0\n     schedule from schedule_preempt_disabled+0xc/0x10\n     schedule_preempt_disabled from __mutex_lock.constprop.0+0x218/0x3b4\n     __mutex_lock.constprop.0 from clk_prepare_lock+0x38/0xe4\n     clk_prepare_lock from clk_set_rate+0x18/0x154\n     clk_set_rate from sossi_read_data+0x4c/0x168\n     sossi_read_data from hwa742_read_reg+0x5c/0x8c\n     hwa742_read_reg from send_frame_handler+0xfc/0x300\n     send_frame_handler from process_pending_requests+0x74/0xd0\n     process_pending_requests from lcd_dma_irq_handler+0x50/0x74\n     lcd_dma_irq_handler from __handle_irq_event_percpu+0x44/0x130\n     __handle_irq_event_percpu from handle_irq_event+0x28/0x68\n     handle_irq_event from handle_level_irq+0x9c/0x170\n     handle_level_irq from generic_handle_domain_irq+0x2c/0x3c\n     generic_handle_domain_irq from omap1_handle_irq+0x40/0x8c\n     omap1_handle_irq from generic_handle_arch_irq+0x28/0x3c\n     generic_handle_arch_irq from call_with_stack+0x1c/0x24\n     call_with_stack from __irq_svc+0x94/0xa8\n    Exception stack(0xc5255da0 to 0xc5255de8)\n    5da0: 00000001 c22fc620 00000000 00000000 c08384a8 c106fc00 00000000 c240c248\n    5dc0: c113a600 c3f6ec30 00000001 00000000 c22fc620 c5255df0 c22fc620 c0279a94\n    5de0: 60000013 ffffffff\n     __irq_svc from clk_prepare_lock+0x4c/0xe4\n     clk_prepare_lock from clk_get_rate+0x10/0x74\n     clk_get_rate from uwire_setup_transfer+0x40/0x180\n     uwire_setup_transfer from spi_bitbang_transfer_one+0x2c/0x9c\n     spi_bitbang_transfer_one from spi_transfer_one_message+0x2d0/0x664\n     spi_transfer_one_message from __spi_pump_transfer_message+0x29c/0x498\n     __spi_pump_transfer_message from __spi_sync+0x1f8/0x2e8\n     __spi_sync from spi_sync+0x24/0x40\n     spi_sync from ads7846_halfd_read_state+0x5c/0x1c0\n     ads7846_halfd_read_state from ads7846_irq+0x58/0x348\n     ads7846_irq from irq_thread_fn+0x1c/0x78\n     irq_thread_fn from irq_thread+0x120/0x228\n     irq_thread from kthread+0xc8/0xe8\n     kthread from ret_from_fork+0x14/0x28\n\nAs a quick fix, switch to a threaded IRQ which provides a stable system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "faafec3f-ecb1-4e40-8893-e6ed7f0dafe4",  "id": "CVE-2014-2678",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2678"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b6bd9f8d-d3ba-4120-8f39-78d18c455b30",  "id": "CVE-2010-4343",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4343"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    665  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51396430-6f70-46f3-bf1b-f6bbc3de973b",  "id": "CVE-2025-38063",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix unconditional IO throttle caused by REQ_PREFLUSH\n\nWhen a bio with REQ_PREFLUSH is submitted to dm, __send_empty_flush()\ngenerates a flush_bio with REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC,\nwhich causes the flush_bio to be throttled by wbt_wait().\n\nAn example from v5.4, similar problem also exists in upstream:\n\n    crash> bt 2091206\n    PID: 2091206  TASK: ffff2050df92a300  CPU: 109  COMMAND: \"kworker/u260:0\"\n     #0 [ffff800084a2f7f0] __switch_to at ffff80004008aeb8\n     #1 [ffff800084a2f820] __schedule at ffff800040bfa0c4\n     #2 [ffff800084a2f880] schedule at ffff800040bfa4b4\n     #3 [ffff800084a2f8a0] io_schedule at ffff800040bfa9c4\n     #4 [ffff800084a2f8c0] rq_qos_wait at ffff8000405925bc\n     #5 [ffff800084a2f940] wbt_wait at ffff8000405bb3a0\n     #6 [ffff800084a2f9a0] __rq_qos_throttle at ffff800040592254\n     #7 [ffff800084a2f9c0] blk_mq_make_request at ffff80004057cf38\n     #8 [ffff800084a2fa60] generic_make_request at ffff800040570138\n     #9 [ffff800084a2fae0] submit_bio at ffff8000405703b4\n    #10 [ffff800084a2fb50] xlog_write_iclog at ffff800001280834 [xfs]\n    #11 [ffff800084a2fbb0] xlog_sync at ffff800001280c3c [xfs]\n    #12 [ffff800084a2fbf0] xlog_state_release_iclog at ffff800001280df4 [xfs]\n    #13 [ffff800084a2fc10] xlog_write at ffff80000128203c [xfs]\n    #14 [ffff800084a2fcd0] xlog_cil_push at ffff8000012846dc [xfs]\n    #15 [ffff800084a2fda0] xlog_cil_push_work at ffff800001284a2c [xfs]\n    #16 [ffff800084a2fdb0] process_one_work at ffff800040111d08\n    #17 [ffff800084a2fe00] worker_thread at ffff8000401121cc\n    #18 [ffff800084a2fe70] kthread at ffff800040118de4\n\nAfter commit 2def2845cc33 (\"xfs: don't allow log IO to be throttled\"),\nthe metadata submitted by xlog_write_iclog() should not be throttled.\nBut due to the existence of the dm layer, throttling flush_bio indirectly\ncauses the metadata bio to be throttled.\n\nFix this by conditionally adding REQ_IDLE to flush_bio.bi_opf, which makes\nwbt_should_throttle() return false to avoid wbt_wait().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "57f0a8fa-3d65-4195-a485-bedda0259cb5",  "id": "CVE-2022-3533",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3533"  },  "ratings": [    {      "score": 5.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    404  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211031.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e90e0fcb-74b0-4e3d-a0ba-c6ed91dfafb0",  "id": "CVE-2022-49497",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: remove two BUG() from skb_checksum_help()\n\nI have a syzbot report that managed to get a crash in skb_checksum_help()\n\nIf syzbot can trigger these BUG(), it makes sense to replace\nthem with more friendly WARN_ON_ONCE() since skb_checksum_help()\ncan instead return an error code.\n\nNote that syzbot will still crash there, until real bug is fixed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "46389deb-7ce6-4ebe-ba21-18e8e534ad6c",  "id": "CVE-2013-3227",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3227"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The caif_seqpkt_recvmsg function in net/caif/caif_socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f4277655-5ee1-4fdc-bbae-6a22b0bf0c3a",  "id": "CVE-2026-52920",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.300000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_policy: fix strict mode inbound policy matching\n\nmatch_policy_in() walks sec_path entries from the last transform to the\nfirst one, but strict policy matching needs to consume info->pol[] in\nthe same forward order as the rule layout.\n\nDerive the strict-match policy position from the number of transforms\nalready consumed so that multi-element inbound rules are matched\nconsistently.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c74adfbd-b95d-4148-a93c-e10154434cd4",  "id": "CVE-2023-53150",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Pointer may be dereferenced\n\nKlocwork tool reported pointer 'rport' returned from call to function\nfc_bsg_to_rport() may be NULL and will be dereferenced.\n\nAdd a fix to validate rport before dereferencing.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18d929f0-4e22-4696-858a-0d2714f72bd2",  "id": "CVE-2026-31402",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix heap overflow in NFSv4.0 LOCK replay cache\n\nThe NFSv4.0 replay cache uses a fixed 112-byte inline buffer\n(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses.\nThis size was calculated based on OPEN responses and does not account\nfor LOCK denied responses, which include the conflicting lock owner as\na variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT).\n\nWhen a LOCK operation is denied due to a conflict with an existing lock\nthat has a large owner, nfsd4_encode_operation() copies the full encoded\nresponse into the undersized replay buffer via read_bytes_from_xdr_buf()\nwith no bounds check. This results in a slab-out-of-bounds write of up\nto 944 bytes past the end of the buffer, corrupting adjacent heap memory.\n\nThis can be triggered remotely by an unauthenticated attacker with two\ncooperating NFSv4.0 clients: one sets a lock with a large owner string,\nthen the other requests a conflicting lock to provoke the denial.\n\nWe could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full\nopaque, but that would increase the size of every stateowner, when most\nlockowners are not that large.\n\nInstead, fix this by checking the encoded response length against\nNFSD4_REPLAY_ISIZE before copying into the replay buffer. If the\nresponse is too large, set rp_buflen to 0 to skip caching the replay\npayload. The status is still cached, and the client already received the\ncorrect response on the original request.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9d7b001-8121-468b-b0c6-98a4295fede0",  "id": "CVE-2022-23303",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23303"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    203  ],  "analysis": {    "state": "in_triage"  },  "description": "The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bcaedc4d-ad56-4e56-862d-9eb4026112c8",  "id": "CVE-2022-44034",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44034"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/scr24x_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between scr24x_open() and scr24x_remove().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e8048cfd-e25d-4dd0-8398-5bad418efd10",  "id": "CVE-2019-15220",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15220"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.2.1. There is a use-after-free caused by a malicious USB device in the drivers/net/wireless/intersil/p54/p54usb.c driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2a4a936e-c79c-4f28-8d85-d121f4545583",  "id": "OESA-2023-1821",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf25f556-1092-4f0b-914a-d22a5ab05603",  "id": "DLA-3942-2",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "598641db-05d7-4ee6-afb6-d1b30a852db7",  "id": "CVE-2022-3707",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3707"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    415,    460  ],  "analysis": {    "state": "in_triage"  },  "description": "A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could allow a local user to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e1f3128d-78af-414c-9c21-33d6f5096933",  "id": "CVE-2024-26811",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate payload size in ipc response\n\nIf installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc\nresponse to ksmbd kernel server. ksmbd should validate payload size of\nipc response from ksmbd.mountd to avoid memory overrun or\nslab-out-of-bounds. This patch validate 3 ipc response that has payload.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e1001ce-c763-43bd-b71b-a1de9795f494",  "id": "CVE-2013-2140",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2140"  },  "ratings": [    {      "score": 3.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:S/C:N/I:P/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The dispatch_discard_io function in drivers/block/xen-blkback/blkback.c in the Xen blkback implementation in the Linux kernel before 3.10.5 allows guest OS users to cause a denial of service (data loss) via filesystem write operations on a read-only disk that supports the (1) BLKIF_OP_DISCARD (aka discard or TRIM) or (2) SCSI UNMAP feature.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "64b0addc-520c-4df3-ac78-c2ee4a10eff1",  "id": "CVE-2021-3736",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3736"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200,    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O (VFIO) Mediated devices. This flaw could allow a local attacker to leak internal kernel information.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bb9990e7-8e05-4a84-bc1d-c8eb93763bf9",  "id": "CVE-2022-48902",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not WARN_ON() if we have PageError set\n\nWhenever we do any extent buffer operations we call\nassert_eb_page_uptodate() to complain loudly if we're operating on an\nnon-uptodate page.  Our overnight tests caught this warning earlier this\nweek\n\n  WARNING: CPU: 1 PID: 553508 at fs/btrfs/extent_io.c:6849 assert_eb_page_uptodate+0x3f/0x50\n  CPU: 1 PID: 553508 Comm: kworker/u4:13 Tainted: G        W         5.17.0-rc3+ #564\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014\n  Workqueue: btrfs-cache btrfs_work_helper\n  RIP: 0010:assert_eb_page_uptodate+0x3f/0x50\n  RSP: 0018:ffffa961440a7c68 EFLAGS: 00010246\n  RAX: 0017ffffc0002112 RBX: ffffe6e74453f9c0 RCX: 0000000000001000\n  RDX: ffffe6e74467c887 RSI: ffffe6e74453f9c0 RDI: ffff8d4c5efc2fc0\n  RBP: 0000000000000d56 R08: ffff8d4d4a224000 R09: 0000000000000000\n  R10: 00015817fa9d1ef0 R11: 000000000000000c R12: 00000000000007b1\n  R13: ffff8d4c5efc2fc0 R14: 0000000001500000 R15: 0000000001cb1000\n  FS:  0000000000000000(0000) GS:ffff8d4dbbd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007ff31d3448d8 CR3: 0000000118be8004 CR4: 0000000000370ee0\n  Call Trace:\n\n   extent_buffer_test_bit+0x3f/0x70\n   free_space_test_bit+0xa6/0xc0\n   load_free_space_tree+0x1f6/0x470\n   caching_thread+0x454/0x630\n   ? rcu_read_lock_sched_held+0x12/0x60\n   ? rcu_read_lock_sched_held+0x12/0x60\n   ? rcu_read_lock_sched_held+0x12/0x60\n   ? lock_release+0x1f0/0x2d0\n   btrfs_work_helper+0xf2/0x3e0\n   ? lock_release+0x1f0/0x2d0\n   ? finish_task_switch.isra.0+0xf9/0x3a0\n   process_one_work+0x26d/0x580\n   ? process_one_work+0x580/0x580\n   worker_thread+0x55/0x3b0\n   ? process_one_work+0x580/0x580\n   kthread+0xf0/0x120\n   ? kthread_complete_and_exit+0x20/0x20\n   ret_from_fork+0x1f/0x30\n\nThis was partially fixed by c2e39305299f01 (\"btrfs: clear extent buffer\nuptodate when we fail to write it\"), however all that fix did was keep\nus from finding extent buffers after a failed writeout.  It didn't keep\nus from continuing to use a buffer that we already had found.\n\nIn this case we're searching the commit root to cache the block group,\nso we can start committing the transaction and switch the commit root\nand then start writing.  After the switch we can look up an extent\nbuffer that hasn't been written yet and start processing that block\ngroup.  Then we fail to write that block out and clear Uptodate on the\npage, and then we start spewing these errors.\n\nNormally we're protected by the tree lock to a certain degree here.  If\nwe read a block we have that block read locked, and we block the writer\nfrom locking the block before we submit it for the write.  However this\nisn't necessarily fool proof because the read could happen before we do\nthe submit_bio and after we locked and unlocked the extent buffer.\n\nAlso in this particular case we have path->skip_locking set, so that\nwon't save us here.  We'll simply get a block that was valid when we\nread it, but became invalid while we were using it.\n\nWhat we really want is to catch the case where we've \"read\" a block but\nit's not marked Uptodate.  On read we ClearPageError(), so if we're\n!Uptodate and !Error we know we didn't do the right thing for reading\nthe page.\n\nFix this by checking !Uptodate && !Error, this way we will not complain\nif our buffer gets invalidated while we're using it, and we'll maintain\nthe spirit of the check which is to make sure we have a fully in-cache\nblock while we're messing with it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "25958dd9-8d46-47a2-a46a-0d59e5c2a064",  "id": "CVE-2022-41858",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41858"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    416,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "61e5cad4-e3ad-4f34-b5e8-a5e33fc55578",  "id": "CVE-2024-38607",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacintosh/via-macii: Fix \"BUG: sleeping function called from invalid context\"\n\nThe via-macii ADB driver calls request_irq() after disabling hard\ninterrupts. But disabling interrupts isn't necessary here because the\nVIA shift register interrupt was masked during VIA1 initialization.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1af0f63f-811b-4fd4-8bb0-9ae136f3aaea",  "id": "CVE-2021-3348",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3348"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup, aka CID-b98e762e3d71.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9712e4f2-4fcd-42c4-b1dc-f1f00b0f1b93",  "id": "CVE-2026-53039",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate group add input before caching\n\n[BUG]\nOCFS2_IOC_GROUP_ADD can trigger a BUG_ON in\nocfs2_set_new_buffer_uptodate():\n\nkernel BUG at fs/ocfs2/uptodate.c:509!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:ocfs2_set_new_buffer_uptodate+0x194/0x1e0 fs/ocfs2/uptodate.c:509\nCode: ffffe88f 42b9fe4c 89e64889 dfe8b4df\nCall Trace:\n ocfs2_group_add+0x3f1/0x1510 fs/ocfs2/resize.c:507\n ocfs2_ioctl+0x309/0x6e0 fs/ocfs2/ioctl.c:887\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7bbfb55a966d\n\n[CAUSE]\nocfs2_group_add() calls ocfs2_set_new_buffer_uptodate() on a\nuser-controlled group block before ocfs2_verify_group_and_input()\nvalidates that block number. That helper is only valid for newly\nallocated metadata and asserts that the block is not already present in\nthe chosen metadata cache. The code also uses INODE_CACHE(inode) even\nthough the group descriptor belongs to main_bm_inode and later journal\naccesses use that cache context instead.\n\n[FIX]\nValidate the on-disk group descriptor before caching it, then add it to\nthe metadata cache tracked by INODE_CACHE(main_bm_inode). Keep the\nvalidation failure path separate from the later cleanup path so we only\nremove the buffer from that cache after it has actually been inserted.\nThis keeps the group buffer lifetime consistent across validation,\njournaling, and cleanup.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dce8fe75-909f-4f9a-8790-e4b5c19db64f",  "id": "CVE-2010-4164",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4164"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple integer underflows in the x25_parse_facilities function in net/x25/x25_facilities.c in the Linux kernel before 2.6.36.2 allow remote attackers to cause a denial of service (system crash) via malformed X.25 (1) X25_FAC_CLASS_A, (2) X25_FAC_CLASS_B, (3) X25_FAC_CLASS_C, or (4) X25_FAC_CLASS_D facility data, a different vulnerability than CVE-2010-3873.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "efda14a6-3128-4f43-b72e-95907eeb2d8f",  "id": "CVE-2022-1734",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1734"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b09e9832-710f-4624-ae17-439df0cca789",  "id": "CVE-2026-43383",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.4,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tcp-md5: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant\ntime.  Use the appropriate helper function for this.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "49e7951f-6f9a-4a90-a83e-8c44350103a6",  "id": "CVE-2015-7515",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7515"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The aiptek_probe function in drivers/input/tablet/aiptek.c in the Linux kernel before 4.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device that lacks endpoints.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:39544'"    }  ]},{  "bom-ref": "556f00ed-b2fe-40a3-a14b-e51fcc6b8056",  "id": "CVE-2016-6156",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6156"  },  "ratings": [    {      "score": 5.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a \"double fetch\" vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "73708052-aa22-4459-ad83-e46317d18302",  "id": "CLSA-2026-1777397374",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "983ed94a-6921-44da-83c8-5fb9d8bf4403",  "id": "CVE-2026-31405",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-net: fix OOB access in ULE extension header tables\n\nThe ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables\nin handle_one_ule_extension() are declared with 255 elements (valid\nindices 0-254), but the index htype is derived from network-controlled\ndata as (ule_sndu_type & 0x00FF), giving a range of 0-255. When\nhtype equals 255, an out-of-bounds read occurs on the function pointer\ntable, and the OOB value may be called as a function pointer.\n\nAdd a bounds check on htype against the array size before either table\nis accessed. Out-of-range values now cause the SNDU to be discarded.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ec040897-874a-4f67-b811-962790e4f0e0",  "id": "CVE-2015-8324",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8324"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The ext4 implementation in the Linux kernel before 2.6.34 does not properly track the initialization of certain data structures, which allows physically proximate attackers to cause a denial of service (NULL pointer dereference and panic) via a crafted USB device, related to the ext4_fill_super function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e3f6b8d5-2e48-42e4-a751-9b92a77d3fd9",  "id": "CVE-2024-37078",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential kernel bug due to lack of writeback flag waiting\n\nDestructive writes to a block device on which nilfs2 is mounted can cause\na kernel bug in the folio/page writeback start routine or writeback end\nroutine (__folio_start_writeback in the log below):\n\n kernel BUG at mm/page-writeback.c:3070!\n Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\n ...\n RIP: 0010:__folio_start_writeback+0xbaa/0x10e0\n Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff\n  e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f>\n  0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00\n ...\n Call Trace:\n  <TASK>\n  nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2]\n  nilfs_segctor_construct+0x181/0x6b0 [nilfs2]\n  nilfs_segctor_thread+0x548/0x11c0 [nilfs2]\n  kthread+0x2f0/0x390\n  ret_from_fork+0x4b/0x80\n  ret_from_fork_asm+0x1a/0x30\n  </TASK>\n\nThis is because when the log writer starts a writeback for segment summary\nblocks or a super root block that use the backing device's page cache, it\ndoes not wait for the ongoing folio/page writeback, resulting in an\ninconsistent writeback state.\n\nFix this issue by waiting for ongoing writebacks when putting\nfolios/pages on the backing device into writeback state.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cc03f31a-9185-4a7d-905b-1c0319ffa9af",  "id": "CVE-2022-39190",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39190"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95ebf856-e76c-4330-9a0f-b89fcabb573a",  "id": "ALSA-2022:8070",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "72c685d5-05cd-44da-bfb0-4e277f97da28",  "id": "CVE-2013-4579",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4579"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through 3.12 uses a BSSID masking approach to determine the set of MAC addresses on which a Wi-Fi device is listening, which allows remote attackers to discover the original MAC address after spoofing by sending a series of packets to MAC addresses with certain bit manipulations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:38826'"    }  ]},{  "bom-ref": "5c47db58-a797-4c53-91f3-ada8a0379e12",  "id": "CVE-2020-28915",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28915"  },  "ratings": [    {      "score": 5.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b883080-f6d5-4e87-841b-0160931a9ff2",  "id": "CVE-2024-40969",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: don't set RO when shutting down f2fs\n\nShutdown does not check the error of thaw_super due to readonly, which\ncauses a deadlock like below.\n\nf2fs_ioc_shutdown(F2FS_GOING_DOWN_FULLSYNC)        issue_discard_thread\n - bdev_freeze\n  - freeze_super\n - f2fs_stop_checkpoint()\n  - f2fs_handle_critical_error                     - sb_start_write\n    - set RO                                         - waiting\n - bdev_thaw\n  - thaw_super_locked\n    - return -EINVAL, if sb_rdonly()\n - f2fs_stop_discard_thread\n  -> wait for kthread_stop(discard_thread);",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45b01cd8-f4a1-4047-b728-25cd7065382d",  "id": "CVE-2014-0069",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0069"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fdae25ab-4111-4b64-adee-fbb63f5e80a1",  "id": "CVE-2015-0292",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0292"  },  "ratings": [    {      "score": 7.5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b38b0e9-90f7-4c70-9966-46cb2e6b9c3f",  "id": "CVE-2025-22109",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: Remove broken autobind\n\nBinding AX25 socket by using the autobind feature leads to memory leaks\nin ax25_connect() and also refcount leaks in ax25_release(). Memory\nleak was detected with kmemleak:\n\n================================================================\nunreferenced object 0xffff8880253cd680 (size 96):\nbacktrace:\n__kmalloc_node_track_caller_noprof (./include/linux/kmemleak.h:43)\nkmemdup_noprof (mm/util.c:136)\nax25_rt_autobind (net/ax25/ax25_route.c:428)\nax25_connect (net/ax25/af_ax25.c:1282)\n__sys_connect_file (net/socket.c:2045)\n__sys_connect (net/socket.c:2064)\n__x64_sys_connect (net/socket.c:2067)\ndo_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n================================================================\n\nWhen socket is bound, refcounts must be incremented the way it is done\nin ax25_bind() and ax25_setsockopt() (SO_BINDTODEVICE). In case of\nautobind, the refcounts are not incremented.\n\nThis bug leads to the following issue reported by Syzkaller:\n\n================================================================\nax25_connect(): syz-executor318 uses autobind, please contact jreuter@yaina.de\n------------[ cut here ]------------\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 0 PID: 5317 at lib/refcount.c:31 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:31\nModules linked in:\nCPU: 0 UID: 0 PID: 5317 Comm: syz-executor318 Not tainted 6.14.0-rc4-syzkaller-00278-gece144f151ac #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:31\n...\nCall Trace:\n <TASK>\n __refcount_dec include/linux/refcount.h:336 [inline]\n refcount_dec include/linux/refcount.h:351 [inline]\n ref_tracker_free+0x6af/0x7e0 lib/ref_tracker.c:236\n netdev_tracker_free include/linux/netdevice.h:4302 [inline]\n netdev_put include/linux/netdevice.h:4319 [inline]\n ax25_release+0x368/0x960 net/ax25/af_ax25.c:1080\n __sock_release net/socket.c:647 [inline]\n sock_close+0xbc/0x240 net/socket.c:1398\n __fput+0x3e9/0x9f0 fs/file_table.c:464\n __do_sys_close fs/open.c:1580 [inline]\n __se_sys_close fs/open.c:1565 [inline]\n __x64_sys_close+0x7f/0x110 fs/open.c:1565\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n ...\n </TASK>\n================================================================\n\nConsidering the issues above and the comments left in the code that say:\n\"check if we can remove this feature. It is broken.\"; \"autobinding in this\nmay or may not work\"; - it is better to completely remove this feature than\nto fix it because it is broken and leads to various kinds of memory bugs.\n\nNow calling connect() without first binding socket will result in an\nerror (-EINVAL). Userspace software that relies on the autobind feature\nmight get broken. However, this feature does not seem widely used with\nthis specific driver as it was not reliable at any point of time, and it\nis already broken anyway. E.g. ax25-tools and ax25-apps packages for\npopular distributions do not use the autobind feature for AF_AX25.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d1eb08a-d500-440d-ae2a-89be0abaaf0c",  "id": "CLSA-2021-1632261785",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c7197b87-9a3d-4f64-8f99-dc069ec96d44",  "id": "CVE-2018-7740",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7740"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The resv_map_release function in mm/hugetlb.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (BUG) via a crafted application that makes mmap system calls and has a large pgoff argument to the remap_file_pages system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "79de6e0b-f218-4bc8-b88b-d1cb54bc8b1a",  "id": "CVE-2021-47474",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47474"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: vmk80xx: fix bulk-buffer overflow\n\nThe driver is using endpoint-sized buffers but must not assume that the\ntx and rx buffers are of equal size or a malicious device could overflow\nthe slab-allocated receive buffer when doing bulk transfers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e25986fa-6b6e-45dd-8c9a-c446b9b3c487",  "id": "CVE-2024-42151",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable\n\nTest case dummy_st_ops/dummy_init_ret_value passes NULL as the first\nparameter of the test_1() function. Mark this parameter as nullable to\nmake verifier aware of such possibility.\nOtherwise, NULL check in the test_1() code:\n\n      SEC(\"struct_ops/test_1\")\n      int BPF_PROG(test_1, struct bpf_dummy_ops_state *state)\n      {\n            if (!state)\n                    return ...;\n\n            ... access state ...\n      }\n\nMight be removed by verifier, thus triggering NULL pointer dereference\nunder certain conditions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0e7a105-cac6-4982-86f1-ca1009ea5420",  "id": "CVE-2013-1848",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1848"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e03ef782-747c-4f28-bbe8-80a056a8f2c1",  "id": "CVE-2024-53114",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client\n\nA number of Zen4 client SoCs advertise the ability to use virtualized\nVMLOAD/VMSAVE, but using these instructions is reported to be a cause\nof a random host reboot.\n\nThese instructions aren't intended to be advertised on Zen4 client\nso clear the capability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5584e4b2-75dc-47e2-8ade-b3ddca830ce8",  "id": "SUSE-RU-2015:1469-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2946426-cb0e-4432-8431-ca537e29c4ee",  "id": "CLSA-2021-1633442910",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "38a3a4e6-f065-4522-b522-c30ce228846b",  "id": "CVE-2023-52624",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    77  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wake DMCUB before executing GPINT commands\n\n[Why]\nDMCUB can be in idle when we attempt to interface with the HW through\nthe GPINT mailbox resulting in a system hang.\n\n[How]\nAdd dc_wake_and_execute_gpint() to wrap the wake, execute, sleep\nsequence.\n\nIf the GPINT executes successfully then DMCUB will be put back into\nsleep after the optional response is returned.\n\nIt functions similar to the inbox command interface.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "73f8ca94-3f12-4a1d-835f-f791f928b991",  "id": "CVE-2024-35950",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: Fully protect modes[] with dev->mode_config.mutex\n\nThe modes[] array contains pointers to modes on the connectors'\nmode lists, which are protected by dev->mode_config.mutex.\nThus we need to extend modes[] the same protection or by the\ntime we use it the elements may already be pointing to\nfreed/reused memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a6c55c4-e7c0-448d-b21a-1205610ebdbf",  "id": "CVE-2022-3115",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3115"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e46c3221-d99e-4451-84fd-118d23d4a10e",  "id": "MGASA-2019-0354",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "260a99af-2e55-4767-93a8-b4394d06404d",  "id": "CVE-2014-2038",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2038"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "72a7de3b-3a13-464a-9b56-36370d315d04",  "id": "CVE-2021-47187",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47187"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency\n\nThe entry/exit latency and minimum residency in state for the idle\nstates of MSM8998 were ..bad: first of all, for all of them the\ntimings were written for CPU sleep but the min-residency-us param\nwas miscalculated (supposedly, while porting this from downstream);\nThen, the power collapse states are setting PC on both the CPU\ncluster *and* the L2 cache, which have different timings: in the\nspecific case of L2 the times are higher so these ones should be\ntaken into account instead of the CPU ones.\n\nThis parameter misconfiguration was not giving particular issues\nbecause on MSM8998 there was no CPU scaling at all, so cluster/L2\npower collapse was rarely (if ever) hit.\nWhen CPU scaling is enabled, though, the wrong timings will produce\nSoC unstability shown to the user as random, apparently error-less,\nsudden reboots and/or lockups.\n\nThis set of parameters are stabilizing the SoC when CPU scaling is\nON and when power collapse is frequently hit.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18530cab-6452-4d90-8feb-6923fee4232a",  "id": "SUSE-SU-2019:1553-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0d283ad9-b58a-4ee8-8211-6f2a9aaad63f",  "id": "CVE-2022-50012",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64: Init jump labels before parse_early_param()\n\nOn 64-bit, calling jump_label_init() in setup_feature_keys() is too\nlate because static keys may be used in subroutines of\nparse_early_param() which is again subroutine of early_init_devtree().\n\nFor example booting with \"threadirqs\":\n\n  static_key_enable_cpuslocked(): static key '0xc000000002953260' used before call to jump_label_init()\n  WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xfc/0x120\n  ...\n  NIP static_key_enable_cpuslocked+0xfc/0x120\n  LR  static_key_enable_cpuslocked+0xf8/0x120\n  Call Trace:\n    static_key_enable_cpuslocked+0xf8/0x120 (unreliable)\n    static_key_enable+0x30/0x50\n    setup_forced_irqthreads+0x28/0x40\n    do_early_param+0xa0/0x108\n    parse_args+0x290/0x4e0\n    parse_early_options+0x48/0x5c\n    parse_early_param+0x58/0x84\n    early_init_devtree+0xd4/0x518\n    early_setup+0xb4/0x214\n\nSo call jump_label_init() just before parse_early_param() in\nearly_init_devtree().\n\n[mpe: Add call trace to change log and minor wording edits.]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dbaef370-d20a-41c9-be51-60345e1f892e",  "id": "CVE-2013-6383",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6383"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "71a7d260-27ff-4aa3-9497-7d0ecc302030",  "id": "CVE-2018-15594",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15594"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "08ea5177-c6bb-4645-b618-0fcc29d93f3b",  "id": "CVE-2022-1016",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1016"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    824,    909  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a1b33648-2232-4524-b349-152d05c17748",  "id": "CVE-2022-49381",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: fix memory leak in jffs2_do_fill_super\n\nIf jffs2_iget() or d_make_root() in jffs2_do_fill_super() returns\nan error, we can observe the following kmemleak report:\n\n--------------------------------------------\nunreferenced object 0xffff888105a65340 (size 64):\n  comm \"mount\", pid 710, jiffies 4302851558 (age 58.239s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [<ffffffff859c45e5>] kmem_cache_alloc_trace+0x475/0x8a0\n    [<ffffffff86160146>] jffs2_sum_init+0x96/0x1a0\n    [<ffffffff86140e25>] jffs2_do_mount_fs+0x745/0x2120\n    [<ffffffff86149fec>] jffs2_do_fill_super+0x35c/0x810\n    [<ffffffff8614aae9>] jffs2_fill_super+0x2b9/0x3b0\n    [...]\nunreferenced object 0xffff8881bd7f0000 (size 65536):\n  comm \"mount\", pid 710, jiffies 4302851558 (age 58.239s)\n  hex dump (first 32 bytes):\n    bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................\n    bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................\n  backtrace:\n    [<ffffffff858579ba>] kmalloc_order+0xda/0x110\n    [<ffffffff85857a11>] kmalloc_order_trace+0x21/0x130\n    [<ffffffff859c2ed1>] __kmalloc+0x711/0x8a0\n    [<ffffffff86160189>] jffs2_sum_init+0xd9/0x1a0\n    [<ffffffff86140e25>] jffs2_do_mount_fs+0x745/0x2120\n    [<ffffffff86149fec>] jffs2_do_fill_super+0x35c/0x810\n    [<ffffffff8614aae9>] jffs2_fill_super+0x2b9/0x3b0\n    [...]\n--------------------------------------------\n\nThis is because the resources allocated in jffs2_sum_init() are not\nreleased. Call jffs2_sum_exit() to release these resources to solve\nthe problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "33d548a4-4bd9-49fa-9982-4d117002ea69",  "id": "CVE-2023-53387",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix device management cmd timeout flow\n\nIn the UFS error handling flow, the host will send a device management cmd\n(NOP OUT) to the device for link recovery. If this cmd times out and\nclearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and\nreturn. hba->dev_cmd.complete struct is not set to NULL.\n\nWhen this happens, if cmd has been completed by device, then we will call\ncomplete() in __ufshcd_transfer_req_compl(). Because the complete struct is\nallocated on the stack, the following crash will occur:\n\n  ipanic_die+0x24/0x38 [mrdump]\n  die+0x344/0x748\n  arm64_notify_die+0x44/0x104\n  do_debug_exception+0x104/0x1e0\n  el1_dbg+0x38/0x54\n  el1_sync_handler+0x40/0x88\n  el1_sync+0x8c/0x140\n  queued_spin_lock_slowpath+0x2e4/0x3c0\n  __ufshcd_transfer_req_compl+0x3b0/0x1164\n  ufshcd_trc_handler+0x15c/0x308\n  ufshcd_host_reset_and_restore+0x54/0x260\n  ufshcd_reset_and_restore+0x28c/0x57c\n  ufshcd_err_handler+0xeb8/0x1b6c\n  process_one_work+0x288/0x964\n  worker_thread+0x4bc/0xc7c\n  kthread+0x15c/0x264\n  ret_from_fork+0x10/0x30",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ec45d91-4d1a-49ed-9b62-af30e2bba189",  "id": "openSUSE-SU-2021:3530-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "541057df-67d0-4572-beca-c837d87e219e",  "id": "CVE-2017-7645",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7645"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2f4b0137-5159-4aa5-bd1a-c7175e873f19",  "id": "CVE-2013-4270",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4270"  },  "ratings": [    {      "score": 3.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c1fe358-6f15-4aea-9a3c-045cc4c6c591",  "id": "CVE-2026-43445",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ne1000/e1000e: Fix leak in DMA error cleanup\n\nIf an error is encountered while mapping TX buffers, the driver should\nunmap any buffers already mapped for that skb.\n\nBecause count is incremented after a successful mapping, it will always\nmatch the correct number of unmappings needed when dma_error is reached.\nDecrementing count before the while loop in dma_error causes an\noff-by-one error. If any mapping was successful before an unsuccessful\nmapping, exactly one DMA mapping would leak.\n\nIn these commits, a faulty while condition caused an infinite loop in\ndma_error:\nCommit 03b1320dfcee (\"e1000e: remove use of skb_dma_map from e1000e\ndriver\")\nCommit 602c0554d7b0 (\"e1000: remove use of skb_dma_map from e1000 driver\")\n\nCommit c1fa347f20f1 (\"e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of\nunsigned in *_tx_map()\") fixed the infinite loop, but introduced the\noff-by-one error.\n\nThis issue may still exist in the igbvf driver, but I did not address it\nin this patch.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "78489830-6deb-4725-a654-002a8790b663",  "id": "CVE-2010-3084",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3084"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the niu_get_ethtool_tcam_all function in drivers/net/niu.c in the Linux kernel before 2.6.36-rc4 allows local users to cause a denial of service or possibly have unspecified other impact via the ETHTOOL_GRXCLSRLALL ethtool command.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e52fdc7e-89c9-4eea-ad1d-2a064f51170c",  "id": "RHSA-2024:0500",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d395a7ea-4c6d-4c3c-beb2-3b7cd2244f32",  "id": "CVE-2024-50048",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Fix a NULL pointer dereference issue in fbcon_putcs\n\nsyzbot has found a NULL pointer dereference bug in fbcon.\nHere is the simplified C reproducer:\n\nstruct param {\n\tuint8_t type;\n\tstruct tiocl_selection ts;\n};\n\nint main()\n{\n\tstruct fb_con2fbmap con2fb;\n\tstruct param param;\n\n\tint fd = open(\"/dev/fb1\", 0, 0);\n\n\tcon2fb.console = 0x19;\n\tcon2fb.framebuffer = 0;\n\tioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);\n\n\tparam.type = 2;\n\tparam.ts.xs = 0; param.ts.ys = 0;\n\tparam.ts.xe = 0; param.ts.ye = 0;\n\tparam.ts.sel_mode = 0;\n\n\tint fd1 = open(\"/dev/tty1\", O_RDWR, 0);\n\tioctl(fd1, TIOCLINUX, &param);\n\n\tcon2fb.console = 1;\n\tcon2fb.framebuffer = 0;\n\tioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);\n\n\treturn 0;\n}\n\nAfter calling ioctl(fd1, TIOCLINUX, &param), the subsequent ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb)\ncauses the kernel to follow a different execution path:\n\n set_con2fb_map\n  -> con2fb_init_display\n   -> fbcon_set_disp\n    -> redraw_screen\n     -> hide_cursor\n      -> clear_selection\n       -> highlight\n        -> invert_screen\n         -> do_update_region\n          -> fbcon_putcs\n           -> ops->putcs\n\nSince ops->putcs is a NULL pointer, this leads to a kernel panic.\nTo prevent this, we need to call set_blitting_type() within set_con2fb_map()\nto properly initialize ops->putcs.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "498b87bc-551e-4305-af91-9a47590eb39c",  "id": "CVE-2025-38604",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtl818x: Kill URBs before clearing tx status queue\n\nIn rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing\nb_tx_status.queue. This change prevents callbacks from using already freed\nskb due to anchor was not killed before freeing such skb.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000080\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP NOPTI\n CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Not tainted 6.15.0 #8 PREEMPT(voluntary)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015\n RIP: 0010:ieee80211_tx_status_irqsafe+0x21/0xc0 [mac80211]\n Call Trace:\n  <IRQ>\n  rtl8187_tx_cb+0x116/0x150 [rtl8187]\n  __usb_hcd_giveback_urb+0x9d/0x120\n  usb_giveback_urb_bh+0xbb/0x140\n  process_one_work+0x19b/0x3c0\n  bh_worker+0x1a7/0x210\n  tasklet_action+0x10/0x30\n  handle_softirqs+0xf0/0x340\n  __irq_exit_rcu+0xcd/0xf0\n  common_interrupt+0x85/0xa0\n  </IRQ>\n\nTested on RTL8187BvE device.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fee3bd2c-d2dc-43e7-b380-f25234ce3521",  "id": "CVE-2024-35878",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nof: module: prevent NULL pointer dereference in vsnprintf()\n\nIn of_modalias(), we can get passed the str and len parameters which would\ncause a kernel oops in vsnprintf() since it only allows passing a NULL ptr\nwhen the length is also 0. Also, we need to filter out the negative values\nof the len parameter as these will result in a really huge buffer since\nsnprintf() takes size_t parameter while ours is ssize_t...\n\nFound by Linux Verification Center (linuxtesting.org) with the Svace static\nanalysis tool.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9ccfb213-0d1e-4687-80f3-43e11e34e1fc",  "id": "CVE-2023-23006",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23006"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "170f4f3a-1a32-4481-bda7-21c8b6080276",  "id": "CVE-2026-43227",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource/drivers/sh_tmu: Always leave device running after probe\n\nThe TMU device can be used as both a clocksource and a clockevent\nprovider. The driver tries to be smart and power itself on and off, as\nwell as enabling and disabling its clock when it's not in operation.\nThis behavior is slightly altered if the TMU is used as an early\nplatform device in which case the device is left powered on after probe,\nbut the clock is still enabled and disabled at runtime.\n\nThis has worked for a long time, but recent improvements in PREEMPT_RT\nand PROVE_LOCKING have highlighted an issue. As the TMU registers itself\nas a clockevent provider, clockevents_register_device(), it needs to use\nraw spinlocks internally as this is the context of which the clockevent\nframework interacts with the TMU driver. However in the context of\nholding a raw spinlock the TMU driver can't really manage its power\nstate or clock with calls to pm_runtime_*() and clk_*() as these calls\nend up in other platform drivers using regular spinlocks to control\npower and clocks.\n\nThis mix of spinlock contexts trips a lockdep warning.\n\n    =============================\n    [ BUG: Invalid wait context ]\n    6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted\n    -----------------------------\n    swapper/0/0 is trying to lock:\n    ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88\n    other info that might help us debug this:\n    context-{5:5}\n    1 lock held by swapper/0/0:\n    ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0\n     #0: ffff8000817ec298\n    ccree e6601000.crypto: ARM ccree device initialized\n     (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8\n    stack backtrace:\n    CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT\n    Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)\n    Call trace:\n     show_stack+0x14/0x1c (C)\n     dump_stack_lvl+0x6c/0x90\n     dump_stack+0x14/0x1c\n     __lock_acquire+0x904/0x1584\n     lock_acquire+0x220/0x34c\n     _raw_spin_lock_irqsave+0x58/0x80\n     __pm_runtime_resume+0x38/0x88\n     sh_tmu_clock_event_set_oneshot+0x84/0xd4\n     clockevents_switch_state+0xfc/0x13c\n     tick_broadcast_set_event+0x30/0xa4\n     __tick_broadcast_oneshot_control+0x1e0/0x3a8\n     tick_broadcast_oneshot_control+0x30/0x40\n     cpuidle_enter_state+0x40c/0x680\n     cpuidle_enter+0x30/0x40\n     do_idle+0x1f4/0x280\n     cpu_startup_entry+0x34/0x40\n     kernel_init+0x0/0x130\n     do_one_initcall+0x0/0x230\n     __primary_switched+0x88/0x90\n\nFor non-PREEMPT_RT builds this is not really an issue, but for\nPREEMPT_RT builds where normal spinlocks can sleep this might be an\nissue. Be cautious and always leave the power and clock running after\nprobe.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d7e43f8-d240-4a1d-bded-935cba35c9a3",  "id": "CVE-2018-8043",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8043"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c in the Linux kernel through 4.15.8 does not validate certain resource availability, which allows local users to cause a denial of service (NULL pointer dereference).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b423606c-7ab6-4787-9f73-e09847d0d8cb",  "id": "CVE-2026-46169",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix uninit-value by validating catalog record size\n\nSyzbot reported a KMSAN uninit-value issue in hfsplus_strcasecmp(). The\nroot cause is that hfs_brec_read() doesn't validate that the on-disk\nrecord size matches the expected size for the record type being read.\n\nWhen mounting a corrupted filesystem, hfs_brec_read() may read less data\nthan expected. For example, when reading a catalog thread record, the\ndebug output showed:\n\n  HFSPLUS_BREC_READ: rec_len=520, fd->entrylength=26\n  HFSPLUS_BREC_READ: WARNING - entrylength (26) < rec_len (520) - PARTIAL READ!\n\nhfs_brec_read() only validates that entrylength is not greater than the\nbuffer size, but doesn't check if it's less than expected. It successfully\nreads 26 bytes into a 520-byte structure and returns success, leaving 494\nbytes uninitialized.\n\nThis uninitialized data in tmp.thread.nodeName then gets copied by\nhfsplus_cat_build_key_uni() and used by hfsplus_strcasecmp(), triggering\nthe KMSAN warning when the uninitialized bytes are used as array indices\nin case_fold().\n\nFix by introducing hfsplus_brec_read_cat() wrapper that:\n1. Calls hfs_brec_read() to read the data\n2. Validates the record size based on the type field:\n   - Fixed size for folder and file records\n   - Variable size for thread records (depends on string length)\n3. Returns -EIO if size doesn't match expected\n\nFor thread records, check against HFSPLUS_MIN_THREAD_SZ before reading\nnodeName.length to avoid reading uninitialized data at call sites that\ndon't zero-initialize the entry structure.\n\nAlso initialize the tmp variable in hfsplus_find_cat() as defensive\nprogramming to ensure no uninitialized data even if validation is\nbypassed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "755b5c6f-32df-4b4a-82e9-485d76c1ab1d",  "id": "OESA-2024-1904",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b75ad91-98c6-4d78-9a8b-6d162475c2fc",  "id": "CVE-2011-4097",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4097"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the oom_badness function in mm/oom_kill.c in the Linux kernel before 3.1.8 on 64-bit platforms allows local users to cause a denial of service (memory consumption or process termination) by using a certain large amount of memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e1b86560-03d5-4449-a15c-8a096aef6583",  "id": "CVE-2024-46702",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Mark XDomain as unplugged when router is removed\n\nI noticed that when we do discrete host router NVM upgrade and it gets\nhot-removed from the PCIe side as a result of NVM firmware authentication,\nif there is another host connected with enabled paths we hang in tearing\nthem down. This is due to fact that the Thunderbolt networking driver\nalso tries to cleanup the paths and ends up blocking in\ntb_disconnect_xdomain_paths() waiting for the domain lock.\n\nHowever, at this point we already cleaned the paths in tb_stop() so\nthere is really no need for tb_disconnect_xdomain_paths() to do that\nanymore. Furthermore it already checks if the XDomain is unplugged and\nbails out early so take advantage of that and mark the XDomain as\nunplugged when we remove the parent router.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'SNYK:SNYK-UNMANAGED-TORVALDSLINUX-20697067'"    }  ]},{  "bom-ref": "6add37ec-0237-465b-8e3c-06e6f08102aa",  "id": "CVE-2022-48946",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix preallocation discarding at indirect extent boundary\n\nWhen preallocation extent is the first one in the extent block, the\ncode would corrupt extent tree header instead. Fix the problem and use\nudf_delete_aext() for deleting extent to avoid some code duplication.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "da29cd03-49ca-432f-b728-259c9abcd9a1",  "id": "CVE-2026-46116",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416,    763  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: defensively unhash xfrm_state lists in __xfrm_state_delete\n\nKASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s\nhlist_del_rcu calls under syzkaller load on linux-6.12.y stable\n(reproduced on 6.12.47, also reachable via the same code path on\ntorvalds/master and on the ipsec tree). Nine unique signatures cluster\nin the xfrm_state lifecycle, the load-bearing one being:\n\n  BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]\n  BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline]\n  BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c\n  Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435\n\n  Workqueue: netns cleanup_net\n  Call Trace:\n   __hlist_del / hlist_del_rcu\n   __xfrm_state_delete\n   xfrm_state_delete\n   xfrm_state_flush\n   xfrm_state_fini\n   ops_exit_list\n   cleanup_net\n\nThe other observed signatures hit the same slab object from\n__xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB\nwrite variant of __xfrm_state_delete, all on the byseq/byspi\nhash chains.\n\n__xfrm_state_delete() guards its byseq and byspi unhashes with\nvalue-based predicates:\n\n\tif (x->km.seq)\n\t\thlist_del_rcu(&x->byseq);\n\tif (x->id.spi)\n\t\thlist_del_rcu(&x->byspi);\n\nwhile everywhere else in the file (e.g. state_cache, state_cache_input)\nthe safer hlist_unhashed() check is used. xfrm_alloc_spi() sets\nx->id.spi = newspi inside xfrm_state_lock and then immediately inserts\ninto byspi, but a path that observes x->id.spi != 0 outside of\nxfrm_state_lock can still skip-or-hit the byspi unhash inconsistently\nwith whether x is actually on the list. The same holds for x->km.seq\nversus byseq, and the bydst/bysrc unhashes have no predicate at all,\nso a second __xfrm_state_delete() on the same object writes through\nLIST_POISON pprev.\n\nThe defensive change here:\n\n  - Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst,\n    bysrc, byseq and byspi so a second deletion is a no-op rather\n    than a write through LIST_POISON pprev. The byseq/byspi nodes\n    are already initialised in xfrm_state_alloc().\n  - Test hlist_unhashed() rather than the value predicate for\n    byseq/byspi, so the unhash decision tracks list state rather than\n    mutable scalar fields.\n\nEmpirical verification: applied this patch on top of v6.12.47, rebuilt,\nand re-ran the same syzkaller harness for 1h16m on a previously-crashy\nconfiguration that produced ~100 hits each of slab-use-after-free\nRead in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in\n__xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at\n~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo\nconfirms the xfrm_state slab is actively allocated and freed during\nthe run (~143 KiB resident), so the fuzzer is still exercising those\ncode paths -- they just no longer crash.\n\nReproduction:\n\n  - Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV\n  - syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db\n  - 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal\n  - 9 unique signatures collected in ~9h, all within xfrm_state\n    lifecycle",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b356ab5e-2a7e-41b9-9820-e69579c86905",  "id": "CVE-2024-41063",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: cancel all works upon hci_unregister_dev()\n\nsyzbot is reporting that calling hci_release_dev() from hci_error_reset()\ndue to hci_dev_put() from hci_error_reset() can cause deadlock at\ndestroy_workqueue(), for hci_error_reset() is called from\nhdev->req_workqueue which destroy_workqueue() needs to flush.\n\nWe need to make sure that hdev->{rx_work,cmd_work,tx_work} which are\nqueued into hdev->workqueue and hdev->{power_on,error_reset} which are\nqueued into hdev->req_workqueue are no longer running by the moment\n\n       destroy_workqueue(hdev->workqueue);\n       destroy_workqueue(hdev->req_workqueue);\n\nare called from hci_release_dev().\n\nCall cancel_work_sync() on these work items from hci_unregister_dev()\nas soon as hdev->list is removed from hci_dev_list.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c269ee9f-914b-474a-88a6-9a0268caa8c7",  "id": "CVE-2023-52615",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwrng: core - Fix page fault dead lock on mmap-ed hwrng\n\nThere is a dead-lock in the hwrng device read path.  This triggers\nwhen the user reads from /dev/hwrng into memory also mmap-ed from\n/dev/hwrng.  The resulting page fault triggers a recursive read\nwhich then dead-locks.\n\nFix this by using a stack buffer when calling copy_to_user.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e142269b-b7aa-495a-a1b4-30c8825917c1",  "id": "CVE-2023-52569",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: remove BUG() after failure to insert delayed dir index item\n\nInstead of calling BUG() when we fail to insert a delayed dir index item\ninto the delayed node's tree, we can just release all the resources we\nhave allocated/acquired before and return the error to the caller. This is\nfine because all existing call chains undo anything they have done before\ncalling btrfs_insert_delayed_dir_index() or BUG_ON (when creating pending\nsnapshots in the transaction commit path).\n\nSo remove the BUG() call and do proper error handling.\n\nThis relates to a syzbot report linked below, but does not fix it because\nit only prevents hitting a BUG(), it does not fix the issue where somehow\nwe attempt to use twice the same index number for different index items.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d6b9add-ff8b-4e05-baee-c0ad2e0e03eb",  "id": "CVE-2026-31667",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: uinput - fix circular locking dependency with ff-core\n\nA lockdep circular locking dependency warning can be triggered\nreproducibly when using a force-feedback gamepad with uinput (for\nexample, playing ELDEN RING under Wine with a Flydigi Vader 5\ncontroller):\n\n  ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex\n\nThe cycle is caused by four lock acquisition paths:\n\n1. ff upload: input_ff_upload() holds ff->mutex and calls\n   uinput_dev_upload_effect() -> uinput_request_submit() ->\n   uinput_request_send(), which acquires udev->mutex.\n\n2. device create: uinput_ioctl_handler() holds udev->mutex and calls\n   uinput_create_device() -> input_register_device(), which acquires\n   input_mutex.\n\n3. device register: input_register_device() holds input_mutex and\n   calls kbd_connect() -> input_register_handle(), which acquires\n   dev->mutex.\n\n4. evdev release: evdev_release() calls input_flush_device() under\n   dev->mutex, which calls input_ff_flush() acquiring ff->mutex.\n\nFix this by introducing a new state_lock spinlock to protect\nudev->state and udev->dev access in uinput_request_send() instead of\nacquiring udev->mutex.  The function only needs to atomically check\ndevice state and queue an input event into the ring buffer via\nuinput_dev_event() -- both operations are safe under a spinlock\n(ktime_get_ts64() and wake_up_interruptible() do not sleep).  This\nbreaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in\nthe lock ordering and cannot form cycles with mutexes.\n\nTo keep state transitions visible to uinput_request_send(), protect\nwrites to udev->state in uinput_create_device() and\nuinput_destroy_device() with the same state_lock spinlock.\n\nAdditionally, move init_completion(&request->done) from\nuinput_request_send() to uinput_request_submit() before\nuinput_request_reserve_slot().  Once the slot is allocated,\nuinput_flush_requests() may call complete() on it at any time from\nthe destroy path, so the completion must be initialised before the\nrequest becomes visible.\n\nLock ordering after the fix:\n\n  ff->mutex -> state_lock (spinlock, leaf)\n  udev->mutex -> state_lock (spinlock, leaf)\n  udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "87abc3a0-cd6e-4306-a140-5c97802942ca",  "id": "AZL-83102",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "e52e445b-24d0-4150-822b-d76563b46e68",      "versions": [        {          "component": "sed",          "version": "4.0"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e704254d-2909-4c93-b33c-0c5cdea4b548",  "id": "CVE-2026-43113",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wl1251: validate packet IDs before indexing tx_frames\n\nwl1251_tx_packet_cb() uses the firmware completion ID directly to index\nthe fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the\ncompletion block, and the callback does not currently verify that it\nfits the array before dereferencing it.\n\nReject completion IDs that fall outside wl->tx_frames[] and keep the\nexisting NULL check in the same guard. This keeps the fix local to the\ntrust boundary and avoids touching the rest of the completion flow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2e412f0-dda0-4bab-8dd3-0d76cfeb4efa",  "id": "CLSA-2026-1771004260",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "707436c9-da77-49a0-a853-59043e75b40a",  "id": "SUSE-SU-2017:2616-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "60a42f2b-2dda-4a8a-942d-3873d02b29d5",  "id": "CVE-2026-23255",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: add proper RCU protection to /proc/net/ptype\n\nYin Fengwei reported an RCU stall in ptype_seq_show() and provided\na patch.\n\nReal issue is that ptype_seq_next() and ptype_seq_show() violate\nRCU rules.\n\nptype_seq_show() runs under rcu_read_lock(), and reads pt->dev\nto get device name without any barrier.\n\nAt the same time, concurrent writers can remove a packet_type structure\n(which is correctly freed after an RCU grace period) and clear pt->dev\nwithout an RCU grace period.\n\nDefine ptype_iter_state to carry a dev pointer along seq_net_private:\n\nstruct ptype_iter_state {\n\tstruct seq_net_private\tp;\n\tstruct net_device\t*dev; // added in this patch\n};\n\nWe need to record the device pointer in ptype_get_idx() and\nptype_seq_next() so that ptype_seq_show() is safe against\nconcurrent pt->dev changes.\n\nWe also need to add full RCU protection in ptype_seq_next().\n(Missing READ_ONCE() when reading list.next values)\n\nMany thanks to Dong Chenchen for providing a repro.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f430b82-5a83-4ee1-953c-f22a8e08767c",  "id": "CVE-2016-6136",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6136"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a \"double fetch\" vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5f19cdd0-0982-45df-b171-98b072eac2b8",  "id": "CVE-2021-3411",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3411"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    94  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel in versions prior to 5.10. A violation of memory access was found while detecting a padding of int3 in the linking state. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c684178-8a2c-4d94-812b-59147b0bb293",  "id": "CVE-2017-14033",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14033"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d6bc39bf-dcc7-4800-9663-b8da4b199cce",  "id": "CVE-2026-53001",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xtables: restrict several matches to inet family\n\nThis is a partial revert of:\n\n  commit ab4f21e6fb1c (\"netfilter: xtables: use NFPROTO_UNSPEC in more extensions\")\n\nto allow ipv4 and ipv6 only.\n\n- xt_mac\n- xt_owner\n- xt_physdev\n\nThese extensions are not used by ebtables in userspace.\n\nMoreover, xt_realm is only for ipv4, since dst->tclassid is ipv4\nspecific.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0e54559c-1c90-4603-992d-cce32ee7d4eb",  "id": "CVE-2011-2517",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2517"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6982d153-f0c6-446d-86e4-97d7efc01b64",  "id": "CVE-2023-53215",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/fair: Don't balance task to its current running CPU\n\nWe've run into the case that the balancer tries to balance a migration\ndisabled task and trigger the warning in set_task_cpu() like below:\n\n ------------[ cut here ]------------\n WARNING: CPU: 7 PID: 0 at kernel/sched/core.c:3115 set_task_cpu+0x188/0x240\n Modules linked in: hclgevf xt_CHECKSUM ipt_REJECT nf_reject_ipv4 <...snip>\n CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G           O       6.1.0-rc4+ #1\n Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 12/09/2021\n pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : set_task_cpu+0x188/0x240\n lr : load_balance+0x5d0/0xc60\n sp : ffff80000803bc70\n x29: ffff80000803bc70 x28: ffff004089e190e8 x27: ffff004089e19040\n x26: ffff007effcabc38 x25: 0000000000000000 x24: 0000000000000001\n x23: ffff80000803be84 x22: 000000000000000c x21: ffffb093e79e2a78\n x20: 000000000000000c x19: ffff004089e19040 x18: 0000000000000000\n x17: 0000000000001fad x16: 0000000000000030 x15: 0000000000000000\n x14: 0000000000000003 x13: 0000000000000000 x12: 0000000000000000\n x11: 0000000000000001 x10: 0000000000000400 x9 : ffffb093e4cee530\n x8 : 00000000fffffffe x7 : 0000000000ce168a x6 : 000000000000013e\n x5 : 00000000ffffffe1 x4 : 0000000000000001 x3 : 0000000000000b2a\n x2 : 0000000000000b2a x1 : ffffb093e6d6c510 x0 : 0000000000000001\n Call trace:\n  set_task_cpu+0x188/0x240\n  load_balance+0x5d0/0xc60\n  rebalance_domains+0x26c/0x380\n  _nohz_idle_balance.isra.0+0x1e0/0x370\n  run_rebalance_domains+0x6c/0x80\n  __do_softirq+0x128/0x3d8\n  ____do_softirq+0x18/0x24\n  call_on_irq_stack+0x2c/0x38\n  do_softirq_own_stack+0x24/0x3c\n  __irq_exit_rcu+0xcc/0xf4\n  irq_exit_rcu+0x18/0x24\n  el1_interrupt+0x4c/0xe4\n  el1h_64_irq_handler+0x18/0x2c\n  el1h_64_irq+0x74/0x78\n  arch_cpu_idle+0x18/0x4c\n  default_idle_call+0x58/0x194\n  do_idle+0x244/0x2b0\n  cpu_startup_entry+0x30/0x3c\n  secondary_start_kernel+0x14c/0x190\n  __secondary_switched+0xb0/0xb4\n ---[ end trace 0000000000000000 ]---\n\nFurther investigation shows that the warning is superfluous, the migration\ndisabled task is just going to be migrated to its current running CPU.\nThis is because that on load balance if the dst_cpu is not allowed by the\ntask, we'll re-select a new_dst_cpu as a candidate. If no task can be\nbalanced to dst_cpu we'll try to balance the task to the new_dst_cpu\ninstead. In this case when the migration disabled task is not on CPU it\nonly allows to run on its current CPU, load balance will select its\ncurrent CPU as new_dst_cpu and later triggers the warning above.\n\nThe new_dst_cpu is chosen from the env->dst_grpmask. Currently it\ncontains CPUs in sched_group_span() and if we have overlapped groups it's\npossible to run into this case. This patch makes env->dst_grpmask of\ngroup_balance_mask() which exclude any CPUs from the busiest group and\nsolve the issue. For balancing in a domain with no overlapped groups\nthe behaviour keeps same as before.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "187e8799-dc68-45fc-8b68-3b5125eab651",  "id": "DLA-1124-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "626cda26-fa72-49c1-8d27-81d33c8ddd37",  "id": "CVE-2024-41076",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix memory leak in nfs4_set_security_label\n\nWe leak nfs_fattr and nfs4_label every time we set a security xattr.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "873eb649-8ba4-42b5-a9cb-dbccd7852d1f",  "id": "RHSA-2024:9333",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc567feb-defc-4e93-8e7b-1311f10b12ee",  "id": "CVE-2026-31596",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: handle invalid dinode in ocfs2_group_extend\n\n[BUG]\nkernel BUG at fs/ocfs2/resize.c:308!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308\nCode: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe\nCall Trace:\n ...\n ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n ...\n\n[CAUSE]\nocfs2_group_extend() assumes that the global bitmap inode block\nreturned from ocfs2_inode_lock() has already been validated and\nBUG_ONs when the signature is not a dinode. That assumption is too\nstrong for crafted filesystems because the JBD2-managed buffer path\ncan bypass structural validation and return an invalid dinode to the\nresize ioctl.\n\n[FIX]\nValidate the dinode explicitly in ocfs2_group_extend(). If the global\nbitmap buffer does not contain a valid dinode, report filesystem\ncorruption with ocfs2_error() and fail the resize operation instead of\ncrashing the kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6482d000-c545-4e47-a81e-7f3a10e26469",  "id": "CVE-2024-58013",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync\n\nThis fixes the following crash:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543\nRead of size 8 at addr ffff88814128f898 by task kworker/u9:4/5961\n\nCPU: 1 UID: 0 PID: 5961 Comm: kworker/u9:4 Not tainted 6.12.0-syzkaller-10684-gf1cd565ce577 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nWorkqueue: hci0 hci_cmd_sync_work\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:489\n kasan_report+0x143/0x180 mm/kasan/report.c:602\n mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543\n hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n </TASK>\n\nAllocated by task 16026:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314\n kmalloc_noprof include/linux/slab.h:901 [inline]\n kzalloc_noprof include/linux/slab.h:1037 [inline]\n mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269\n mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296\n remove_adv_monitor+0x102/0x1b0 net/bluetooth/mgmt.c:5568\n hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712\n hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832\n sock_sendmsg_nosec net/socket.c:711 [inline]\n __sock_sendmsg+0x221/0x270 net/socket.c:726\n sock_write_iter+0x2d7/0x3f0 net/socket.c:1147\n new_sync_write fs/read_write.c:586 [inline]\n vfs_write+0xaeb/0xd30 fs/read_write.c:679\n ksys_write+0x18f/0x2b0 fs/read_write.c:731\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 16022:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:233 [inline]\n slab_free_hook mm/slub.c:2338 [inline]\n slab_free mm/slub.c:4598 [inline]\n kfree+0x196/0x420 mm/slub.c:4746\n mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259\n __mgmt_power_off+0x183/0x430 net/bluetooth/mgmt.c:9550\n hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208\n hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]\n hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508\n sock_do_ioctl+0x158/0x460 net/socket.c:1209\n sock_ioctl+0x626/0x8e0 net/socket.c:1328\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fef50520-30ec-45e1-af74-9020aea27724",  "id": "CVE-2019-19083",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19083"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption). This affects the dce112_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, the dce100_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, the dcn20_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c, the dce120_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, and the dce80_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c, aka CID-055e547478a1.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "caa8b506-9ce5-4879-b1db-8e019490d02c",  "id": "CVE-2011-2479",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2479"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 2.6.39 does not properly create transparent huge pages in response to a MAP_PRIVATE mmap system call on /dev/zero, which allows local users to cause a denial of service (system crash) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "592ed9be-2396-4553-8dd5-a0e166731586",  "id": "AZL-33493",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "530106b5-d0d1-49f7-8ff0-f6fd6ca06b0e",  "id": "CVE-2011-5321",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-5321"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The tty_open function in drivers/tty/tty_io.c in the Linux kernel before 3.1.1 mishandles a driver-lookup failure, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted access to a device file under the /dev/pts directory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f88255b4-7aa5-452d-be5f-1a1b12f4c24a",  "id": "CVE-2014-9420",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9420"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a9a62a3-50fc-43ba-a401-f019a8da8bc1",  "id": "CVE-2014-9900",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9900"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The ethtool_get_wol function in net/core/ethtool.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not initialize a certain data structure, which allows local users to obtain sensitive information via a crafted application, aka Android internal bug 28803952 and Qualcomm internal bug CR570754.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bc868988-2c2b-4d06-a7a9-7d82ef0f11bd",  "id": "OESA-2021-1121",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b205bb67-6566-4455-91d0-4d709ddd086d",  "id": "CVE-2024-46833",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: void array out of bound when loop tnl_num\n\nWhen query reg inf of SSU, it loops tnl_num times. However, tnl_num comes\nfrom hardware and the length of array is a fixed value. To void array out\nof bound, make sure the loop time is not greater than the length of array",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4096007b-0676-4652-849b-e06e2e9d6804",  "id": "CVE-2021-4044",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4044"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally unexpected and applications may not behave correctly as a result. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses. This issue is made more serious in combination with a separate bug in OpenSSL 3.0 that will cause X509_verify_cert() to indicate an internal error when processing a certificate chain. This will occur where a certificate does not include the Subject Alternative Name extension but where a Certificate Authority has enforced name constraints. This issue can occur even with valid chains. By combining the two issues an attacker could induce incorrect, application dependent behaviour. Fixed in OpenSSL 3.0.1 (Affected 3.0.0).",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52b73965-cf7a-4bb1-832b-93e625628d5e",  "id": "openSUSE-SU-2026:11605-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2b039c2e-9b0c-4bb4-894e-12db4458d442",  "id": "CVE-2011-2495",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2495"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc/#####/io files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by discovering the length of another user's password.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fa84ecc9-1342-43a0-bde3-750b1c01806e",  "id": "OESA-2025-2327",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef096635-156b-41fd-baad-cda25a92688b",  "id": "SUSE-SU-2023:1907-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2d35acd-3078-4485-9851-d8f6d9d82b39",  "id": "CVE-2026-23455",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: check for zero length in DecodeQ931()\n\nIn DecodeQ931(), the UserUserIE code path reads a 16-bit length from\nthe packet, then decrements it by 1 to skip the protocol discriminator\nbyte before passing it to DecodeH323_UserInformation(). If the encoded\nlength is 0, the decrement wraps to -1, which is then passed as a\nlarge value to the decoder, leading to an out-of-bounds read.\n\nAdd a check to ensure len is positive after the decrement.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a5eb3616-8940-491e-96df-183719dc2a1a",  "id": "CVE-2022-30594",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30594"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    862  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:170362/Linux-PT_SUSPEND_SECCOMP-Permission-Bypass-Ptracer-Death-Race.html'"    }  ]},{  "bom-ref": "39acb157-5dfb-41de-be54-2a703deca2e1",  "id": "CVE-2022-49870",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncapabilities: fix undefined behavior in bit shift for CAP_TO_MASK\n\nShifting signed 32-bit value by 31 bits is undefined, so changing\nsignificant bit to unsigned. The UBSAN warning calltrace like below:\n\nUBSAN: shift-out-of-bounds in security/commoncap.c:1252:2\nleft shift of 1 by 31 places cannot be represented in type 'int'\nCall Trace:\n <TASK>\n dump_stack_lvl+0x7d/0xa5\n dump_stack+0x15/0x1b\n ubsan_epilogue+0xe/0x4e\n __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c\n cap_task_prctl+0x561/0x6f0\n security_task_prctl+0x5a/0xb0\n __x64_sys_prctl+0x61/0x8f0\n do_syscall_64+0x58/0x80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4a4e5931-2c71-4720-977d-52ea8a100afe",  "id": "AZL-75287",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "510ad392-edb1-4c6b-9f44-e444675d7f63",  "id": "CVE-2022-49980",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: Fix use-after-free Read in usb_udc_uevent()\n\nThe syzbot fuzzer found a race between uevent callbacks and gadget\ndriver unregistration that can cause a use-after-free bug:\n\n---------------------------------------------------------------\nBUG: KASAN: use-after-free in usb_udc_uevent+0x11f/0x130\ndrivers/usb/gadget/udc/core.c:1732\nRead of size 8 at addr ffff888078ce2050 by task udevd/2968\n\nCPU: 1 PID: 2968 Comm: udevd Not tainted 5.19.0-rc4-next-20220628-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google\n06/29/2022\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:317 [inline]\n print_report.cold+0x2ba/0x719 mm/kasan/report.c:433\n kasan_report+0xbe/0x1f0 mm/kasan/report.c:495\n usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732\n dev_uevent+0x290/0x770 drivers/base/core.c:2424\n---------------------------------------------------------------\n\nThe bug occurs because usb_udc_uevent() dereferences udc->driver but\ndoes so without acquiring the udc_lock mutex, which protects this\nfield.  If the gadget driver is unbound from the udc concurrently with\nuevent processing, the driver structure may be accessed after it has\nbeen deallocated.\n\nTo prevent the race, we make sure that the routine holds the mutex\naround the racing accesses.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3df4973a-e260-4924-bf3c-f7e798af9855",  "id": "CVE-2014-3505",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3505"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "98e5a767-90cd-4e7d-a022-5484698b647d",  "id": "CVE-2011-2493",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2493"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The ext4_fill_super function in fs/ext4/super.c in the Linux kernel before 2.6.39 does not properly initialize a certain error-report data structure, which allows local users to cause a denial of service (OOPS) by attempting to mount a crafted ext4 filesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "805940f8-bdce-4ece-8ca7-97360f931a88",  "id": "CVE-2025-21992",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: ignore non-functional sensor in HP 5MP Camera\n\nThe HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that\nis not actually implemented. Attempting to access this non-functional\nsensor via iio_info causes system hangs as runtime PM tries to wake up\nan unresponsive sensor.\n\n  [453] hid-sensor-hub 0003:0408:5473.0003: Report latency attributes: ffffffff:ffffffff\n  [453] hid-sensor-hub 0003:0408:5473.0003: common attributes: 5:1, 2:1, 3:1 ffffffff:ffffffff\n\nAdd this device to the HID ignore list since the sensor interface is\nnon-functional by design and should not be exposed to userspace.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "15ec1b3f-eae4-4edb-9ae4-ea10c2725f5d",  "id": "CVE-2024-50024",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix an unsafe loop on the list\n\nThe kernel may crash when deleting a genetlink family if there are still\nlisteners for that family:\n\nOops: Kernel access of bad area, sig: 11 [#1]\n  ...\n  NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0\n  LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0\n  Call Trace:\n__netlink_clear_multicast_users+0x74/0xc0\ngenl_unregister_family+0xd4/0x2d0\n\nChange the unsafe loop on the list to a safe one, because inside the\nloop there is an element removal from this list.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "614d84a0-be2f-4b4e-91e6-389ea861dbd4",  "id": "CVE-2017-9077",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9077"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "72067296-4ffd-48b9-8a43-bd00b6cae0a7",  "id": "RLSA-2025:21248",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d7fb5d1-7e77-405c-9d0c-7d9313c0785c",  "id": "CVE-2012-2375",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2375"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "The __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words in an FATTR4_ACL reply.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-4131.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9cb9c63d-4e4c-48af-8573-14e3da4147ad",  "id": "CLSA-2026-1770804736",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5f1db7e4-50ec-45e9-9d7c-5ac6a4375ac0",  "id": "CVE-2024-26999",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial/pmac_zilog: Remove flawed mitigation for rx irq flood\n\nThe mitigation was intended to stop the irq completely. That may be\nbetter than a hard lock-up but it turns out that you get a crash anyway\nif you're using pmac_zilog as a serial console:\n\nttyPZ0: pmz: rx irq flood !\nBUG: spinlock recursion on CPU#0, swapper/0\n\nThat's because the pr_err() call in pmz_receive_chars() results in\npmz_console_write() attempting to lock a spinlock already locked in\npmz_interrupt(). With CONFIG_DEBUG_SPINLOCK=y, this produces a fatal\nBUG splat. The spinlock in question is the one in struct uart_port.\n\nEven when it's not fatal, the serial port rx function ceases to work.\nAlso, the iteration limit doesn't play nicely with QEMU, as can be\nseen in the bug report linked below.\n\nA web search for other reports of the error message \"pmz: rx irq flood\"\ndidn't produce anything. So I don't think this code is needed any more.\nRemove it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0c1b1898-0353-407f-bbe3-589a2097ae42",  "id": "ALSA-2025:21248",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4ed942b2-c9b9-43fb-9684-90ae5b7d40a1",  "id": "CVE-2015-8575",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8575"  },  "ratings": [    {      "score": 4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bc2cb9dc-0164-44c2-8cb9-8d5cb4510401",  "id": "CLSA-2026-1778020314",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6187a103-503d-4de8-8e80-b4f798672fae",  "id": "CVE-2024-49906",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointer before try to access it\n\n[why & how]\nChange the order of the pipe_ctx->plane_state check to ensure that\nplane_state is not null before accessing it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d4a9fc79-6d6e-4d0d-ae15-6e507a7a1544",  "id": "CVE-2020-8597",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8597"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.",  "affects": [    {      "ref": "73881d6c-a776-4513-80a9-27bcf656c60d",      "versions": [        {          "component": "point-to-point_protocol",          "version": "2.4.2b3"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:156662/pppd-2.4.8-Buffer-Overflow.html'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:156802/pppd-2.4.8-Buffer-Overflow.html'"    }  ]},{  "bom-ref": "5e35c549-d8b2-449f-b88b-388cc352ae3e",  "id": "CVE-2026-46163",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: b43legacy: enforce bounds check on firmware key index in RX path\n\nSame fix as b43: the firmware-controlled key index in b43legacy_rx()\ncan exceed dev->max_nr_keys. The existing B43legacy_WARN_ON is\nnon-enforcing in production builds, allowing an out-of-bounds read of\ndev->key[].\n\nMake the check enforcing by dropping the frame for invalid indices.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "abd3ed34-9e4a-4537-b121-1f0a13534abd",  "id": "CVE-2010-2942",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2942"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations, which allows local users to obtain potentially sensitive information from kernel memory via vectors related to (1) the tcf_gact_dump function in net/sched/act_gact.c, (2) the tcf_mirred_dump function in net/sched/act_mirred.c, (3) the tcf_nat_dump function in net/sched/act_nat.c, (4) the tcf_simp_dump function in net/sched/act_simple.c, and (5) the tcf_skbedit_dump function in net/sched/act_skbedit.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3d5d35b0-1fda-4e6a-bc66-f9d7445d3955",  "id": "CVE-2022-49328",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmt76: fix use-after-free by removing a non-RCU wcid pointer\n\nFixes an issue caught by KASAN about use-after-free in mt76_txq_schedule\nby protecting mtxq->wcid with rcu_lock between mt76_txq_schedule and\nsta_info_[alloc, free].\n\n[18853.876689] ==================================================================\n[18853.876751] BUG: KASAN: use-after-free in mt76_txq_schedule+0x204/0xaf8 [mt76]\n[18853.876773] Read of size 8 at addr ffffffaf989a2138 by task mt76-tx phy0/883\n[18853.876786]\n[18853.876810] CPU: 5 PID: 883 Comm: mt76-tx phy0 Not tainted 5.10.100-fix-510-56778d365941-kasan #5 0b01fbbcf41a530f52043508fec2e31a4215\n\n[18853.876840] Call trace:\n[18853.876861]  dump_backtrace+0x0/0x3ec\n[18853.876878]  show_stack+0x20/0x2c\n[18853.876899]  dump_stack+0x11c/0x1ac\n[18853.876918]  print_address_description+0x74/0x514\n[18853.876934]  kasan_report+0x134/0x174\n[18853.876948]  __asan_report_load8_noabort+0x44/0x50\n[18853.876976]  mt76_txq_schedule+0x204/0xaf8 [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2]\n[18853.877002]  mt76_txq_schedule_all+0x2c/0x48 [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2]\n[18853.877030]  mt7921_tx_worker+0xa0/0x1cc [mt7921_common f0875ebac9d7b4754e1010549e7db50fbd90a047]\n[18853.877054]  __mt76_worker_fn+0x190/0x22c [mt76 074e03e4640e97fe7405ee1fab547b81c4fa45d2]\n[18853.877071]  kthread+0x2f8/0x3b8\n[18853.877087]  ret_from_fork+0x10/0x30\n[18853.877098]\n[18853.877112] Allocated by task 941:\n[18853.877131]  kasan_save_stack+0x38/0x68\n[18853.877147]  __kasan_kmalloc+0xd4/0xfc\n[18853.877163]  kasan_kmalloc+0x10/0x1c\n[18853.877177]  __kmalloc+0x264/0x3c4\n[18853.877294]  sta_info_alloc+0x460/0xf88 [mac80211]\n[18853.877410]  ieee80211_prep_connection+0x204/0x1ee0 [mac80211]\n[18853.877523]  ieee80211_mgd_auth+0x6c4/0xa4c [mac80211]\n[18853.877635]  ieee80211_auth+0x20/0x2c [mac80211]\n[18853.877733]  rdev_auth+0x7c/0x438 [cfg80211]\n[18853.877826]  cfg80211_mlme_auth+0x26c/0x390 [cfg80211]\n[18853.877919]  nl80211_authenticate+0x6d4/0x904 [cfg80211]\n[18853.877938]  genl_rcv_msg+0x748/0x93c\n[18853.877954]  netlink_rcv_skb+0x160/0x2a8\n[18853.877969]  genl_rcv+0x3c/0x54\n[18853.877985]  netlink_unicast_kernel+0x104/0x1ec\n[18853.877999]  netlink_unicast+0x178/0x268\n[18853.878015]  netlink_sendmsg+0x3cc/0x5f0\n[18853.878030]  sock_sendmsg+0xb4/0xd8\n[18853.878043]  ____sys_sendmsg+0x2f8/0x53c\n[18853.878058]  ___sys_sendmsg+0xe8/0x150\n[18853.878071]  __sys_sendmsg+0xc4/0x1f4\n[18853.878087]  __arm64_compat_sys_sendmsg+0x88/0x9c\n[18853.878101]  el0_svc_common+0x1b4/0x390\n[18853.878115]  do_el0_svc_compat+0x8c/0xdc\n[18853.878131]  el0_svc_compat+0x10/0x1c\n[18853.878146]  el0_sync_compat_handler+0xa8/0xcc\n[18853.878161]  el0_sync_compat+0x188/0x1c0\n[18853.878171]\n[18853.878183] Freed by task 10927:\n[18853.878200]  kasan_save_stack+0x38/0x68\n[18853.878215]  kasan_set_track+0x28/0x3c\n[18853.878228]  kasan_set_free_info+0x24/0x48\n[18853.878244]  __kasan_slab_free+0x11c/0x154\n[18853.878259]  kasan_slab_free+0x14/0x24\n[18853.878273]  slab_free_freelist_hook+0xac/0x1b0\n[18853.878287]  kfree+0x104/0x390\n[18853.878402]  sta_info_free+0x198/0x210 [mac80211]\n[18853.878515]  __sta_info_destroy_part2+0x230/0x2d4 [mac80211]\n[18853.878628]  __sta_info_flush+0x300/0x37c [mac80211]\n[18853.878740]  ieee80211_set_disassoc+0x2cc/0xa7c [mac80211]\n[18853.878851]  ieee80211_mgd_deauth+0x4a4/0x10a0 [mac80211]\n[18853.878962]  ieee80211_deauth+0x20/0x2c [mac80211]\n[18853.879057]  rdev_deauth+0x7c/0x438 [cfg80211]\n[18853.879150]  cfg80211_mlme_deauth+0x274/0x414 [cfg80211]\n[18853.879243]  cfg80211_mlme_down+0xe4/0x118 [cfg80211]\n[18853.879335]  cfg80211_disconnect+0x218/0x2d8 [cfg80211]\n[18853.879427]  __cfg80211_leave+0x17c/0x240 [cfg80211]\n[18853.879519]  cfg80211_leave+0x3c/0x58 [cfg80211]\n[18853.879611]  wiphy_suspend+0xdc/0x200 [cfg80211]\n[18853.879628]  dpm_run_callback+0x58/0x408\n[18853.879642]  __device_suspend+0x4cc/0x864\n[18853.879658]  async_suspend+0x34/0xf4\n[18\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee0252f3-578d-4706-b41b-dbb0b5d16912",  "id": "CLSA-2022-1657814965",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "63c0c141-c275-42aa-9dd5-84e292c050ea",  "id": "ROOT-OS-DEBIAN-12-CVE-2026-14456",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2250b0e9-d863-4958-9b0d-d023cc85ac30",  "id": "CVE-2020-36385",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36385"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is called, aka CID-f5449e74802c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a4dee841-395f-4522-9ef1-4e77b55220d4",  "id": "CVE-2012-6657",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6657"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5.7 does not ensure that a keepalive action is associated with a stream socket, which allows local users to cause a denial of service (system crash) by leveraging the ability to create a raw socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9968a1ca-e291-4931-ba4b-3599ea5848e9",  "id": "CVE-2019-15292",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15292"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit, related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5ee28c49-3017-4b84-bbf9-194bdd9841e3",  "id": "CVE-2007-3108",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-3108"  },  "ratings": [    {      "score": 1.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bd6fbb52-fda0-401d-8225-2d78f226c4b3",  "id": "CVE-2019-15924",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15924"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.11. fm10k_init_module in drivers/net/ethernet/intel/fm10k/fm10k_main.c has a NULL pointer dereference because there is no -ENOMEM upon an alloc_workqueue failure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52019b4f-ab22-4b92-a24c-e15d08932772",  "id": "CVE-2024-44960",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: core: Check for unset descriptor\n\nMake sure the descriptor has been set before looking at maxpacket.\nThis fixes a null pointer panic in this case.\n\nThis may happen if the gadget doesn't properly set up the endpoint\nfor the current speed, or the gadget descriptors are malformed and\nthe descriptor for the speed/endpoint are not found.\n\nNo current gadget driver is known to have this problem, but this\nmay cause a hard-to-find bug during development of new gadgets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b0a1f2bb-539a-49f8-83c2-6e3462c14ec7",  "id": "AZL-75780",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7f37d87e-c64a-40c1-830c-0cea7b4ad274",  "id": "CVE-2024-37354",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix crash on racing fsync and size-extending write into prealloc\n\nWe have been seeing crashes on duplicate keys in\nbtrfs_set_item_key_safe():\n\n  BTRFS critical (device vdb): slot 4 key (450 108 8192) new key (450 108 8192)\n  ------------[ cut here ]------------\n  kernel BUG at fs/btrfs/ctree.c:2620!\n  invalid opcode: 0000 [#1] PREEMPT SMP PTI\n  CPU: 0 PID: 3139 Comm: xfs_io Kdump: loaded Not tainted 6.9.0 #6\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\n  RIP: 0010:btrfs_set_item_key_safe+0x11f/0x290 [btrfs]\n\nWith the following stack trace:\n\n  #0  btrfs_set_item_key_safe (fs/btrfs/ctree.c:2620:4)\n  #1  btrfs_drop_extents (fs/btrfs/file.c:411:4)\n  #2  log_one_extent (fs/btrfs/tree-log.c:4732:9)\n  #3  btrfs_log_changed_extents (fs/btrfs/tree-log.c:4955:9)\n  #4  btrfs_log_inode (fs/btrfs/tree-log.c:6626:9)\n  #5  btrfs_log_inode_parent (fs/btrfs/tree-log.c:7070:8)\n  #6  btrfs_log_dentry_safe (fs/btrfs/tree-log.c:7171:8)\n  #7  btrfs_sync_file (fs/btrfs/file.c:1933:8)\n  #8  vfs_fsync_range (fs/sync.c:188:9)\n  #9  vfs_fsync (fs/sync.c:202:9)\n  #10 do_fsync (fs/sync.c:212:9)\n  #11 __do_sys_fdatasync (fs/sync.c:225:9)\n  #12 __se_sys_fdatasync (fs/sync.c:223:1)\n  #13 __x64_sys_fdatasync (fs/sync.c:223:1)\n  #14 do_syscall_x64 (arch/x86/entry/common.c:52:14)\n  #15 do_syscall_64 (arch/x86/entry/common.c:83:7)\n  #16 entry_SYSCALL_64+0xaf/0x14c (arch/x86/entry/entry_64.S:121)\n\nSo we're logging a changed extent from fsync, which is splitting an\nextent in the log tree. But this split part already exists in the tree,\ntriggering the BUG().\n\nThis is the state of the log tree at the time of the crash, dumped with\ndrgn (https://github.com/osandov/drgn/blob/main/contrib/btrfs_tree.py)\nto get more details than btrfs_print_leaf() gives us:\n\n  >>> print_extent_buffer(prog.crashed_thread().stack_trace()[0][\"eb\"])\n  leaf 33439744 level 0 items 72 generation 9 owner 18446744073709551610\n  leaf 33439744 flags 0x100000000000000\n  fs uuid e5bd3946-400c-4223-8923-190ef1f18677\n  chunk uuid d58cb17e-6d02-494a-829a-18b7d8a399da\n          item 0 key (450 INODE_ITEM 0) itemoff 16123 itemsize 160\n                  generation 7 transid 9 size 8192 nbytes 8473563889606862198\n                  block group 0 mode 100600 links 1 uid 0 gid 0 rdev 0\n                  sequence 204 flags 0x10(PREALLOC)\n                  atime 1716417703.220000000 (2024-05-22 15:41:43)\n                  ctime 1716417704.983333333 (2024-05-22 15:41:44)\n                  mtime 1716417704.983333333 (2024-05-22 15:41:44)\n                  otime 17592186044416.000000000 (559444-03-08 01:40:16)\n          item 1 key (450 INODE_REF 256) itemoff 16110 itemsize 13\n                  index 195 namelen 3 name: 193\n          item 2 key (450 XATTR_ITEM 1640047104) itemoff 16073 itemsize 37\n                  location key (0 UNKNOWN.0 0) type XATTR\n                  transid 7 data_len 1 name_len 6\n                  name: user.a\n                  data a\n          item 3 key (450 EXTENT_DATA 0) itemoff 16020 itemsize 53\n                  generation 9 type 1 (regular)\n                  extent data disk byte 303144960 nr 12288\n                  extent data offset 0 nr 4096 ram 12288\n                  extent compression 0 (none)\n          item 4 key (450 EXTENT_DATA 4096) itemoff 15967 itemsize 53\n                  generation 9 type 2 (prealloc)\n                  prealloc data disk byte 303144960 nr 12288\n                  prealloc data offset 4096 nr 8192\n          item 5 key (450 EXTENT_DATA 8192) itemoff 15914 itemsize 53\n                  generation 9 type 2 (prealloc)\n                  prealloc data disk byte 303144960 nr 12288\n                  prealloc data offset 8192 nr 4096\n  ...\n\nSo the real problem happened earlier: notice that items 4 (4k-12k) and 5\n(8k-12k) overlap. Both are prealloc extents. Item 4 straddles i_size and\nitem 5 starts at i_size.\n\nHere is the state of \n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4efd7e31-168e-4a45-8548-db3c94fff826",  "id": "CVE-2023-53286",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Return the firmware result upon destroying QP/RQ\n\nPreviously when destroying a QP/RQ, the result of the firmware\ndestruction function was ignored and upper layers weren't informed\nabout the failure.\nWhich in turn could lead to various problems since when upper layer\nisn't aware of the failure it continues its operation thinking that the\nrelated QP/RQ was successfully destroyed while it actually wasn't,\nwhich could lead to the below kernel WARN.\n\nCurrently, we return the correct firmware destruction status to upper\nlayers which in case of the RQ would be mlx5_ib_destroy_wq() which\nwas already capable of handling RQ destruction failure or in case of\na QP to destroy_qp_common(), which now would actually warn upon qp\ndestruction failure.\n\nWARNING: CPU: 3 PID: 995 at drivers/infiniband/core/rdma_core.c:940 uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs]\nModules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core overlay mlx5_core fuse\nCPU: 3 PID: 995 Comm: python3 Not tainted 5.16.0-rc5+ #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs]\nCode: 41 5c 41 5d 41 5e e9 44 34 f0 e0 48 89 df e8 4c 77 ff ff 49 8b 86 10 01 00 00 48 85 c0 74 a1 4c 89 e7 ff d0 eb 9a 0f 0b eb c1 <0f> 0b be 04 00 00 00 48 89 df e8 b6 f6 ff ff e9 75 ff ff ff 90 0f\nRSP: 0018:ffff8881533e3e78 EFLAGS: 00010287\nRAX: ffff88811b2cf3e0 RBX: ffff888106209700 RCX: 0000000000000000\nRDX: ffff888106209780 RSI: ffff8881533e3d30 RDI: ffff888109b101a0\nRBP: 0000000000000001 R08: ffff888127cb381c R09: 0de9890000000009\nR10: ffff888127cb3800 R11: 0000000000000000 R12: ffff888106209780\nR13: ffff888106209750 R14: ffff888100f20660 R15: 0000000000000000\nFS:  00007f8be353b740(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f8bd5b117c0 CR3: 000000012cd8a004 CR4: 0000000000370ea0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n ib_uverbs_close+0x1a/0x90 [ib_uverbs]\n __fput+0x82/0x230\n task_work_run+0x59/0x90\n exit_to_user_mode_prepare+0x138/0x140\n syscall_exit_to_user_mode+0x1d/0x50\n ? __x64_sys_close+0xe/0x40\n do_syscall_64+0x4a/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f8be3ae0abb\nCode: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 83 43 f9 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 c1 43 f9 ff 8b 44\nRSP: 002b:00007ffdb51909c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003\nRAX: 0000000000000000 RBX: 0000557bb7f7c020 RCX: 00007f8be3ae0abb\nRDX: 0000557bb7c74010 RSI: 0000557bb7f14ca0 RDI: 0000000000000005\nRBP: 0000557bb7fbd598 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000293 R12: 0000557bb7fbd5b8\nR13: 0000557bb7fbd5a8 R14: 0000000000001000 R15: 0000557bb7f7c020\n </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fdfc5e0f-0655-4ce0-a338-212b7fbbad30",  "id": "CVE-2022-32981",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32981"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point registers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "710d7238-ac7a-45de-947e-8f7e04793f40",  "id": "CVE-2022-49546",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kexec: fix memory leak of elf header buffer\n\nThis is reported by kmemleak detector:\n\nunreferenced object 0xffffc900002a9000 (size 4096):\n  comm \"kexec\", pid 14950, jiffies 4295110793 (age 373.951s)\n  hex dump (first 32 bytes):\n    7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00  .ELF............\n    04 00 3e 00 01 00 00 00 00 00 00 00 00 00 00 00  ..>.............\n  backtrace:\n    [<0000000016a8ef9f>] __vmalloc_node_range+0x101/0x170\n    [<000000002b66b6c0>] __vmalloc_node+0xb4/0x160\n    [<00000000ad40107d>] crash_prepare_elf64_headers+0x8e/0xcd0\n    [<0000000019afff23>] crash_load_segments+0x260/0x470\n    [<0000000019ebe95c>] bzImage64_load+0x814/0xad0\n    [<0000000093e16b05>] arch_kexec_kernel_image_load+0x1be/0x2a0\n    [<000000009ef2fc88>] kimage_file_alloc_init+0x2ec/0x5a0\n    [<0000000038f5a97a>] __do_sys_kexec_file_load+0x28d/0x530\n    [<0000000087c19992>] do_syscall_64+0x3b/0x90\n    [<0000000066e063a4>] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nIn crash_prepare_elf64_headers(), a buffer is allocated via vmalloc() to\nstore elf headers.  While it's not freed back to system correctly when\nkdump kernel is reloaded or unloaded.  Then memory leak is caused.  Fix it\nby introducing x86 specific function arch_kimage_file_post_load_cleanup(),\nand freeing the buffer there.\n\nAnd also remove the incorrect elf header buffer freeing code.  Before\ncalling arch specific kexec_file loading function, the image instance has\nbeen initialized.  So 'image->elf_headers' must be NULL.  It doesn't make\nsense to free the elf header buffer in the place.\n\nThree different people have reported three bugs about the memory leak on\nx86_64 inside Redhat.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7f6a8c37-a8e6-418c-91f4-ec1846b52cf1",  "id": "SUSE-SU-2023:3729-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c19a24e1-00cf-4887-898d-3f465532b4eb",  "id": "CVE-2022-1184",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1184"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f29dbe30-bfa6-42c1-b56a-94cc478f933f",  "id": "CVE-2024-56590",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.6,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix not checking skb length on hci_acldata_packet\n\nThis fixes not checking if skb really contains an ACL header otherwise\nthe code may attempt to access some uninitilized/invalid memory past the\nvalid skb->data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "34291a68-8357-46f5-80b0-20089de01c21",  "id": "SUSE-SU-2017:2981-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b57af1a8-795b-4119-b3e6-444755417b72",  "id": "CVE-2024-26776",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected\n\nReturn IRQ_NONE from the interrupt handler when no interrupt was\ndetected. Because an empty interrupt will cause a null pointer error:\n\n    Unable to handle kernel NULL pointer dereference at virtual\n  address 0000000000000008\n    Call trace:\n        complete+0x54/0x100\n        hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx]\n        __handle_irq_event_percpu+0x64/0x1e0\n        handle_irq_event+0x7c/0x1cc",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d415461e-182b-47a8-a2c3-d92642e0a9fe",  "id": "CVE-2022-49179",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: don't move oom_bfqq\n\nOur test report a UAF:\n\n[ 2073.019181] ==================================================================\n[ 2073.019188] BUG: KASAN: use-after-free in __bfq_put_async_bfqq+0xa0/0x168\n[ 2073.019191] Write of size 8 at addr ffff8000ccf64128 by task rmmod/72584\n[ 2073.019192]\n[ 2073.019196] CPU: 0 PID: 72584 Comm: rmmod Kdump: loaded Not tainted 4.19.90-yk #5\n[ 2073.019198] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\n[ 2073.019200] Call trace:\n[ 2073.019203]  dump_backtrace+0x0/0x310\n[ 2073.019206]  show_stack+0x28/0x38\n[ 2073.019210]  dump_stack+0xec/0x15c\n[ 2073.019216]  print_address_description+0x68/0x2d0\n[ 2073.019220]  kasan_report+0x238/0x2f0\n[ 2073.019224]  __asan_store8+0x88/0xb0\n[ 2073.019229]  __bfq_put_async_bfqq+0xa0/0x168\n[ 2073.019233]  bfq_put_async_queues+0xbc/0x208\n[ 2073.019236]  bfq_pd_offline+0x178/0x238\n[ 2073.019240]  blkcg_deactivate_policy+0x1f0/0x420\n[ 2073.019244]  bfq_exit_queue+0x128/0x178\n[ 2073.019249]  blk_mq_exit_sched+0x12c/0x160\n[ 2073.019252]  elevator_exit+0xc8/0xd0\n[ 2073.019256]  blk_exit_queue+0x50/0x88\n[ 2073.019259]  blk_cleanup_queue+0x228/0x3d8\n[ 2073.019267]  null_del_dev+0xfc/0x1e0 [null_blk]\n[ 2073.019274]  null_exit+0x90/0x114 [null_blk]\n[ 2073.019278]  __arm64_sys_delete_module+0x358/0x5a0\n[ 2073.019282]  el0_svc_common+0xc8/0x320\n[ 2073.019287]  el0_svc_handler+0xf8/0x160\n[ 2073.019290]  el0_svc+0x10/0x218\n[ 2073.019291]\n[ 2073.019294] Allocated by task 14163:\n[ 2073.019301]  kasan_kmalloc+0xe0/0x190\n[ 2073.019305]  kmem_cache_alloc_node_trace+0x1cc/0x418\n[ 2073.019308]  bfq_pd_alloc+0x54/0x118\n[ 2073.019313]  blkcg_activate_policy+0x250/0x460\n[ 2073.019317]  bfq_create_group_hierarchy+0x38/0x110\n[ 2073.019321]  bfq_init_queue+0x6d0/0x948\n[ 2073.019325]  blk_mq_init_sched+0x1d8/0x390\n[ 2073.019330]  elevator_switch_mq+0x88/0x170\n[ 2073.019334]  elevator_switch+0x140/0x270\n[ 2073.019338]  elv_iosched_store+0x1a4/0x2a0\n[ 2073.019342]  queue_attr_store+0x90/0xe0\n[ 2073.019348]  sysfs_kf_write+0xa8/0xe8\n[ 2073.019351]  kernfs_fop_write+0x1f8/0x378\n[ 2073.019359]  __vfs_write+0xe0/0x360\n[ 2073.019363]  vfs_write+0xf0/0x270\n[ 2073.019367]  ksys_write+0xdc/0x1b8\n[ 2073.019371]  __arm64_sys_write+0x50/0x60\n[ 2073.019375]  el0_svc_common+0xc8/0x320\n[ 2073.019380]  el0_svc_handler+0xf8/0x160\n[ 2073.019383]  el0_svc+0x10/0x218\n[ 2073.019385]\n[ 2073.019387] Freed by task 72584:\n[ 2073.019391]  __kasan_slab_free+0x120/0x228\n[ 2073.019394]  kasan_slab_free+0x10/0x18\n[ 2073.019397]  kfree+0x94/0x368\n[ 2073.019400]  bfqg_put+0x64/0xb0\n[ 2073.019404]  bfqg_and_blkg_put+0x90/0xb0\n[ 2073.019408]  bfq_put_queue+0x220/0x228\n[ 2073.019413]  __bfq_put_async_bfqq+0x98/0x168\n[ 2073.019416]  bfq_put_async_queues+0xbc/0x208\n[ 2073.019420]  bfq_pd_offline+0x178/0x238\n[ 2073.019424]  blkcg_deactivate_policy+0x1f0/0x420\n[ 2073.019429]  bfq_exit_queue+0x128/0x178\n[ 2073.019433]  blk_mq_exit_sched+0x12c/0x160\n[ 2073.019437]  elevator_exit+0xc8/0xd0\n[ 2073.019440]  blk_exit_queue+0x50/0x88\n[ 2073.019443]  blk_cleanup_queue+0x228/0x3d8\n[ 2073.019451]  null_del_dev+0xfc/0x1e0 [null_blk]\n[ 2073.019459]  null_exit+0x90/0x114 [null_blk]\n[ 2073.019462]  __arm64_sys_delete_module+0x358/0x5a0\n[ 2073.019467]  el0_svc_common+0xc8/0x320\n[ 2073.019471]  el0_svc_handler+0xf8/0x160\n[ 2073.019474]  el0_svc+0x10/0x218\n[ 2073.019475]\n[ 2073.019479] The buggy address belongs to the object at ffff8000ccf63f00\n which belongs to the cache kmalloc-1024 of size 1024\n[ 2073.019484] The buggy address is located 552 bytes inside of\n 1024-byte region [ffff8000ccf63f00, ffff8000ccf64300)\n[ 2073.019486] The buggy address belongs to the page:\n[ 2073.019492] page:ffff7e000333d800 count:1 mapcount:0 mapping:ffff8000c0003a00 index:0x0 compound_mapcount: 0\n[ 2073.020123] flags: 0x7ffff0000008100(slab|head)\n[ 2073.020403] raw: 07ffff0000008100 ffff7e0003334c08 ffff7e00001f5a08 ffff8000c0003a00\n[ 2073.020409] ra\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52ba224a-ac77-46a2-b65b-3c2af9d7111b",  "id": "CVE-2019-15921",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15921"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.6. There is a memory leak issue when idr_alloc() fails in genl_register_family() in net/netlink/genetlink.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "62477f55-a74f-43b0-9b26-3aa55c01417a",  "id": "CVE-2013-0216",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0216"  },  "ratings": [    {      "score": 5.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:S/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0f2e28ba-28cb-4227-870b-a85fbaf27bc7",  "id": "CVE-2026-43180",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode\n\nkaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls\nnetif_stop_queue() and netif_wake_queue(). These are TX queue flow\ncontrol functions unrelated to RX multicast configuration.\n\nThe premature netif_wake_queue() can re-enable TX while tx_urb is still\nin-flight, leading to a double usb_submit_urb() on the same URB:\n\nkaweth_start_xmit() {\n    netif_stop_queue();\n    usb_submit_urb(kaweth->tx_urb);\n}\n\nkaweth_set_rx_mode() {\n    netif_stop_queue();\n    netif_wake_queue();             // wakes TX queue before URB is done\n}\n\nkaweth_start_xmit() {\n    netif_stop_queue();\n    usb_submit_urb(kaweth->tx_urb); // URB submitted while active\n}\n\nThis triggers the WARN in usb_submit_urb():\n\n  \"URB submitted while active\"\n\nThis is a similar class of bug fixed in rtl8150 by\n\n- commit 958baf5eaee3 (\"net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast\").\n\nAlso kaweth_set_rx_mode() is already functionally broken, the\nreal set_rx_mode action is performed by kaweth_async_set_rx_mode(),\nwhich in turn is not a no-op only at ndo_open() time.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "35a06bcc-c3fb-41bd-bc15-68b566bc90f9",  "id": "CVE-2018-6554",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6554"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400,    772  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in the irda_bind function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "492b31c6-dd09-4e76-ba02-7240f5df8097",  "id": "CVE-2026-64177",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphonet/pep: disable BH around forwarded sk_receive_skb()\n\nThe networking receive path is usually run from softirq context, but\nprotocols that take the socket lock may have packets stored in the\nbacklog and processed later from process context. In that case\nrelease_sock() -> __release_sock() drops the slock with spin_unlock_bh()\nand then calls sk->sk_backlog_rcv() with bottom halves enabled.\n\nTypical sk_backlog_rcv handlers process the socket whose backlog is\nbeing drained, so the BH state at entry is irrelevant for the slocks\nthey touch. pep_do_rcv() is different: when the inbound skb targets an\nexisting PEP pipe, it forwards the skb to a different *child* socket\nvia sk_receive_skb(). That helper takes the child slock with\nbh_lock_sock_nested(), which is just spin_lock_nested() and assumes BH\nis already off. The same child slock therefore ends up acquired with\nBH on (process path) and with BH off (softirq path):\n\n  process context                   softirq context\n  ---------------                   ---------------\n  release_sock(listener)            __netif_receive_skb()\n   __release_sock()                  phonet_rcv()\n    spin_unlock_bh()                  __sk_receive_skb(listener)\n    [BH now ENABLED]                  [BH already disabled]\n    sk_backlog_rcv:                   sk_backlog_rcv:\n     pep_do_rcv()                      pep_do_rcv()\n      sk_receive_skb(child)             sk_receive_skb(child)\n       bh_lock_sock_nested(child)        bh_lock_sock_nested(child)\n       => SOFTIRQ-ON-W                   => IN-SOFTIRQ-W\n\nLockdep flags this as inconsistent lock state, and it can become a real\nself-deadlock if a softirq on the same CPU tries to receive to the same\nchild socket while its slock is held in the BH-enabled path:\n\n  WARNING: inconsistent lock state\n  inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.\n   (slock-AF_PHONET/1){+.?.}-{3:3}, at: __sk_receive_skb+0x1cf/0x900\n    __sk_receive_skb              net/core/sock.c:563\n    sk_receive_skb                include/net/sock.h:2022 [inline]\n    pep_do_rcv                    net/phonet/pep.c:675\n    sk_backlog_rcv                include/net/sock.h:1190\n    __release_sock                net/core/sock.c:3216\n    release_sock                  net/core/sock.c:3815\n    pep_sock_accept               net/phonet/pep.c:879\n\nWrap the forwarded sk_receive_skb() in local_bh_disable() /\nlocal_bh_enable() so the child slock is always acquired with BH off.\nlocal_bh_disable() nests safely on the softirq path.\n\nDiscovered via in-house syzkaller fuzzing; the same root cause also\non the linux-6.1.y syzbot dashboard as extid 44f0626dd6284f02663c.\nReproduced under KASAN + LOCKDEP + PROVE_LOCKING, reproducer:\nhttps://pastebin.com/A3t8xzCR",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "30a3eeb7-ee99-40ef-972d-10990f45f4eb",  "id": "CVE-2024-50035",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: fix ppp_async_encode() illegal access\n\nsyzbot reported an issue in ppp_async_encode() [1]\n\nIn this case, pppoe_sendmsg() is called with a zero size.\nThen ppp_async_encode() is called with an empty skb.\n\nBUG: KMSAN: uninit-value in ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline]\n BUG: KMSAN: uninit-value in ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675\n  ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline]\n  ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675\n  ppp_async_send+0x130/0x1b0 drivers/net/ppp/ppp_async.c:634\n  ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2280 [inline]\n  ppp_input+0x1f1/0xe60 drivers/net/ppp/ppp_generic.c:2304\n  pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379\n  sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113\n  __release_sock+0x1da/0x330 net/core/sock.c:3072\n  release_sock+0x6b/0x250 net/core/sock.c:3626\n  pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903\n  sock_sendmsg_nosec net/socket.c:729 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:744\n  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n  __do_sys_sendmmsg net/socket.c:2771 [inline]\n  __se_sys_sendmmsg net/socket.c:2768 [inline]\n  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:4092 [inline]\n  slab_alloc_node mm/slub.c:4135 [inline]\n  kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4187\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587\n  __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678\n  alloc_skb include/linux/skbuff.h:1322 [inline]\n  sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732\n  pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867\n  sock_sendmsg_nosec net/socket.c:729 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:744\n  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n  __do_sys_sendmmsg net/socket.c:2771 [inline]\n  __se_sys_sendmmsg net/socket.c:2768 [inline]\n  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 1 UID: 0 PID: 5411 Comm: syz.1.14 Not tainted 6.12.0-rc1-syzkaller-00165-g360c1f1f24c6 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "71323d73-210c-42b4-99df-e2d654b8b3e6",  "id": "CVE-2024-50090",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Fix overflow in oa batch buffer\n\nBy default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch\nbuffer, this is not a problem if batch buffer is only used once but\noa reuses the batch buffer for the same metric and at each call\nit appends a MI_BATCH_BUFFER_END, printing the warning below and then\noverflowing.\n\n[  381.072016] ------------[ cut here ]------------\n[  381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed!\n               platform: LUNARLAKE subplatform: 1\n               graphics: Xe2_LPG / Xe2_HPG 20.04 step B0\n               media: Xe2_LPM / Xe2_HPM 20.00 step B0\n               tile: 0 VRAM 0 B\n               GT: 0 type 1\n\nSo here checking if batch buffer already have MI_BATCH_BUFFER_END if\nnot append it.\n\nv2:\n- simply fix, suggestion from Ashutosh\n\n(cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "96eee129-6d68-43b7-9460-6370a77be869",  "id": "CVE-2024-56775",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    401,    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix handling of plane refcount\n\n[Why]\nThe mechanism to backup and restore plane states doesn't maintain\nrefcount, which can cause issues if the refcount of the plane changes\nin between backup and restore operations, such as memory leaks if the\nrefcount was supposed to go down, or double frees / invalid memory\naccesses if the refcount was supposed to go up.\n\n[How]\nCache and re-apply current refcount when restoring plane states.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31ab60d3-5236-419c-97f0-acb1224e2670",  "id": "openSUSE-SU-2025:15361-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8320df27-ed04-4d5e-b3e6-6e6b9ca3dec6",  "id": "CVE-2024-49927",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/ioapic: Handle allocation failures gracefully\n\nBreno observed panics when using failslab under certain conditions during\nruntime:\n\n   can not alloc irq_pin_list (-1,0,20)\n   Kernel panic - not syncing: IO-APIC: failed to add irq-pin. Can not proceed\n\n   panic+0x4e9/0x590\n   mp_irqdomain_alloc+0x9ab/0xa80\n   irq_domain_alloc_irqs_locked+0x25d/0x8d0\n   __irq_domain_alloc_irqs+0x80/0x110\n   mp_map_pin_to_irq+0x645/0x890\n   acpi_register_gsi_ioapic+0xe6/0x150\n   hpet_open+0x313/0x480\n\nThat's a pointless panic which is a leftover of the historic IO/APIC code\nwhich panic'ed during early boot when the interrupt allocation failed.\n\nThe only place which might justify panic is the PIT/HPET timer_check() code\nwhich tries to figure out whether the timer interrupt is delivered through\nthe IO/APIC. But that code does not require to handle interrupt allocation\nfailures. If the interrupt cannot be allocated then timer delivery fails\nand it either panics due to that or falls back to legacy mode.\n\nCure this by removing the panic wrapper around __add_pin_to_irq_node() and\nmaking mp_irqdomain_alloc() aware of the failure condition and handle it as\nany other failure in this function gracefully.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "df87f929-f43f-4e09-af0d-b1e4f328333b",  "id": "CVE-2026-45920",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix dirtyclusters double decrement on fs shutdown\n\nfstests test generic/388 occasionally reproduces a warning in\next4_put_super() associated with the dirty clusters count:\n\n  WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]\n\nTracing the failure shows that the warning fires due to an\ns_dirtyclusters_counter value of -1. IOW, this appears to be a\nspurious decrement as opposed to some sort of leak. Further tracing\nof the dirty cluster count deltas and an LLM scan of the resulting\noutput identified the cause as a double decrement in the error path\nbetween ext4_mb_mark_diskspace_used() and the caller\next4_mb_new_blocks().\n\nFirst, note that generic/388 is a shutdown vs. fsstress test and so\nproduces a random set of operations and shutdown injections. In the\nproblematic case, the shutdown triggers an error return from the\next4_handle_dirty_metadata() call(s) made from\next4_mb_mark_context(). The changed value is non-zero at this point,\nso ext4_mb_mark_diskspace_used() does not exit after the error\nbubbles up from ext4_mb_mark_context(). Instead, the former\ndecrements both cluster counters and returns the error up to\next4_mb_new_blocks(). The latter falls into the !ar->len out path\nwhich decrements the dirty clusters counter a second time, creating\nthe inconsistency.\n\nTo avoid this problem and simplify ownership of the cluster\nreservation in this codepath, lift the counter reduction to a single\nplace in the caller. This makes it more clear that\next4_mb_new_blocks() is responsible for acquiring cluster\nreservation (via ext4_claim_free_clusters()) in the !delalloc case\nas well as releasing it, regardless of whether it ends up consumed\nor returned due to failure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4dcad98e-5f81-4785-bf16-9af2d2d12ecd",  "id": "CVE-2022-49449",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources()\n\nIt will cause null-ptr-deref when using 'res', if platform_get_resource()\nreturns NULL, so move using 'res' after devm_ioremap_resource() that\nwill check it to avoid null-ptr-deref.\nAnd use devm_platform_get_and_ioremap_resource() to simplify code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f396fa1-4245-4fca-a4ea-c3c3806ca48c",  "id": "CVE-2006-4339",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4339"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS #1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying X.509 and other certificates that use PKCS #1.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9a470a1-0fb3-40e5-bc02-a81504fd4a66",  "id": "CVE-2020-25685",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25685"  },  "ratings": [    {      "score": 3.7,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    326  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in forward.c:reply_query(), which is the forwarded query that matches the reply, by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) this flaw allows an off-path attacker to find several different domains all having the same hash, substantially reducing the number of attempts they would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that the query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5ce53f83-f5c5-4ede-af52-f71e66165ae8",  "id": "CVE-2012-0044",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0044"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the drm_mode_dirtyfb_ioctl function in drivers/gpu/drm/drm_crtc.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.1.5 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1897714a-76a1-4eaf-9737-6f2f09910f39",  "id": "CVE-2024-46834",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: fail closed if we can't get max channel used in indirection tables\n\nCommit 0d1b7d6c9274 (\"bnxt: fix crashes when reducing ring count with\nactive RSS contexts\") proves that allowing indirection table to contain\nchannels with out of bounds IDs may lead to crashes. Currently the\nmax channel check in the core gets skipped if driver can't fetch\nthe indirection table or when we can't allocate memory.\n\nBoth of those conditions should be extremely rare but if they do\nhappen we should try to be safe and fail the channel change.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4785840e-7f7a-4f99-8353-aeff7efa9beb",  "id": "CVE-2017-13695",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13695"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8e27cfe4-88f1-47e2-b7f1-83344501f498",  "id": "CVE-2024-49858",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nefistub/tpm: Use ACPI reclaim memory for event log to avoid corruption\n\nThe TPM event log table is a Linux specific construct, where the data\nproduced by the GetEventLog() boot service is cached in memory, and\npassed on to the OS using an EFI configuration table.\n\nThe use of EFI_LOADER_DATA here results in the region being left\nunreserved in the E820 memory map constructed by the EFI stub, and this\nis the memory description that is passed on to the incoming kernel by\nkexec, which is therefore unaware that the region should be reserved.\n\nEven though the utility of the TPM2 event log after a kexec is\nquestionable, any corruption might send the parsing code off into the\nweeds and crash the kernel. So let's use EFI_ACPI_RECLAIM_MEMORY\ninstead, which is always treated as reserved by the E820 conversion\nlogic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0a9732bb-9bf9-42bc-ae39-9ff32b590cef",  "id": "CVE-2023-53391",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nshmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs\n\nAs the ramfs-based tmpfs uses ramfs_init_fs_context() for the\ninit_fs_context method, which allocates fc->s_fs_info, use ramfs_kill_sb()\nto free it and avoid a memory leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c1a80f36-4b74-4fc8-86c7-c92684009cc4",  "id": "CVE-2014-3185",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3185"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "96fda546-0c9b-4ea7-8b78-874e43234315",  "id": "CVE-2023-52815",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vkms: fix a possible null pointer dereference\n\nIn amdgpu_vkms_conn_get_modes(), the return value of drm_cvt_mode()\nis assigned to mode, which will lead to a NULL pointer dereference\non failure of drm_cvt_mode(). Add a check to avoid null pointer\ndereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d059d463-eb0f-4126-aa3e-3f2386863ec0",  "id": "MGASA-2017-0367",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0d0fd38-f591-47f4-86f8-059aee03c2a7",  "id": "CVE-2022-50202",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM: hibernate: defer device probing when resuming from hibernation\n\nsyzbot is reporting hung task at misc_open() [1], for there is a race\nwindow of AB-BA deadlock which involves probe_count variable. Currently\nwait_for_device_probe() from snapshot_open() from misc_open() can sleep\nforever with misc_mtx held if probe_count cannot become 0.\n\nWhen a device is probed by hub_event() work function, probe_count is\nincremented before the probe function starts, and probe_count is\ndecremented after the probe function completed.\n\nThere are three cases that can prevent probe_count from dropping to 0.\n\n  (a) A device being probed stopped responding (i.e. broken/malicious\n      hardware).\n\n  (b) A process emulating a USB device using /dev/raw-gadget interface\n      stopped responding for some reason.\n\n  (c) New device probe requests keeps coming in before existing device\n      probe requests complete.\n\nThe phenomenon syzbot is reporting is (b). A process which is holding\nsystem_transition_mutex and misc_mtx is waiting for probe_count to become\n0 inside wait_for_device_probe(), but the probe function which is called\n from hub_event() work function is waiting for the processes which are\nblocked at mutex_lock(&misc_mtx) to respond via /dev/raw-gadget interface.\n\nThis patch mitigates (b) by deferring wait_for_device_probe() from\nsnapshot_open() to snapshot_write() and snapshot_ioctl(). Please note that\nthe possibility of (b) remains as long as any thread which is emulating a\nUSB device via /dev/raw-gadget interface can be blocked by uninterruptible\nblocking operations (e.g. mutex_lock()).\n\nPlease also note that (a) and (c) are not addressed. Regarding (c), we\nshould change the code to wait for only one device which contains the\nimage for resuming from hibernation. I don't know how to address (a), for\nuse of timeout for wait_for_device_probe() might result in loss of user\ndata in the image. Maybe we should require the userland to wait for the\nimage device before opening /dev/snapshot interface.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "54b6b3f7-d2c5-410a-a264-6f33250b4bff",  "id": "CVE-2026-43262",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fiemap page fault fix\n\nIn gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode\nglock.  This can lead to recursive glock taking if the fiemap buffer is\nmemory mapped to the same inode and accessing it triggers a page fault.\n\nFix by disabling page faults for iomap_fiemap() and faulting in the\nbuffer by hand if necessary.\n\nFixes xfstest generic/742.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bee0b6ca-3e9f-4b16-ae32-df73d9aacb04",  "id": "CVE-2019-19068",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19068"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-a2cdd07488e6.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ed5363e-bb66-4189-b313-ee6290e5761c",  "id": "CVE-2025-21833",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Avoid use of NULL after WARN_ON_ONCE\n\nThere is a WARN_ON_ONCE to catch an unlikely situation when\ndomain_remove_dev_pasid can't find the `pasid`. In case it nevertheless\nhappens we must avoid using a NULL pointer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cee349ea-66bb-4be4-b7b4-621fe2facc83",  "id": "CVE-2011-1833",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1833"  },  "ratings": [    {      "score": 3.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N"    }  ],  "cwes": [    264,    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the ecryptfs_mount function in fs/ecryptfs/main.c in the eCryptfs subsystem in the Linux kernel before 3.1 allows local users to bypass intended file permissions via a mount.ecryptfs_private mount with a mismatched uid.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "36fc320e-c860-4075-9183-d342b32ec0a5",  "id": "CVE-2021-47331",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47331"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: common: usb-conn-gpio: fix NULL pointer dereference of charger\n\nWhen power on system with OTG cable, IDDIG's interrupt arises before\nthe charger registration, it will cause a NULL pointer dereference,\nfix the issue by registering the power supply before requesting\nIDDIG/VBUS irq.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "784cb186-818e-4835-8759-aaf9b877ea69",  "id": "CVE-2023-51043",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51043"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a nonblocking atomic commit and a driver unload.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d4277dff-a230-41af-ae4e-56429f255103",  "id": "CVE-2024-49917",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn30_init_hw` function. The issue could occur when `dc->clk_mgr` or\n`dc->clk_mgr->funcs` is null.\n\nThe fix adds a check to ensure `dc->clk_mgr` and `dc->clk_mgr->funcs` is\nnot null before accessing its functions. This prevents a potential null\npointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:789 dcn30_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 628)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ac9f3aa-84e4-4ca9-936f-a10309603127",  "id": "CVE-2012-0038",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0038"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the xfs_acl_from_disk function in fs/xfs/xfs_acl.c in the Linux kernel before 3.1.9 allows local users to cause a denial of service (panic) via a filesystem with a malformed ACL, leading to a heap-based buffer overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ffd8e3d3-4cd4-4747-a1ee-0631d25b9b09",  "id": "CVE-2020-26558",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26558"  },  "ratings": [    {      "score": 4.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    287  ],  "analysis": {    "state": "in_triage"  },  "description": "Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10d10496-5f99-435a-9830-ee540977cff0",  "id": "CVE-2025-38072",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibnvdimm/labels: Fix divide error in nd_label_data_init()\n\nIf a faulty CXL memory device returns a broken zero LSA size in its\nmemory device information (Identify Memory Device (Opcode 4000h), CXL\nspec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm\ndriver:\n\n Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI\n RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm]\n\nCode and flow:\n\n1) CXL Command 4000h returns LSA size = 0\n2) config_size is assigned to zero LSA size (CXL pmem driver):\n\ndrivers/cxl/pmem.c:             .config_size = mds->lsa_size,\n\n3) max_xfer is set to zero (nvdimm driver):\n\ndrivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size);\n\n4) A subsequent DIV_ROUND_UP() causes a division by zero:\n\ndrivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */\ndrivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer,\ndrivers/nvdimm/label.c-                 config_size);\n\nFix this by checking the config size parameter by extending an\nexisting check.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e87ffb51-640e-4127-9179-ddb51ba89b42",  "id": "CVE-2022-1852",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1852"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "54b6d71b-caf7-4fa7-a73a-65be442040bf",  "id": "CVE-2023-53145",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition\n\nIn btsdio_probe, the data->work is bound with btsdio_work. It will be\nstarted in btsdio_send_frame.\n\nIf the btsdio_remove runs with a unfinished work, there may be a race\ncondition that hdev is freed but used in btsdio_work. Fix it by\ncanceling the work before do cleanup in btsdio_remove.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "779ddd61-ea09-4963-93b5-6b418fda6ae7",  "id": "CVE-2012-0884",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0884"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack (MMA) adaptive chosen ciphertext attack.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5fb17f1c-4362-464b-a69a-d333aea95959",  "id": "CVE-2021-47332",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47332"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usx2y: Don't call free_pages_exact() with NULL address\n\nUnlike some other functions, we can't pass NULL pointer to\nfree_pages_exact().  Add a proper NULL check for avoiding possible\nOops.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc736b75-faf5-4f6a-b31d-6dd40ea06b74",  "id": "ROOT-OS-ALPINE-315-CVE-2026-28390",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a62e98b0-5ef3-4d3f-b214-4d6315828923",  "id": "CVE-2026-23290",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: validate USB endpoints\n\nThe pegasus driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expecting before it binds\nto it.  If a malicious device were to not have the same urbs the driver\nwill crash later on when it blindly accesses these endpoints.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e42d83a2-d323-4587-875f-5878f56ac16c",  "id": "CVE-2014-9730",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9730"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The udf_pc_to_char function in fs/udf/symlink.c in the Linux kernel before 3.18.2 relies on component lengths that are unused, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "07e87daf-7174-46ec-819c-361b99e520a9",  "id": "CVE-2022-3202",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3202"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux kernel. This could allow a local attacker to crash the system or leak kernel internal information.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ab19b19-811c-4228-ad2e-4c30b5ca989c",  "id": "CVE-2022-40476",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40476"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A null pointer dereference issue was discovered in fs/io_uring.c in the Linux kernel before 5.15.62. A local user could use this flaw to crash the system or potentially cause a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "477c5671-31a7-4e4f-8eed-367a3e3eca55",  "id": "CVE-2026-31748",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: me_daq: Fix potential overrun of firmware buffer\n\n`me2600_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`.  It is possible for it to overrun the source\nbuffer because it blindly trusts the file format.  It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards.  Although it checks that the supplied firmware is at least 16\nbytes long, it does not check that it is long enough to contain the data\nstream.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream.  On failure, log an error and\nreturn `-EINVAL`.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9f931135-8ac7-4359-acb5-abba7662bdc2",  "id": "CVE-2017-0523",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0523"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-32835279. References: QC-CR#1096945.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "53cb3fe9-670a-40f7-a29a-313846a7b776",  "id": "CVE-2025-37785",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix OOB read when checking dotdot dir\n\nMounting a corrupted filesystem with directory which contains '.' dir\nentry with rec_len == block size results in out-of-bounds read (later\non, when the corrupted directory is removed).\n\next4_empty_dir() assumes every ext4 directory contains at least '.'\nand '..' as directory entries in the first data block. It first loads\nthe '.' dir entry, performs sanity checks by calling ext4_check_dir_entry()\nand then uses its rec_len member to compute the location of '..' dir\nentry (in ext4_next_entry). It assumes the '..' dir entry fits into the\nsame data block.\n\nIf the rec_len of '.' is precisely one block (4KB), it slips through the\nsanity checks (it is considered the last directory entry in the data\nblock) and leaves \"struct ext4_dir_entry_2 *de\" point exactly past the\nmemory slot allocated to the data block. The following call to\next4_check_dir_entry() on new value of de then dereferences this pointer\nwhich results in out-of-bounds mem access.\n\nFix this by extending __ext4_check_dir_entry() to check for '.' dir\nentries that reach the end of data block. Make sure to ignore the phony\ndir entries for checksum (by checking name_len for non-zero).\n\nNote: This is reported by KASAN as use-after-free in case another\nstructure was recently freed from the slot past the bound, but it is\nreally an OOB read.\n\nThis issue was found by syzkaller tool.\n\nCall Trace:\n[   38.594108] BUG: KASAN: slab-use-after-free in __ext4_check_dir_entry+0x67e/0x710\n[   38.594649] Read of size 2 at addr ffff88802b41a004 by task syz-executor/5375\n[   38.595158]\n[   38.595288] CPU: 0 UID: 0 PID: 5375 Comm: syz-executor Not tainted 6.14.0-rc7 #1\n[   38.595298] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[   38.595304] Call Trace:\n[   38.595308]  <TASK>\n[   38.595311]  dump_stack_lvl+0xa7/0xd0\n[   38.595325]  print_address_description.constprop.0+0x2c/0x3f0\n[   38.595339]  ? __ext4_check_dir_entry+0x67e/0x710\n[   38.595349]  print_report+0xaa/0x250\n[   38.595359]  ? __ext4_check_dir_entry+0x67e/0x710\n[   38.595368]  ? kasan_addr_to_slab+0x9/0x90\n[   38.595378]  kasan_report+0xab/0xe0\n[   38.595389]  ? __ext4_check_dir_entry+0x67e/0x710\n[   38.595400]  __ext4_check_dir_entry+0x67e/0x710\n[   38.595410]  ext4_empty_dir+0x465/0x990\n[   38.595421]  ? __pfx_ext4_empty_dir+0x10/0x10\n[   38.595432]  ext4_rmdir.part.0+0x29a/0xd10\n[   38.595441]  ? __dquot_initialize+0x2a7/0xbf0\n[   38.595455]  ? __pfx_ext4_rmdir.part.0+0x10/0x10\n[   38.595464]  ? __pfx___dquot_initialize+0x10/0x10\n[   38.595478]  ? down_write+0xdb/0x140\n[   38.595487]  ? __pfx_down_write+0x10/0x10\n[   38.595497]  ext4_rmdir+0xee/0x140\n[   38.595506]  vfs_rmdir+0x209/0x670\n[   38.595517]  ? lookup_one_qstr_excl+0x3b/0x190\n[   38.595529]  do_rmdir+0x363/0x3c0\n[   38.595537]  ? __pfx_do_rmdir+0x10/0x10\n[   38.595544]  ? strncpy_from_user+0x1ff/0x2e0\n[   38.595561]  __x64_sys_unlinkat+0xf0/0x130\n[   38.595570]  do_syscall_64+0x5b/0x180\n[   38.595583]  entry_SYSCALL_64_after_hwframe+0x76/0x7e",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fbaf95b3-2ff1-43fe-95e6-11216203360a",  "id": "CVE-2017-14493",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14493"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:42943'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:144473/Dnsmasq-Stack-Based-Overflow.html'"    }  ]},{  "bom-ref": "64fad5e9-08a3-48da-a9c7-9e3488f37156",  "id": "CVE-2021-47357",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47357"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: iphase: fix possible use-after-free in ia_module_exit()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "37a79d6b-b24d-494e-97b7-a311af2793ed",  "id": "CVE-2022-49054",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Deactivate sysctl_record_panic_msg by default in isolated guests\n\nhv_panic_page might contain guest-sensitive information, do not dump it\nover to Hyper-V by default in isolated guests.\n\nWhile at it, update some comments in hyperv_{panic,die}_event().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "740b2b93-5ffe-4956-a24f-8e7af3e013fa",  "id": "CVE-2022-48734",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock between quota disable and qgroup rescan worker\n\nQuota disable ioctl starts a transaction before waiting for the qgroup\nrescan worker completes. However, this wait can be infinite and results\nin deadlock because of circular dependency among the quota disable\nioctl, the qgroup rescan worker and the other task with transaction such\nas block group relocation task.\n\nThe deadlock happens with the steps following:\n\n1) Task A calls ioctl to disable quota. It starts a transaction and\n   waits for qgroup rescan worker completes.\n2) Task B such as block group relocation task starts a transaction and\n   joins to the transaction that task A started. Then task B commits to\n   the transaction. In this commit, task B waits for a commit by task A.\n3) Task C as the qgroup rescan worker starts its job and starts a\n   transaction. In this transaction start, task C waits for completion\n   of the transaction that task A started and task B committed.\n\nThis deadlock was found with fstests test case btrfs/115 and a zoned\nnull_blk device. The test case enables and disables quota, and the\nblock group reclaim was triggered during the quota disable by chance.\nThe deadlock was also observed by running quota enable and disable in\nparallel with 'btrfs balance' command on regular null_blk devices.\n\nAn example report of the deadlock:\n\n  [372.469894] INFO: task kworker/u16:6:103 blocked for more than 122 seconds.\n  [372.479944]       Not tainted 5.16.0-rc8 #7\n  [372.485067] \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n  [372.493898] task:kworker/u16:6   state:D stack:    0 pid:  103 ppid:     2 flags:0x00004000\n  [372.503285] Workqueue: btrfs-qgroup-rescan btrfs_work_helper [btrfs]\n  [372.510782] Call Trace:\n  [372.514092]  <TASK>\n  [372.521684]  __schedule+0xb56/0x4850\n  [372.530104]  ? io_schedule_timeout+0x190/0x190\n  [372.538842]  ? lockdep_hardirqs_on+0x7e/0x100\n  [372.547092]  ? _raw_spin_unlock_irqrestore+0x3e/0x60\n  [372.555591]  schedule+0xe0/0x270\n  [372.561894]  btrfs_commit_transaction+0x18bb/0x2610 [btrfs]\n  [372.570506]  ? btrfs_apply_pending_changes+0x50/0x50 [btrfs]\n  [372.578875]  ? free_unref_page+0x3f2/0x650\n  [372.585484]  ? finish_wait+0x270/0x270\n  [372.591594]  ? release_extent_buffer+0x224/0x420 [btrfs]\n  [372.599264]  btrfs_qgroup_rescan_worker+0xc13/0x10c0 [btrfs]\n  [372.607157]  ? lock_release+0x3a9/0x6d0\n  [372.613054]  ? btrfs_qgroup_account_extent+0xda0/0xda0 [btrfs]\n  [372.620960]  ? do_raw_spin_lock+0x11e/0x250\n  [372.627137]  ? rwlock_bug.part.0+0x90/0x90\n  [372.633215]  ? lock_is_held_type+0xe4/0x140\n  [372.639404]  btrfs_work_helper+0x1ae/0xa90 [btrfs]\n  [372.646268]  process_one_work+0x7e9/0x1320\n  [372.652321]  ? lock_release+0x6d0/0x6d0\n  [372.658081]  ? pwq_dec_nr_in_flight+0x230/0x230\n  [372.664513]  ? rwlock_bug.part.0+0x90/0x90\n  [372.670529]  worker_thread+0x59e/0xf90\n  [372.676172]  ? process_one_work+0x1320/0x1320\n  [372.682440]  kthread+0x3b9/0x490\n  [372.687550]  ? _raw_spin_unlock_irq+0x24/0x50\n  [372.693811]  ? set_kthread_struct+0x100/0x100\n  [372.700052]  ret_from_fork+0x22/0x30\n  [372.705517]  </TASK>\n  [372.709747] INFO: task btrfs-transacti:2347 blocked for more than 123 seconds.\n  [372.729827]       Not tainted 5.16.0-rc8 #7\n  [372.745907] \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n  [372.767106] task:btrfs-transacti state:D stack:    0 pid: 2347 ppid:     2 flags:0x00004000\n  [372.787776] Call Trace:\n  [372.801652]  <TASK>\n  [372.812961]  __schedule+0xb56/0x4850\n  [372.830011]  ? io_schedule_timeout+0x190/0x190\n  [372.852547]  ? lockdep_hardirqs_on+0x7e/0x100\n  [372.871761]  ? _raw_spin_unlock_irqrestore+0x3e/0x60\n  [372.886792]  schedule+0xe0/0x270\n  [372.901685]  wait_current_trans+0x22c/0x310 [btrfs]\n  [372.919743]  ? btrfs_put_transaction+0x3d0/0x3d0 [btrfs]\n  [372.938923]  ? finish_wait+0x270/0x270\n  [372.959085]  ? join_transaction+0xc7\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f31c231d-4aef-4f21-bd95-c2717ca00422",  "id": "CVE-2022-49532",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes\n\ndrm_cvt_mode may return NULL and we should check it.\n\nThis bug is found by syzkaller:\n\nFAULT_INJECTION stacktrace:\n[  168.567394] FAULT_INJECTION: forcing a failure.\nname failslab, interval 1, probability 0, space 0, times 1\n[  168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1\n[  168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\n[  168.567408] Call trace:\n[  168.567414]  dump_backtrace+0x0/0x310\n[  168.567418]  show_stack+0x28/0x38\n[  168.567423]  dump_stack+0xec/0x15c\n[  168.567427]  should_fail+0x3ac/0x3d0\n[  168.567437]  __should_failslab+0xb8/0x120\n[  168.567441]  should_failslab+0x28/0xc0\n[  168.567445]  kmem_cache_alloc_trace+0x50/0x640\n[  168.567454]  drm_mode_create+0x40/0x90\n[  168.567458]  drm_cvt_mode+0x48/0xc78\n[  168.567477]  virtio_gpu_conn_get_modes+0xa8/0x140 [virtio_gpu]\n[  168.567485]  drm_helper_probe_single_connector_modes+0x3a4/0xd80\n[  168.567492]  drm_mode_getconnector+0x2e0/0xa70\n[  168.567496]  drm_ioctl_kernel+0x11c/0x1d8\n[  168.567514]  drm_ioctl+0x558/0x6d0\n[  168.567522]  do_vfs_ioctl+0x160/0xf30\n[  168.567525]  ksys_ioctl+0x98/0xd8\n[  168.567530]  __arm64_sys_ioctl+0x50/0xc8\n[  168.567536]  el0_svc_common+0xc8/0x320\n[  168.567540]  el0_svc_handler+0xf8/0x160\n[  168.567544]  el0_svc+0x10/0x218\n\nKASAN stacktrace:\n[  168.567561] BUG: KASAN: null-ptr-deref in virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu]\n[  168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425\n[  168.567566]\n[  168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1\n[  168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\n[  168.567575] Call trace:\n[  168.567578]  dump_backtrace+0x0/0x310\n[  168.567582]  show_stack+0x28/0x38\n[  168.567586]  dump_stack+0xec/0x15c\n[  168.567591]  kasan_report+0x244/0x2f0\n[  168.567594]  __asan_load4+0x58/0xb0\n[  168.567607]  virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu]\n[  168.567612]  drm_helper_probe_single_connector_modes+0x3a4/0xd80\n[  168.567617]  drm_mode_getconnector+0x2e0/0xa70\n[  168.567621]  drm_ioctl_kernel+0x11c/0x1d8\n[  168.567624]  drm_ioctl+0x558/0x6d0\n[  168.567628]  do_vfs_ioctl+0x160/0xf30\n[  168.567632]  ksys_ioctl+0x98/0xd8\n[  168.567636]  __arm64_sys_ioctl+0x50/0xc8\n[  168.567641]  el0_svc_common+0xc8/0x320\n[  168.567645]  el0_svc_handler+0xf8/0x160\n[  168.567649]  el0_svc+0x10/0x218",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "139eac00-c958-443a-ad37-9babf98c3f79",  "id": "CVE-2024-46815",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]\n\n[WHY & HOW]\nnum_valid_sets needs to be checked to avoid a negative index when\naccessing reader_wm_sets[num_valid_sets - 1].\n\nThis fixes an OVERRUN issue reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b1d20c09-8e2a-407c-96b8-251b327a2922",  "id": "CVE-2022-50343",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: fix possible name leaks when rio_add_device() fails\n\nPatch series \"rapidio: fix three possible memory leaks\".\n\nThis patchset fixes three name leaks in error handling.\n - patch #1 fixes two name leaks while rio_add_device() fails.\n - patch #2 fixes a name leak while  rio_register_mport() fails.\n\n\nThis patch (of 2):\n\nIf rio_add_device() returns error, the name allocated by dev_set_name()\nneed be freed.  It should use put_device() to give up the reference in the\nerror path, so that the name can be freed in kobject_cleanup(), and the\n'rdev' can be freed in rio_release_dev().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aab76c5a-be09-431d-9bbc-ea1f042b0517",  "id": "SUSE-SU-2026:0235-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "162669c7-94e3-412c-bf52-6973593467b0",  "id": "CLSA-2021-1632262317",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "64c86851-3a1b-4c95-8865-2949a7172def",  "id": "CVE-2023-2162",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2162"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff9d9dd0-a50c-4855-a99e-85fd0cfb6f23",  "id": "CVE-2026-45905",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix ip_rt_bug race in icmp_route_lookup reverse path\n\nicmp_route_lookup() performs multiple route lookups to find a suitable\nroute for sending ICMP error messages, with special handling for XFRM\n(IPsec) policies.\n\nThe lookup sequence is:\n1. First, lookup output route for ICMP reply (dst = original src)\n2. Pass through xfrm_lookup() for policy check\n3. If blocked (-EPERM) or dst is not local, enter \"reverse path\"\n4. In reverse path, call xfrm_decode_session_reverse() to get fl4_dec\n   which reverses the original packet's flow (saddr<->daddr swapped)\n5. If fl4_dec.saddr is local (we are the original destination), use\n   __ip_route_output_key() for output route lookup\n6. If fl4_dec.saddr is NOT local (we are a forwarding node), use\n   ip_route_input() to simulate the reverse packet's input path\n7. Finally, pass rt2 through xfrm_lookup() with XFRM_LOOKUP_ICMP flag\n\nThe bug occurs in step 6: ip_route_input() is called with fl4_dec.daddr\n(original packet's source) as destination. If this address becomes local\nbetween the initial check and ip_route_input() call (e.g., due to\nconcurrent \"ip addr add\"), ip_route_input() returns a LOCAL route with\ndst.output set to ip_rt_bug.\n\nThis route is then used for ICMP output, causing dst_output() to call\nip_rt_bug(), triggering a WARN_ON:\n\n ------------[ cut here ]------------\n WARNING: net/ipv4/route.c:1275 at ip_rt_bug+0x21/0x30, CPU#1\n Call Trace:\n  <TASK>\n  ip_push_pending_frames+0x202/0x240\n  icmp_push_reply+0x30d/0x430\n  __icmp_send+0x1149/0x24f0\n  ip_options_compile+0xa2/0xd0\n  ip_rcv_finish_core+0x829/0x1950\n  ip_rcv+0x2d7/0x420\n  __netif_receive_skb_one_core+0x185/0x1f0\n  netif_receive_skb+0x90/0x450\n  tun_get_user+0x3413/0x3fb0\n  tun_chr_write_iter+0xe4/0x220\n  ...\n\nFix this by checking rt2->rt_type after ip_route_input(). If it's\nRTN_LOCAL, the route cannot be used for output, so treat it as an error.\n\nThe reproducer requires kernel modification to widen the race window,\nmaking it unsuitable as a selftest. It is available at:\n\n  https://gist.github.com/mrpre/eae853b72ac6a750f5d45d64ddac1e81",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0e67e5d5-cb5b-45dd-941c-076dd86b0e1d",  "id": "CVE-2024-39473",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension\n\nIf a process module does not have base config extension then the same\nformat applies to all of it's inputs and the process->base_config_ext is\nNULL, causing NULL dereference when specifically crafted topology and\nsequences used.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c4267c30-1214-4b8e-a1d0-8e4158fa8bec",  "id": "CVE-2019-17056",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17056"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    276  ],  "analysis": {    "state": "in_triage"  },  "description": "llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-3a359798b176.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2261029-3623-4591-9ebf-1f92e80ea266",  "id": "SUSE-SU-2019:3189-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "78869baa-5392-43c8-8187-fe4c67313e2e",  "id": "CVE-2018-18690",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18690"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    754  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE operations with conversion of an attr from short to long form.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "320c7258-ae56-4474-9e92-54c905896c9b",  "id": "CVE-2021-38200",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38200"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perf_event_paranoid=-1 and no specific PMU driver support registered, allows local users to cause a denial of service (perf_instruction_pointer NULL pointer dereference and OOPS) via a \"perf record\" command.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5f59a1c3-8fc0-4400-9907-573de1553a0f",  "id": "CVE-2022-3595",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3595"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119,    415  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in Linux Kernel. It has been rated as problematic. Affected by this issue is the function sess_free_buffer of the file fs/cifs/sess.c of the component CIFS Handler. The manipulation leads to double free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211364.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c3b80842-e422-43ef-b5b2-8105224c5fe1",  "id": "CVE-2024-38600",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: Fix deadlocks with kctl removals at disconnection\n\nIn snd_card_disconnect(), we set card->shutdown flag at the beginning,\ncall callbacks and do sync for card->power_ref_sleep waiters at the\nend.  The callback may delete a kctl element, and this can lead to a\ndeadlock when the device was in the suspended state.  Namely:\n\n* A process waits for the power up at snd_power_ref_and_wait() in\n  snd_ctl_info() or read/write() inside card->controls_rwsem.\n\n* The system gets disconnected meanwhile, and the driver tries to\n  delete a kctl via snd_ctl_remove*(); it tries to take\n  card->controls_rwsem again, but this is already locked by the\n  above.  Since the sleeper isn't woken up, this deadlocks.\n\nAn easy fix is to wake up sleepers before processing the driver\ndisconnect callbacks but right after setting the card->shutdown flag.\nThen all sleepers will abort immediately, and the code flows again.\n\nSo, basically this patch moves the wait_event() call at the right\ntiming.  While we're at it, just to be sure, call wait_event_all()\ninstead of wait_event(), although we don't use exclusive events on\nthis queue for now.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0bf3ba07-b32f-4a09-8660-8df5b2b82b5c",  "id": "CVE-2022-48174",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48174"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "844e77ec-53c8-42c4-a093-2ddd09f6bbf1",  "id": "AZL-6346",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.2,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "978055c2-826c-4c25-9a17-caf2addda8f4",  "id": "CVE-2024-26764",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio\n\nIf kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the\nfollowing kernel warning appears:\n\nWARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocb_set_cancel_fn+0x9c/0xa8\nCall trace:\n kiocb_set_cancel_fn+0x9c/0xa8\n ffs_epfile_read_iter+0x144/0x1d0\n io_read+0x19c/0x498\n io_issue_sqe+0x118/0x27c\n io_submit_sqes+0x25c/0x5fc\n __arm64_sys_io_uring_enter+0x104/0xab0\n invoke_syscall+0x58/0x11c\n el0_svc_common+0xb4/0xf4\n do_el0_svc+0x2c/0xb0\n el0_svc+0x2c/0xa4\n el0t_64_sync_handler+0x68/0xb4\n el0t_64_sync+0x1a4/0x1a8\n\nFix this by setting the IOCB_AIO_RW flag for read and write I/O that is\nsubmitted by libaio.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a85c2d36-7376-4ea0-b969-348b3491fc3d",  "id": "CVE-2020-10768",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10768"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    440  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed6c8e37-e842-4889-b30d-cdd31faad3d7",  "id": "CVE-2022-49611",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/speculation: Fill RSB on vmexit for IBRS\n\nPrevent RSB underflow/poisoning attacks with RSB.  While at it, add a\nbunch of comments to attempt to document the current state of tribal\nknowledge about RSB attacks and what exactly is being mitigated.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8128ed4e-94ad-4f6e-aa59-aa7c2865130d",  "id": "CVE-2024-49959",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error\n\nIn __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail()\nto recover some journal space. But if an error occurs while executing\njbd2_cleanup_journal_tail() (e.g., an EIO), we don't stop waiting for free\nspace right away, we try other branches, and if j_committing_transaction\nis NULL (i.e., the tid is 0), we will get the following complain:\n\n============================================\nJBD2: I/O error when updating journal superblock for sdd-8.\n__jbd2_log_wait_for_space: needed 256 blocks and only had 217 space available\n__jbd2_log_wait_for_space: no way to get more journal space in sdd-8\n------------[ cut here ]------------\nWARNING: CPU: 2 PID: 139804 at fs/jbd2/checkpoint.c:109 __jbd2_log_wait_for_space+0x251/0x2e0\nModules linked in:\nCPU: 2 PID: 139804 Comm: kworker/u8:3 Not tainted 6.6.0+ #1\nRIP: 0010:__jbd2_log_wait_for_space+0x251/0x2e0\nCall Trace:\n <TASK>\n add_transaction_credits+0x5d1/0x5e0\n start_this_handle+0x1ef/0x6a0\n jbd2__journal_start+0x18b/0x340\n ext4_dirty_inode+0x5d/0xb0\n __mark_inode_dirty+0xe4/0x5d0\n generic_update_time+0x60/0x70\n[...]\n============================================\n\nSo only if jbd2_cleanup_journal_tail() returns 1, i.e., there is nothing to\nclean up at the moment, continue to try to reclaim free space in other ways.\n\nNote that this fix relies on commit 6f6a6fda2945 (\"jbd2: fix ocfs2 corrupt\nwhen updating journal superblock fails\") to make jbd2_cleanup_journal_tail\nreturn the correct error code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ab111fa4-c471-41fe-9742-39ea909e8599",  "id": "CVE-2015-4170",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4170"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service (ldsem_down_read and ldsem_down_write deadlock) by establishing a new tty thread during shutdown of a previous tty thread.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8d6f47a9-9f2b-46db-84d6-099afbfa9bd4",  "id": "CVE-2022-50373",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: dlm: fix race in lowcomms\n\nThis patch fixes a race between queue_work() in\n_dlm_lowcomms_commit_msg() and srcu_read_unlock(). The queue_work() can\ntake the final reference of a dlm_msg and so msg->idx can contain\ngarbage which is signaled by the following warning:\n\n[  676.237050] ------------[ cut here ]------------\n[  676.237052] WARNING: CPU: 0 PID: 1060 at include/linux/srcu.h:189 dlm_lowcomms_commit_msg+0x41/0x50\n[  676.238945] Modules linked in: dlm_locktorture torture rpcsec_gss_krb5 intel_rapl_msr intel_rapl_common iTCO_wdt iTCO_vendor_support qxl kvm_intel drm_ttm_helper vmw_vsock_virtio_transport kvm vmw_vsock_virtio_transport_common ttm irqbypass crc32_pclmul joydev crc32c_intel serio_raw drm_kms_helper vsock virtio_scsi virtio_console virtio_balloon snd_pcm drm syscopyarea sysfillrect sysimgblt snd_timer fb_sys_fops i2c_i801 lpc_ich snd i2c_smbus soundcore pcspkr\n[  676.244227] CPU: 0 PID: 1060 Comm: lock_torture_wr Not tainted 5.19.0-rc3+ #1546\n[  676.245216] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-2.module+el8.7.0+15506+033991b0 04/01/2014\n[  676.246460] RIP: 0010:dlm_lowcomms_commit_msg+0x41/0x50\n[  676.247132] Code: fe ff ff ff 75 24 48 c7 c6 bd 0f 49 bb 48 c7 c7 38 7c 01 bd e8 00 e7 ca ff 89 de 48 c7 c7 60 78 01 bd e8 42 3d cd ff 5b 5d c3 <0f> 0b eb d8 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48\n[  676.249253] RSP: 0018:ffffa401c18ffc68 EFLAGS: 00010282\n[  676.249855] RAX: 0000000000000001 RBX: 00000000ffff8b76 RCX: 0000000000000006\n[  676.250713] RDX: 0000000000000000 RSI: ffffffffbccf3a10 RDI: ffffffffbcc7b62e\n[  676.251610] RBP: ffffa401c18ffc70 R08: 0000000000000001 R09: 0000000000000001\n[  676.252481] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000005\n[  676.253421] R13: ffff8b76786ec370 R14: ffff8b76786ec370 R15: ffff8b76786ec480\n[  676.254257] FS:  0000000000000000(0000) GS:ffff8b7777800000(0000) knlGS:0000000000000000\n[  676.255239] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  676.255897] CR2: 00005590205d88b8 CR3: 000000017656c003 CR4: 0000000000770ee0\n[  676.256734] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  676.257567] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  676.258397] PKRU: 55555554\n[  676.258729] Call Trace:\n[  676.259063]  <TASK>\n[  676.259354]  dlm_midcomms_commit_mhandle+0xcc/0x110\n[  676.259964]  queue_bast+0x8b/0xb0\n[  676.260423]  grant_pending_locks+0x166/0x1b0\n[  676.261007]  _unlock_lock+0x75/0x90\n[  676.261469]  unlock_lock.isra.57+0x62/0xa0\n[  676.262009]  dlm_unlock+0x21e/0x330\n[  676.262457]  ? lock_torture_stats+0x80/0x80 [dlm_locktorture]\n[  676.263183]  torture_unlock+0x5a/0x90 [dlm_locktorture]\n[  676.263815]  ? preempt_count_sub+0xba/0x100\n[  676.264361]  ? complete+0x1d/0x60\n[  676.264777]  lock_torture_writer+0xb8/0x150 [dlm_locktorture]\n[  676.265555]  kthread+0x10a/0x130\n[  676.266007]  ? kthread_complete_and_exit+0x20/0x20\n[  676.266616]  ret_from_fork+0x22/0x30\n[  676.267097]  </TASK>\n[  676.267381] irq event stamp: 9579855\n[  676.267824] hardirqs last  enabled at (9579863): [<ffffffffbb14e6f8>] __up_console_sem+0x58/0x60\n[  676.268896] hardirqs last disabled at (9579872): [<ffffffffbb14e6dd>] __up_console_sem+0x3d/0x60\n[  676.270008] softirqs last  enabled at (9579798): [<ffffffffbc200349>] __do_softirq+0x349/0x4c7\n[  676.271438] softirqs last disabled at (9579897): [<ffffffffbb0d54c0>] irq_exit_rcu+0xb0/0xf0\n[  676.272796] ---[ end trace 0000000000000000 ]---\n\nI reproduced this warning with dlm_locktorture test which is currently\nnot upstream. However this patch fix the issue by make a additional\nrefcount between dlm_lowcomms_new_msg() and dlm_lowcomms_commit_msg().\nIn case of the race the kref_put() in dlm_lowcomms_commit_msg() will be\nthe final put.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c49da86c-98be-439d-b442-e1b1eb26c54b",  "id": "CVE-2023-53417",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: sl811: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "25d61eb0-69ff-46d1-93ac-eeb2c74a3f47",  "id": "CVE-2024-57976",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    459  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do proper folio cleanup when cow_file_range() failed\n\n[BUG]\nWhen testing with COW fixup marked as BUG_ON() (this is involved with the\nnew pin_user_pages*() change, which should not result new out-of-band\ndirty pages), I hit a crash triggered by the BUG_ON() from hitting COW\nfixup path.\n\nThis BUG_ON() happens just after a failed btrfs_run_delalloc_range():\n\n  BTRFS error (device dm-2): failed to run delalloc range, root 348 ino 405 folio 65536 submit_bitmap 6-15 start 90112 len 106496: -28\n  ------------[ cut here ]------------\n  kernel BUG at fs/btrfs/extent_io.c:1444!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n  CPU: 0 UID: 0 PID: 434621 Comm: kworker/u24:8 Tainted: G           OE      6.12.0-rc7-custom+ #86\n  Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022\n  Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]\n  pc : extent_writepage_io+0x2d4/0x308 [btrfs]\n  lr : extent_writepage_io+0x2d4/0x308 [btrfs]\n  Call trace:\n   extent_writepage_io+0x2d4/0x308 [btrfs]\n   extent_writepage+0x218/0x330 [btrfs]\n   extent_write_cache_pages+0x1d4/0x4b0 [btrfs]\n   btrfs_writepages+0x94/0x150 [btrfs]\n   do_writepages+0x74/0x190\n   filemap_fdatawrite_wbc+0x88/0xc8\n   start_delalloc_inodes+0x180/0x3b0 [btrfs]\n   btrfs_start_delalloc_roots+0x174/0x280 [btrfs]\n   shrink_delalloc+0x114/0x280 [btrfs]\n   flush_space+0x250/0x2f8 [btrfs]\n   btrfs_async_reclaim_data_space+0x180/0x228 [btrfs]\n   process_one_work+0x164/0x408\n   worker_thread+0x25c/0x388\n   kthread+0x100/0x118\n   ret_from_fork+0x10/0x20\n  Code: aa1403e1 9402f3ef aa1403e0 9402f36f (d4210000)\n  ---[ end trace 0000000000000000 ]---\n\n[CAUSE]\nThat failure is mostly from cow_file_range(), where we can hit -ENOSPC.\n\nAlthough the -ENOSPC is already a bug related to our space reservation\ncode, let's just focus on the error handling.\n\nFor example, we have the following dirty range [0, 64K) of an inode,\nwith 4K sector size and 4K page size:\n\n   0        16K        32K       48K       64K\n   |///////////////////////////////////////|\n   |#######################################|\n\nWhere |///| means page are still dirty, and |###| means the extent io\ntree has EXTENT_DELALLOC flag.\n\n- Enter extent_writepage() for page 0\n\n- Enter btrfs_run_delalloc_range() for range [0, 64K)\n\n- Enter cow_file_range() for range [0, 64K)\n\n- Function btrfs_reserve_extent() only reserved one 16K extent\n  So we created extent map and ordered extent for range [0, 16K)\n\n   0        16K        32K       48K       64K\n   |////////|//////////////////////////////|\n   |<- OE ->|##############################|\n\n   And range [0, 16K) has its delalloc flag cleared.\n   But since we haven't yet submit any bio, involved 4 pages are still\n   dirty.\n\n- Function btrfs_reserve_extent() returns with -ENOSPC\n  Now we have to run error cleanup, which will clear all\n  EXTENT_DELALLOC* flags and clear the dirty flags for the remaining\n  ranges:\n\n   0        16K        32K       48K       64K\n   |////////|                              |\n   |        |                              |\n\n  Note that range [0, 16K) still has its pages dirty.\n\n- Some time later, writeback is triggered again for the range [0, 16K)\n  since the page range still has dirty flags.\n\n- btrfs_run_delalloc_range() will do nothing because there is no\n  EXTENT_DELALLOC flag.\n\n- extent_writepage_io() finds page 0 has no ordered flag\n  Which falls into the COW fixup path, triggering the BUG_ON().\n\nUnfortunately this error handling bug dates back to the introduction of\nbtrfs.  Thankfully with the abuse of COW fixup, at least it won't crash\nthe kernel.\n\n[FIX]\nInstead of immediately unlocking the extent and folios, we keep the extent\nand folios locked until either erroring out or the whole delalloc range\nfinished.\n\nWhen the whole delalloc range finished without error, we just unlock the\nwhole range with PAGE_SET_ORDERED (and PAGE_UNLOCK for !keep_locked\ncases)\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95fdfa60-33e9-4726-a438-87cc0ac918e1",  "id": "ALSA-2023:3722",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "411836d5-7db5-41b7-8282-affe69696b56",  "id": "CVE-2022-48920",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: get rid of warning on transaction commit when using flushoncommit\n\nWhen using the flushoncommit mount option, during almost every transaction\ncommit we trigger a warning from __writeback_inodes_sb_nr():\n\n  $ cat fs/fs-writeback.c:\n  (...)\n  static void __writeback_inodes_sb_nr(struct super_block *sb, ...\n  {\n        (...)\n        WARN_ON(!rwsem_is_locked(&sb->s_umount));\n        (...)\n  }\n  (...)\n\nThe trace produced in dmesg looks like the following:\n\n  [947.473890] WARNING: CPU: 5 PID: 930 at fs/fs-writeback.c:2610 __writeback_inodes_sb_nr+0x7e/0xb3\n  [947.481623] Modules linked in: nfsd nls_cp437 cifs asn1_decoder cifs_arc4 fscache cifs_md4 ipmi_ssif\n  [947.489571] CPU: 5 PID: 930 Comm: btrfs-transacti Not tainted 95.16.3-srb-asrock-00001-g36437ad63879 #186\n  [947.497969] RIP: 0010:__writeback_inodes_sb_nr+0x7e/0xb3\n  [947.502097] Code: 24 10 4c 89 44 24 18 c6 (...)\n  [947.519760] RSP: 0018:ffffc90000777e10 EFLAGS: 00010246\n  [947.523818] RAX: 0000000000000000 RBX: 0000000000963300 RCX: 0000000000000000\n  [947.529765] RDX: 0000000000000000 RSI: 000000000000fa51 RDI: ffffc90000777e50\n  [947.535740] RBP: ffff888101628a90 R08: ffff888100955800 R09: ffff888100956000\n  [947.541701] R10: 0000000000000002 R11: 0000000000000001 R12: ffff888100963488\n  [947.547645] R13: ffff888100963000 R14: ffff888112fb7200 R15: ffff888100963460\n  [947.553621] FS:  0000000000000000(0000) GS:ffff88841fd40000(0000) knlGS:0000000000000000\n  [947.560537] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [947.565122] CR2: 0000000008be50c4 CR3: 000000000220c000 CR4: 00000000001006e0\n  [947.571072] Call Trace:\n  [947.572354]  <TASK>\n  [947.573266]  btrfs_commit_transaction+0x1f1/0x998\n  [947.576785]  ? start_transaction+0x3ab/0x44e\n  [947.579867]  ? schedule_timeout+0x8a/0xdd\n  [947.582716]  transaction_kthread+0xe9/0x156\n  [947.585721]  ? btrfs_cleanup_transaction.isra.0+0x407/0x407\n  [947.590104]  kthread+0x131/0x139\n  [947.592168]  ? set_kthread_struct+0x32/0x32\n  [947.595174]  ret_from_fork+0x22/0x30\n  [947.597561]  </TASK>\n  [947.598553] ---[ end trace 644721052755541c ]---\n\nThis is because we started using writeback_inodes_sb() to flush delalloc\nwhen committing a transaction (when using -o flushoncommit), in order to\navoid deadlocks with filesystem freeze operations. This change was made\nby commit ce8ea7cc6eb313 (\"btrfs: don't call btrfs_start_delalloc_roots\nin flushoncommit\"). After that change we started producing that warning,\nand every now and then a user reports this since the warning happens too\noften, it spams dmesg/syslog, and a user is unsure if this reflects any\nproblem that might compromise the filesystem's reliability.\n\nWe can not just lock the sb->s_umount semaphore before calling\nwriteback_inodes_sb(), because that would at least deadlock with\nfilesystem freezing, since at fs/super.c:freeze_super() sync_filesystem()\nis called while we are holding that semaphore in write mode, and that can\ntrigger a transaction commit, resulting in a deadlock. It would also\ntrigger the same type of deadlock in the unmount path. Possibly, it could\nalso introduce some other locking dependencies that lockdep would report.\n\nTo fix this call try_to_writeback_inodes_sb() instead of\nwriteback_inodes_sb(), because that will try to read lock sb->s_umount\nand then will only call writeback_inodes_sb() if it was able to lock it.\nThis is fine because the cases where it can't read lock sb->s_umount\nare during a filesystem unmount or during a filesystem freeze - in those\ncases sb->s_umount is write locked and sync_filesystem() is called, which\ncalls writeback_inodes_sb(). In other words, in all cases where we can't\ntake a read lock on sb->s_umount, writeback is already being triggered\nelsewhere.\n\nAn alternative would be to call btrfs_start_delalloc_roots() with a\nnumber of pages different from LONG_MAX, for example matching the number\nof delalloc bytes we currently have, in \n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e50ee521-3c7f-45c0-9063-2aa4a7b694ea",  "id": "CVE-2018-10675",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10675"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c72b51c8-1e03-47bd-95cb-eb20eb3ef89c",  "id": "CVE-2011-2497",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2497"  },  "ratings": [    {      "score": 8.300000000000001,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer underflow in the l2cap_config_req function in net/bluetooth/l2cap_core.c in the Linux kernel before 3.0 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a small command-size value within the command header of a Logical Link Control and Adaptation Protocol (L2CAP) configuration request, leading to a buffer overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "25054944-6c97-44e8-81b4-d4afc519e889",  "id": "CVE-2024-43907",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules\n\nCheck the pointer value to fix potential null pointer\ndereference",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "015a0d63-87c5-404d-96b2-23a22ecc9523",  "id": "SUSE-SU-2016:1057-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8fae7864-b3a8-4a3d-9d9c-4189c37abfe5",  "id": "OESA-2026-1310",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4b7cbd0c-b37d-4103-818f-0a03a03b9b30",  "id": "CVE-2024-38589",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetrom: fix possible dead-lock in nr_rt_ioctl()\n\nsyzbot loves netrom, and found a possible deadlock in nr_rt_ioctl [1]\n\nMake sure we always acquire nr_node_list_lock before nr_node_lock(nr_node)\n\n[1]\nWARNING: possible circular locking dependency detected\n6.9.0-rc7-syzkaller-02147-g654de42f3fc6 #0 Not tainted\n------------------------------------------------------\nsyz-executor350/5129 is trying to acquire lock:\n ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]\n ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: nr_node_lock include/net/netrom.h:152 [inline]\n ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:464 [inline]\n ffff8880186e2070 (&nr_node->node_lock){+...}-{2:2}, at: nr_rt_ioctl+0x1bb/0x1090 net/netrom/nr_route.c:697\n\nbut task is already holding lock:\n ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]\n ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:462 [inline]\n ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_rt_ioctl+0x10a/0x1090 net/netrom/nr_route.c:697\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-> #1 (nr_node_list_lock){+...}-{2:2}:\n        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754\n        __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]\n        _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178\n        spin_lock_bh include/linux/spinlock.h:356 [inline]\n        nr_remove_node net/netrom/nr_route.c:299 [inline]\n        nr_del_node+0x4b4/0x820 net/netrom/nr_route.c:355\n        nr_rt_ioctl+0xa95/0x1090 net/netrom/nr_route.c:683\n        sock_do_ioctl+0x158/0x460 net/socket.c:1222\n        sock_ioctl+0x629/0x8e0 net/socket.c:1341\n        vfs_ioctl fs/ioctl.c:51 [inline]\n        __do_sys_ioctl fs/ioctl.c:904 [inline]\n        __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890\n        do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n        do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n       entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n-> #0 (&nr_node->node_lock){+...}-{2:2}:\n        check_prev_add kernel/locking/lockdep.c:3134 [inline]\n        check_prevs_add kernel/locking/lockdep.c:3253 [inline]\n        validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869\n        __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137\n        lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754\n        __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]\n        _raw_spin_lock_bh+0x35/0x50 kernel/locking/spinlock.c:178\n        spin_lock_bh include/linux/spinlock.h:356 [inline]\n        nr_node_lock include/net/netrom.h:152 [inline]\n        nr_dec_obs net/netrom/nr_route.c:464 [inline]\n        nr_rt_ioctl+0x1bb/0x1090 net/netrom/nr_route.c:697\n        sock_do_ioctl+0x158/0x460 net/socket.c:1222\n        sock_ioctl+0x629/0x8e0 net/socket.c:1341\n        vfs_ioctl fs/ioctl.c:51 [inline]\n        __do_sys_ioctl fs/ioctl.c:904 [inline]\n        __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890\n        do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n        do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n       entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nother info that might help us debug this:\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(nr_node_list_lock);\n                               lock(&nr_node->node_lock);\n                               lock(nr_node_list_lock);\n  lock(&nr_node->node_lock);\n\n *** DEADLOCK ***\n\n1 lock held by syz-executor350/5129:\n  #0: ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]\n  #0: ffffffff8f7053b8 (nr_node_list_lock){+...}-{2:2}, at: nr_dec_obs net/netrom/nr_route.c:462 [inline]\n  #0: ffffffff8f70\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "277d9872-77a2-4c1a-9143-2f4ad7ad3589",  "id": "CVE-2026-53238",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlabel: validate unlabeled address and mask attribute lengths\n\nnetlbl_unlabel_addrinfo_get() used the address attribute length to\ndetermine whether the attribute data could be read as an IPv4 or IPv6\naddress, but did not independently validate the corresponding mask\nattribute length.  A crafted Generic Netlink request could therefore\nprovide a valid IPv4/IPv6 address attribute with a shorter mask\nattribute, which would later be read as a full struct in_addr or\nstruct in6_addr.\n\nNLA_BINARY policy lengths are maximum lengths by default, so use\nNLA_POLICY_EXACT_LEN() for the unlabeled IPv4/IPv6 address and mask\nattributes.  This rejects short attributes during policy validation and\nalso exposes the exact length requirements through policy introspection.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e5d526db-1ede-43f9-a69e-1933bb3b653e",  "id": "CVE-2021-38203",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38203"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "btrfs in the Linux kernel before 5.13.4 allows attackers to cause a denial of service (deadlock) via processes that trigger allocation of new system chunks during times when there is a shortage of free space in the system space_info.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb447e52-22f0-4b11-80e9-9c3a056a4846",  "id": "CVE-2026-23099",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: limit BOND_MODE_8023AD to Ethernet devices\n\nBOND_MODE_8023AD makes sense for ARPHRD_ETHER only.\n\nsyzbot reported:\n\n BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr_lists.c:63 [inline]\n BUG: KASAN: global-out-of-bounds in __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118\nRead of size 16 at addr ffffffff8bf94040 by task syz.1.3580/19497\n\nCPU: 1 UID: 0 PID: 19497 Comm: syz.1.3580 Tainted: G             L      syzkaller #0 PREEMPT(full)\nTainted: [L]=SOFTLOCKUP\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nCall Trace:\n <TASK>\n  dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120\n  print_address_description mm/kasan/report.c:378 [inline]\n  print_report+0xca/0x240 mm/kasan/report.c:482\n  kasan_report+0x118/0x150 mm/kasan/report.c:595\n check_region_inline mm/kasan/generic.c:-1 [inline]\n  kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:200\n  __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105\n  __hw_addr_create net/core/dev_addr_lists.c:63 [inline]\n  __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118\n  __dev_mc_add net/core/dev_addr_lists.c:868 [inline]\n  dev_mc_add+0xa1/0x120 net/core/dev_addr_lists.c:886\n  bond_enslave+0x2b8b/0x3ac0 drivers/net/bonding/bond_main.c:2180\n  do_set_master+0x533/0x6d0 net/core/rtnetlink.c:2963\n  do_setlink+0xcf0/0x41c0 net/core/rtnetlink.c:3165\n  rtnl_changelink net/core/rtnetlink.c:3776 [inline]\n  __rtnl_newlink net/core/rtnetlink.c:3935 [inline]\n  rtnl_newlink+0x161c/0x1c90 net/core/rtnetlink.c:4072\n  rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6958\n  netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550\n  netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n  netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344\n  netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894\n  sock_sendmsg_nosec net/socket.c:727 [inline]\n  __sock_sendmsg+0x21c/0x270 net/socket.c:742\n  ____sys_sendmsg+0x505/0x820 net/socket.c:2592\n  ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646\n  __sys_sendmsg+0x164/0x220 net/socket.c:2678\n  do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]\n  __do_fast_syscall_32+0x1dc/0x560 arch/x86/entry/syscall_32.c:307\n  do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332\n entry_SYSENTER_compat_after_hwframe+0x84/0x8e\n </TASK>\n\nThe buggy address belongs to the variable:\n lacpdu_mcast_addr+0x0/0x40",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99c13a3c-a1ab-47f2-82d1-46d46cb75462",  "id": "MGASA-2023-0195",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69c7e137-2d23-4211-b158-6ddb6caf047c",  "id": "CVE-2022-3424",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3424"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "894c21cf-952b-420e-8b49-09cc0ba4a896",  "id": "CVE-2013-2888",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2888"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "043b6064-efd6-441a-bd87-b0864e810d6f",  "id": "MGASA-2013-0358",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "39cb4311-9af2-4b15-b164-016bc825a7f9",  "id": "CVE-2021-27365",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27365"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4ab25aec-36b0-46e2-abc0-ee64f4ce58f1",  "id": "CVE-2025-37923",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix oob write in trace_seq_to_buffer()\n\nsyzbot reported this bug:\n==================================================================\nBUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]\nBUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822\nWrite of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260\n\nCPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0xc3/0x670 mm/kasan/report.c:521\n kasan_report+0xe0/0x110 mm/kasan/report.c:634\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189\n __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106\n trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]\n tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822\n ....\n==================================================================\n\nIt has been reported that trace_seq_to_buffer() tries to copy more data\nthan PAGE_SIZE to buf. Therefore, to prevent this, we should use the\nsmaller of trace_seq_used(&iter->seq) and PAGE_SIZE as an argument.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eaaa5d6a-27d8-42ee-9827-a3125a0857db",  "id": "AZL-25660",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e743d009-2443-45c4-9e76-74d7f51a2cde",  "id": "CVE-2023-52737",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: lock the inode in shared mode before starting fiemap\n\nCurrently fiemap does not take the inode's lock (VFS lock), it only locks\na file range in the inode's io tree. This however can lead to a deadlock\nif we have a concurrent fsync on the file and fiemap code triggers a fault\nwhen accessing the user space buffer with fiemap_fill_next_extent(). The\ndeadlock happens on the inode's i_mmap_lock semaphore, which is taken both\nby fsync and btrfs_page_mkwrite(). This deadlock was recently reported by\nsyzbot and triggers a trace like the following:\n\n   task:syz-executor361 state:D stack:20264 pid:5668  ppid:5119   flags:0x00004004\n   Call Trace:\n    <TASK>\n    context_switch kernel/sched/core.c:5293 [inline]\n    __schedule+0x995/0xe20 kernel/sched/core.c:6606\n    schedule+0xcb/0x190 kernel/sched/core.c:6682\n    wait_on_state fs/btrfs/extent-io-tree.c:707 [inline]\n    wait_extent_bit+0x577/0x6f0 fs/btrfs/extent-io-tree.c:751\n    lock_extent+0x1c2/0x280 fs/btrfs/extent-io-tree.c:1742\n    find_lock_delalloc_range+0x4e6/0x9c0 fs/btrfs/extent_io.c:488\n    writepage_delalloc+0x1ef/0x540 fs/btrfs/extent_io.c:1863\n    __extent_writepage+0x736/0x14e0 fs/btrfs/extent_io.c:2174\n    extent_write_cache_pages+0x983/0x1220 fs/btrfs/extent_io.c:3091\n    extent_writepages+0x219/0x540 fs/btrfs/extent_io.c:3211\n    do_writepages+0x3c3/0x680 mm/page-writeback.c:2581\n    filemap_fdatawrite_wbc+0x11e/0x170 mm/filemap.c:388\n    __filemap_fdatawrite_range mm/filemap.c:421 [inline]\n    filemap_fdatawrite_range+0x175/0x200 mm/filemap.c:439\n    btrfs_fdatawrite_range fs/btrfs/file.c:3850 [inline]\n    start_ordered_ops fs/btrfs/file.c:1737 [inline]\n    btrfs_sync_file+0x4ff/0x1190 fs/btrfs/file.c:1839\n    generic_write_sync include/linux/fs.h:2885 [inline]\n    btrfs_do_write_iter+0xcd3/0x1280 fs/btrfs/file.c:1684\n    call_write_iter include/linux/fs.h:2189 [inline]\n    new_sync_write fs/read_write.c:491 [inline]\n    vfs_write+0x7dc/0xc50 fs/read_write.c:584\n    ksys_write+0x177/0x2a0 fs/read_write.c:637\n    do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n    do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n    entry_SYSCALL_64_after_hwframe+0x63/0xcd\n   RIP: 0033:0x7f7d4054e9b9\n   RSP: 002b:00007f7d404fa2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n   RAX: ffffffffffffffda RBX: 00007f7d405d87a0 RCX: 00007f7d4054e9b9\n   RDX: 0000000000000090 RSI: 0000000020000000 RDI: 0000000000000006\n   RBP: 00007f7d405a51d0 R08: 0000000000000000 R09: 0000000000000000\n   R10: 0000000000000000 R11: 0000000000000246 R12: 61635f65646f6e69\n   R13: 65646f7475616f6e R14: 7261637369646f6e R15: 00007f7d405d87a8\n    </TASK>\n   INFO: task syz-executor361:5697 blocked for more than 145 seconds.\n         Not tainted 6.2.0-rc3-syzkaller-00376-g7c6984405241 #0\n   \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n   task:syz-executor361 state:D stack:21216 pid:5697  ppid:5119   flags:0x00004004\n   Call Trace:\n    <TASK>\n    context_switch kernel/sched/core.c:5293 [inline]\n    __schedule+0x995/0xe20 kernel/sched/core.c:6606\n    schedule+0xcb/0x190 kernel/sched/core.c:6682\n    rwsem_down_read_slowpath+0x5f9/0x930 kernel/locking/rwsem.c:1095\n    __down_read_common+0x54/0x2a0 kernel/locking/rwsem.c:1260\n    btrfs_page_mkwrite+0x417/0xc80 fs/btrfs/inode.c:8526\n    do_page_mkwrite+0x19e/0x5e0 mm/memory.c:2947\n    wp_page_shared+0x15e/0x380 mm/memory.c:3295\n    handle_pte_fault mm/memory.c:4949 [inline]\n    __handle_mm_fault mm/memory.c:5073 [inline]\n    handle_mm_fault+0x1b79/0x26b0 mm/memory.c:5219\n    do_user_addr_fault+0x69b/0xcb0 arch/x86/mm/fault.c:1428\n    handle_page_fault arch/x86/mm/fault.c:1519 [inline]\n    exc_page_fault+0x7a/0x110 arch/x86/mm/fault.c:1575\n    asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570\n   RIP: 0010:copy_user_short_string+0xd/0x40 arch/x86/lib/copy_user_64.S:233\n   Code: 74 0a 89 (...)\n   RSP: 0018:ffffc9000570f330 EFLAGS: 000502\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d347511d-d224-4bb8-9eb7-bb4a9195f3ca",  "id": "CVE-2024-50010",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: don't WARN for racy path_noexec check\n\nBoth i_mode and noexec checks wrapped in WARN_ON stem from an artifact\nof the previous implementation. They used to legitimately check for the\ncondition, but that got moved up in two commits:\n633fb6ac3980 (\"exec: move S_ISREG() check earlier\")\n0fd338b2d2cd (\"exec: move path_noexec() check earlier\")\n\nInstead of being removed said checks are WARN_ON'ed instead, which\nhas some debug value.\n\nHowever, the spurious path_noexec check is racy, resulting in\nunwarranted warnings should someone race with setting the noexec flag.\n\nOne can note there is more to perm-checking whether execve is allowed\nand none of the conditions are guaranteed to still hold after they were\ntested for.\n\nAdditionally this does not validate whether the code path did any perm\nchecking to begin with -- it will pass if the inode happens to be\nregular.\n\nKeep the redundant path_noexec() check even though it's mindless\nnonsense checking for guarantee that isn't given so drop the WARN.\n\nReword the commentary and do small tidy ups while here.\n\n[brauner: keep redundant path_noexec() check]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84552268-a97d-40fa-b281-f96bc4f10a72",  "id": "CVE-2025-37883",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/sclp: Add check for get_zeroed_page()\n\nAdd check for the return value of get_zeroed_page() in\nsclp_console_init() to prevent null pointer dereference.\nFurthermore, to solve the memory leak caused by the loop\nallocation, add a free helper to do the free job.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a9f538e4-6a0c-4a87-80e9-addf57613f65",  "id": "CVE-2024-39483",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked\n\nWhen requesting an NMI window, WARN on vNMI support being enabled if and\nonly if NMIs are actually masked, i.e. if the vCPU is already handling an\nNMI.  KVM's ABI for NMIs that arrive simultanesouly (from KVM's point of\nview) is to inject one NMI and pend the other.  When using vNMI, KVM pends\nthe second NMI simply by setting V_NMI_PENDING, and lets the CPU do the\nrest (hardware automatically sets V_NMI_BLOCKING when an NMI is injected).\n\nHowever, if KVM can't immediately inject an NMI, e.g. because the vCPU is\nin an STI shadow or is running with GIF=0, then KVM will request an NMI\nwindow and trigger the WARN (but still function correctly).\n\nWhether or not the GIF=0 case makes sense is debatable, as the intent of\nKVM's behavior is to provide functionality that is as close to real\nhardware as possible.  E.g. if two NMIs are sent in quick succession, the\nprobability of both NMIs arriving in an STI shadow is infinitesimally low\non real hardware, but significantly larger in a virtual environment, e.g.\nif the vCPU is preempted in the STI shadow.  For GIF=0, the argument isn't\nas clear cut, because the window where two NMIs can collide is much larger\nin bare metal (though still small).\n\nThat said, KVM should not have divergent behavior for the GIF=0 case based\non whether or not vNMI support is enabled.  And KVM has allowed\nsimultaneous NMIs with GIF=0 for over a decade, since commit 7460fb4a3400\n(\"KVM: Fix simultaneous NMIs\").  I.e. KVM's GIF=0 handling shouldn't be\nmodified without a *really* good reason to do so, and if KVM's behavior\nwere to be modified, it should be done irrespective of vNMI support.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e431021-e74a-49e7-9f24-f212c808ba3a",  "id": "RHBA-2017:1929",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84c34648-75eb-4d24-87c7-43cc1ca7972f",  "id": "CVE-2018-7754",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7754"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    532  ],  "analysis": {    "state": "in_triage"  },  "description": "The aoedisk_debugfs_show function in drivers/block/aoe/aoeblk.c in the Linux kernel through 4.16.4rc4 allows local users to obtain sensitive address information by reading \"ffree: \" lines in a debugfs file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a8f2167-c5d6-4eef-8796-f999876d0937",  "id": "CVE-2017-9211",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9211"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The crypto_skcipher_init_tfm function in crypto/skcipher.c in the Linux kernel through 4.11.2 relies on a setkey function that lacks a key-size check, which allows local users to cause a denial of service (NULL pointer dereference) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b3b9b433-e41f-4160-b5d3-63b6aaa10642",  "id": "CVE-2022-50099",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: arkfb: Check the size of screen before memset_io()\n\nIn the function arkfb_set_par(), the value of 'screen_size' is\ncalculated by the user input. If the user provides the improper value,\nthe value of 'screen_size' may larger than 'info->screen_size', which\nmay cause the following bug:\n\n[  659.399066] BUG: unable to handle page fault for address: ffffc90003000000\n[  659.399077] #PF: supervisor write access in kernel mode\n[  659.399079] #PF: error_code(0x0002) - not-present page\n[  659.399094] RIP: 0010:memset_orig+0x33/0xb0\n[  659.399116] Call Trace:\n[  659.399122]  arkfb_set_par+0x143f/0x24c0\n[  659.399130]  fb_set_var+0x604/0xeb0\n[  659.399161]  do_fb_ioctl+0x234/0x670\n[  659.399189]  fb_ioctl+0xdd/0x130\n\nFix the this by checking the value of 'screen_size' before memset_io().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "274250e3-8a23-4e12-878a-f25889c6edf6",  "id": "CVE-2022-50101",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: vt8623fb: Check the size of screen before memset_io()\n\nIn the function vt8623fb_set_par(), the value of 'screen_size' is\ncalculated by the user input. If the user provides the improper value,\nthe value of 'screen_size' may larger than 'info->screen_size', which\nmay cause the following bug:\n\n[  583.339036] BUG: unable to handle page fault for address: ffffc90005000000\n[  583.339049] #PF: supervisor write access in kernel mode\n[  583.339052] #PF: error_code(0x0002) - not-present page\n[  583.339074] RIP: 0010:memset_orig+0x33/0xb0\n[  583.339110] Call Trace:\n[  583.339118]  vt8623fb_set_par+0x11cd/0x21e0\n[  583.339146]  fb_set_var+0x604/0xeb0\n[  583.339181]  do_fb_ioctl+0x234/0x670\n[  583.339209]  fb_ioctl+0xdd/0x130\n\nFix the this by checking the value of 'screen_size' before memset_io().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "60c36dc0-5372-4e50-adca-193d223af0b9",  "id": "OESA-2023-1355",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d6ea7a9-6050-4290-8f07-0698da181052",  "id": "CLSA-2026-1778072039",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db1c59de-99fa-46a9-9b38-2a4d42c84ced",  "id": "CVE-2024-50245",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix possible deadlock in mi_read\n\nMutex lock with another subclass used in ni_lock_dir().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f4f5c049-abfd-4717-84ad-2da96aa4d5f5",  "id": "CVE-2023-52699",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsysv: don't call sb_bread() with pointers_lock held\n\nsyzbot is reporting sleep in atomic context in SysV filesystem [1], for\nsb_bread() is called with rw_spinlock held.\n\nA \"write_lock(&pointers_lock) => read_lock(&pointers_lock) deadlock\" bug\nand a \"sb_bread() with write_lock(&pointers_lock)\" bug were introduced by\n\"Replace BKL for chain locking with sysvfs-private rwlock\" in Linux 2.5.12.\n\nThen, \"[PATCH] err1-40: sysvfs locking fix\" in Linux 2.6.8 fixed the\nformer bug by moving pointers_lock lock to the callers, but instead\nintroduced a \"sb_bread() with read_lock(&pointers_lock)\" bug (which made\nthis problem easier to hit).\n\nAl Viro suggested that why not to do like get_branch()/get_block()/\nfind_shared() in Minix filesystem does. And doing like that is almost a\nrevert of \"[PATCH] err1-40: sysvfs locking fix\" except that get_branch()\n from with find_shared() is called without write_lock(&pointers_lock).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e06903f5-c74a-44a9-a351-975d8554dece",  "id": "CVE-2024-49914",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe\n\nThis commit addresses a null pointer dereference issue in the\n`dcn20_program_pipe` function. The issue could occur when\n`pipe_ctx->plane_state` is null.\n\nThe fix adds a check to ensure `pipe_ctx->plane_state` is not null\nbefore accessing. This prevents a null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c:1925 dcn20_program_pipe() error: we previously assumed 'pipe_ctx->plane_state' could be null (see line 1877)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4b0f1975-aa48-4b54-8aaa-593095fb3db0",  "id": "CVE-2013-7470",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7470"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "567ada4f-cbaa-40da-a26c-162a758c76e6",  "id": "CLSA-2024-1710786990",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "02f11af2-e554-4b07-a5b5-2928dd7d5f2e",  "id": "CLSA-2026-1777297012",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17b24541-8e92-4c4b-8b4a-9eb8708c1746",  "id": "CVE-2024-53177",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: prevent use-after-free due to open_cached_dir error paths\n\nIf open_cached_dir() encounters an error parsing the lease from the\nserver, the error handling may race with receiving a lease break,\nresulting in open_cached_dir() freeing the cfid while the queued work is\npending.\n\nUpdate open_cached_dir() to drop refs rather than directly freeing the\ncfid.\n\nHave cached_dir_lease_break(), cfids_laundromat_worker(), and\ninvalidate_all_cached_dirs() clear has_lease immediately while still\nholding cfids->cfid_list_lock, and then use this to also simplify the\nreference counting in cfids_laundromat_worker() and\ninvalidate_all_cached_dirs().\n\nFixes this KASAN splat (which manually injects an error and lease break\nin open_cached_dir()):\n\n==================================================================\nBUG: KASAN: slab-use-after-free in smb2_cached_lease_break+0x27/0xb0\nRead of size 8 at addr ffff88811cc24c10 by task kworker/3:1/65\n\nCPU: 3 UID: 0 PID: 65 Comm: kworker/3:1 Not tainted 6.12.0-rc6-g255cf264e6e5-dirty #87\nHardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\nWorkqueue: cifsiod smb2_cached_lease_break\nCall Trace:\n <TASK>\n dump_stack_lvl+0x77/0xb0\n print_report+0xce/0x660\n kasan_report+0xd3/0x110\n smb2_cached_lease_break+0x27/0xb0\n process_one_work+0x50a/0xc50\n worker_thread+0x2ba/0x530\n kthread+0x17c/0x1c0\n ret_from_fork+0x34/0x60\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nAllocated by task 2464:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n open_cached_dir+0xa7d/0x1fb0\n smb2_query_path_info+0x43c/0x6e0\n cifs_get_fattr+0x346/0xf10\n cifs_get_inode_info+0x157/0x210\n cifs_revalidate_dentry_attr+0x2d1/0x460\n cifs_getattr+0x173/0x470\n vfs_statx_path+0x10f/0x160\n vfs_statx+0xe9/0x150\n vfs_fstatat+0x5e/0xc0\n __do_sys_newfstatat+0x91/0xf0\n do_syscall_64+0x95/0x1a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 2464:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x51/0x70\n kfree+0x174/0x520\n open_cached_dir+0x97f/0x1fb0\n smb2_query_path_info+0x43c/0x6e0\n cifs_get_fattr+0x346/0xf10\n cifs_get_inode_info+0x157/0x210\n cifs_revalidate_dentry_attr+0x2d1/0x460\n cifs_getattr+0x173/0x470\n vfs_statx_path+0x10f/0x160\n vfs_statx+0xe9/0x150\n vfs_fstatat+0x5e/0xc0\n __do_sys_newfstatat+0x91/0xf0\n do_syscall_64+0x95/0x1a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nLast potentially related work creation:\n kasan_save_stack+0x33/0x60\n __kasan_record_aux_stack+0xad/0xc0\n insert_work+0x32/0x100\n __queue_work+0x5c9/0x870\n queue_work_on+0x82/0x90\n open_cached_dir+0x1369/0x1fb0\n smb2_query_path_info+0x43c/0x6e0\n cifs_get_fattr+0x346/0xf10\n cifs_get_inode_info+0x157/0x210\n cifs_revalidate_dentry_attr+0x2d1/0x460\n cifs_getattr+0x173/0x470\n vfs_statx_path+0x10f/0x160\n vfs_statx+0xe9/0x150\n vfs_fstatat+0x5e/0xc0\n __do_sys_newfstatat+0x91/0xf0\n do_syscall_64+0x95/0x1a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe buggy address belongs to the object at ffff88811cc24c00\n which belongs to the cache kmalloc-1k of size 1024\nThe buggy address is located 16 bytes inside of\n freed 1024-byte region [ffff88811cc24c00, ffff88811cc25000)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a6c10236-f888-4665-97bd-61baa0111f31",  "id": "CVE-2011-1767",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1767"  },  "ratings": [    {      "score": 5.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "net/ipv4/ip_gre.c in the Linux kernel before 2.6.34, when ip_gre is configured as a module, allows remote attackers to cause a denial of service (OOPS) by sending a packet during module loading.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be9a69f9-d88a-48cd-8581-051f1987de5d",  "id": "CVE-2024-26778",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: savage: Error out if pixclock equals zero\n\nThe userspace program could pass any values to the driver through\nioctl() interface. If the driver doesn't check the value of pixclock,\nit may cause divide-by-zero error.\n\nAlthough pixclock is checked in savagefb_decode_var(), but it is not\nchecked properly in savagefb_probe(). Fix this by checking whether\npixclock is zero in the function savagefb_check_var() before\ninfo->var.pixclock is used as the divisor.\n\nThis is similar to CVE-2022-3061 in i740fb which was fixed by\ncommit 15cf0b8.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2cef1ca8-f420-4f36-b2a9-0e1bd2405aa9",  "id": "CVE-2014-0181",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0181"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9099e084-8f29-488b-b51f-d1aebfbd03b4",  "id": "CVE-2011-1478",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1478"  },  "ratings": [    {      "score": 5.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The napi_reuse_skb function in net/core/dev.c in the Generic Receive Offload (GRO) implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denial of service (NULL pointer dereference) via a malformed VLAN frame.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4820256f-51e1-4ede-989d-a5e5c04e2543",  "id": "CVE-2024-50248",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: Add bounds checking to mi_enum_attr()\n\nAdded bounds checking to make sure that every attr don't stray beyond\nvalid memory region.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b188f74a-adab-4f86-94c3-fb73b7c6dfde",  "id": "CVE-2022-49563",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - add param check for RSA\n\nReject requests with a source buffer that is bigger than the size of the\nkey. This is to prevent a possible integer underflow that might happen\nwhen copying the source scatterlist into a linear buffer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "24d7acc1-ccd6-4c56-b756-30c7b1ef4a60",  "id": "CVE-2012-6545",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6545"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The Bluetooth RFCOMM implementation in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aec49fb8-2773-4d40-b8ae-bdd042f0aa92",  "id": "CVE-2024-36909",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.300000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nThe VMBus ring buffer code could free decrypted/shared pages if\nset_memory_decrypted() fails. Check the decrypted field in the struct\nvmbus_gpadl for the ring buffers to decide whether to free the memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8d0c2e2-ead6-40dd-9225-74b9ae061499",  "id": "OESA-2026-2282",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "e52e445b-24d0-4150-822b-d76563b46e68",      "versions": [        {          "component": "sed",          "version": "4.0"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a62bc335-cbfc-403b-b7e3-f5bcaa7cee07",  "id": "CLSA-2026-1778061272",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "697ac8c7-a492-498f-ab71-c710788a8bf0",  "id": "CVE-2024-26906",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()\n\nWhen trying to use copy_from_kernel_nofault() to read vsyscall page\nthrough a bpf program, the following oops was reported:\n\n  BUG: unable to handle page fault for address: ffffffffff600000\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0\n  Oops: 0000 [#1] PREEMPT SMP PTI\n  CPU: 1 PID: 20390 Comm: test_progs ...... 6.7.0+ #58\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......\n  RIP: 0010:copy_from_kernel_nofault+0x6f/0x110\n  ......\n  Call Trace:\n   <TASK>\n   ? copy_from_kernel_nofault+0x6f/0x110\n   bpf_probe_read_kernel+0x1d/0x50\n   bpf_prog_2061065e56845f08_do_probe_read+0x51/0x8d\n   trace_call_bpf+0xc5/0x1c0\n   perf_call_bpf_enter.isra.0+0x69/0xb0\n   perf_syscall_enter+0x13e/0x200\n   syscall_trace_enter+0x188/0x1c0\n   do_syscall_64+0xb5/0xe0\n   entry_SYSCALL_64_after_hwframe+0x6e/0x76\n   </TASK>\n  ......\n  ---[ end trace 0000000000000000 ]---\n\nThe oops is triggered when:\n\n1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall\npage and invokes copy_from_kernel_nofault() which in turn calls\n__get_user_asm().\n\n2) Because the vsyscall page address is not readable from kernel space,\na page fault exception is triggered accordingly.\n\n3) handle_page_fault() considers the vsyscall page address as a user\nspace address instead of a kernel space address. This results in the\nfix-up setup by bpf not being applied and a page_fault_oops() is invoked\ndue to SMAP.\n\nConsidering handle_page_fault() has already considered the vsyscall page\naddress as a userspace address, fix the problem by disallowing vsyscall\npage read for copy_from_kernel_nofault().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "23b3274a-a84a-4609-89a1-38f5f35bb951",  "id": "AZL-92487",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "43f3eba9-2b47-4c6a-a769-3fce354921b5",  "id": "CVE-2023-25012",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25012"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17850867-4cb5-429b-944a-b174b3c3b62d",  "id": "CVE-2017-7261",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7261"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain levels data, which allows local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "400be07b-f33b-4cee-a349-2231fb51b796",  "id": "CVE-2022-0494",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0494"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200,    908  ],  "analysis": {    "state": "in_triage"  },  "description": "A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c6ea57c-6226-40f4-a753-a7576b045bf8",  "id": "CVE-2023-52633",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: time-travel: fix time corruption\n\nIn 'basic' time-travel mode (without =inf-cpu or =ext), we\nstill get timer interrupts. These can happen at arbitrary\npoints in time, i.e. while in timer_read(), which pushes\ntime forward just a little bit. Then, if we happen to get\nthe interrupt after calculating the new time to push to,\nbut before actually finishing that, the interrupt will set\nthe time to a value that's incompatible with the forward,\nand we'll crash because time goes backwards when we do the\nforwarding.\n\nFix this by reading the time_travel_time, calculating the\nadjustment, and doing the adjustment all with interrupts\ndisabled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "83bd5673-9b31-4086-b414-018b6a9aa596",  "id": "CVE-2022-50518",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Fix locking in pdc_iodc_print() firmware call\n\nUtilize pdc_lock spinlock to protect parallel modifications of the\niodc_dbuf[] buffer, check length to prevent buffer overflow of\niodc_dbuf[], drop the iodc_retbuf[] buffer and fix some wrong\nindentings.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8cb2588f-b3a1-4000-86d7-c1f33c778ced",  "id": "RHSA-2024:6783",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8ecb7d1c-ce52-4a34-8218-1d02ac3cc6e2",  "id": "CVE-2023-3268",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3268"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f1af1ead-40ea-4e0b-b6d1-0997c6eb8545",  "id": "CVE-2015-4177",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4177"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The collect_mounts function in fs/namespace.c in the Linux kernel before 4.0.5 does not properly consider that it may execute after a path has been unmounted, which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "572a2518-f598-46e2-937e-ab9954119af0",  "id": "CVE-2022-50333",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: jfs: fix shift-out-of-bounds in dbDiscardAG\n\nThis should be applied to most URSAN bugs found recently by syzbot,\nby guarding the dbMount. As syzbot feeding rubbish into the bmap\ndescriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "57e711f8-c18c-4bf4-8017-c579e092deae",  "id": "OESA-2026-2041",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9557d4a-7b37-4456-8f89-40b6eb5f2ee7",  "id": "CVE-2013-3236",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3236"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The vmci_transport_dgram_dequeue function in net/vmw_vsock/vmci_transport.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "874a742a-c182-4096-97c1-71f80c50c658",  "id": "CVE-2022-48844",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix leaking sent_cmd skb\n\nsent_cmd memory is not freed before freeing hci_dev causing it to leak\nit contents.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c9370a09-d18f-4a23-94c6-e6c501ec66f9",  "id": "CVE-2024-49988",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add refcnt to ksmbd_conn struct\n\nWhen sending an oplock break request, opinfo->conn is used,\nBut freed ->conn can be used on multichannel.\nThis patch add a reference count to the ksmbd_conn struct\nso that it can be freed when it is no longer used.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fbb77e16-37a9-4f92-884b-80432fd0f313",  "id": "CVE-2022-50315",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS\n\nUBSAN complains about array-index-out-of-bounds:\n[ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41\n[ 1.980709] kernel: index 15 is out of range for type 'ahci_em_priv [8]'\n[ 1.980713] kernel: CPU: 0 PID: 209 Comm: scsi_eh_8 Not tainted 5.15.0-25-generic #25-Ubuntu\n[ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS 1102 06/11/2010\n[ 1.980718] kernel: Call Trace:\n[ 1.980721] kernel: <TASK>\n[ 1.980723] kernel: show_stack+0x52/0x58\n[ 1.980729] kernel: dump_stack_lvl+0x4a/0x5f\n[ 1.980734] kernel: dump_stack+0x10/0x12\n[ 1.980736] kernel: ubsan_epilogue+0x9/0x45\n[ 1.980739] kernel: __ubsan_handle_out_of_bounds.cold+0x44/0x49\n[ 1.980742] kernel: ahci_qc_issue+0x166/0x170 [libahci]\n[ 1.980748] kernel: ata_qc_issue+0x135/0x240\n[ 1.980752] kernel: ata_exec_internal_sg+0x2c4/0x580\n[ 1.980754] kernel: ? vprintk_default+0x1d/0x20\n[ 1.980759] kernel: ata_exec_internal+0x67/0xa0\n[ 1.980762] kernel: sata_pmp_read+0x8d/0xc0\n[ 1.980765] kernel: sata_pmp_read_gscr+0x3c/0x90\n[ 1.980768] kernel: sata_pmp_attach+0x8b/0x310\n[ 1.980771] kernel: ata_eh_revalidate_and_attach+0x28c/0x4b0\n[ 1.980775] kernel: ata_eh_recover+0x6b6/0xb30\n[ 1.980778] kernel: ? ahci_do_hardreset+0x180/0x180 [libahci]\n[ 1.980783] kernel: ? ahci_stop_engine+0xb0/0xb0 [libahci]\n[ 1.980787] kernel: ? ahci_do_softreset+0x290/0x290 [libahci]\n[ 1.980792] kernel: ? trace_event_raw_event_ata_eh_link_autopsy_qc+0xe0/0xe0\n[ 1.980795] kernel: sata_pmp_eh_recover.isra.0+0x214/0x560\n[ 1.980799] kernel: sata_pmp_error_handler+0x23/0x40\n[ 1.980802] kernel: ahci_error_handler+0x43/0x80 [libahci]\n[ 1.980806] kernel: ata_scsi_port_error_handler+0x2b1/0x600\n[ 1.980810] kernel: ata_scsi_error+0x9c/0xd0\n[ 1.980813] kernel: scsi_error_handler+0xa1/0x180\n[ 1.980817] kernel: ? scsi_unjam_host+0x1c0/0x1c0\n[ 1.980820] kernel: kthread+0x12a/0x150\n[ 1.980823] kernel: ? set_kthread_struct+0x50/0x50\n[ 1.980826] kernel: ret_from_fork+0x22/0x30\n[ 1.980831] kernel: </TASK>\n\nThis happens because sata_pmp_init_links() initialize link->pmp up to\nSATA_PMP_MAX_PORTS while em_priv is declared as 8 elements array.\n\nI can't find the maximum Enclosure Management ports specified in AHCI\nspec v1.3.1, but \"12.2.1 LED message type\" states that \"Port Multiplier\nInformation\" can utilize 4 bits, which implies it can support up to 16\nports. Hence, use SATA_PMP_MAX_PORTS as EM_MAX_SLOTS to resolve the\nissue.\n\nBugLink: https://bugs.launchpad.net/bugs/1970074",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0074867e-133c-4fe1-8861-47b4d66a8ead",  "id": "CVE-2021-47610",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47610"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix null ptr access msm_ioctl_gem_submit()\n\nFix the below null pointer dereference in msm_ioctl_gem_submit():\n\n 26545.260705:   Call trace:\n 26545.263223:    kref_put+0x1c/0x60\n 26545.266452:    msm_ioctl_gem_submit+0x254/0x744\n 26545.270937:    drm_ioctl_kernel+0xa8/0x124\n 26545.274976:    drm_ioctl+0x21c/0x33c\n 26545.278478:    drm_compat_ioctl+0xdc/0xf0\n 26545.282428:    __arm64_compat_sys_ioctl+0xc8/0x100\n 26545.287169:    el0_svc_common+0xf8/0x250\n 26545.291025:    do_el0_svc_compat+0x28/0x54\n 26545.295066:    el0_svc_compat+0x10/0x1c\n 26545.298838:    el0_sync_compat_handler+0xa8/0xcc\n 26545.303403:    el0_sync_compat+0x188/0x1c0\n 26545.307445:   Code: d503201f d503201f 52800028 4b0803e8 (b8680008)\n 26545.318799:   Kernel panic - not syncing: Oops: Fatal exception",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2128b40a-c375-4e53-a2aa-b282c02ce0ca",  "id": "OESA-2026-1415",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ab0e0556-3a2f-4135-b3da-8fa8176184ba",  "id": "CVE-2011-0711",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0711"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The xfs_fs_geometry function in fs/xfs/xfs_fsops.c in the Linux kernel before 2.6.38-rc6-git3 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FSGEOMETRY_V1 ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84e62056-8f63-4db5-a647-78b482be8225",  "id": "CVE-2021-47623",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47623"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/fixmap: Fix VM debug warning on unmap\n\nUnmapping a fixmap entry is done by calling __set_fixmap()\nwith FIXMAP_PAGE_CLEAR as flags.\n\nToday, powerpc __set_fixmap() calls map_kernel_page().\n\nmap_kernel_page() is not happy when called a second time\nfor the same page.\n\n\tWARNING: CPU: 0 PID: 1 at arch/powerpc/mm/pgtable.c:194 set_pte_at+0xc/0x1e8\n\tCPU: 0 PID: 1 Comm: swapper Not tainted 5.16.0-rc3-s3k-dev-01993-g350ff07feb7d-dirty #682\n\tNIP:  c0017cd4 LR: c00187f0 CTR: 00000010\n\tREGS: e1011d50 TRAP: 0700   Not tainted  (5.16.0-rc3-s3k-dev-01993-g350ff07feb7d-dirty)\n\tMSR:  00029032 <EE,ME,IR,DR,RI>  CR: 42000208  XER: 00000000\n\n\tGPR00: c0165fec e1011e10 c14c0000 c0ee2550 ff800000 c0f3d000 00000000 c001686c\n\tGPR08: 00001000 b00045a9 00000001 c0f58460 c0f50000 00000000 c0007e10 00000000\n\tGPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000\n\tGPR24: 00000000 00000000 c0ee2550 00000000 c0f57000 00000ff8 00000000 ff800000\n\tNIP [c0017cd4] set_pte_at+0xc/0x1e8\n\tLR [c00187f0] map_kernel_page+0x9c/0x100\n\tCall Trace:\n\t[e1011e10] [c0736c68] vsnprintf+0x358/0x6c8 (unreliable)\n\t[e1011e30] [c0165fec] __set_fixmap+0x30/0x44\n\t[e1011e40] [c0c13bdc] early_iounmap+0x11c/0x170\n\t[e1011e70] [c0c06cb0] ioremap_legacy_serial_console+0x88/0xc0\n\t[e1011e90] [c0c03634] do_one_initcall+0x80/0x178\n\t[e1011ef0] [c0c0385c] kernel_init_freeable+0xb4/0x250\n\t[e1011f20] [c0007e34] kernel_init+0x24/0x140\n\t[e1011f30] [c0016268] ret_from_kernel_thread+0x5c/0x64\n\tInstruction dump:\n\t7fe3fb78 48019689 80010014 7c630034 83e1000c 5463d97e 7c0803a6 38210010\n\t4e800020 81250000 712a0001 41820008 <0fe00000> 9421ffe0 93e1001c 48000030\n\nImplement unmap_kernel_page() which clears an existing pte.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c198fd44-782a-4179-b11c-7312144919a1",  "id": "CVE-2024-41082",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fabrics: use reserved tag for reg read/write command\n\nIn some scenarios, if too many commands are issued by nvme command in\nthe same time by user tasks, this may exhaust all tags of admin_q. If\na reset (nvme reset or IO timeout) occurs before these commands finish,\nreconnect routine may fail to update nvme regs due to insufficient tags,\nwhich will cause kernel hang forever. In order to workaround this issue,\nmaybe we can let reg_read32()/reg_read64()/reg_write32() use reserved\ntags. This maybe safe for nvmf:\n\n1. For the disable ctrl path,  we will not issue connect command\n2. For the enable ctrl / fw activate path, since connect and reg_xx()\n   are called serially.\n\nSo the reserved tags may still be enough while reg_xx() use reserved tags.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a777bdb-1573-45af-929c-0a95ee99fcc5",  "id": "CVE-2022-1195",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1195"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17572092-a0fe-451f-b07e-72f6f4d90602",  "id": "CVE-2024-35803",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/efistub: Call mixed mode boot services on the firmware's stack\n\nNormally, the EFI stub calls into the EFI boot services using the stack\nthat was live when the stub was entered. According to the UEFI spec,\nthis stack needs to be at least 128k in size - this might seem large but\nall asynchronous processing and event handling in EFI runs from the same\nstack and so quite a lot of space may be used in practice.\n\nIn mixed mode, the situation is a bit different: the bootloader calls\nthe 32-bit EFI stub entry point, which calls the decompressor's 32-bit\nentry point, where the boot stack is set up, using a fixed allocation\nof 16k. This stack is still in use when the EFI stub is started in\n64-bit mode, and so all calls back into the EFI firmware will be using\nthe decompressor's limited boot stack.\n\nDue to the placement of the boot stack right after the boot heap, any\nstack overruns have gone unnoticed. However, commit\n\n  5c4feadb0011983b (\"x86/decompressor: Move global symbol references to C code\")\n\nmoved the definition of the boot heap into C code, and now the boot\nstack is placed right at the base of BSS, where any overruns will\ncorrupt the end of the .data section.\n\nWhile it would be possible to work around this by increasing the size of\nthe boot stack, doing so would affect all x86 systems, and mixed mode\nsystems are a tiny (and shrinking) fraction of the x86 installed base.\n\nSo instead, record the firmware stack pointer value when entering from\nthe 32-bit firmware, and switch to this stack every time a EFI boot\nservice call is made.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "55518442-d3a7-40c5-b1ac-f51ac4f94772",  "id": "OESA-2024-1956",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7bea68c1-ca17-4c85-877c-0aa5a61d3ebe",  "id": "CVE-2026-43076",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate inline data i_size during inode read\n\nWhen reading an inode from disk, ocfs2_validate_inode_block() performs\nvarious sanity checks but does not validate the size of inline data.  If\nthe filesystem is corrupted, an inode's i_size can exceed the actual\ninline data capacity (id_count).\n\nThis causes ocfs2_dir_foreach_blk_id() to iterate beyond the inline data\nbuffer, triggering a use-after-free when accessing directory entries from\nfreed memory.\n\nIn the syzbot report:\n  - i_size was 1099511627576 bytes (~1TB)\n  - Actual inline data capacity (id_count) is typically <256 bytes\n  - A garbage rec_len (54648) caused ctx->pos to jump out of bounds\n  - This triggered a UAF in ocfs2_check_dir_entry()\n\nFix by adding a validation check in ocfs2_validate_inode_block() to ensure\ninodes with inline data have i_size <= id_count.  This catches the\ncorruption early during inode read and prevents all downstream code from\noperating on invalid data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c722a2fc-05f5-4493-8646-7e7e55230751",  "id": "SUSE-SU-2019:1362-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "33ef0304-772b-4c73-b92e-452a6d8b54b9",  "id": "CVE-2025-23141",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses\n\nAcquire a lock on kvm->srcu when userspace is getting MP state to handle a\nrather extreme edge case where \"accepting\" APIC events, i.e. processing\npending INIT or SIPI, can trigger accesses to guest memory.  If the vCPU\nis in L2 with INIT *and* a TRIPLE_FAULT request pending, then getting MP\nstate will trigger a nested VM-Exit by way of ->check_nested_events(), and\nemuating the nested VM-Exit can access guest memory.\n\nThe splat was originally hit by syzkaller on a Google-internal kernel, and\nreproduced on an upstream kernel by hacking the triple_fault_event_test\nselftest to stuff a pending INIT, store an MSR on VM-Exit (to generate a\nmemory access on VMX), and do vcpu_mp_state_get() to trigger the scenario.\n\n  =============================\n  WARNING: suspicious RCU usage\n  6.14.0-rc3-b112d356288b-vmx/pi_lockdep_false_pos-lock #3 Not tainted\n  -----------------------------\n  include/linux/kvm_host.h:1058 suspicious rcu_dereference_check() usage!\n\n  other info that might help us debug this:\n\n  rcu_scheduler_active = 2, debug_locks = 1\n  1 lock held by triple_fault_ev/1256:\n   #0: ffff88810df5a330 (&vcpu->mutex){+.+.}-{4:4}, at: kvm_vcpu_ioctl+0x8b/0x9a0 [kvm]\n\n  stack backtrace:\n  CPU: 11 UID: 1000 PID: 1256 Comm: triple_fault_ev Not tainted 6.14.0-rc3-b112d356288b-vmx #3\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x7f/0x90\n   lockdep_rcu_suspicious+0x144/0x190\n   kvm_vcpu_gfn_to_memslot+0x156/0x180 [kvm]\n   kvm_vcpu_read_guest+0x3e/0x90 [kvm]\n   read_and_check_msr_entry+0x2e/0x180 [kvm_intel]\n   __nested_vmx_vmexit+0x550/0xde0 [kvm_intel]\n   kvm_check_nested_events+0x1b/0x30 [kvm]\n   kvm_apic_accept_events+0x33/0x100 [kvm]\n   kvm_arch_vcpu_ioctl_get_mpstate+0x30/0x1d0 [kvm]\n   kvm_vcpu_ioctl+0x33e/0x9a0 [kvm]\n   __x64_sys_ioctl+0x8b/0xb0\n   do_syscall_64+0x6c/0x170\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9f9df159-12c1-4bf3-a18c-e8f6e86cd3b0",  "id": "CVE-2019-19532",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19532"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c, drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c, drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-tmff.c, and drivers/hid/hid-zpff.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "55b1fcf2-1f14-4551-9925-daef4e58309d",  "id": "CVE-2024-46775",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Validate function returns\n\n[WHAT & HOW]\nFunction return values must be checked before data can be used\nin subsequent functions.\n\nThis fixes 4 CHECKED_RETURN issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e078be63-430f-4d7a-8181-06476a71fa46",  "id": "CVE-2024-42071",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    834  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nionic: use dev_consume_skb_any outside of napi\n\nIf we're not in a NAPI softirq context, we need to be careful\nabout how we call napi_consume_skb(), specifically we need to\ncall it with budget==0 to signal to it that we're not in a\nsafe context.\n\nThis was found while running some configuration stress testing\nof traffic and a change queue config loop running, and this\ncurious note popped out:\n\n[ 4371.402645] BUG: using smp_processor_id() in preemptible [00000000] code: ethtool/20545\n[ 4371.402897] caller is napi_skb_cache_put+0x16/0x80\n[ 4371.403120] CPU: 25 PID: 20545 Comm: ethtool Kdump: loaded Tainted: G           OE      6.10.0-rc3-netnext+ #8\n[ 4371.403302] Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 01/23/2021\n[ 4371.403460] Call Trace:\n[ 4371.403613]  <TASK>\n[ 4371.403758]  dump_stack_lvl+0x4f/0x70\n[ 4371.403904]  check_preemption_disabled+0xc1/0xe0\n[ 4371.404051]  napi_skb_cache_put+0x16/0x80\n[ 4371.404199]  ionic_tx_clean+0x18a/0x240 [ionic]\n[ 4371.404354]  ionic_tx_cq_service+0xc4/0x200 [ionic]\n[ 4371.404505]  ionic_tx_flush+0x15/0x70 [ionic]\n[ 4371.404653]  ? ionic_lif_qcq_deinit.isra.23+0x5b/0x70 [ionic]\n[ 4371.404805]  ionic_txrx_deinit+0x71/0x190 [ionic]\n[ 4371.404956]  ionic_reconfigure_queues+0x5f5/0xff0 [ionic]\n[ 4371.405111]  ionic_set_ringparam+0x2e8/0x3e0 [ionic]\n[ 4371.405265]  ethnl_set_rings+0x1f1/0x300\n[ 4371.405418]  ethnl_default_set_doit+0xbb/0x160\n[ 4371.405571]  genl_family_rcv_msg_doit+0xff/0x130\n\t[...]\n\nI found that ionic_tx_clean() calls napi_consume_skb() which calls\nnapi_skb_cache_put(), but before that last call is the note\n    /* Zero budget indicate non-NAPI context called us, like netpoll */\nand\n    DEBUG_NET_WARN_ON_ONCE(!in_softirq());\n\nThose are pretty big hints that we're doing it wrong.  We can pass a\ncontext hint down through the calls to let ionic_tx_clean() know what\nwe're doing so it can call napi_consume_skb() correctly.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2dfa4a0-8a05-4f69-bbbc-c7c67a110402",  "id": "MGASA-2017-0405",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9457ed63-4d01-43cb-9f95-539e9f19dfc4",  "id": "SUSE-SU-2022:14940-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b683cec-ab33-4b29-9432-5cf37fb42834",  "id": "CVE-2022-2588",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2588"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ba534fba-4d71-4088-9a02-51d434bbd187",  "id": "CVE-2025-38180",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atm: fix /proc/net/atm/lec handling\n\n/proc/net/atm/lec must ensure safety against dev_lec[] changes.\n\nIt appears it had dev_put() calls without prior dev_hold(),\nleading to imbalance and UAF.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "01fe9780-9aec-4ef0-bd82-30dfb211f241",  "id": "CVE-2025-38198",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Make sure modelist not set on unregistered console\n\nIt looks like attempting to write to the \"store_modes\" sysfs node will\nrun afoul of unregistered consoles:\n\nUBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28\nindex -1 is out of range for type 'fb_info *[32]'\n...\n fbcon_info_from_console+0x192/0x1a0 drivers/video/fbdev/core/fbcon.c:122\n fbcon_new_modelist+0xbf/0x2d0 drivers/video/fbdev/core/fbcon.c:3048\n fb_new_modelist+0x328/0x440 drivers/video/fbdev/core/fbmem.c:673\n store_modes+0x1c9/0x3e0 drivers/video/fbdev/core/fbsysfs.c:113\n dev_attr_store+0x55/0x80 drivers/base/core.c:2439\n\nstatic struct fb_info *fbcon_registered_fb[FB_MAX];\n...\nstatic signed char con2fb_map[MAX_NR_CONSOLES];\n...\nstatic struct fb_info *fbcon_info_from_console(int console)\n...\n        return fbcon_registered_fb[con2fb_map[console]];\n\nIf con2fb_map contains a -1 things go wrong here. Instead, return NULL,\nas callers of fbcon_info_from_console() are trying to compare against\nexisting \"info\" pointers, so error handling should kick in correctly.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bcdb36e2-425d-42e9-97a4-4b45aed12bc6",  "id": "CVE-2015-4178",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4178"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The fs_pin implementation in the Linux kernel before 4.0.5 does not ensure the internal consistency of a certain list data structure, which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call, related to fs/fs_pin.c and include/linux/fs_pin.h.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "966b0476-7874-432e-b6b7-e302421fe8db",  "id": "CVE-2011-1493",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1493"  },  "ratings": [    {      "score": 7.5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "Array index error in the rose_parse_national function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by composing FAC_NATIONAL_DIGIS data that specifies a large number of digipeaters, and then sending this data to a ROSE socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb89ab1b-cfca-418d-a221-01d8a7def510",  "id": "CVE-2022-48943",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: make apf token non-zero to fix bug\n\nIn current async pagefault logic, when a page is ready, KVM relies on\nkvm_arch_can_dequeue_async_page_present() to determine whether to deliver\na READY event to the Guest. This function test token value of struct\nkvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a\nREADY event is finished by Guest. If value is zero meaning that a READY\nevent is done, so the KVM can deliver another.\nBut the kvm_arch_setup_async_pf() may produce a valid token with zero\nvalue, which is confused with previous mention and may lead the loss of\nthis READY event.\n\nThis bug may cause task blocked forever in Guest:\n INFO: task stress:7532 blocked for more than 1254 seconds.\n       Not tainted 5.10.0 #16\n \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:stress          state:D stack:    0 pid: 7532 ppid:  1409\n flags:0x00000080\n Call Trace:\n  __schedule+0x1e7/0x650\n  schedule+0x46/0xb0\n  kvm_async_pf_task_wait_schedule+0xad/0xe0\n  ? exit_to_user_mode_prepare+0x60/0x70\n  __kvm_handle_async_pf+0x4f/0xb0\n  ? asm_exc_page_fault+0x8/0x30\n  exc_page_fault+0x6f/0x110\n  ? asm_exc_page_fault+0x8/0x30\n  asm_exc_page_fault+0x1e/0x30\n RIP: 0033:0x402d00\n RSP: 002b:00007ffd31912500 EFLAGS: 00010206\n RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0\n RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0\n RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086\n R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000\n R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cbca1fff-031b-4b25-ab44-922095033920",  "id": "CVE-2022-49171",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: don't BUG if someone dirty pages without asking ext4 first\n\n[un]pin_user_pages_remote is dirtying pages without properly warning\nthe file system in advance.  A related race was noted by Jan Kara in\n2018[1]; however, more recently instead of it being a very hard-to-hit\nrace, it could be reliably triggered by process_vm_writev(2) which was\ndiscovered by Syzbot[2].\n\nThis is technically a bug in mm/gup.c, but arguably ext4 is fragile in\nthat if some other kernel subsystem dirty pages without properly\nnotifying the file system using page_mkwrite(), ext4 will BUG, while\nother file systems will not BUG (although data will still be lost).\n\nSo instead of crashing with a BUG, issue a warning (since there may be\npotential data loss) and just mark the page as clean to avoid\nunprivileged denial of service attacks until the problem can be\nproperly fixed.  More discussion and background can be found in the\nthread starting at [2].\n\n[1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz\n[2] https://lore.kernel.org/r/Yg0m6IjcNmfaSokM@google.com",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e1bde32-07fc-442c-bbf8-7624268636f7",  "id": "CVE-2026-31581",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: fix use-after-free on disconnect\n\nIn usb6fire_chip_abort(), the chip struct is allocated as the card's\nprivate data (via snd_card_new with sizeof(struct sfire_chip)).  When\nsnd_card_free_when_closed() is called and no file handles are open, the\ncard and embedded chip are freed synchronously.  The subsequent\nchip->card = NULL write then hits freed slab memory.\n\nCall trace:\n  usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]\n  usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182\n  usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458\n  ...\n  hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953\n\nFix by moving the card lifecycle out of usb6fire_chip_abort() and into\nusb6fire_chip_disconnect().  The card pointer is saved in a local\nbefore any teardown, snd_card_disconnect() is called first to prevent\nnew opens, URBs are aborted while chip is still valid, and\nsnd_card_free_when_closed() is called last so chip is never accessed\nafter the card may be freed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69cb00e8-6aa0-4249-8d1d-b19482cad486",  "id": "CVE-2024-36946",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphonet: fix rtm_phonet_notify() skb allocation\n\nfill_route() stores three components in the skb:\n\n- struct rtmsg\n- RTA_DST (u8)\n- RTA_OIF (u32)\n\nTherefore, rtm_phonet_notify() should use\n\nNLMSG_ALIGN(sizeof(struct rtmsg)) +\nnla_total_size(1) +\nnla_total_size(4)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d3e4474-987c-42c4-a595-627aef90b57e",  "id": "CVE-2023-50387",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50387"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the \"KeyTrap\" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'SNYK:SNYK-JAVA-ORGDNSJAVA-8056461'"    }  ]},{  "bom-ref": "4cd2743b-3d29-4d10-8efe-26224e978afa",  "id": "CVE-2024-35929",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()\n\nFor the kernels built with CONFIG_RCU_NOCB_CPU_DEFAULT_ALL=y and\nCONFIG_RCU_LAZY=y, the following scenarios will trigger WARN_ON_ONCE()\nin the rcu_nocb_bypass_lock() and rcu_nocb_wait_contended() functions:\n\n        CPU2                                               CPU11\nkthread\nrcu_nocb_cb_kthread                                       ksys_write\nrcu_do_batch                                              vfs_write\nrcu_torture_timer_cb                                      proc_sys_write\n__kmem_cache_free                                         proc_sys_call_handler\nkmemleak_free                                             drop_caches_sysctl_handler\ndelete_object_full                                        drop_slab\n__delete_object                                           shrink_slab\nput_object                                                lazy_rcu_shrink_scan\ncall_rcu                                                  rcu_nocb_flush_bypass\n__call_rcu_commn                                            rcu_nocb_bypass_lock\n                                                            raw_spin_trylock(&rdp->nocb_bypass_lock) fail\n                                                            atomic_inc(&rdp->nocb_lock_contended);\nrcu_nocb_wait_contended                                     WARN_ON_ONCE(smp_processor_id() != rdp->cpu);\n WARN_ON_ONCE(atomic_read(&rdp->nocb_lock_contended))                                          |\n                            |_ _ _ _ _ _ _ _ _ _same rdp and rdp->cpu != 11_ _ _ _ _ _ _ _ _ __|\n\nReproduce this bug with \"echo 3 > /proc/sys/vm/drop_caches\".\n\nThis commit therefore uses rcu_nocb_try_flush_bypass() instead of\nrcu_nocb_flush_bypass() in lazy_rcu_shrink_scan().  If the nocb_bypass\nqueue is being flushed, then rcu_nocb_try_flush_bypass will return\ndirectly.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8e47771-6cb1-4251-99d4-96f840387130",  "id": "CVE-2016-2184",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2184"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference or double free, and system crash) via a crafted endpoints value in a USB device descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:39555'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:136221/Linux-snd-usb-audio-Denial-Of-Service.html'"    }  ]},{  "bom-ref": "3e139ec2-5c38-446e-9f57-41cf22be8501",  "id": "CVE-2019-15920",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15920"  },  "ratings": [    {      "score": 4.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.10. SMB2_read in fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was not fixed correctly in 5.0.10; see the 5.0.11 ChangeLog, which documents a memory leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "424d71fa-2f59-4bc2-abc7-82caec77abe4",  "id": "MGASA-2022-0135",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "33e9a63d-6fbe-4310-86d1-79896f2aa7f3",  "id": "CVE-2021-3448",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3448"  },  "ratings": [    {      "score": 4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"    }  ],  "cwes": [    358  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "79344fee-5e8b-46fe-9af8-dfb8d8d51daf",  "id": "AZL-34419",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2582c64b-ec68-4cc4-a061-5fb8ce91dbb8",  "id": "CVE-2023-53254",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncacheinfo: Fix shared_cpu_map to handle shared caches at different levels\n\nThe cacheinfo sets up the shared_cpu_map by checking whether the caches\nwith the same index are shared between CPUs. However, this will trigger\nslab-out-of-bounds access if the CPUs do not have the same cache hierarchy.\nAnother problem is the mismatched shared_cpu_map when the shared cache does\nnot have the same index between CPUs.\n\nCPU0\tI\tD\tL3\nindex\t0\t1\t2\tx\n\t^\t^\t^\t^\nindex\t0\t1\t2\t3\nCPU1\tI\tD\tL2\tL3\n\nThis patch checks each cache is shared with all caches on other CPUs.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "774f0dc8-ca58-4188-b609-4574170d7f31",  "id": "CVE-2017-14495",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14495"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    772  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:42945'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:144468/Dnsmasq-Lack-Of-Free-Denial-Of-Service.html'"    }  ]},{  "bom-ref": "6d9ed478-ed03-4cec-9bb1-8905f677604b",  "id": "CVE-2025-38074",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: protect vq->log_used with vq->mutex\n\nThe vhost-scsi completion path may access vq->log_base when vq->log_used is\nalready set to false.\n\n    vhost-thread                       QEMU-thread\n\nvhost_scsi_complete_cmd_work()\n-> vhost_add_used()\n   -> vhost_add_used_n()\n      if (unlikely(vq->log_used))\n                                      QEMU disables vq->log_used\n                                      via VHOST_SET_VRING_ADDR.\n                                      mutex_lock(&vq->mutex);\n                                      vq->log_used = false now!\n                                      mutex_unlock(&vq->mutex);\n\n\t\t\t\t      QEMU gfree(vq->log_base)\n        log_used()\n        -> log_write(vq->log_base)\n\nAssuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be\nreclaimed via gfree(). As a result, this causes invalid memory writes to\nQEMU userspace.\n\nThe control queue path has the same issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7218269f-a47b-45a7-9c43-1a6dd3045569",  "id": "CVE-2022-48712",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix error handling in ext4_fc_record_modified_inode()\n\nCurrent code does not fully takes care of krealloc() error case, which\ncould lead to silent memory corruption or a kernel bug.  This patch\nfixes that.\n\nAlso it cleans up some duplicated error handling logic from various\nfunctions in fast_commit.c file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b6505848-f03a-457d-afb9-4eceed90825b",  "id": "CLSA-2026-1777048319",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c72e86f8-95db-4946-addb-1666b283c15b",  "id": "OESA-2026-3683",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9a802217-cdc0-4106-ac87-5d7415561130",  "id": "CVE-2021-47359",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47359"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix soft lockup during fsstress\n\nBelow traces are observed during fsstress and system got hung.\n[  130.698396] watchdog: BUG: soft lockup - CPU#6 stuck for 26s!",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ea30b21b-283d-47a9-b99b-3d07481f682f",  "id": "ALSA-2026:19218",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9abf8fc9-fe1b-4dec-9bbd-d50589ed76c9",  "id": "CVE-2015-1790",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1790"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7ea096a0-7cb9-48d9-84e6-d0c1a3b6e2d1",  "id": "CVE-2018-14610",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14610"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 4.17.10. There is out-of-bounds access in write_extent_buffer() when mounting and operating a crafted btrfs image, because of a lack of verification that each block group has a corresponding chunk at mount time, within btrfs_read_block_groups in fs/btrfs/extent-tree.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "15455383-58d1-40df-84ab-1209939b5d24",  "id": "CVE-2013-3076",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3076"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The crypto API in the Linux kernel through 3.9-rc8 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2dd6576b-5e19-4e53-a0b9-e6726ed50a70",  "id": "CVE-2010-4527",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4527"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel before 2.6.37 incorrectly expects that a certain name field ends with a '\\0' character, which allows local users to conduct buffer overflow attacks and gain privileges, or possibly obtain sensitive information from kernel memory, via a SOUND_MIXER_SETLEVELS ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9057ce45-f9e0-42b0-b40c-b3eb4e160f7f",  "id": "DSA-5532-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9434f8cb-7992-4e0a-a02b-16040cc98995",  "id": "CVE-2024-39472",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix log recovery buffer allocation for the legacy h_size fixup\n\nCommit a70f9fe52daa (\"xfs: detect and handle invalid iclog size set by\nmkfs\") added a fixup for incorrect h_size values used for the initial\numount record in old xfsprogs versions.  Later commit 0c771b99d6c9\n(\"xfs: clean up calculation of LR header blocks\") cleaned up the log\nreover buffer calculation, but stoped using the fixed up h_size value\nto size the log recovery buffer, which can lead to an out of bounds\naccess when the incorrect h_size does not come from the old mkfs\ntool, but a fuzzer.\n\nFix this by open coding xlog_logrec_hblks and taking the fixed h_size\ninto account for this calculation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84884642-a016-40aa-a70d-89aec097f827",  "id": "CVE-2021-47576",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47576"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()\n\nIn resp_mode_select() sanity check the block descriptor len to avoid UAF.\n\nBUG: KASAN: use-after-free in resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509\nRead of size 1 at addr ffff888026670f50 by task scsicmd/15032\n\nCPU: 1 PID: 15032 Comm: scsicmd Not tainted 5.15.0-01d0625 #15\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nCall Trace:\n <TASK>\n dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:107\n print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:257\n kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:443\n __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306\n resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509\n schedule_resp+0x4af/0x1a10 drivers/scsi/scsi_debug.c:5483\n scsi_debug_queuecommand+0x8c9/0x1e70 drivers/scsi/scsi_debug.c:7537\n scsi_queue_rq+0x16b4/0x2d10 drivers/scsi/scsi_lib.c:1521\n blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1640\n __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325\n blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358\n __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1762\n __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1839\n blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891\n blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474\n blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:63\n sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:837\n sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:775\n sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:941\n sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1166\n __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:52\n do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:50\n entry_SYSCALL_64_after_hwframe+0x44/0xae arch/x86/entry/entry_64.S:113",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b8cdfc6-be04-456f-8249-bc09f3291605",  "id": "CVE-2017-18255",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18255"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow) or possibly have unspecified other impact via a large value, as demonstrated by an incorrect sample-rate calculation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2745bfa4-8927-491e-87cd-edde16ae0006",  "id": "ROOT-OS-ALPINE-317-CVE-2026-7383",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c280f00-72fb-470e-baa8-be93bd163922",  "id": "CVE-2010-2537",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2537"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a (1) BTRFS_IOC_CLONE or (2) BTRFS_IOC_CLONE_RANGE ioctl call that specifies this file as a donor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bb8c762d-ac0c-4a1a-b13b-d06f7f86cea7",  "id": "CVE-2017-7184",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7184"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a584a65-b53a-448e-8a77-0f88a692fccd",  "id": "CVE-2019-20810",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20810"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "651261cc-c4a9-4ab8-be37-5c64236944c4",  "id": "CVE-2025-21749",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rose: lock the socket in rose_bind()\n\nsyzbot reported a soft lockup in rose_loopback_timer(),\nwith a repro calling bind() from multiple threads.\n\nrose_bind() must lock the socket to avoid this issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a2a764c9-1b08-4ecd-aea4-888e41243c46",  "id": "CVE-2024-36915",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: fix nfc_llcp_setsockopt() unsafe copies\n\nsyzbot reported unsafe calls to copy_from_sockptr() [1]\n\nUse copy_safe_from_sockptr() instead.\n\n[1]\n\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\n BUG: KASAN: slab-out-of-bounds in nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255\nRead of size 4 at addr ffff88801caa1ec3 by task syz-executor459/5078\n\nCPU: 0 PID: 5078 Comm: syz-executor459 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n <TASK>\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\n  nfc_llcp_setsockopt+0x6c2/0x850 net/nfc/llcp_sock.c:255\n  do_sock_setsockopt+0x3b1/0x720 net/socket.c:2311\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfd/0x240\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\nRIP: 0033:0x7f7fac07fd89\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 91 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fff660eb788 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f7fac07fd89\nRDX: 0000000000000000 RSI: 0000000000000118 RDI: 0000000000000004\nRBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000000000\nR10: 0000000020000a80 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7ffb6036-5469-4ec7-845f-9d604edebfae",  "id": "AZL-92837",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8d15f778-eedf-4c45-ba7b-028002e173d6",  "id": "ROOT-OS-ALPINE-315-CVE-2025-69419",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e556249-1382-437a-b4fb-90f4873adf65",  "id": "CVE-2023-52478",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    367  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-hidpp: Fix kernel crash on receiver USB disconnect\n\nhidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU)\nraces when it races with itself.\n\nhidpp_connect_event() primarily runs from a workqueue but it also runs\non probe() and if a \"device-connected\" packet is received by the hw\nwhen the thread running hidpp_connect_event() from probe() is waiting on\nthe hw, then a second thread running hidpp_connect_event() will be\nstarted from the workqueue.\n\nThis opens the following races (note the below code is simplified):\n\n1. Retrieving + printing the protocol (harmless race):\n\n\tif (!hidpp->protocol_major) {\n\t\thidpp_root_get_protocol_version()\n\t\thidpp->protocol_major = response.rap.params[0];\n\t}\n\nWe can actually see this race hit in the dmesg in the abrt output\nattached to rhbz#2227968:\n\n[ 3064.624215] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected.\n[ 3064.658184] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected.\n\nTesting with extra logging added has shown that after this the 2 threads\ntake turn grabbing the hw access mutex (send_mutex) so they ping-pong\nthrough all the other TOCTOU cases managing to hit all of them:\n\n2. Updating the name to the HIDPP name (harmless race):\n\n\tif (hidpp->name == hdev->name) {\n\t\t...\n\t\thidpp->name = new_name;\n\t}\n\n3. Initializing the power_supply class for the battery (problematic!):\n\nhidpp_initialize_battery()\n{\n        if (hidpp->battery.ps)\n                return 0;\n\n\tprobe_battery(); /* Blocks, threads take turns executing this */\n\n\thidpp->battery.desc.properties =\n\t\tdevm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);\n\n\thidpp->battery.ps =\n\t\tdevm_power_supply_register(&hidpp->hid_dev->dev,\n\t\t\t\t\t   &hidpp->battery.desc, cfg);\n}\n\n4. Creating delayed input_device (potentially problematic):\n\n\tif (hidpp->delayed_input)\n\t\treturn;\n\n\thidpp->delayed_input = hidpp_allocate_input(hdev);\n\nThe really big problem here is 3. Hitting the race leads to the following\nsequence:\n\n\thidpp->battery.desc.properties =\n\t\tdevm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);\n\n\thidpp->battery.ps =\n\t\tdevm_power_supply_register(&hidpp->hid_dev->dev,\n\t\t\t\t\t   &hidpp->battery.desc, cfg);\n\n\t...\n\n\thidpp->battery.desc.properties =\n\t\tdevm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);\n\n\thidpp->battery.ps =\n\t\tdevm_power_supply_register(&hidpp->hid_dev->dev,\n\t\t\t\t\t   &hidpp->battery.desc, cfg);\n\nSo now we have registered 2 power supplies for the same battery,\nwhich looks a bit weird from userspace's pov but this is not even\nthe really big problem.\n\nNotice how:\n\n1. This is all devm-maganaged\n2. The hidpp->battery.desc struct is shared between the 2 power supplies\n3. hidpp->battery.desc.properties points to the result from the second\n   devm_kmemdup()\n\nThis causes a use after free scenario on USB disconnect of the receiver:\n1. The last registered power supply class device gets unregistered\n2. The memory from the last devm_kmemdup() call gets freed,\n   hidpp->battery.desc.properties now points to freed memory\n3. The first registered power supply class device gets unregistered,\n   this involves sending a remove uevent to userspace which invokes\n   power_supply_uevent() to fill the uevent data\n4. power_supply_uevent() uses hidpp->battery.desc.properties which\n   now points to freed memory leading to backtraces like this one:\n\nSep 22 20:01:35 eric kernel: BUG: unable to handle page fault for address: ffffb2140e017f08\n...\nSep 22 20:01:35 eric kernel: Workqueue: usb_hub_wq hub_event\nSep 22 20:01:35 eric kernel: RIP: 0010:power_supply_uevent+0xee/0x1d0\n...\nSep 22 20:01:35 eric kernel:  ? asm_exc_page_fault+0x26/0x30\nSep 22 20:01:35 eric kernel:  ? power_supply_uevent+0xee/0x1d0\nSep 22 20:01:35 eric kernel:  ? power_supply_uevent+0x10d/0x1d0\nSep 22 20:01:35 eric kernel:  dev_uevent+0x10f/0x2d0\nSep 22 20:01:35 eric kernel:  kobject_uevent_env+0x291/0x680\nSep 22 20:01:35 eric kernel:  \n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5238097a-d5b4-47cd-8c3d-d4f2ac06c8da",  "id": "AZL-77613",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a0fda4c-459f-486f-adba-4664634d9ece",  "id": "CVE-2023-53182",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Avoid undefined behavior: applying zero offset to null pointer\n\nACPICA commit 770653e3ba67c30a629ca7d12e352d83c2541b1e\n\nBefore this change we see the following UBSAN stack trace in Fuchsia:\n\n  #0    0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 <platform-bus-x86.so>+0x233302\n  #1.2  0x000020d0f660777f in ubsan_get_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:41 <libclang_rt.asan.so>+0x3d77f\n  #1.1  0x000020d0f660777f in maybe_print_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:51 <libclang_rt.asan.so>+0x3d77f\n  #1    0x000020d0f660777f in ~scoped_report() compiler-rt/lib/ubsan/ubsan_diag.cpp:387 <libclang_rt.asan.so>+0x3d77f\n  #2    0x000020d0f660b96d in handlepointer_overflow_impl() compiler-rt/lib/ubsan/ubsan_handlers.cpp:809 <libclang_rt.asan.so>+0x4196d\n  #3    0x000020d0f660b50d in compiler-rt/lib/ubsan/ubsan_handlers.cpp:815 <libclang_rt.asan.so>+0x4150d\n  #4    0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 <platform-bus-x86.so>+0x233302\n  #5    0x000021e4213e2369 in acpi_ds_call_control_method(struct acpi_thread_state*, struct acpi_walk_state*, union acpi_parse_object*) ../../third_party/acpica/source/components/dispatcher/dsmethod.c:605 <platform-bus-x86.so>+0x262369\n  #6    0x000021e421437fac in acpi_ps_parse_aml(struct acpi_walk_state*) ../../third_party/acpica/source/components/parser/psparse.c:550 <platform-bus-x86.so>+0x2b7fac\n  #7    0x000021e4214464d2 in acpi_ps_execute_method(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/parser/psxface.c:244 <platform-bus-x86.so>+0x2c64d2\n  #8    0x000021e4213aa052 in acpi_ns_evaluate(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/namespace/nseval.c:250 <platform-bus-x86.so>+0x22a052\n  #9    0x000021e421413dd8 in acpi_ns_init_one_device(acpi_handle, u32, void*, void**) ../../third_party/acpica/source/components/namespace/nsinit.c:735 <platform-bus-x86.so>+0x293dd8\n  #10   0x000021e421429e98 in acpi_ns_walk_namespace(acpi_object_type, acpi_handle, u32, u32, acpi_walk_callback, acpi_walk_callback, void*, void**) ../../third_party/acpica/source/components/namespace/nswalk.c:298 <platform-bus-x86.so>+0x2a9e98\n  #11   0x000021e4214131ac in acpi_ns_initialize_devices(u32) ../../third_party/acpica/source/components/namespace/nsinit.c:268 <platform-bus-x86.so>+0x2931ac\n  #12   0x000021e42147c40d in acpi_initialize_objects(u32) ../../third_party/acpica/source/components/utilities/utxfinit.c:304 <platform-bus-x86.so>+0x2fc40d\n  #13   0x000021e42126d603 in acpi::acpi_impl::initialize_acpi(acpi::acpi_impl*) ../../src/devices/board/lib/acpi/acpi-impl.cc:224 <platform-bus-x86.so>+0xed603\n\nAdd a simple check that avoids incrementing a pointer by zero, but\notherwise behaves as before. Note that our findings are against ACPICA\n20221020, but the same code exists on master.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b714831e-ac89-4210-924d-a9b90201ea76",  "id": "CVE-2024-1151",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1151"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    121,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls into the code block. The OVS module does not validate the stack depth, pushing too many frames and causing a stack overflow. As a result, this can lead to a crash or other related issues.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "671b5c50-c128-49d8-936f-64983f28752e",  "id": "CLSA-2025-1760559298",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "559794e8-4cb7-48be-a528-641d7812e555",  "id": "DSA-3673-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "64c0295c-47a8-4574-886d-673d69f0f49d",  "id": "CVE-2011-3359",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3359"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The dma_rx function in drivers/net/wireless/b43/dma.c in the Linux kernel before 2.6.39 does not properly allocate receive buffers, which allows remote attackers to cause a denial of service (system crash) via a crafted frame.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "398f8e5d-433d-4699-9ba6-f0a70a6e8784",  "id": "CVE-2024-42093",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/dpaa2: Avoid explicit cpumask var allocation on stack\n\nFor CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask\nvariable on stack is not recommended since it can cause potential stack\noverflow.\n\nInstead, kernel code should always use *cpumask_var API(s) to allocate\ncpumask var in config-neutral way, leaving allocation strategy to\nCONFIG_CPUMASK_OFFSTACK.\n\nUse *cpumask_var API(s) to address it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "60d5705f-8e18-406c-a10a-7db82f514d16",  "id": "CVE-2023-0468",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0468"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Kernel due to a race condition of poll_refs. This flaw may cause a NULL pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1ef88eb2-dbf2-4bb6-a07a-20c79edd0f9e",  "id": "CVE-2024-53174",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: make sure cache entry active before cache_show\n\nThe function `c_show` was called with protection from RCU. This only\nensures that `cp` will not be freed. Therefore, the reference count for\n`cp` can drop to zero, which will trigger a refcount use-after-free\nwarning when `cache_get` is called. To resolve this issue, use\n`cache_get_rcu` to ensure that `cp` remains active.\n\n------------[ cut here ]------------\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 7 PID: 822 at lib/refcount.c:25\nrefcount_warn_saturate+0xb1/0x120\nCPU: 7 UID: 0 PID: 822 Comm: cat Not tainted 6.12.0-rc3+ #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nRIP: 0010:refcount_warn_saturate+0xb1/0x120\n\nCall Trace:\n <TASK>\n c_show+0x2fc/0x380 [sunrpc]\n seq_read_iter+0x589/0x770\n seq_read+0x1e5/0x270\n proc_reg_read+0xe1/0x140\n vfs_read+0x125/0x530\n ksys_read+0xc1/0x160\n do_syscall_64+0x5f/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d9d11513-7381-4a03-acd4-b479f74972f4",  "id": "CVE-2011-2022",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2022"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The agp_generic_remove_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 does not validate a certain start parameter, which allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_UNBIND agp_ioctl ioctl call, a different vulnerability than CVE-2011-1745.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e68d2356-2f0a-48c0-b442-aa15b49b2cdf",  "id": "CVE-2022-0487",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0487"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "67e94b3f-64d2-46ff-b54f-0722d6c87197",  "id": "RHSA-2023:1440",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17488b05-79e9-4901-b22a-42c226dd7e98",  "id": "RHSA-2020:5640",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "07f26aea-3c75-4750-8dcf-9c12cdf8df73",  "id": "CVE-2021-47118",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47118"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npid: take a reference when initializing `cad_pid`\n\nDuring boot, kernel_init_freeable() initializes `cad_pid` to the init\ntask's struct pid.  Later on, we may change `cad_pid` via a sysctl, and\nwhen this happens proc_do_cad_pid() will increment the refcount on the\nnew pid via get_pid(), and will decrement the refcount on the old pid\nvia put_pid().  As we never called get_pid() when we initialized\n`cad_pid`, we decrement a reference we never incremented, can therefore\nfree the init task's struct pid early.  As there can be dangling\nreferences to the struct pid, we can later encounter a use-after-free\n(e.g.  when delivering signals).\n\nThis was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to\nhave been around since the conversion of `cad_pid` to struct pid in\ncommit 9ec52099e4b8 (\"[PATCH] replace cad_pid by a struct pid\") from the\npre-KASAN stone age of v2.6.19.\n\nFix this by getting a reference to the init task's struct pid when we\nassign it to `cad_pid`.\n\nFull KASAN splat below.\n\n   ==================================================================\n   BUG: KASAN: use-after-free in ns_of_pid include/linux/pid.h:153 [inline]\n   BUG: KASAN: use-after-free in task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509\n   Read of size 4 at addr ffff23794dda0004 by task syz-executor.0/273\n\n   CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1\n   Hardware name: linux,dummy-virt (DT)\n   Call trace:\n    ns_of_pid include/linux/pid.h:153 [inline]\n    task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509\n    do_notify_parent+0x308/0xe60 kernel/signal.c:1950\n    exit_notify kernel/exit.c:682 [inline]\n    do_exit+0x2334/0x2bd0 kernel/exit.c:845\n    do_group_exit+0x108/0x2c8 kernel/exit.c:922\n    get_signal+0x4e4/0x2a88 kernel/signal.c:2781\n    do_signal arch/arm64/kernel/signal.c:882 [inline]\n    do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936\n    work_pending+0xc/0x2dc\n\n   Allocated by task 0:\n    slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516\n    slab_alloc_node mm/slub.c:2907 [inline]\n    slab_alloc mm/slub.c:2915 [inline]\n    kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920\n    alloc_pid+0xdc/0xc00 kernel/pid.c:180\n    copy_process+0x2794/0x5e18 kernel/fork.c:2129\n    kernel_clone+0x194/0x13c8 kernel/fork.c:2500\n    kernel_thread+0xd4/0x110 kernel/fork.c:2552\n    rest_init+0x44/0x4a0 init/main.c:687\n    arch_call_rest_init+0x1c/0x28\n    start_kernel+0x520/0x554 init/main.c:1064\n    0x0\n\n   Freed by task 270:\n    slab_free_hook mm/slub.c:1562 [inline]\n    slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600\n    slab_free mm/slub.c:3161 [inline]\n    kmem_cache_free+0x224/0x8e0 mm/slub.c:3177\n    put_pid.part.4+0xe0/0x1a8 kernel/pid.c:114\n    put_pid+0x30/0x48 kernel/pid.c:109\n    proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401\n    proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591\n    proc_sys_write+0x34/0x48 fs/proc/proc_sysctl.c:617\n    call_write_iter include/linux/fs.h:1977 [inline]\n    new_sync_write+0x3ac/0x510 fs/read_write.c:518\n    vfs_write fs/read_write.c:605 [inline]\n    vfs_write+0x9c4/0x1018 fs/read_write.c:585\n    ksys_write+0x124/0x240 fs/read_write.c:658\n    __do_sys_write fs/read_write.c:670 [inline]\n    __se_sys_write fs/read_write.c:667 [inline]\n    __arm64_sys_write+0x78/0xb0 fs/read_write.c:667\n    __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]\n    invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]\n    el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129\n    do_el0_svc+0xf8/0x150 arch/arm64/kernel/syscall.c:168\n    el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416\n    el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432\n    el0_sync+0x154/0x180 arch/arm64/kernel/entry.S:701\n\n   The buggy address belongs to the object at ffff23794dda0000\n    which belongs to the cache pid of size 224\n   The buggy address is located 4 bytes inside of\n    224-byte region [ff\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "60bf9fc2-fbbb-4c15-a458-4eacdbd67aaf",  "id": "CVE-2015-1333",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1333"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9a658b1d-f401-4eb3-8685-af59495b6cc6",  "id": "CVE-2022-49764",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Prevent bpf program recursion for raw tracepoint probes\n\nWe got report from sysbot [1] about warnings that were caused by\nbpf program attached to contention_begin raw tracepoint triggering\nthe same tracepoint by using bpf_trace_printk helper that takes\ntrace_printk_lock lock.\n\n Call Trace:\n  <TASK>\n  ? trace_event_raw_event_bpf_trace_printk+0x5f/0x90\n  bpf_trace_printk+0x2b/0xe0\n  bpf_prog_a9aec6167c091eef_prog+0x1f/0x24\n  bpf_trace_run2+0x26/0x90\n  native_queued_spin_lock_slowpath+0x1c6/0x2b0\n  _raw_spin_lock_irqsave+0x44/0x50\n  bpf_trace_printk+0x3f/0xe0\n  bpf_prog_a9aec6167c091eef_prog+0x1f/0x24\n  bpf_trace_run2+0x26/0x90\n  native_queued_spin_lock_slowpath+0x1c6/0x2b0\n  _raw_spin_lock_irqsave+0x44/0x50\n  bpf_trace_printk+0x3f/0xe0\n  bpf_prog_a9aec6167c091eef_prog+0x1f/0x24\n  bpf_trace_run2+0x26/0x90\n  native_queued_spin_lock_slowpath+0x1c6/0x2b0\n  _raw_spin_lock_irqsave+0x44/0x50\n  bpf_trace_printk+0x3f/0xe0\n  bpf_prog_a9aec6167c091eef_prog+0x1f/0x24\n  bpf_trace_run2+0x26/0x90\n  native_queued_spin_lock_slowpath+0x1c6/0x2b0\n  _raw_spin_lock_irqsave+0x44/0x50\n  __unfreeze_partials+0x5b/0x160\n  ...\n\nThe can be reproduced by attaching bpf program as raw tracepoint on\ncontention_begin tracepoint. The bpf prog calls bpf_trace_printk\nhelper. Then by running perf bench the spin lock code is forced to\ntake slow path and call contention_begin tracepoint.\n\nFixing this by skipping execution of the bpf program if it's\nalready running, Using bpf prog 'active' field, which is being\ncurrently used by trampoline programs for the same reason.\n\nMoving bpf_prog_inc_misses_counter to syscall.c because\ntrampoline.c is compiled in just for CONFIG_BPF_JIT option.\n\n[1] https://lore.kernel.org/bpf/YxhFe3EwqchC%2FfYf@krava/T/#t",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5876a1f1-c2f0-4683-967e-7e48275c4723",  "id": "CVE-2015-3288",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3288"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8ee86ec2-7650-496c-95a1-63547f5872be",  "id": "CVE-2022-1198",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1198"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef18ad8b-1bb9-4f72-a0e4-6dc82b9a27c8",  "id": "CVE-2025-37745",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM: hibernate: Avoid deadlock in hibernate_compressor_param_set()\n\nsyzbot reported a deadlock in lock_system_sleep() (see below).\n\nThe write operation to \"/sys/module/hibernate/parameters/compressor\"\nconflicts with the registration of ieee80211 device, resulting in a deadlock\nwhen attempting to acquire system_transition_mutex under param_lock.\n\nTo avoid this deadlock, change hibernate_compressor_param_set() to use\nmutex_trylock() for attempting to acquire system_transition_mutex and\nreturn -EBUSY when it fails.\n\nTask flags need not be saved or adjusted before calling\nmutex_trylock(&system_transition_mutex) because the caller is not going\nto end up waiting for this mutex and if it runs concurrently with system\nsuspend in progress, it will be frozen properly when it returns to user\nspace.\n\nsyzbot report:\n\nsyz-executor895/5833 is trying to acquire lock:\nffffffff8e0828c8 (system_transition_mutex){+.+.}-{4:4}, at: lock_system_sleep+0x87/0xa0 kernel/power/main.c:56\n\nbut task is already holding lock:\nffffffff8e07dc68 (param_lock){+.+.}-{4:4}, at: kernel_param_lock kernel/params.c:607 [inline]\nffffffff8e07dc68 (param_lock){+.+.}-{4:4}, at: param_attr_store+0xe6/0x300 kernel/params.c:586\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-> #3 (param_lock){+.+.}-{4:4}:\n       __mutex_lock_common kernel/locking/mutex.c:585 [inline]\n       __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730\n       ieee80211_rate_control_ops_get net/mac80211/rate.c:220 [inline]\n       rate_control_alloc net/mac80211/rate.c:266 [inline]\n       ieee80211_init_rate_ctrl_alg+0x18d/0x6b0 net/mac80211/rate.c:1015\n       ieee80211_register_hw+0x20cd/0x4060 net/mac80211/main.c:1531\n       mac80211_hwsim_new_radio+0x304e/0x54e0 drivers/net/wireless/virtual/mac80211_hwsim.c:5558\n       init_mac80211_hwsim+0x432/0x8c0 drivers/net/wireless/virtual/mac80211_hwsim.c:6910\n       do_one_initcall+0x128/0x700 init/main.c:1257\n       do_initcall_level init/main.c:1319 [inline]\n       do_initcalls init/main.c:1335 [inline]\n       do_basic_setup init/main.c:1354 [inline]\n       kernel_init_freeable+0x5c7/0x900 init/main.c:1568\n       kernel_init+0x1c/0x2b0 init/main.c:1457\n       ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148\n       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\n-> #2 (rtnl_mutex){+.+.}-{4:4}:\n       __mutex_lock_common kernel/locking/mutex.c:585 [inline]\n       __mutex_lock+0x19b/0xb10 kernel/locking/mutex.c:730\n       wg_pm_notification drivers/net/wireguard/device.c:80 [inline]\n       wg_pm_notification+0x49/0x180 drivers/net/wireguard/device.c:64\n       notifier_call_chain+0xb7/0x410 kernel/notifier.c:85\n       notifier_call_chain_robust kernel/notifier.c:120 [inline]\n       blocking_notifier_call_chain_robust kernel/notifier.c:345 [inline]\n       blocking_notifier_call_chain_robust+0xc9/0x170 kernel/notifier.c:333\n       pm_notifier_call_chain_robust+0x27/0x60 kernel/power/main.c:102\n       snapshot_open+0x189/0x2b0 kernel/power/user.c:77\n       misc_open+0x35a/0x420 drivers/char/misc.c:179\n       chrdev_open+0x237/0x6a0 fs/char_dev.c:414\n       do_dentry_open+0x735/0x1c40 fs/open.c:956\n       vfs_open+0x82/0x3f0 fs/open.c:1086\n       do_open fs/namei.c:3830 [inline]\n       path_openat+0x1e88/0x2d80 fs/namei.c:3989\n       do_filp_open+0x20c/0x470 fs/namei.c:4016\n       do_sys_openat2+0x17a/0x1e0 fs/open.c:1428\n       do_sys_open fs/open.c:1443 [inline]\n       __do_sys_openat fs/open.c:1459 [inline]\n       __se_sys_openat fs/open.c:1454 [inline]\n       __x64_sys_openat+0x175/0x210 fs/open.c:1454\n       do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n       do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n       entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n-> #1 ((pm_chain_head).rwsem){++++}-{4:4}:\n       down_read+0x9a/0x330 kernel/locking/rwsem.c:1524\n       blocking_notifier_call_chain_robust kerne\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2d27791-5791-4cb8-b529-3e0648bc2ebd",  "id": "CVE-2023-52589",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkisp1: Fix IRQ disable race issue\n\nIn rkisp1_isp_stop() and rkisp1_csi_disable() the driver masks the\ninterrupts and then apparently assumes that the interrupt handler won't\nbe running, and proceeds in the stop procedure. This is not the case, as\nthe interrupt handler can already be running, which would lead to the\nISP being disabled while the interrupt handler handling a captured\nframe.\n\nThis brings up two issues: 1) the ISP could be powered off while the\ninterrupt handler is still running and accessing registers, leading to\nboard lockup, and 2) the interrupt handler code and the code that\ndisables the streaming might do things that conflict.\n\nIt is not clear to me if 2) causes a real issue, but 1) can be seen with\na suitable delay (or printk in my case) in the interrupt handler,\nleading to board lockup.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "57941956-b085-4aba-ac6e-436dfdc787e1",  "id": "CVE-2026-31749",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: ni_atmio16d: Fix invalid clean-up after failed attach\n\nIf the driver's COMEDI \"attach\" handler function (`atmio16d_attach()`)\nreturns an error, the COMEDI core will call the driver's \"detach\"\nhandler function (`atmio16d_detach()`) to clean up.  This calls\n`reset_atmio16d()` unconditionally, but depending on where the error\noccurred in the attach handler, the device may not have been\nsufficiently initialized to call `reset_atmio16d()`.  It uses\n`dev->iobase` as the I/O port base address and `dev->private` as the\npointer to the COMEDI device's private data structure.  `dev->iobase`\nmay still be set to its initial value of 0, which would result in\nundesired writes to low I/O port addresses.  `dev->private` may still be\n`NULL`, which would result in null pointer dereferences.\n\nFix `atmio16d_detach()` by checking that `dev->private` is valid\n(non-null) before calling `reset_atmio16d()`.  This implies that\n`dev->iobase` was set correctly since that is set up before\n`dev->private`.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "563292a2-36b5-4bd6-acab-dde183553dd6",  "id": "CVE-2022-50511",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/fonts: fix undefined behavior in bit shift for get_default_font\n\nShifting signed 32-bit value by 31 bits is undefined, so changing\nsignificant bit to unsigned.  The UBSAN warning calltrace like below:\n\nUBSAN: shift-out-of-bounds in lib/fonts/fonts.c:139:20\nleft shift of 1 by 31 places cannot be represented in type 'int'\n <TASK>\n dump_stack_lvl+0x7d/0xa5\n dump_stack+0x15/0x1b\n ubsan_epilogue+0xe/0x4e\n __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c\n get_default_font+0x1c7/0x1f0\n fbcon_startup+0x347/0x3a0\n do_take_over_console+0xce/0x270\n do_fbcon_takeover+0xa1/0x170\n do_fb_registered+0x2a8/0x340\n fbcon_fb_registered+0x47/0xe0\n register_framebuffer+0x294/0x4a0\n __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper]\n drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper]\n drm_fbdev_client_hotplug+0x156/0x1b0 [drm_kms_helper]\n drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper]\n bochs_pci_probe+0x6ca/0x772 [bochs]\n local_pci_probe+0x4d/0xb0\n pci_device_probe+0x119/0x320\n really_probe+0x181/0x550\n __driver_probe_device+0xc6/0x220\n driver_probe_device+0x32/0x100\n __driver_attach+0x195/0x200\n bus_for_each_dev+0xbb/0x120\n driver_attach+0x27/0x30\n bus_add_driver+0x22e/0x2f0\n driver_register+0xa9/0x190\n __pci_register_driver+0x90/0xa0\n bochs_pci_driver_init+0x52/0x1000 [bochs]\n do_one_initcall+0x76/0x430\n do_init_module+0x61/0x28a\n load_module+0x1f82/0x2e50\n __do_sys_finit_module+0xf8/0x190\n __x64_sys_finit_module+0x23/0x30\n do_syscall_64+0x58/0x80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "633886d1-87a3-46c0-805f-ffe56462890e",  "id": "DSA-1888-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "50c70fd8-bb90-4461-93cb-543e715a7edc",  "id": "CVE-2023-53419",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu: Protect rcu_print_task_exp_stall() ->exp_tasks access\n\nFor kernels built with CONFIG_PREEMPT_RCU=y, the following scenario can\nresult in a NULL-pointer dereference:\n\n           CPU1                                           CPU2\nrcu_preempt_deferred_qs_irqrestore                rcu_print_task_exp_stall\n  if (special.b.blocked)                            READ_ONCE(rnp->exp_tasks) != NULL\n    raw_spin_lock_rcu_node\n    np = rcu_next_node_entry(t, rnp)\n    if (&t->rcu_node_entry == rnp->exp_tasks)\n      WRITE_ONCE(rnp->exp_tasks, np)\n      ....\n      raw_spin_unlock_irqrestore_rcu_node\n                                                    raw_spin_lock_irqsave_rcu_node\n                                                    t = list_entry(rnp->exp_tasks->prev,\n                                                        struct task_struct, rcu_node_entry)\n                                                    (if rnp->exp_tasks is NULL, this\n                                                       will dereference a NULL pointer)\n\nThe problem is that CPU2 accesses the rcu_node structure's->exp_tasks\nfield without holding the rcu_node structure's ->lock and CPU2 did\nnot observe CPU1's change to rcu_node structure's ->exp_tasks in time.\nTherefore, if CPU1 sets rcu_node structure's->exp_tasks pointer to NULL,\nthen CPU2 might dereference that NULL pointer.\n\nThis commit therefore holds the rcu_node structure's ->lock while\naccessing that structure's->exp_tasks field.\n\n[ paulmck: Apply Frederic Weisbecker feedback. ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3dd0ecfc-5360-48c8-b35f-6d54b8cfd698",  "id": "CVE-2024-27415",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: confirm multicast packets before passing them up the stack\n\nconntrack nf_confirm logic cannot handle cloned skbs referencing\nthe same nf_conn entry, which will happen for multicast (broadcast)\nframes on bridges.\n\n Example:\n    macvlan0\n       |\n      br0\n     /  \\\n  ethX    ethY\n\n ethX (or Y) receives a L2 multicast or broadcast packet containing\n an IP packet, flow is not yet in conntrack table.\n\n 1. skb passes through bridge and fake-ip (br_netfilter)Prerouting.\n    -> skb->_nfct now references a unconfirmed entry\n 2. skb is broad/mcast packet. bridge now passes clones out on each bridge\n    interface.\n 3. skb gets passed up the stack.\n 4. In macvlan case, macvlan driver retains clone(s) of the mcast skb\n    and schedules a work queue to send them out on the lower devices.\n\n    The clone skb->_nfct is not a copy, it is the same entry as the\n    original skb.  The macvlan rx handler then returns RX_HANDLER_PASS.\n 5. Normal conntrack hooks (in NF_INET_LOCAL_IN) confirm the orig skb.\n\nThe Macvlan broadcast worker and normal confirm path will race.\n\nThis race will not happen if step 2 already confirmed a clone. In that\ncase later steps perform skb_clone() with skb->_nfct already confirmed (in\nhash table).  This works fine.\n\nBut such confirmation won't happen when eb/ip/nftables rules dropped the\npackets before they reached the nf_confirm step in postrouting.\n\nPablo points out that nf_conntrack_bridge doesn't allow use of stateful\nnat, so we can safely discard the nf_conn entry and let inet call\nconntrack again.\n\nThis doesn't work for bridge netfilter: skb could have a nat\ntransformation. Also bridge nf prevents re-invocation of inet prerouting\nvia 'sabotage_in' hook.\n\nWork around this problem by explicit confirmation of the entry at LOCAL_IN\ntime, before upper layer has a chance to clone the unconfirmed entry.\n\nThe downside is that this disables NAT and conntrack helpers.\n\nAlternative fix would be to add locking to all code parts that deal with\nunconfirmed packets, but even if that could be done in a sane way this\nopens up other problems, for example:\n\n-m physdev --physdev-out eth0 -j SNAT --snat-to 1.2.3.4\n-m physdev --physdev-out eth1 -j SNAT --snat-to 1.2.3.5\n\nFor multicast case, only one of such conflicting mappings will be\ncreated, conntrack only handles 1:1 NAT mappings.\n\nUsers should set create a setup that explicitly marks such traffic\nNOTRACK (conntrack bypass) to avoid this, but we cannot auto-bypass\nthem, ruleset might have accept rules for untracked traffic already,\nso user-visible behaviour would change.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "02965942-59cd-489b-964c-5d0fe113bc95",  "id": "CVE-2024-27062",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau: lock the client object tree.\n\nIt appears the client object tree has no locking unless I've missed\nsomething else. Fix races around adding/removing client objects,\nmostly vram bar mappings.\n\n 4562.099306] general protection fault, probably for non-canonical address 0x6677ed422bceb80c: 0000 [#1] PREEMPT SMP PTI\n[ 4562.099314] CPU: 2 PID: 23171 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27\n[ 4562.099324] Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021\n[ 4562.099330] RIP: 0010:nvkm_object_search+0x1d/0x70 [nouveau]\n[ 4562.099503] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 48 89 f8 48 85 f6 74 39 48 8b 87 a0 00 00 00 48 85 c0 74 12 <48> 8b 48 f8 48 39 ce 73 15 48 8b 40 10 48 85 c0 75 ee 48 c7 c0 fe\n[ 4562.099506] RSP: 0000:ffffa94cc420bbf8 EFLAGS: 00010206\n[ 4562.099512] RAX: 6677ed422bceb814 RBX: ffff98108791f400 RCX: ffff9810f26b8f58\n[ 4562.099517] RDX: 0000000000000000 RSI: ffff9810f26b9158 RDI: ffff98108791f400\n[ 4562.099519] RBP: ffff9810f26b9158 R08: 0000000000000000 R09: 0000000000000000\n[ 4562.099521] R10: ffffa94cc420bc48 R11: 0000000000000001 R12: ffff9810f02a7cc0\n[ 4562.099526] R13: 0000000000000000 R14: 00000000000000ff R15: 0000000000000007\n[ 4562.099528] FS:  00007f629c5017c0(0000) GS:ffff98142c700000(0000) knlGS:0000000000000000\n[ 4562.099534] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 4562.099536] CR2: 00007f629a882000 CR3: 000000017019e004 CR4: 00000000003706f0\n[ 4562.099541] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 4562.099542] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 4562.099544] Call Trace:\n[ 4562.099555]  <TASK>\n[ 4562.099573]  ? die_addr+0x36/0x90\n[ 4562.099583]  ? exc_general_protection+0x246/0x4a0\n[ 4562.099593]  ? asm_exc_general_protection+0x26/0x30\n[ 4562.099600]  ? nvkm_object_search+0x1d/0x70 [nouveau]\n[ 4562.099730]  nvkm_ioctl+0xa1/0x250 [nouveau]\n[ 4562.099861]  nvif_object_map_handle+0xc8/0x180 [nouveau]\n[ 4562.099986]  nouveau_ttm_io_mem_reserve+0x122/0x270 [nouveau]\n[ 4562.100156]  ? dma_resv_test_signaled+0x26/0xb0\n[ 4562.100163]  ttm_bo_vm_fault_reserved+0x97/0x3c0 [ttm]\n[ 4562.100182]  ? __mutex_unlock_slowpath+0x2a/0x270\n[ 4562.100189]  nouveau_ttm_fault+0x69/0xb0 [nouveau]\n[ 4562.100356]  __do_fault+0x32/0x150\n[ 4562.100362]  do_fault+0x7c/0x560\n[ 4562.100369]  __handle_mm_fault+0x800/0xc10\n[ 4562.100382]  handle_mm_fault+0x17c/0x3e0\n[ 4562.100388]  do_user_addr_fault+0x208/0x860\n[ 4562.100395]  exc_page_fault+0x7f/0x200\n[ 4562.100402]  asm_exc_page_fault+0x26/0x30\n[ 4562.100412] RIP: 0033:0x9b9870\n[ 4562.100419] Code: 85 a8 f7 ff ff 8b 8d 80 f7 ff ff 89 08 e9 18 f2 ff ff 0f 1f 84 00 00 00 00 00 44 89 32 e9 90 fa ff ff 0f 1f 84 00 00 00 00 00 <44> 89 32 e9 f8 f1 ff ff 0f 1f 84 00 00 00 00 00 66 44 89 32 e9 e7\n[ 4562.100422] RSP: 002b:00007fff9ba2dc70 EFLAGS: 00010246\n[ 4562.100426] RAX: 0000000000000004 RBX: 000000000dd65e10 RCX: 000000fff0000000\n[ 4562.100428] RDX: 00007f629a882000 RSI: 00007f629a882000 RDI: 0000000000000066\n[ 4562.100432] RBP: 00007fff9ba2e570 R08: 0000000000000000 R09: 0000000123ddf000\n[ 4562.100434] R10: 0000000000000001 R11: 0000000000000246 R12: 000000007fffffff\n[ 4562.100436] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[ 4562.100446]  </TASK>\n[ 4562.100448] Modules linked in: nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink cmac bnep sunrpc iwlmvm intel_rapl_msr intel_rapl_common snd_sof_pci_intel_cnl x86_pkg_temp_thermal intel_powerclamp snd_sof_intel_hda_common mac80211 coretemp snd_soc_acpi_intel_match kvm_intel snd_soc_acpi snd_soc_hdac_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof_intel_hda_mlink \n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dca4a8ab-e696-449a-87fc-c991f1c40d6a",  "id": "CVE-2023-52594",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()\n\nFix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug\noccurs when txs->cnt, data from a URB provided by a USB device, is\nbigger than the size of the array txs->txstatus, which is\nHTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug\nhandling code after the check. Make the function return if that is the\ncase.\n\nFound by a modified version of syzkaller.\n\nUBSAN: array-index-out-of-bounds in htc_drv_txrx.c\nindex 13 is out of range for type '__wmi_event_txstatus [12]'\nCall Trace:\n ath9k_htc_txstatus\n ath9k_wmi_event_tasklet\n tasklet_action_common\n __do_softirq\n irq_exit_rxu\n sysvec_apic_timer_interrupt",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "41748398-a756-4269-8c46-dd836f98e6fd",  "id": "CVE-2026-31777",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Check the error for index mapping\n\nThe ctxfi driver blindly assumed a proper value returned from\ndaio_device_index(), but it's not always true.  Add a proper error\ncheck to deal with the error from the function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "491ed437-2ccf-4b9c-8895-342cd662e43b",  "id": "CVE-2023-52500",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command\n\nTags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed\nwhen we receive the response.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f51738c1-a78e-4964-bff7-537ddc9ecf36",  "id": "CVE-2011-4577",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4577"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC 3779 support is enabled, allows remote attackers to cause a denial of service (assertion failure) via an X.509 certificate containing certificate-extension data associated with (1) IP address blocks or (2) Autonomous System (AS) identifiers.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7667251a-d2bb-42cb-b810-b23f58f06da9",  "id": "CVE-2016-10147",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10147"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an AF_ALG socket with an incompatible algorithm, as demonstrated by mcryptd(md5).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "493e9a81-bd6c-4ae8-97b1-44e9eb3cd048",  "id": "CVE-2025-39753",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops\n\nClears up the warning added in 7ee3647243e5 (\"migrate: Remove call to\n->writepage\") that occurs in various xfstests, causing \"something found\nin dmesg\" failures.\n\n[  341.136573] gfs2_meta_aops does not implement migrate_folio\n[  341.136953] WARNING: CPU: 1 PID: 36 at mm/migrate.c:944 move_to_new_folio+0x2f8/0x300",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "828a1deb-428e-4296-a968-55d24fd816ae",  "id": "CVE-2024-58095",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: add check read-only before txBeginAnon() call\n\nAdded a read-only check before calling `txBeginAnon` in `extAlloc`\nand `extRecord`. This prevents modification attempts on a read-only\nmounted filesystem, avoiding potential errors or crashes.\n\nCall trace:\n txBeginAnon+0xac/0x154\n extAlloc+0xe8/0xdec fs/jfs/jfs_extent.c:78\n jfs_get_block+0x340/0xb98 fs/jfs/inode.c:248\n __block_write_begin_int+0x580/0x166c fs/buffer.c:2128\n __block_write_begin fs/buffer.c:2177 [inline]\n block_write_begin+0x98/0x11c fs/buffer.c:2236\n jfs_write_begin+0x44/0x88 fs/jfs/inode.c:299",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cc990098-4cca-435d-b3a4-85e125a9d50d",  "id": "DSA-3197-2",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "46d00291-db1b-4727-a37d-34d4d6ecac1e",  "id": "CVE-2024-53101",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Fix uninitialized value issue in from_kuid and from_kgid\n\nocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in\na trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set.\n\nInitialize all fields of newattrs to avoid uninitialized variables, by\nchecking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7b9cb2a0-3558-4054-9543-cf34871da049",  "id": "CVE-2023-53008",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix potential memory leaks in session setup\n\nMake sure to free cifs_ses::auth_key.response before allocating it as\nwe might end up leaking memory in reconnect or mounting.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "70093203-5abc-4673-b43c-35ee41ff41ea",  "id": "CVE-2016-4998",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4998"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'MSF:netfilter_priv_esc_ipv4'"    }  ]},{  "bom-ref": "a14dd15e-08ae-4a1d-8905-e771a88f1ed2",  "id": "SUSE-SU-2019:14092-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "93e78b49-fc2a-42bb-9256-e547a5490c15",  "id": "SUSE-SU-2026:22325-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "e52e445b-24d0-4150-822b-d76563b46e68",      "versions": [        {          "component": "sed",          "version": "4.0"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d4d44da3-60a3-4139-b126-43a77a40f1d8",  "id": "CVE-2011-2695",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2695"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    193  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a write operation involving a block number corresponding to the largest possible 32-bit unsigned integer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c2318c7-7ed4-4cce-90b8-60edd36fbe67",  "id": "CVE-2024-26902",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: RISCV: Fix panic on pmu overflow handler\n\n(1 << idx) of int is not desired when setting bits in unsigned long\noverflowed_ctrs, use BIT() instead. This panic happens when running\n'perf record -e branches' on sophgo sg2042.\n\n[  273.311852] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098\n[  273.320851] Oops [#1]\n[  273.323179] Modules linked in:\n[  273.326303] CPU: 0 PID: 1475 Comm: perf Not tainted 6.6.0-rc3+ #9\n[  273.332521] Hardware name: Sophgo Mango (DT)\n[  273.336878] epc : riscv_pmu_ctr_get_width_mask+0x8/0x62\n[  273.342291]  ra : pmu_sbi_ovf_handler+0x2e0/0x34e\n[  273.347091] epc : ffffffff80aecd98 ra : ffffffff80aee056 sp : fffffff6e36928b0\n[  273.354454]  gp : ffffffff821f82d0 tp : ffffffd90c353200 t0 : 0000002ade4f9978\n[  273.361815]  t1 : 0000000000504d55 t2 : ffffffff8016cd8c s0 : fffffff6e3692a70\n[  273.369180]  s1 : 0000000000000020 a0 : 0000000000000000 a1 : 00001a8e81800000\n[  273.376540]  a2 : 0000003c00070198 a3 : 0000003c00db75a4 a4 : 0000000000000015\n[  273.383901]  a5 : ffffffd7ff8804b0 a6 : 0000000000000015 a7 : 000000000000002a\n[  273.391327]  s2 : 000000000000ffff s3 : 0000000000000000 s4 : ffffffd7ff8803b0\n[  273.398773]  s5 : 0000000000504d55 s6 : ffffffd905069800 s7 : ffffffff821fe210\n[  273.406139]  s8 : 000000007fffffff s9 : ffffffd7ff8803b0 s10: ffffffd903f29098\n[  273.413660]  s11: 0000000080000000 t3 : 0000000000000003 t4 : ffffffff8017a0ca\n[  273.421022]  t5 : ffffffff8023cfc2 t6 : ffffffd9040780e8\n[  273.426437] status: 0000000200000100 badaddr: 0000000000000098 cause: 000000000000000d\n[  273.434512] [<ffffffff80aecd98>] riscv_pmu_ctr_get_width_mask+0x8/0x62\n[  273.441169] [<ffffffff80076bd8>] handle_percpu_devid_irq+0x98/0x1ee\n[  273.447562] [<ffffffff80071158>] generic_handle_domain_irq+0x28/0x36\n[  273.454151] [<ffffffff8047a99a>] riscv_intc_irq+0x36/0x4e\n[  273.459659] [<ffffffff80c944de>] handle_riscv_irq+0x4a/0x74\n[  273.465442] [<ffffffff80c94c48>] do_irq+0x62/0x92\n[  273.470360] Code: 0420 60a2 6402 5529 0141 8082 0013 0000 0013 0000 (6d5c) b783\n[  273.477921] ---[ end trace 0000000000000000 ]---\n[  273.482630] Kernel panic - not syncing: Fatal exception in interrupt",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "68535377-7bc1-452b-9bb0-2cd786a604f9",  "id": "CVE-2026-45843",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.199999999999999,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nslip: bound decode() reads against the compressed packet length\n\nslhc_uncompress() parses a VJ-compressed TCP header by advancing a\npointer through the packet via decode() and pull16(). Neither helper\nbounds-checks against isize, and decode() masks its return with\n& 0xffff so it can never return the -1 that callers test for -- those\nerror paths are dead code.\n\nA short compressed frame whose change byte requests optional fields\nlets decode() read past the end of the packet. The over-read bytes\nare folded into the cached cstate and reflected into subsequent\nreconstructed packets.\n\nMake decode() and pull16() take the packet end pointer and return -1\nwhen exhausted. Add a bounds check before the TCP-checksum read.\nThe existing == -1 tests now do what they were always meant to.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2bdf8f5-e78c-410e-b7ca-9aaee84164ec",  "id": "CVE-2024-57948",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: check local interfaces before deleting sdata list\n\nsyzkaller reported a corrupted list in ieee802154_if_remove. [1]\n\nRemove an IEEE 802.15.4 network interface after unregister an IEEE 802.15.4\nhardware device from the system.\n\nCPU0\t\t\t\t\tCPU1\n====\t\t\t\t\t====\ngenl_family_rcv_msg_doit\t\tieee802154_unregister_hw\nieee802154_del_iface\t\t\tieee802154_remove_interfaces\nrdev_del_virtual_intf_deprecated\tlist_del(&sdata->list)\nieee802154_if_remove\nlist_del_rcu\n\nThe net device has been unregistered, since the rcu grace period,\nunregistration must be run before ieee802154_if_remove.\n\nTo avoid this issue, add a check for local->interfaces before deleting\nsdata list.\n\n[1]\nkernel BUG at lib/list_debug.c:58!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 UID: 0 PID: 6277 Comm: syz-executor157 Not tainted 6.12.0-rc6-syzkaller-00005-g557329bcecc2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nRIP: 0010:__list_del_entry_valid_or_report+0xf4/0x140 lib/list_debug.c:56\nCode: e8 a1 7e 00 07 90 0f 0b 48 c7 c7 e0 37 60 8c 4c 89 fe e8 8f 7e 00 07 90 0f 0b 48 c7 c7 40 38 60 8c 4c 89 fe e8 7d 7e 00 07 90 <0f> 0b 48 c7 c7 a0 38 60 8c 4c 89 fe e8 6b 7e 00 07 90 0f 0b 48 c7\nRSP: 0018:ffffc9000490f3d0 EFLAGS: 00010246\nRAX: 000000000000004e RBX: dead000000000122 RCX: d211eee56bb28d00\nRDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000\nRBP: ffff88805b278dd8 R08: ffffffff8174a12c R09: 1ffffffff2852f0d\nR10: dffffc0000000000 R11: fffffbfff2852f0e R12: dffffc0000000000\nR13: dffffc0000000000 R14: dead000000000100 R15: ffff88805b278cc0\nFS:  0000555572f94380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000056262e4a3000 CR3: 0000000078496000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n __list_del_entry_valid include/linux/list.h:124 [inline]\n __list_del_entry include/linux/list.h:215 [inline]\n list_del_rcu include/linux/rculist.h:157 [inline]\n ieee802154_if_remove+0x86/0x1e0 net/mac802154/iface.c:687\n rdev_del_virtual_intf_deprecated net/ieee802154/rdev-ops.h:24 [inline]\n ieee802154_del_iface+0x2c0/0x5c0 net/ieee802154/nl-phy.c:323\n genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2551\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]\n netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357\n netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901\n sock_sendmsg_nosec net/socket.c:729 [inline]\n __sock_sendmsg+0x221/0x270 net/socket.c:744\n ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2607\n ___sys_sendmsg net/socket.c:2661 [inline]\n __sys_sendmsg+0x292/0x380 net/socket.c:2690\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "894161a1-26d5-4362-bdab-d0a5b67475ef",  "id": "CVE-2021-3612",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3612"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    20,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "367d8818-a11a-44ca-a514-f155b97c6608",  "id": "CVE-2025-38481",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large\n\nThe handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to\nhold the array of `struct comedi_insn`, getting the length from the\n`n_insns` member of the `struct comedi_insnlist` supplied by the user.\nThe allocation will fail with a WARNING and a stack dump if it is too\nlarge.\n\nAvoid that by failing with an `-EINVAL` error if the supplied `n_insns`\nvalue is unreasonable.\n\nDefine the limit on the `n_insns` value in the `MAX_INSNS` macro.  Set\nthis to the same value as `MAX_SAMPLES` (65536), which is the maximum\nallowed sum of the values of the member `n` in the array of `struct\ncomedi_insn`, and sensible comedi instructions will have an `n` of at\nleast 1.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3e5ccf72-6390-4313-a097-14590d9133a8",  "id": "RHSA-2022:1071",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed62959a-d93c-494b-a08a-fe6299538d70",  "id": "CVE-2020-25212",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25212"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    367,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bfd36045-e3b4-42a1-9ae3-8871bb679f60",  "id": "CVE-2024-46794",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/tdx: Fix data leak in mmio_read()\n\nThe mmio_read() function makes a TDVMCALL to retrieve MMIO data for an\naddress from the VMM.\n\nSean noticed that mmio_read() unintentionally exposes the value of an\ninitialized variable (val) on the stack to the VMM.\n\nThis variable is only needed as an output value. It did not need to be\npassed to the VMM in the first place.\n\nDo not send the original value of *val to the VMM.\n\n[ dhansen: clarify what 'val' is used for. ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b8dacbc-3cfb-4731-bc19-e3e7d99f449b",  "id": "CVE-2026-43037",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787,    843  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2->cb[] in ip4ip6_err()\n\nOskar Kjos reported the following problem.\n\nip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written\nby the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes\nIPCB(skb2) to __ip_options_echo(), which interprets that cb[] region\nas struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff\nat offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr\nvalue. __ip_options_echo() then reads optlen from attacker-controlled\npacket data at sptr[rr+1] and copies that many bytes into dopt->__data,\na fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).\n\nTo fix this we clear skb2->cb[], as suggested by Oskar Kjos.\n\nAlso add minimal IPv4 header validation (version == 4, ihl >= 5).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae82b362-208f-45c2-9351-42e9e52e6635",  "id": "GHSA-6h88-qjpv-p32m",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7389d9db-4c11-40cd-93d3-e492411aa78e",  "id": "CVE-2020-12464",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12464"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer occurs without a reference, aka CID-056ad39ee925.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2dec548-54b2-479f-ace9-f93c4839ec69",  "id": "CVE-2024-46804",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add array index check for hdcp ddc access\n\n[Why]\nCoverity reports OVERRUN warning. Do not check if array\nindex valid.\n\n[How]\nCheck msg_id valid and valid array index.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d23b6167-21ac-4117-9ec9-d260bdab4088",  "id": "OESA-2026-3579",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c30b38c9-fb52-4225-8288-c3334ac2d89c",  "id": "CVE-2024-42082",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: Remove WARN() from __xdp_reg_mem_model()\n\nsyzkaller reports a warning in __xdp_reg_mem_model().\n\nThe warning occurs only if __mem_id_init_hash_table() returns an error. It\nreturns the error in two cases:\n\n  1. memory allocation fails;\n  2. rhashtable_init() fails when some fields of rhashtable_params\n     struct are not initialized properly.\n\nThe second case cannot happen since there is a static const rhashtable_params\nstruct with valid fields. So, warning is only triggered when there is a\nproblem with memory allocation.\n\nThus, there is no sense in using WARN() to handle this error and it can be\nsafely removed.\n\nWARNING: CPU: 0 PID: 5065 at net/core/xdp.c:299 __xdp_reg_mem_model+0x2d9/0x650 net/core/xdp.c:299\n\nCPU: 0 PID: 5065 Comm: syz-executor883 Not tainted 6.8.0-syzkaller-05271-gf99c5f563c17 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nRIP: 0010:__xdp_reg_mem_model+0x2d9/0x650 net/core/xdp.c:299\n\nCall Trace:\n xdp_reg_mem_model+0x22/0x40 net/core/xdp.c:344\n xdp_test_run_setup net/bpf/test_run.c:188 [inline]\n bpf_test_run_xdp_live+0x365/0x1e90 net/bpf/test_run.c:377\n bpf_prog_test_run_xdp+0x813/0x11b0 net/bpf/test_run.c:1267\n bpf_prog_test_run+0x33a/0x3b0 kernel/bpf/syscall.c:4240\n __sys_bpf+0x48d/0x810 kernel/bpf/syscall.c:5649\n __do_sys_bpf kernel/bpf/syscall.c:5738 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5736 [inline]\n __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nFound by Linux Verification Center (linuxtesting.org) with syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e5010a3d-8eb8-461c-935d-1cdfc69820b7",  "id": "CVE-2017-13088",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13088"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    323,    330  ],  "analysis": {    "state": "in_triage"  },  "description": "Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d40ec11e-313a-4ad6-ae71-1921bd1b5b64",  "id": "CVE-2024-53680",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()\n\nUnder certain kernel configurations when building with Clang/LLVM, the\ncompiler does not generate a return or jump as the terminator\ninstruction for ip_vs_protocol_init(), triggering the following objtool\nwarning during build time:\n\n  vmlinux.o: warning: objtool: ip_vs_protocol_init() falls through to next function __initstub__kmod_ip_vs_rr__935_123_ip_vs_rr_init6()\n\nAt runtime, this either causes an oops when trying to load the ipvs\nmodule or a boot-time panic if ipvs is built-in. This same issue has\nbeen reported by the Intel kernel test robot previously.\n\nDigging deeper into both LLVM and the kernel code reveals this to be a\nundefined behavior problem. ip_vs_protocol_init() uses a on-stack buffer\nof 64 chars to store the registered protocol names and leaves it\nuninitialized after definition. The function calls strnlen() when\nconcatenating protocol names into the buffer. With CONFIG_FORTIFY_SOURCE\nstrnlen() performs an extra step to check whether the last byte of the\ninput char buffer is a null character (commit 3009f891bb9f (\"fortify:\nAllow strlen() and strnlen() to pass compile-time known lengths\")).\nThis, together with possibly other configurations, cause the following\nIR to be generated:\n\n  define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #5 section \".init.text\" align 16 !kcfi_type !29 {\n    %1 = alloca [64 x i8], align 16\n    ...\n\n  14:                                               ; preds = %11\n    %15 = getelementptr inbounds i8, ptr %1, i64 63\n    %16 = load i8, ptr %15, align 1\n    %17 = tail call i1 @llvm.is.constant.i8(i8 %16)\n    %18 = icmp eq i8 %16, 0\n    %19 = select i1 %17, i1 %18, i1 false\n    br i1 %19, label %20, label %23\n\n  20:                                               ; preds = %14\n    %21 = call i64 @strlen(ptr noundef nonnull dereferenceable(1) %1) #23\n    ...\n\n  23:                                               ; preds = %14, %11, %20\n    %24 = call i64 @strnlen(ptr noundef nonnull dereferenceable(1) %1, i64 noundef 64) #24\n    ...\n  }\n\nThe above code calculates the address of the last char in the buffer\n(value %15) and then loads from it (value %16). Because the buffer is\nnever initialized, the LLVM GVN pass marks value %16 as undefined:\n\n  %13 = getelementptr inbounds i8, ptr %1, i64 63\n  br i1 undef, label %14, label %17\n\nThis gives later passes (SCCP, in particular) more DCE opportunities by\npropagating the undef value further, and eventually removes everything\nafter the load on the uninitialized stack location:\n\n  define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #0 section \".init.text\" align 16 !kcfi_type !11 {\n    %1 = alloca [64 x i8], align 16\n    ...\n\n  12:                                               ; preds = %11\n    %13 = getelementptr inbounds i8, ptr %1, i64 63\n    unreachable\n  }\n\nIn this way, the generated native code will just fall through to the\nnext function, as LLVM does not generate any code for the unreachable IR\ninstruction and leaves the function without a terminator.\n\nZero the on-stack buffer to avoid this possible UB.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cdcd302e-5778-42e7-b2cb-085d277dd4ee",  "id": "CVE-2023-52583",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix deadlock or deadcode of misusing dget()\n\nThe lock order is incorrect between denty and its parent, we should\nalways make sure that the parent get the lock first.\n\nBut since this deadcode is never used and the parent dir will always\nbe set from the callers, let's just remove it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be0ecee0-3071-4c88-973d-a6cab42a523b",  "id": "CVE-2024-46836",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: aspeed_udc: validate endpoint index for ast udc\n\nWe should verify the bound of the array to assure that host\nmay not manipulate the index to point past endpoint array.\n\nFound by static analysis.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "49a24c44-594f-4d91-b769-7edb78ec7ba1",  "id": "CVE-2022-50030",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input\n\nMalformed user input to debugfs results in buffer overflow crashes.  Adapt\ninput string lengths to fit within internal buffers, leaving space for NULL\nterminators.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ecc88c0b-098b-4332-8596-435049fc3d64",  "id": "RHSA-2021:3798",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b0fdc10f-fb92-4f07-bd5a-56193dc20343",  "id": "CVE-2017-12168",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12168"  },  "ratings": [    {      "score": 6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "The access_pmu_evcntr function in arch/arm64/kvm/sys_regs.c in the Linux kernel before 4.8.11 allows privileged KVM guest OS users to cause a denial of service (assertion failure and host OS crash) by accessing the Performance Monitors Cycle Count Register (PMCCNTR).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "511f8676-16f7-41c5-8a9b-c9a7c20af99f",  "id": "CVE-2014-8989",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8989"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a \"negative groups\" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32b10e6f-fc58-49b7-ae81-b0d87c548d33",  "id": "CVE-2020-25683",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25683"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    122  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6743b360-bbb8-462c-839c-025637ff00b4",  "id": "CVE-2022-49307",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: synclink_gt: Fix null-pointer-dereference in slgt_clean()\n\nWhen the driver fails at alloc_hdlcdev(), and then we remove the driver\nmodule, we will get the following splat:\n\n[   25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI\n[   25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]\n[   25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0\n[   25.077709] Call Trace:\n[   25.077924]  <TASK>\n[   25.078108]  unregister_hdlc_device+0x16/0x30\n[   25.078481]  slgt_cleanup+0x157/0x9f0 [synclink_gt]\n\nFix this by checking whether the 'info->netdev' is a null pointer first.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b786fcca-1fe3-4c4d-bfc8-6cbb17caee32",  "id": "CVE-2023-42755",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42755"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "34ddefd6-ca8b-41bc-9c08-97d4f3e0586c",  "id": "CVE-2009-0590",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0590"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "206874d6-4079-465c-b9d6-be634ee2b718",  "id": "CVE-2025-37862",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: pidff: Fix null pointer dereference in pidff_find_fields\n\nThis function triggered a null pointer dereference if used to search for\na report that isn't implemented on the device. This happened both for\noptional and required reports alike.\n\nThe same logic was applied to pidff_find_special_field and although\npidff_init_fields should return an error earlier if one of the required\nreports is missing, future modifications could change this logic and\nresurface this possible null pointer dereference again.\n\nLKML bug report:\nhttps://lore.kernel.org/all/CAL-gK7f5=R0nrrQdPtaZZr1fd-cdAMbDMuZ_NLA8vM0SX+nGSw@mail.gmail.com",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "970632a0-9b4e-47fc-86e1-2596023a897e",  "id": "CVE-2023-52843",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: verify mac len before reading mac header\n\nLLC reads the mac header with eth_hdr without verifying that the skb\nhas an Ethernet header.\n\nSyzbot was able to enter llc_rcv on a tun device. Tun can insert\npackets without mac len and with user configurable skb->protocol\n(passing a tun_pi header when not configuring IFF_NO_PI).\n\n    BUG: KMSAN: uninit-value in llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]\n    BUG: KMSAN: uninit-value in llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111\n    llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline]\n    llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111\n    llc_rcv+0xc5d/0x14a0 net/llc/llc_input.c:218\n    __netif_receive_skb_one_core net/core/dev.c:5523 [inline]\n    __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637\n    netif_receive_skb_internal net/core/dev.c:5723 [inline]\n    netif_receive_skb+0x58/0x660 net/core/dev.c:5782\n    tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555\n    tun_get_user+0x54c5/0x69c0 drivers/net/tun.c:2002\n\nAdd a mac_len test before all three eth_hdr(skb) calls under net/llc.\n\nThere are further uses in include/net/llc_pdu.h. All these are\nprotected by a test skb->protocol == ETH_P_802_2. Which does not\nprotect against this tun scenario.\n\nBut the mac_len test added in this patch in llc_fixup_skb will\nindirectly protect those too. That is called from llc_rcv before any\nother LLC code.\n\nIt is tempting to just add a blanket mac_len check in llc_rcv, but\nnot sure whether that could break valid LLC paths that do not assume\nan Ethernet header. 802.2 LLC may be used on top of non-802.3\nprotocols in principle. The below referenced commit shows that used\nto, on top of Token Ring.\n\nAt least one of the three eth_hdr uses goes back to before the start\nof git history. But the one that syzbot exercises is introduced in\nthis commit. That commit is old enough (2008), that effectively all\nstable kernels should receive this.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "df024b15-e408-40fe-9bbb-a8fccf3cb009",  "id": "CVE-2026-46108",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi:si: Return state to normal if message allocation fails\n\nThere were places where nothing would get started if a message\nallocation failed, so the driver needs to return to normal state.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "003d0c4e-c485-4b28-a3be-c4b08b351ade",  "id": "CVE-2010-4158",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4158"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM instruction, which allows local users to obtain potentially sensitive information from kernel stack memory via a crafted socket filter.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:34987'"    }  ]},{  "bom-ref": "5d99d1df-78ac-4760-9c78-4d31edc7daff",  "id": "RLSA-2021:1024",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a15450c8-7e0a-4af0-9c42-aa508841f346",  "id": "CVE-2019-16714",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16714"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are not initialized.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "92def190-d433-4642-b09b-d65f1b47c301",  "id": "CVE-2025-38234",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/rt: Fix race in push_rt_task\n\nOverview\n========\nWhen a CPU chooses to call push_rt_task and picks a task to push to\nanother CPU's runqueue then it will call find_lock_lowest_rq method\nwhich would take a double lock on both CPUs' runqueues. If one of the\nlocks aren't readily available, it may lead to dropping the current\nrunqueue lock and reacquiring both the locks at once. During this window\nit is possible that the task is already migrated and is running on some\nother CPU. These cases are already handled. However, if the task is\nmigrated and has already been executed and another CPU is now trying to\nwake it up (ttwu) such that it is queued again on the runqeue\n(on_rq is 1) and also if the task was run by the same CPU, then the\ncurrent checks will pass even though the task was migrated out and is no\nlonger in the pushable tasks list.\n\nCrashes\n=======\nThis bug resulted in quite a few flavors of crashes triggering kernel\npanics with various crash signatures such as assert failures, page\nfaults, null pointer dereferences, and queue corruption errors all\ncoming from scheduler itself.\n\nSome of the crashes:\n-> kernel BUG at kernel/sched/rt.c:1616! BUG_ON(idx >= MAX_RT_PRIO)\n   Call Trace:\n   ? __die_body+0x1a/0x60\n   ? die+0x2a/0x50\n   ? do_trap+0x85/0x100\n   ? pick_next_task_rt+0x6e/0x1d0\n   ? do_error_trap+0x64/0xa0\n   ? pick_next_task_rt+0x6e/0x1d0\n   ? exc_invalid_op+0x4c/0x60\n   ? pick_next_task_rt+0x6e/0x1d0\n   ? asm_exc_invalid_op+0x12/0x20\n   ? pick_next_task_rt+0x6e/0x1d0\n   __schedule+0x5cb/0x790\n   ? update_ts_time_stats+0x55/0x70\n   schedule_idle+0x1e/0x40\n   do_idle+0x15e/0x200\n   cpu_startup_entry+0x19/0x20\n   start_secondary+0x117/0x160\n   secondary_startup_64_no_verify+0xb0/0xbb\n\n-> BUG: kernel NULL pointer dereference, address: 00000000000000c0\n   Call Trace:\n   ? __die_body+0x1a/0x60\n   ? no_context+0x183/0x350\n   ? __warn+0x8a/0xe0\n   ? exc_page_fault+0x3d6/0x520\n   ? asm_exc_page_fault+0x1e/0x30\n   ? pick_next_task_rt+0xb5/0x1d0\n   ? pick_next_task_rt+0x8c/0x1d0\n   __schedule+0x583/0x7e0\n   ? update_ts_time_stats+0x55/0x70\n   schedule_idle+0x1e/0x40\n   do_idle+0x15e/0x200\n   cpu_startup_entry+0x19/0x20\n   start_secondary+0x117/0x160\n   secondary_startup_64_no_verify+0xb0/0xbb\n\n-> BUG: unable to handle page fault for address: ffff9464daea5900\n   kernel BUG at kernel/sched/rt.c:1861! BUG_ON(rq->cpu != task_cpu(p))\n\n-> kernel BUG at kernel/sched/rt.c:1055! BUG_ON(!rq->nr_running)\n   Call Trace:\n   ? __die_body+0x1a/0x60\n   ? die+0x2a/0x50\n   ? do_trap+0x85/0x100\n   ? dequeue_top_rt_rq+0xa2/0xb0\n   ? do_error_trap+0x64/0xa0\n   ? dequeue_top_rt_rq+0xa2/0xb0\n   ? exc_invalid_op+0x4c/0x60\n   ? dequeue_top_rt_rq+0xa2/0xb0\n   ? asm_exc_invalid_op+0x12/0x20\n   ? dequeue_top_rt_rq+0xa2/0xb0\n   dequeue_rt_entity+0x1f/0x70\n   dequeue_task_rt+0x2d/0x70\n   __schedule+0x1a8/0x7e0\n   ? blk_finish_plug+0x25/0x40\n   schedule+0x3c/0xb0\n   futex_wait_queue_me+0xb6/0x120\n   futex_wait+0xd9/0x240\n   do_futex+0x344/0xa90\n   ? get_mm_exe_file+0x30/0x60\n   ? audit_exe_compare+0x58/0x70\n   ? audit_filter_rules.constprop.26+0x65e/0x1220\n   __x64_sys_futex+0x148/0x1f0\n   do_syscall_64+0x30/0x80\n   entry_SYSCALL_64_after_hwframe+0x62/0xc7\n\n-> BUG: unable to handle page fault for address: ffff8cf3608bc2c0\n   Call Trace:\n   ? __die_body+0x1a/0x60\n   ? no_context+0x183/0x350\n   ? spurious_kernel_fault+0x171/0x1c0\n   ? exc_page_fault+0x3b6/0x520\n   ? plist_check_list+0x15/0x40\n   ? plist_check_list+0x2e/0x40\n   ? asm_exc_page_fault+0x1e/0x30\n   ? _cond_resched+0x15/0x30\n   ? futex_wait_queue_me+0xc8/0x120\n   ? futex_wait+0xd9/0x240\n   ? try_to_wake_up+0x1b8/0x490\n   ? futex_wake+0x78/0x160\n   ? do_futex+0xcd/0xa90\n   ? plist_check_list+0x15/0x40\n   ? plist_check_list+0x2e/0x40\n   ? plist_del+0x6a/0xd0\n   ? plist_check_list+0x15/0x40\n   ? plist_check_list+0x2e/0x40\n   ? dequeue_pushable_task+0x20/0x70\n   ? __schedule+0x382/0x7e0\n   ? asm_sysvec_reschedule_i\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ee5f20c-a32d-4a2a-82c2-1c228b25e4f1",  "id": "CVE-2024-56551",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix usage slab after free\n\n[  +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]\n[  +0.000027] Read of size 8 at addr ffff8881b8605f88 by task amd_pci_unplug/2147\n\n[  +0.000023] CPU: 6 PID: 2147 Comm: amd_pci_unplug Not tainted 6.10.0+ #1\n[  +0.000016] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020\n[  +0.000016] Call Trace:\n[  +0.000008]  <TASK>\n[  +0.000009]  dump_stack_lvl+0x76/0xa0\n[  +0.000017]  print_report+0xce/0x5f0\n[  +0.000017]  ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]\n[  +0.000019]  ? srso_return_thunk+0x5/0x5f\n[  +0.000015]  ? kasan_complete_mode_report_info+0x72/0x200\n[  +0.000016]  ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]\n[  +0.000019]  kasan_report+0xbe/0x110\n[  +0.000015]  ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]\n[  +0.000023]  __asan_report_load8_noabort+0x14/0x30\n[  +0.000014]  drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]\n[  +0.000020]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? __kasan_check_write+0x14/0x30\n[  +0.000016]  ? __pfx_drm_sched_entity_flush+0x10/0x10 [gpu_sched]\n[  +0.000020]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? __kasan_check_write+0x14/0x30\n[  +0.000013]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? enable_work+0x124/0x220\n[  +0.000015]  ? __pfx_enable_work+0x10/0x10\n[  +0.000013]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? free_large_kmalloc+0x85/0xf0\n[  +0.000016]  drm_sched_entity_destroy+0x18/0x30 [gpu_sched]\n[  +0.000020]  amdgpu_vce_sw_fini+0x55/0x170 [amdgpu]\n[  +0.000735]  ? __kasan_check_read+0x11/0x20\n[  +0.000016]  vce_v4_0_sw_fini+0x80/0x110 [amdgpu]\n[  +0.000726]  amdgpu_device_fini_sw+0x331/0xfc0 [amdgpu]\n[  +0.000679]  ? mutex_unlock+0x80/0xe0\n[  +0.000017]  ? __pfx_amdgpu_device_fini_sw+0x10/0x10 [amdgpu]\n[  +0.000662]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? __kasan_check_write+0x14/0x30\n[  +0.000013]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? mutex_unlock+0x80/0xe0\n[  +0.000016]  amdgpu_driver_release_kms+0x16/0x80 [amdgpu]\n[  +0.000663]  drm_minor_release+0xc9/0x140 [drm]\n[  +0.000081]  drm_release+0x1fd/0x390 [drm]\n[  +0.000082]  __fput+0x36c/0xad0\n[  +0.000018]  __fput_sync+0x3c/0x50\n[  +0.000014]  __x64_sys_close+0x7d/0xe0\n[  +0.000014]  x64_sys_call+0x1bc6/0x2680\n[  +0.000014]  do_syscall_64+0x70/0x130\n[  +0.000014]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? irqentry_exit_to_user_mode+0x60/0x190\n[  +0.000015]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? irqentry_exit+0x43/0x50\n[  +0.000012]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? exc_page_fault+0x7c/0x110\n[  +0.000015]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  +0.000014] RIP: 0033:0x7ffff7b14f67\n[  +0.000013] Code: ff e8 0d 16 02 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 73 ba f7 ff\n[  +0.000026] RSP: 002b:00007fffffffe378 EFLAGS: 00000246 ORIG_RAX: 0000000000000003\n[  +0.000019] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffff7b14f67\n[  +0.000014] RDX: 0000000000000000 RSI: 00007ffff7f6f47a RDI: 0000000000000003\n[  +0.000014] RBP: 00007fffffffe3a0 R08: 0000555555569890 R09: 0000000000000000\n[  +0.000014] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffffffe5c8\n[  +0.000013] R13: 00005555555552a9 R14: 0000555555557d48 R15: 00007ffff7ffd040\n[  +0.000020]  </TASK>\n\n[  +0.000016] Allocated by task 383 on cpu 7 at 26.880319s:\n[  +0.000014]  kasan_save_stack+0x28/0x60\n[  +0.000008]  kasan_save_track+0x18/0x70\n[  +0.000007]  kasan_save_alloc_info+0x38/0x60\n[  +0.000007]  __kasan_kmalloc+0xc1/0xd0\n[  +0.000007]  kmalloc_trace_noprof+0x180/0x380\n[  +0.000007]  drm_sched_init+0x411/0xec0 [gpu_sched]\n[  +0.000012]  amdgpu_device_init+0x695f/0xa610 [amdgpu]\n[  +0.000658]  amdgpu_driver_load_kms+0x1a/0x120 [amdgpu]\n[  +0.000662]  amdgpu_pci_p\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3766d2a9-6261-471f-bf7e-6ae292d172b8",  "id": "CVE-2026-53082",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hamradio: 6pack: fix uninit-value in sixpack_receive_buf\n\nsixpack_receive_buf() does not properly skip bytes with TTY error flags.\nThe while loop iterates through the flags buffer but never advances the\ndata pointer (cp), and passes the original count (including error bytes)\nto sixpack_decode(). This causes sixpack_decode() to process bytes that\nshould have been skipped due to TTY errors.  The TTY layer does not\nguarantee that cp[i] holds a meaningful value when fp[i] is set, so\npassing those positions to sixpack_decode() results in KMSAN reporting\nan uninit-value read.\n\nFix this by processing bytes one at a time, advancing cp on each\niteration, and only passing valid (non-error) bytes to sixpack_decode().\nThis matches the pattern used by slip_receive_buf() and\nmkiss_receive_buf() for the same purpose.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "33cd54b1-0d35-4728-9a26-a3673054f41d",  "id": "CVE-2017-9986",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9986"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The intr function in sound/oss/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a \"double fetch\" vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "16da3ff2-0e52-48e1-b3a7-bd6334f2c6a3",  "id": "DLA-1932-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "792f77f8-23c5-49aa-8e31-4c831d21d7a3",  "id": "CVE-2013-0268",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0268"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:27297'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:122678/Linux-Kernel-MSR-Driver-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "ae5c4fcc-e385-4730-9629-42d95764c1d8",  "id": "CVE-2022-49545",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Cancel pending work at closing a MIDI substream\n\nAt closing a USB MIDI output substream, there might be still a pending\nwork, which would eventually access the rawmidi runtime object that is\nbeing released.  For fixing the race, make sure to cancel the pending\nwork at closing.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f53014e4-fa03-408b-a152-bf1da344aff9",  "id": "CVE-2024-35939",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.300000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-direct: Leak pages on dma_set_decrypted() failure\n\nOn TDX it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nDMA could free decrypted/shared pages if dma_set_decrypted() fails. This\nshould be a rare case. Just leak the pages in this case instead of\nfreeing them.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "29a45309-af14-4130-885e-003c9d94f368",  "id": "CVE-2016-8660",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8660"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    19  ],  "analysis": {    "state": "in_triage"  },  "description": "The XFS subsystem in the Linux kernel through 4.8.2 allows local users to cause a denial of service (fdatasync failure and system hang) by using the vfs syscall group in the trinity program, related to a \"page lock order bug in the XFS seek hole/data implementation.\"",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fade3977-2d82-4059-ac17-5a88c0943d6b",  "id": "CVE-2023-53337",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: do not write dirty data after degenerating to read-only\n\nAccording to syzbot's report, mark_buffer_dirty() called from\nnilfs_segctor_do_construct() outputs a warning with some patterns after\nnilfs2 detects metadata corruption and degrades to read-only mode.\n\nAfter such read-only degeneration, page cache data may be cleared through\nnilfs_clear_dirty_page() which may also clear the uptodate flag for their\nbuffer heads.  However, even after the degeneration, log writes are still\nperformed by unmount processing etc., which causes mark_buffer_dirty() to\nbe called for buffer heads without the \"uptodate\" flag and causes the\nwarning.\n\nSince any writes should not be done to a read-only file system in the\nfirst place, this fixes the warning in mark_buffer_dirty() by letting\nnilfs_segctor_do_construct() abort early if in read-only mode.\n\nThis also changes the retry check of nilfs_segctor_write_out() to avoid\nunnecessary log write retries if it detects -EROFS that\nnilfs_segctor_do_construct() returned.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7bf2e01a-70cc-4b33-91b4-4beca79d9841",  "id": "CVE-2024-56602",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ieee802154: do not leave a dangling sk pointer in ieee802154_create()\n\nsock_init_data() attaches the allocated sk object to the provided sock\nobject. If ieee802154_create() fails later, the allocated sk object is\nfreed, but the dangling pointer remains in the provided sock object, which\nmay allow use-after-free.\n\nClear the sk pointer in the sock object on error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a2ad350c-445c-4cf7-995a-aa4dec595705",  "id": "CVE-2022-49007",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()\n\nSyzbot reported a null-ptr-deref bug:\n\n NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP\n frequency < 30 seconds\n general protection fault, probably for non-canonical address\n 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n CPU: 1 PID: 3603 Comm: segctord Not tainted\n 6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0\n Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google\n 10/11/2022\n RIP: 0010:nilfs_palloc_commit_free_entry+0xe5/0x6b0\n fs/nilfs2/alloc.c:608\n Code: 00 00 00 00 fc ff df 80 3c 02 00 0f 85 cd 05 00 00 48 b8 00 00 00\n 00 00 fc ff df 4c 8b 73 08 49 8d 7e 10 48 89 fa 48 c1 ea 03 <80> 3c 02\n 00 0f 85 26 05 00 00 49 8b 46 10 be a6 00 00 00 48 c7 c7\n RSP: 0018:ffffc90003dff830 EFLAGS: 00010212\n RAX: dffffc0000000000 RBX: ffff88802594e218 RCX: 000000000000000d\n RDX: 0000000000000002 RSI: 0000000000002000 RDI: 0000000000000010\n RBP: ffff888071880222 R08: 0000000000000005 R09: 000000000000003f\n R10: 000000000000000d R11: 0000000000000000 R12: ffff888071880158\n R13: ffff88802594e220 R14: 0000000000000000 R15: 0000000000000004\n FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000)\n knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fb1c08316a8 CR3: 0000000018560000 CR4: 0000000000350ee0\n Call Trace:\n  <TASK>\n  nilfs_dat_commit_free fs/nilfs2/dat.c:114 [inline]\n  nilfs_dat_commit_end+0x464/0x5f0 fs/nilfs2/dat.c:193\n  nilfs_dat_commit_update+0x26/0x40 fs/nilfs2/dat.c:236\n  nilfs_btree_commit_update_v+0x87/0x4a0 fs/nilfs2/btree.c:1940\n  nilfs_btree_commit_propagate_v fs/nilfs2/btree.c:2016 [inline]\n  nilfs_btree_propagate_v fs/nilfs2/btree.c:2046 [inline]\n  nilfs_btree_propagate+0xa00/0xd60 fs/nilfs2/btree.c:2088\n  nilfs_bmap_propagate+0x73/0x170 fs/nilfs2/bmap.c:337\n  nilfs_collect_file_data+0x45/0xd0 fs/nilfs2/segment.c:568\n  nilfs_segctor_apply_buffers+0x14a/0x470 fs/nilfs2/segment.c:1018\n  nilfs_segctor_scan_file+0x3f4/0x6f0 fs/nilfs2/segment.c:1067\n  nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1197 [inline]\n  nilfs_segctor_collect fs/nilfs2/segment.c:1503 [inline]\n  nilfs_segctor_do_construct+0x12fc/0x6af0 fs/nilfs2/segment.c:2045\n  nilfs_segctor_construct+0x8e3/0xb30 fs/nilfs2/segment.c:2379\n  nilfs_segctor_thread_construct fs/nilfs2/segment.c:2487 [inline]\n  nilfs_segctor_thread+0x3c3/0xf30 fs/nilfs2/segment.c:2570\n  kthread+0x2e4/0x3a0 kernel/kthread.c:376\n  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n  </TASK>\n ...\n\nIf DAT metadata file is corrupted on disk, there is a case where\nreq->pr_desc_bh is NULL and blocknr is 0 at nilfs_dat_commit_end() during\na b-tree operation that cascadingly updates ancestor nodes of the b-tree,\nbecause nilfs_dat_commit_alloc() for a lower level block can initialize\nthe blocknr on the same DAT entry between nilfs_dat_prepare_end() and\nnilfs_dat_commit_end().\n\nIf this happens, nilfs_dat_commit_end() calls nilfs_dat_commit_free()\nwithout valid buffer heads in req->pr_desc_bh and req->pr_bitmap_bh, and\ncauses the NULL pointer dereference above in\nnilfs_palloc_commit_free_entry() function, which leads to a crash.\n\nFix this by adding a NULL check on req->pr_desc_bh and req->pr_bitmap_bh\nbefore nilfs_palloc_commit_free_entry() in nilfs_dat_commit_free().\n\nThis also calls nilfs_error() in that case to notify that there is a fatal\nflaw in the filesystem metadata and prevent further operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f5130e72-d6c0-4b50-88ae-ffb1f428d75d",  "id": "CVE-2024-46673",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: aacraid: Fix double-free on probe failure\n\naac_probe_one() calls hardware-specific init functions through the\naac_driver_ident::init pointer, all of which eventually call down to\naac_init_adapter().\n\nIf aac_init_adapter() fails after allocating memory for aac_dev::queues,\nit frees the memory but does not clear that member.\n\nAfter the hardware-specific init function returns an error,\naac_probe_one() goes down an error path that frees the memory pointed to\nby aac_dev::queues, resulting.in a double-free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fe96a179-e354-4ac8-815e-8d5ea4e341be",  "id": "CVE-2025-37805",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsound/virtio: Fix cancel_sync warnings on uninitialized work_structs\n\nBetty reported hitting the following warning:\n\n[    8.709131][  T221] WARNING: CPU: 2 PID: 221 at kernel/workqueue.c:4182\n...\n[    8.713282][  T221] Call trace:\n[    8.713365][  T221]  __flush_work+0x8d0/0x914\n[    8.713468][  T221]  __cancel_work_sync+0xac/0xfc\n[    8.713570][  T221]  cancel_work_sync+0x24/0x34\n[    8.713667][  T221]  virtsnd_remove+0xa8/0xf8 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[    8.713868][  T221]  virtsnd_probe+0x48c/0x664 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[    8.714035][  T221]  virtio_dev_probe+0x28c/0x390\n[    8.714139][  T221]  really_probe+0x1bc/0x4c8\n...\n\nIt seems we're hitting the error path in virtsnd_probe(), which\ntriggers a virtsnd_remove() which iterates over the substreams\ncalling cancel_work_sync() on the elapsed_period work_struct.\n\nLooking at the code, from earlier in:\nvirtsnd_probe()->virtsnd_build_devs()->virtsnd_pcm_parse_cfg()\n\nWe set snd->nsubstreams, allocate the snd->substreams, and if\nwe then hit an error on the info allocation or something in\nvirtsnd_ctl_query_info() fails, we will exit without having\ninitialized the elapsed_period work_struct.\n\nWhen that error path unwinds we then call virtsnd_remove()\nwhich as long as the substreams array is allocated, will iterate\nthrough calling cancel_work_sync() on the uninitialized work\nstruct hitting this warning.\n\nTakashi Iwai suggested this fix, which initializes the substreams\nstructure right after allocation, so that if we hit the error\npaths we avoid trying to cleanup uninitialized data.\n\nNote: I have not yet managed to reproduce the issue myself, so\nthis patch has had limited testing.\n\nFeedback or thoughts would be appreciated!",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "58b3cc6b-4bda-4967-a5b3-c2df79015125",  "id": "CVE-2023-3161",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3161"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    1335,    682  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "002a5395-b600-40be-961f-5b22efc383d3",  "id": "CVE-2025-39756",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Prevent file descriptor table allocations exceeding INT_MAX\n\nWhen sysctl_nr_open is set to a very high value (for example, 1073741816\nas set by systemd), processes attempting to use file descriptors near\nthe limit can trigger massive memory allocation attempts that exceed\nINT_MAX, resulting in a WARNING in mm/slub.c:\n\n  WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288\n\nThis happens because kvmalloc_array() and kvmalloc() check if the\nrequested size exceeds INT_MAX and emit a warning when the allocation is\nnot flagged with __GFP_NOWARN.\n\nSpecifically, when nr_open is set to 1073741816 (0x3ffffff8) and a\nprocess calls dup2(oldfd, 1073741880), the kernel attempts to allocate:\n- File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes\n- Multiple bitmaps: ~400MB\n- Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647)\n\nReproducer:\n1. Set /proc/sys/fs/nr_open to 1073741816:\n   # echo 1073741816 > /proc/sys/fs/nr_open\n\n2. Run a program that uses a high file descriptor:\n   #include <unistd.h>\n   #include <sys/resource.h>\n\n   int main() {\n       struct rlimit rlim = {1073741824, 1073741824};\n       setrlimit(RLIMIT_NOFILE, &rlim);\n       dup2(2, 1073741880);  // Triggers the warning\n       return 0;\n   }\n\n3. Observe WARNING in dmesg at mm/slub.c:5027\n\nsystemd commit a8b627a introduced automatic bumping of fs.nr_open to the\nmaximum possible value. The rationale was that systems with memory\ncontrol groups (memcg) no longer need separate file descriptor limits\nsince memory is properly accounted. However, this change overlooked\nthat:\n\n1. The kernel's allocation functions still enforce INT_MAX as a maximum\n   size regardless of memcg accounting\n2. Programs and tests that legitimately test file descriptor limits can\n   inadvertently trigger massive allocations\n3. The resulting allocations (>8GB) are impractical and will always fail\n\nsystemd's algorithm starts with INT_MAX and keeps halving the value\nuntil the kernel accepts it. On most systems, this results in nr_open\nbeing set to 1073741816 (0x3ffffff8), which is just under 1GB of file\ndescriptors.\n\nWhile processes rarely use file descriptors near this limit in normal\noperation, certain selftests (like\ntools/testing/selftests/core/unshare_test.c) and programs that test file\ndescriptor limits can trigger this issue.\n\nFix this by adding a check in alloc_fdtable() to ensure the requested\nallocation size does not exceed INT_MAX. This causes the operation to\nfail with -EMFILE instead of triggering a kernel warning and avoids the\nimpractical >8GB memory allocation request.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "713c61a2-1efe-4bf7-b48d-31c60ca7a680",  "id": "MGASA-2018-0413",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "22865098-1071-48dd-bb32-379fdc749bf6",  "id": "CLSA-2025-1758635382",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "82bcd602-73c5-4377-bcd5-d88b79422f1c",  "id": "CLSA-2022-1657817606",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1e0cdf44-3d0a-4394-b1e9-da9dc358b2dd",  "id": "CVE-2025-38085",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race\n\nhuge_pmd_unshare() drops a reference on a page table that may have\npreviously been shared across processes, potentially turning it into a\nnormal page table used in another process in which unrelated VMAs can\nafterwards be installed.\n\nIf this happens in the middle of a concurrent gup_fast(), gup_fast() could\nend up walking the page tables of another process.  While I don't see any\nway in which that immediately leads to kernel memory corruption, it is\nreally weird and unexpected.\n\nFix it with an explicit broadcast IPI through tlb_remove_table_sync_one(),\njust like we do in khugepaged when removing page tables for a THP\ncollapse.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9955011-b9b4-49e3-b6d0-38455e779407",  "id": "CVE-2010-3875",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3875"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The ax25_getname function in net/ax25/af_ax25.c in the Linux kernel before 2.6.37-rc2 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff730040-b2c7-4566-b7fb-a99734b6ba6f",  "id": "CVE-2013-2237",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2237"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "362aaea8-9151-43bd-906d-5f5baf995735",  "id": "CVE-2022-50324",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: maps: pxa2xx-flash: fix memory leak in probe\n\nFree 'info' upon remapping error to avoid a memory leak.\n\n[<miquel.raynal@bootlin.com>: Reword the commit log]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a3c74a87-4586-4347-b6c1-71256e3de80d",  "id": "CVE-2021-45480",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45480"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.15.11. There is a memory leak in the __rds_conn_create() function in net/rds/connection.c in a certain combination of circumstances.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4814e119-59cb-4efa-950d-9d4ea19b3e00",  "id": "CVE-2022-48619",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48619"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    755  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service (panic) because input_set_capability mishandles the situation in which an event code falls outside of a bitmap.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3af8b3c3-7825-4f22-a8ba-8a776694576c",  "id": "CVE-2010-2071",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2071"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The btrfs_xattr_set_acl function in fs/btrfs/acl.c in btrfs in the Linux kernel 2.6.34 and earlier does not check file ownership before setting an ACL, which allows local users to bypass file permissions by setting arbitrary ACLs, as demonstrated using setfacl.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2c174b7-475f-4340-a1e7-fe78e010a265",  "id": "CVE-2009-2409",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2409"  },  "ratings": [    {      "score": 5.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    295  ],  "analysis": {    "state": "in_triage"  },  "description": "The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time.  NOTE: the scope of this issue is currently limited because the amount of computation required is still large.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf35215e-155c-4f6c-b5a4-d0791cfc4e4e",  "id": "CVE-2019-19448",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19448"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "50071c65-bdf3-4826-bb3a-01a377d0152d",  "id": "CVE-2024-36924",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()\n\nlpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the\nhbalock.  Thus, lpfc_worker_wake_up() should not be called while holding the\nhbalock to avoid potential deadlock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e259884-4b71-4a56-94a7-24cc06099ca6",  "id": "CLSA-2026-1772102739",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ffdcd30-7ce4-400e-bddd-4a726f67dcfb",  "id": "CVE-2022-50241",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: fix use-after-free on source server when doing inter-server copy\n\nUse-after-free occurred when the laundromat tried to free expired\ncpntf_state entry on the s2s_cp_stateids list after inter-server\ncopy completed. The sc_cp_list that the expired copy state was\ninserted on was already freed.\n\nWhen COPY completes, the Linux client normally sends LOCKU(lock_state x),\nFREE_STATEID(lock_state x) and CLOSE(open_state y) to the source server.\nThe nfs4_put_stid call from nfsd4_free_stateid cleans up the copy state\nfrom the s2s_cp_stateids list before freeing the lock state's stid.\n\nHowever, sometimes the CLOSE was sent before the FREE_STATEID request.\nWhen this happens, the nfsd4_close_open_stateid call from nfsd4_close\nfrees all lock states on its st_locks list without cleaning up the copy\nstate on the sc_cp_list list. When the time the FREE_STATEID arrives the\nserver returns BAD_STATEID since the lock state was freed. This causes\nthe use-after-free error to occur when the laundromat tries to free\nthe expired cpntf_state.\n\nThis patch adds a call to nfs4_free_cpntf_statelist in\nnfsd4_close_open_stateid to clean up the copy state before calling\nfree_ol_stateid_reaplist to free the lock state's stid on the reaplist.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a02d35c-f669-4807-95f8-d6ac94371f7f",  "id": "CVE-2025-22071",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspufs: fix a leak in spufs_create_context()\n\nLeak fixes back in 2008 missed one case - if we are trying to set affinity\nand spufs_mkdir() fails, we need to drop the reference to neighbor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2de9cbe-1c78-4a3a-a0ca-fbdb78650eae",  "id": "CLSA-2023-1693418284",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aa4e4a4b-5376-4f37-9f17-0ecb5ff5a0ff",  "id": "OESA-2026-3685",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c8fbb7e-9979-42d9-b5a4-3bbe4772f350",  "id": "CVE-2026-31616",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()\n\nA broken/bored/mean USB host can overflow the skb_shared_info->frags[]\narray on a Linux gadget exposing a Phonet function by sending an\nunbounded sequence of full-page OUT transfers.\n\npn_rx_complete() finalizes the skb only when req->actual < req->length,\nwhere req->length is set to PAGE_SIZE by the gadget.  If the host always\nsends exactly PAGE_SIZE bytes per transfer, fp->rx.skb will never be\nreset and each completion will add another fragment via\nskb_add_rx_frag().  Once nr_frags exceeds MAX_SKB_FRAGS (default 17),\nsubsequent frag stores overwrite memory adjacent to the shinfo on the\nheap.\n\nDrop the skb and account a length error when the frag limit is reached,\nmatching the fix applied in t7xx by commit f0813bcd2d9d (\"net: wwan:\nt7xx: fix potential skb->frags overflow in RX path\").",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "37985019-1b2d-4afb-8a28-4b546e47476f",  "id": "MGASA-2016-0056",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "01e54c78-3d56-407d-a0fa-1c3c3c036163",  "id": "CVE-2024-50234",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    367  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlegacy: Clear stale interrupts before resuming device\n\niwl4965 fails upon resume from hibernation on my laptop. The reason\nseems to be a stale interrupt which isn't being cleared out before\ninterrupts are enabled. We end up with a race beween the resume\ntrying to bring things back up, and the restart work (queued form\nthe interrupt handler) trying to bring things down. Eventually\nthe whole thing blows up.\n\nFix the problem by clearing out any stale interrupts before\ninterrupts get enabled during resume.\n\nHere's a debug log of the indicent:\n[   12.042589] ieee80211 phy0: il_isr ISR inta 0x00000080, enabled 0xaa00008b, fh 0x00000000\n[   12.042625] ieee80211 phy0: il4965_irq_tasklet inta 0x00000080, enabled 0x00000000, fh 0x00000000\n[   12.042651] iwl4965 0000:10:00.0: RF_KILL bit toggled to enable radio.\n[   12.042653] iwl4965 0000:10:00.0: On demand firmware reload\n[   12.042690] ieee80211 phy0: il4965_irq_tasklet End inta 0x00000000, enabled 0xaa00008b, fh 0x00000000, flags 0x00000282\n[   12.052207] ieee80211 phy0: il4965_mac_start enter\n[   12.052212] ieee80211 phy0: il_prep_station Add STA to driver ID 31: ff:ff:ff:ff:ff:ff\n[   12.052244] ieee80211 phy0: il4965_set_hw_ready hardware  ready\n[   12.052324] ieee80211 phy0: il_apm_init Init card's basic functions\n[   12.052348] ieee80211 phy0: il_apm_init L1 Enabled; Disabling L0S\n[   12.055727] ieee80211 phy0: il4965_load_bsm Begin load bsm\n[   12.056140] ieee80211 phy0: il4965_verify_bsm Begin verify bsm\n[   12.058642] ieee80211 phy0: il4965_verify_bsm BSM bootstrap uCode image OK\n[   12.058721] ieee80211 phy0: il4965_load_bsm BSM write complete, poll 1 iterations\n[   12.058734] ieee80211 phy0: __il4965_up iwl4965 is coming up\n[   12.058737] ieee80211 phy0: il4965_mac_start Start UP work done.\n[   12.058757] ieee80211 phy0: __il4965_down iwl4965 is going down\n[   12.058761] ieee80211 phy0: il_scan_cancel_timeout Scan cancel timeout\n[   12.058762] ieee80211 phy0: il_do_scan_abort Not performing scan to abort\n[   12.058765] ieee80211 phy0: il_clear_ucode_stations Clearing ucode stations in driver\n[   12.058767] ieee80211 phy0: il_clear_ucode_stations No active stations found to be cleared\n[   12.058819] ieee80211 phy0: _il_apm_stop Stop card, put in low power state\n[   12.058827] ieee80211 phy0: _il_apm_stop_master stop master\n[   12.058864] ieee80211 phy0: il4965_clear_free_frames 0 frames on pre-allocated heap on clear.\n[   12.058869] ieee80211 phy0: Hardware restart was requested\n[   16.132299] iwl4965 0000:10:00.0: START_ALIVE timeout after 4000ms.\n[   16.132303] ------------[ cut here ]------------\n[   16.132304] Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n[   16.132338] WARNING: CPU: 0 PID: 181 at net/mac80211/util.c:1826 ieee80211_reconfig+0x8f/0x14b0 [mac80211]\n[   16.132390] Modules linked in: ctr ccm sch_fq_codel xt_tcpudp xt_multiport xt_state iptable_filter iptable_nat nf_nat nf_conntrack nf_defrag_ipv4 ip_tables x_tables binfmt_misc joydev mousedev btusb btrtl btintel btbcm bluetooth ecdh_generic ecc iTCO_wdt i2c_dev iwl4965 iwlegacy coretemp snd_hda_codec_analog pcspkr psmouse mac80211 snd_hda_codec_generic libarc4 sdhci_pci cqhci sha256_generic sdhci libsha256 firewire_ohci snd_hda_intel snd_intel_dspcfg mmc_core snd_hda_codec snd_hwdep firewire_core led_class iosf_mbi snd_hda_core uhci_hcd lpc_ich crc_itu_t cfg80211 ehci_pci ehci_hcd snd_pcm usbcore mfd_core rfkill snd_timer snd usb_common soundcore video parport_pc parport intel_agp wmi intel_gtt backlight e1000e agpgart evdev\n[   16.132456] CPU: 0 UID: 0 PID: 181 Comm: kworker/u8:6 Not tainted 6.11.0-cl+ #143\n[   16.132460] Hardware name: Hewlett-Packard HP Compaq 6910p/30BE, BIOS 68MCU Ver. F.19 07/06/2010\n[   16.132463] Workqueue: async async_run_entry_fn\n[   16.132469] RIP: 0010:ieee80211_reconfig+0x8f/0x14b0 [mac80211]\n[   16.132501] Code: da 02 00 0\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "392ec000-87ba-41c2-a466-75600a0d5278",  "id": "CVE-2017-16645",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16645"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6e46b850-b476-4d77-a382-6067913f5961",  "id": "CVE-2013-0349",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0349"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The hidp_setup_hid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5d1e2a6-93b4-4163-9f4f-475a915cfae2",  "id": "CVE-2024-50039",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: accept TCA_STAB only for root qdisc\n\nMost qdiscs maintain their backlog using qdisc_pkt_len(skb)\non the assumption it is invariant between the enqueue()\nand dequeue() handlers.\n\nUnfortunately syzbot can crash a host rather easily using\na TBF + SFQ combination, with an STAB on SFQ [1]\n\nWe can't support TCA_STAB on arbitrary level, this would\nrequire to maintain per-qdisc storage.\n\n[1]\n[   88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[   88.798611] #PF: supervisor read access in kernel mode\n[   88.799014] #PF: error_code(0x0000) - not-present page\n[   88.799506] PGD 0 P4D 0\n[   88.799829] Oops: Oops: 0000 [#1] SMP NOPTI\n[   88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117\n[   88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq\n[ 88.802544] Code: 0f b7 50 12 48 8d 04 d5 00 00 00 00 48 89 d6 48 29 d0 48 8b 91 c0 01 00 00 48 c1 e0 03 48 01 c2 66 83 7a 1a 00 7e c0 48 8b 3a <4c> 8b 07 4c 89 02 49 89 50 08 48 c7 47 08 00 00 00 00 48 c7 07 00\nAll code\n========\n   0:\t0f b7 50 12          \tmovzwl 0x12(%rax),%edx\n   4:\t48 8d 04 d5 00 00 00 \tlea    0x0(,%rdx,8),%rax\n   b:\t00\n   c:\t48 89 d6             \tmov    %rdx,%rsi\n   f:\t48 29 d0             \tsub    %rdx,%rax\n  12:\t48 8b 91 c0 01 00 00 \tmov    0x1c0(%rcx),%rdx\n  19:\t48 c1 e0 03          \tshl    $0x3,%rax\n  1d:\t48 01 c2             \tadd    %rax,%rdx\n  20:\t66 83 7a 1a 00       \tcmpw   $0x0,0x1a(%rdx)\n  25:\t7e c0                \tjle    0xffffffffffffffe7\n  27:\t48 8b 3a             \tmov    (%rdx),%rdi\n  2a:*\t4c 8b 07             \tmov    (%rdi),%r8\t\t<-- trapping instruction\n  2d:\t4c 89 02             \tmov    %r8,(%rdx)\n  30:\t49 89 50 08          \tmov    %rdx,0x8(%r8)\n  34:\t48 c7 47 08 00 00 00 \tmovq   $0x0,0x8(%rdi)\n  3b:\t00\n  3c:\t48                   \trex.W\n  3d:\tc7                   \t.byte 0xc7\n  3e:\t07                   \t(bad)\n\t...\n\nCode starting with the faulting instruction\n===========================================\n   0:\t4c 8b 07             \tmov    (%rdi),%r8\n   3:\t4c 89 02             \tmov    %r8,(%rdx)\n   6:\t49 89 50 08          \tmov    %rdx,0x8(%r8)\n   a:\t48 c7 47 08 00 00 00 \tmovq   $0x0,0x8(%rdi)\n  11:\t00\n  12:\t48                   \trex.W\n  13:\tc7                   \t.byte 0xc7\n  14:\t07                   \t(bad)\n\t...\n[   88.803721] RSP: 0018:ffff9a1f892b7d58 EFLAGS: 00000206\n[   88.804032] RAX: 0000000000000000 RBX: ffff9a1f8420c800 RCX: ffff9a1f8420c800\n[   88.804560] RDX: ffff9a1f81bc1440 RSI: 0000000000000000 RDI: 0000000000000000\n[   88.805056] RBP: ffffffffc04bb0e0 R08: 0000000000000001 R09: 00000000ff7f9a1f\n[   88.805473] R10: 000000000001001b R11: 0000000000009a1f R12: 0000000000000140\n[   88.806194] R13: 0000000000000001 R14: ffff9a1f886df400 R15: ffff9a1f886df4ac\n[   88.806734] FS:  00007f445601a740(0000) GS:ffff9a2e7fd80000(0000) knlGS:0000000000000000\n[   88.807225] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   88.807672] CR2: 0000000000000000 CR3: 000000050cc46000 CR4: 00000000000006f0\n[   88.808165] Call Trace:\n[   88.808459]  <TASK>\n[   88.808710] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434)\n[   88.809261] ? page_fault_oops (arch/x86/mm/fault.c:715)\n[   88.809561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539)\n[   88.809806] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623)\n[   88.810074] ? sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq\n[   88.810411] sfq_reset (net/sched/sch_sfq.c:525) sch_sfq\n[   88.810671] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_g\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4cc8720b-1c72-4416-80ff-020388e0e6cc",  "id": "CVE-2023-4194",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4194"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    843,    863  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 (\"tun: tun_chr_open(): correctly initialize socket uid\"), - 66b2c338adce (\"tap: tap_open(): correctly initialize socket uid\"), pass \"inode->i_uid\" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f2b7267d-f3c2-4b26-83bf-ca679f9299f2",  "id": "CVE-2016-7914",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7914"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.5.3 does not check whether a slot is a leaf, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and out-of-bounds read) via an application that uses associative-array data structures, as demonstrated by the keyutils test suite.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "12a0dc76-67cb-4671-982b-ee85595d5edb",  "id": "CVE-2018-19854",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19854"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 4.19.3. crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are copied to userspace, potentially leaking sensitive memory to user programs. NOTE: this is a CVE-2013-2547 regression but with easier exploitability because the attacker does not need a capability (however, the system must have the CONFIG_CRYPTO_USER kconfig option).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "37da3e5b-ef37-44ae-9a09-e2b2ba5b4bcd",  "id": "CVE-2023-33203",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33203"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1449036d-3183-4606-a0ae-5cc2267fdb14",  "id": "CVE-2010-3078",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3078"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b150c9d1-c83d-4dac-b3c0-64673229fc60",  "id": "CVE-2012-1601",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1601"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The KVM implementation in the Linux kernel before 3.3.6 allows host OS users to cause a denial of service (NULL pointer dereference and host OS crash) by making a KVM_CREATE_IRQCHIP ioctl call after a virtual CPU already exists.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9f45e797-c0a5-469d-a859-f1637d0c0143",  "id": "CVE-2024-53133",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Handle dml allocation failure to avoid crash\n\n[Why]\nIn the case where a dml allocation fails for any reason, the\ncurrent state's dml contexts would no longer be valid. Then\nsubsequent calls dc_state_copy_internal would shallow copy\ninvalid memory and if the new state was released, a double\nfree would occur.\n\n[How]\nReset dml pointers in new_state to NULL and avoid invalid\npointer\n\n(cherry picked from commit bcafdc61529a48f6f06355d78eb41b3aeda5296c)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "06b652a1-e808-4321-8e46-e6a01bc11f47",  "id": "AZL-61600",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "61fda1a8-3ae6-4bdc-b741-27a0531415b8",  "id": "CVE-2024-50299",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.199999999999999,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: properly validate chunk size in sctp_sf_ootb()\n\nA size validation fix similar to that in Commit 50619dbf8db7 (\"sctp: add\nsize validation when walking chunks\") is also required in sctp_sf_ootb()\nto address a crash reported by syzbot:\n\n  BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712\n  sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712\n  sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166\n  sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407\n  sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88\n  sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243\n  sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159\n  ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205\n  ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "638bd662-da69-4c91-b78a-05ed193958a1",  "id": "CVE-2023-53416",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: isp1362: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f1d120ea-e615-402c-a15d-d21fa4b7c10d",  "id": "CVE-2024-36917",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix overflow in blk_ioctl_discard()\n\nThere is no check for overflow of 'start + len' in blk_ioctl_discard().\nHung task occurs if submit an discard ioctl with the following param:\n  start = 0x80000000000ff000, len = 0x8000000000fff000;\nAdd the overflow validation now.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "004eb900-a21d-4f8b-8502-6c29805ffabc",  "id": "CVE-2025-38531",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: common: st_sensors: Fix use of uninitialize device structs\n\nThroughout the various probe functions &indio_dev->dev is used before it\nis initialized. This caused a kernel panic in st_sensors_power_enable()\nwhen the call to devm_regulator_bulk_get_enable() fails and then calls\ndev_err_probe() with the uninitialized device.\n\nThis seems to only cause a panic with dev_err_probe(), dev_err(),\ndev_warn() and dev_info() don't seem to cause a panic, but are fixed\nas well.\n\nThe issue is reported and traced here: [1]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5131065d-9dfd-4a83-b677-57a9f03b65d6",  "id": "CVE-2016-8632",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8632"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119,    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f983a34b-e8e0-455d-94af-ac9df0c4bd2e",  "id": "CVE-2022-49300",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix race between nbd_alloc_config() and module removal\n\nWhen nbd module is being removing, nbd_alloc_config() may be\ncalled concurrently by nbd_genl_connect(), although try_module_get()\nwill return false, but nbd_alloc_config() doesn't handle it.\n\nThe race may lead to the leak of nbd_config and its related\nresources (e.g, recv_workq) and oops in nbd_read_stat() due\nto the unload of nbd module as shown below:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000040\n  Oops: 0000 [#1] SMP PTI\n  CPU: 5 PID: 13840 Comm: kworker/u17:33 Not tainted 5.14.0+ #1\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n  Workqueue: knbd16-recv recv_work [nbd]\n  RIP: 0010:nbd_read_stat.cold+0x130/0x1a4 [nbd]\n  Call Trace:\n   recv_work+0x3b/0xb0 [nbd]\n   process_one_work+0x1ed/0x390\n   worker_thread+0x4a/0x3d0\n   kthread+0x12a/0x150\n   ret_from_fork+0x22/0x30\n\nFixing it by checking the return value of try_module_get()\nin nbd_alloc_config(). As nbd_alloc_config() may return ERR_PTR(-ENODEV),\nassign nbd->config only when nbd_alloc_config() succeeds to ensure\nthe value of nbd->config is binary (valid or NULL).\n\nAlso adding a debug message to check the reference counter\nof nbd_config during module removal.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e613e76f-421f-4346-ad26-3a46d5d3a8e5",  "id": "CVE-2020-25672",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25672"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak vulnerability was found in Linux kernel in llcp_sock_connect",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6e2b25fa-e863-42ce-8eb1-a31d32b4e712",  "id": "CVE-2018-12232",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12232"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference count, which allows close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "61fe4701-ff14-4c51-a72b-2a19e4341fe8",  "id": "CVE-2023-28328",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28328"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1b0ec9be-cc58-4084-801a-69705444b8d0",  "id": "CVE-2023-1193",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1193"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in setup_async_work in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could allow an attacker to crash the system by accessing freed work.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "88b9e4e0-5030-4306-924b-44f6f1739b0e",  "id": "CVE-2024-0639",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667,    833  ],  "analysis": {    "state": "in_triage"  },  "description": "A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0febe7fa-9ab0-46c5-b8d7-ead9980b9124",  "id": "CVE-2025-38084",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: unshare page tables during VMA split, not before\n\nCurrently, __split_vma() triggers hugetlb page table unsharing through\nvm_ops->may_split().  This happens before the VMA lock and rmap locks are\ntaken - which is too early, it allows racing VMA-locked page faults in our\nprocess and racing rmap walks from other processes to cause page tables to\nbe shared again before we actually perform the split.\n\nFix it by explicitly calling into the hugetlb unshare logic from\n__split_vma() in the same place where THP splitting also happens.  At that\npoint, both the VMA and the rmap(s) are write-locked.\n\nAn annoying detail is that we can now call into the helper\nhugetlb_unshare_pmds() from two different locking contexts:\n\n1. from hugetlb_split(), holding:\n    - mmap lock (exclusively)\n    - VMA lock\n    - file rmap lock (exclusively)\n2. hugetlb_unshare_all_pmds(), which I think is designed to be able to\n   call us with only the mmap lock held (in shared mode), but currently\n   only runs while holding mmap lock (exclusively) and VMA lock\n\nBackporting note:\nThis commit fixes a racy protection that was introduced in commit\nb30c14cd6102 (\"hugetlb: unshare some PMDs when splitting VMAs\"); that\ncommit claimed to fix an issue introduced in 5.13, but it should actually\nalso go all the way back.\n\n[jannh@google.com: v2]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3516a1c8-4f1e-4f1c-9f5e-4faed2b03455",  "id": "CVE-2024-44969",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/sclp: Prevent release of buffer in I/O\n\nWhen a task waiting for completion of a Store Data operation is\ninterrupted, an attempt is made to halt this operation. If this attempt\nfails due to a hardware or firmware problem, there is a chance that the\nSCLP facility might store data into buffers referenced by the original\noperation at a later time.\n\nHandle this situation by not releasing the referenced data buffers if\nthe halt attempt fails. For current use cases, this might result in a\nleak of few pages of memory in case of a rare hardware/firmware\nmalfunction.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e15f52b-3230-49ae-8263-7c07106d3652",  "id": "SUSE-SU-2016:0624-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db082a80-8ee1-4a9c-97c7-086a6a08f807",  "id": "CVE-2011-1173",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1173"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.39 on the x86_64 platform allows remote attackers to obtain potentially sensitive information from kernel stack memory by reading uninitialized data in the ah field of an Acorn Universal Networking (AUN) packet.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae32145a-4a42-4da1-82d8-5689018c8f9c",  "id": "CVE-2026-58374",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58374"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"    }  ],  "cwes": [    193  ],  "analysis": {    "state": "in_triage"  },  "description": "In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd8cea4e-a2c1-40c4-8eeb-b97e059daabc",  "id": "CVE-2021-4090",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4090"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "57836d29-acdc-4e4b-bda8-997a9fd4c9bf",  "id": "DLA-2952-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e2e4b79-66c9-4966-8d22-09daf5cf14fd",  "id": "RLSA-2026:25237",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "49ae7e35-c0d4-496d-9938-76f16c1666db",  "id": "CLSA-2024-1718639724",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "06a074c2-0bc5-443e-b354-c86ee4de002b",  "id": "CVE-2025-38214",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var\n\nIf fb_add_videomode() in fb_set_var() fails to allocate memory for\nfb_videomode, later it may lead to a null-ptr dereference in\nfb_videomode_to_var(), as the fb_info is registered while not having the\nmode in modelist that is expected to be there, i.e. the one that is\ndescribed in fb_info->var.\n\n================================================================\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901\nCall Trace:\n display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929\n fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071\n resize_screen drivers/tty/vt/vt.c:1176 [inline]\n vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263\n fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720\n fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776\n do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128\n fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl fs/ioctl.c:739 [inline]\n __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n================================================================\n\nThe reason is that fb_info->var is being modified in fb_set_var(), and\nthen fb_videomode_to_var() is called. If it fails to add the mode to\nfb_info->modelist, fb_set_var() returns error, but does not restore the\nold value of fb_info->var. Restore fb_info->var on failure the same way\nit is done earlier in the function.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "adfe9f33-2548-4533-aae1-64fe2c052a8a",  "id": "CVE-2024-53094",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES\n\nWhile running ISER over SIW, the initiator machine encounters a warning\nfrom skb_splice_from_iter() indicating that a slab page is being used in\nsend_page. To address this, it is better to add a sendpage_ok() check\nwithin the driver itself, and if it returns 0, then MSG_SPLICE_PAGES flag\nshould be disabled before entering the network stack.\n\nA similar issue has been discussed for NVMe in this thread:\nhttps://lore.kernel.org/all/20240530142417.146696-1-ofir.gal@volumez.com/\n\n  WARNING: CPU: 0 PID: 5342 at net/core/skbuff.c:7140 skb_splice_from_iter+0x173/0x320\n  Call Trace:\n   tcp_sendmsg_locked+0x368/0xe40\n   siw_tx_hdt+0x695/0xa40 [siw]\n   siw_qp_sq_process+0x102/0xb00 [siw]\n   siw_sq_resume+0x39/0x110 [siw]\n   siw_run_sq+0x74/0x160 [siw]\n   kthread+0xd2/0x100\n   ret_from_fork+0x34/0x40\n   ret_from_fork_asm+0x1a/0x30",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cc80cf31-7aa5-4218-a3bb-f9a04359aeb7",  "id": "CVE-2015-2672",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2672"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The xsave/xrstor implementation in arch/x86/include/asm/xsave.h in the Linux kernel before 3.19.2 creates certain .altinstr_replacement pointers and consequently does not provide any protection against instruction faulting, which allows local users to cause a denial of service (panic) by triggering a fault, as demonstrated by an unaligned memory operand or a non-canonical address memory operand.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "94d91948-c4c7-4fc5-a57a-efee993cd7d1",  "id": "CVE-2017-5550",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5550"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "Off-by-one error in the pipe_advance function in lib/iov_iter.c in the Linux kernel before 4.9.5 allows local users to obtain sensitive information from uninitialized heap-memory locations in opportunistic circumstances by reading from a pipe after an incorrect buffer-release decision.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99db085d-0e64-4b97-8517-5a70a75d3ad6",  "id": "CVE-2010-2478",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2478"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.33.7 on 32-bit platforms allows local users to cause a denial of service or possibly have unspecified other impact via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value that triggers a buffer overflow, a different vulnerability than CVE-2010-3084.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0e64855-8a07-4395-816c-bd07edfdd3d5",  "id": "AZL-6342",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ec96953e-5287-403c-8cec-caed18102b63",  "id": "CVE-2026-64279",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: core: fix adapter deregistration race\n\nAdapters can be looked up by their id using i2c_get_adapter() which\ntakes a reference to the embedded struct device.\n\nRemove the adapter from the IDR before tearing it down during\nderegistration (and on registration failure) to make sure its resources\nare not accessed after having been freed (e.g. the device name).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d041bee8-3ee3-472f-bfb1-8e25b3fdc6ec",  "id": "OESA-2022-1673",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bdda82a0-6405-46be-8f90-75b3a786c4d3",  "id": "CVE-2013-7446",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7446"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel before 4.3.3 allows local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aa2cfdde-462d-42e7-9c71-64620d907fd0",  "id": "CVE-2021-3744",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3744"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "38fd6331-8d40-4e01-93cf-0f5b7b6dc792",  "id": "CVE-2017-15649",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15649"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:44053'"    }  ]},{  "bom-ref": "0ef17725-77a3-4e59-a9a2-431441549e54",  "id": "CVE-2023-22997",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22997"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the module_get_next_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "695e8334-7931-4178-af6f-661d30d5572e",  "id": "CVE-2019-20636",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20636"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a36ee676-5e99-4473-bd64-4b9187654168",  "id": "CVE-2024-56600",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: inet6: do not leave a dangling sk pointer in inet6_create()\n\nsock_init_data() attaches the allocated sk pointer to the provided sock\nobject. If inet6_create() fails later, the sk object is released, but the\nsock object retains the dangling sk pointer, which may cause use-after-free\nlater.\n\nClear the sock sk pointer on error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0ad3555-f7cb-4bea-a577-e4897619e3ac",  "id": "CVE-2026-43308",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()\n\nThere is no need to BUG(), we can just return an error and log an error\nmessage.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48221f55-a554-4ba8-af0e-670700a2f9a2",  "id": "CVE-2024-42161",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD\n\n[Changes from V1:\n - Use a default branch in the switch statement to initialize `val'.]\n\nGCC warns that `val' may be used uninitialized in the\nBPF_CRE_READ_BITFIELD macro, defined in bpf_core_read.h as:\n\n\t[...]\n\tunsigned long long val;\t\t\t\t\t\t      \\\n\t[...]\t\t\t\t\t\t\t\t      \\\n\tswitch (__CORE_RELO(s, field, BYTE_SIZE)) {\t\t\t      \\\n\tcase 1: val = *(const unsigned char *)p; break;\t\t\t      \\\n\tcase 2: val = *(const unsigned short *)p; break;\t\t      \\\n\tcase 4: val = *(const unsigned int *)p; break;\t\t\t      \\\n\tcase 8: val = *(const unsigned long long *)p; break;\t\t      \\\n        }       \t\t\t\t\t\t\t      \\\n\t[...]\n\tval;\t\t\t\t\t\t\t\t      \\\n\t}\t\t\t\t\t\t\t\t      \\\n\nThis patch adds a default entry in the switch statement that sets\n`val' to zero in order to avoid the warning, and random values to be\nused in case __builtin_preserve_field_info returns unexpected values\nfor BPF_FIELD_BYTE_SIZE.\n\nTested in bpf-next master.\nNo regressions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5332511d-e5b0-425e-b61b-fbf58aa779fb",  "id": "CVE-2017-7277",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7277"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The TCP stack in the Linux kernel through 4.10.6 mishandles the SCM_TIMESTAMPING_OPT_STATS feature, which allows local users to obtain sensitive information from the kernel's internal socket data structures or cause a denial of service (out-of-bounds read) via crafted system calls, related to net/core/skbuff.c and net/socket.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "194363ce-7162-4c20-85ca-452fb2d423f2",  "id": "CVE-2017-18549",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18549"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_send_raw_srb does not initialize the reply structure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e073aa79-c671-4f02-8c02-3825b8c2da5b",  "id": "CVE-2023-49210",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49210"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    77  ],  "analysis": {    "state": "in_triage"  },  "description": "The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as \"a nonsense wrapper with no real purpose\" by its author, and accepts an opts argument that contains a verb field (used for command execution). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "119df350-3c13-4dd3-8ea8-10dab87dc2dd",  "id": "CVE-2011-2498",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2498"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    772  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel from v2.3.36 before v2.6.39 allows local unprivileged users to cause a denial of service (memory consumption) by triggering creation of PTE pages.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0e325d14-3d8c-40f4-a73a-d097f9102f40",  "id": "CVE-2013-7471",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7471"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    77  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Injection via shell metacharacters in the NewInternalClient, NewExternalPort, or NewInternalPort element of a SOAP POST request.",  "affects": [    {      "ref": "0f9017f6-bd13-4064-97b2-6cfc35c2947d",      "versions": [        {          "component": "dir-600_firmware",          "version": "2.14b01"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc813a93-17ae-4ea5-bda6-47bed93af9c4",  "id": "CVE-2024-43913",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: apple: fix device reference counting\n\nDrivers must call nvme_uninit_ctrl after a successful nvme_init_ctrl.\nSplit the allocation side out to make the error handling boundary easier\nto navigate. The apple driver had been doing this wrong, leaking the\ncontroller device memory on a tagset failure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31db9a82-2a0b-48d6-8150-04d42869b602",  "id": "CVE-2007-5135",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5135"  },  "ratings": [    {      "score": 6.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Off-by-one error in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers to execute arbitrary code via a crafted packet that triggers a one-byte buffer underflow.  NOTE: this issue was introduced as a result of a fix for CVE-2006-3738.  As of 20071012, it is unknown whether code execution is possible.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0a78240e-9c88-4083-8dce-fa8a35d9f191",  "id": "OESA-2024-2128",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "89d63d93-ba86-4190-b3b9-4d9bf1cfd3fe",  "id": "CVE-2017-15299",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15299"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "934d036e-3446-4526-9180-b0285870eeac",  "id": "CLSA-2025-1751889283",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2dd04e4-b8bf-45e0-b5d3-2faedad4c4ee",  "id": "CVE-2011-2918",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2918"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated with PERF_COUNT_SW_CPU_CLOCK events, which allows local users to cause a denial of service (system hang) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:17769'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:104689/Linux-Kernel-perf_count_sw_cpu_clock-Denial-Of-Service.html'"    }  ]},{  "bom-ref": "25f6c506-0c16-4d17-b659-5e985698dee2",  "id": "CVE-2022-50415",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: led: Fix potential null-ptr-deref in start_task()\n\nstart_task() calls create_singlethread_workqueue() and not checked the\nret value, which may return NULL. And a null-ptr-deref may happen:\n\nstart_task()\n    create_singlethread_workqueue() # failed, led_wq is NULL\n    queue_delayed_work()\n        queue_delayed_work_on()\n            __queue_delayed_work()  # warning here, but continue\n                __queue_work()      # access wq->flags, null-ptr-deref\n\nCheck the ret value and return -ENOMEM if it is NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "68496879-cb36-4e9c-91de-32b305a3d9bb",  "id": "CVE-2023-53276",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Free memory for tmpfile name\n\nWhen opening a ubifs tmpfile on an encrypted directory, function\nfscrypt_setup_filename allocates memory for the name that is to be\nstored in the directory entry, but after the name has been copied to the\ndirectory entry inode, the memory is not freed.\n\nWhen running kmemleak on it we see that it is registered as a leak. The\nreport below is triggered by a simple program 'tmpfile' just opening a\ntmpfile:\n\n  unreferenced object 0xffff88810178f380 (size 32):\n    comm \"tmpfile\", pid 509, jiffies 4294934744 (age 1524.742s)\n    backtrace:\n      __kmem_cache_alloc_node\n      __kmalloc\n      fscrypt_setup_filename\n      ubifs_tmpfile\n      vfs_tmpfile\n      path_openat\n\nFree this memory after it has been copied to the inode.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4faba4df-d91e-44a8-a2c8-4cf321e66fe2",  "id": "CVE-2020-14314",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14314"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "158cd9fa-df6e-4343-a7d5-bb8b3819bc52",  "id": "CLSA-2023-1683235565",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "06dfac4a-10d7-4f28-aa3f-adae66362ff3",  "id": "SUSE-SU-2021:14603-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ebd69207-72ed-4bd1-853e-2ed75c92d89f",  "id": "CVE-2019-14283",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14283"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125,    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b5bf08c-f177-4e7d-baef-d68b89d02fec",  "id": "CVE-2026-23312",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kaweth: validate USB endpoints\n\nThe kaweth driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expecting before it binds\nto it.  If a malicious device were to not have the same urbs the driver\nwill crash later on when it blindly accesses these endpoints.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b5c82423-b82f-4b6b-b693-f45870e01551",  "id": "CVE-2023-30456",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30456"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    754  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "978f05a9-aff0-4d9a-9608-6f759549e93f",  "id": "CVE-2020-36789",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36789"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context\n\nIf a driver calls can_get_echo_skb() during a hardware IRQ (which is often, but\nnot always, the case), the 'WARN_ON(in_irq)' in\nnet/core/skbuff.c#skb_release_head_state() might be triggered, under network\ncongestion circumstances, together with the potential risk of a NULL pointer\ndereference.\n\nThe root cause of this issue is the call to kfree_skb() instead of\ndev_kfree_skb_irq() in net/core/dev.c#enqueue_to_backlog().\n\nThis patch prevents the skb to be freed within the call to netif_rx() by\nincrementing its reference count with skb_get(). The skb is finally freed by\none of the in-irq-context safe functions: dev_consume_skb_any() or\ndev_kfree_skb_any(). The \"any\" version is used because some drivers might call\ncan_get_echo_skb() in a normal context.\n\nThe reason for this issue to occur is that initially, in the core network\nstack, loopback skb were not supposed to be received in hardware IRQ context.\nThe CAN stack is an exeption.\n\nThis bug was previously reported back in 2017 in [1] but the proposed patch\nnever got accepted.\n\nWhile [1] directly modifies net/core/dev.c, we try to propose here a\nsmoother modification local to CAN network stack (the assumption\nbehind is that only CAN devices are affected by this issue).\n\n[1] http://lore.kernel.org/r/57a3ffb6-3309-3ad5-5a34-e93c3fe3614d@cetitec.com",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "632f38f2-78d1-44e8-89a8-40b0674263ca",  "id": "CVE-2024-35886",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    674,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix infinite recursion in fib6_dump_done().\n\nsyzkaller reported infinite recursive calls of fib6_dump_done() during\nnetlink socket destruction.  [1]\n\nFrom the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then\nthe response was generated.  The following recvmmsg() resumed the dump\nfor IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due\nto the fault injection.  [0]\n\n  12:01:34 executing program 3:\n  r0 = socket$nl_route(0x10, 0x3, 0x0)\n  sendmsg$nl_route(r0, ... snip ...)\n  recvmmsg(r0, ... snip ...) (fail_nth: 8)\n\nHere, fib6_dump_done() was set to nlk_sk(sk)->cb.done, and the next call\nof inet6_dump_fib() set it to nlk_sk(sk)->cb.args[3].  syzkaller stopped\nreceiving the response halfway through, and finally netlink_sock_destruct()\ncalled nlk_sk(sk)->cb.done().\n\nfib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)->cb.done() if it\nis still not NULL.  fib6_dump_end() rewrites nlk_sk(sk)->cb.done() by\nnlk_sk(sk)->cb.args[3], but it has the same function, not NULL, calling\nitself recursively and hitting the stack guard page.\n\nTo avoid the issue, let's set the destructor after kzalloc().\n\n[0]:\nFAULT_INJECTION: forcing a failure.\nname failslab, interval 1, probability 0, space 0, times 0\nCPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nCall Trace:\n <TASK>\n dump_stack_lvl (lib/dump_stack.c:117)\n should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153)\n should_failslab (mm/slub.c:3733)\n kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992)\n inet6_dump_fib (./include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662)\n rtnl_dump_all (net/core/rtnetlink.c:4029)\n netlink_dump (net/netlink/af_netlink.c:2269)\n netlink_recvmsg (net/netlink/af_netlink.c:1988)\n ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801)\n ___sys_recvmsg (net/socket.c:2846)\n do_recvmmsg (net/socket.c:2943)\n __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034)\n\n[1]:\nBUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb)\nstack guard page: 0000 [#1] PREEMPT SMP KASAN\nCPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nWorkqueue: events netlink_sock_destruct_work\nRIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570)\nCode: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd <53> 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ff\nRSP: 0018:ffffc9000d980000 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3\nRDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358\nRBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000\nR13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68\nFS:  0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0\nPKRU: 55555554\nCall Trace:\n <#DF>\n </#DF>\n <TASK>\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n ...\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n netlink_sock_destruct (net/netlink/af_netlink.c:401)\n __sk_destruct (net/core/sock.c:2177 (discriminator 2))\n sk_destruct (net/core/sock.c:2224)\n __sk_free (net/core/sock.c:2235)\n sk_free (net/core/sock.c:2246)\n process_one_work (kernel/workqueue.c:3259)\n worker_thread (kernel/workqueue.c:3329 kernel/workqueue.\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fa8c7c91-1d47-4d6e-80b3-7687ae5bf71f",  "id": "CVE-2026-52986",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: don't use simple_strtoul\n\nReplace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(),\nand ct_sip_parse_request() with a new sip_parse_port() helper that\nvalidates each digit against the buffer limit, eliminating the use of\nsimple_strtoul() which assumes NUL-terminated strings.\n\nThe previous code dereferenced pointers without bounds checks after\nsip_parse_addr() and relied on simple_strtoul() on non-NUL-terminated\nskb data. A port that reaches the buffer limit without a trailing\ncharacter is also rejected as malformed.\n\nAlso get rid of all simple_strtoul() usage in conntrack, prefer a\nstricter version instead.  There are intentional changes:\n\n- Bail out if number is > UINT_MAX and indicate a failure, same for\n  too long sequences.\n  While we do accept 05535 as port 5535, we will not accept e.g.\n  'sip:10.0.0.1:005060'.  While its syntactically valid under RFC 3261,\n  we should restrict this to not waste cycles when presented with\n  malformed packets with 64k '0' characters.\n\n- Force base 10 in ct_sip_parse_numerical_param(). This is used to fetch\n  'expire=' and 'rports='; both are expected to use base-10.\n\n- In nf_nat_sip.c, only accept the parsed value if its within the 1k-64k\n  range.\n\n- epaddr_len now returns 0 if the port is invalid, as it already does\n  for invalid ip addresses.  This is intentional. nf_conntrack_sip\n  performs lots of guesswork to find the right parts of the message\n  to parse.  Being stricter could break existing setups.\n  Connection tracking helpers are designed to allow traffic to\n  pass, not to block it.\n\nBased on an earlier patch from Jenny Guanni Qu <qguanni@gmail.com>.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "767a7a05-c172-4912-b41e-660fe460de12",  "id": "CVE-2016-7915",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7915"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The hid_input_field function in drivers/hid/hid-core.c in the Linux kernel before 4.6 allows physically proximate attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) by connecting a device, as demonstrated by a Logitech DJ receiver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ab352c93-b77e-4137-ac02-17c3a8eecd4b",  "id": "ROOT-OS-ALPINE-315-CVE-2026-28389",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e88dc640-0673-4093-a344-65e37fc47d94",  "id": "CVE-2026-43416",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc, perf: Check that current->mm is alive before getting user callchain\n\nIt may happen that mm is already released, which leads to kernel panic.\nThis adds the NULL check for current->mm, similarly to\ncommit 20afc60f892d (\"x86, perf: Check that current->mm is alive before getting user callchain\").\n\nI was getting this panic when running a profiling BPF program\n(profile.py from bcc-tools):\n\n    [26215.051935] Kernel attempted to read user page (588) - exploit attempt? (uid: 0)\n    [26215.051950] BUG: Kernel NULL pointer dereference on read at 0x00000588\n    [26215.051952] Faulting instruction address: 0xc00000000020fac0\n    [26215.051957] Oops: Kernel access of bad area, sig: 11 [#1]\n    [...]\n    [26215.052049] Call Trace:\n    [26215.052050] [c000000061da6d30] [c00000000020fc10] perf_callchain_user_64+0x2d0/0x490 (unreliable)\n    [26215.052054] [c000000061da6dc0] [c00000000020f92c] perf_callchain_user+0x1c/0x30\n    [26215.052057] [c000000061da6de0] [c0000000005ab2a0] get_perf_callchain+0x100/0x360\n    [26215.052063] [c000000061da6e70] [c000000000573bc8] bpf_get_stackid+0x88/0xf0\n    [26215.052067] [c000000061da6ea0] [c008000000042258] bpf_prog_16d4ab9ab662f669_do_perf_event+0xf8/0x274\n    [...]\n\nIn addition, move storing the top-level stack entry to generic\nperf_callchain_user to make sure the top-evel entry is always captured,\neven if current->mm is NULL.\n\n[Maddy: fixed message to avoid checkpatch format style error]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "41f0ea48-cc3e-4d6e-a4d5-19acfaeef31e",  "id": "AZL-86763",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bac25fff-7900-4396-a2e3-a1ca08d6d5e2",  "id": "CVE-2024-42066",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix potential integer overflow in page size calculation\n\nExplicitly cast tbo->page_alignment to u64 before bit-shifting to\nprevent overflow when assigning to min_page_size.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fe823a3a-cbab-4ced-98fe-41d517de4aeb",  "id": "CVE-2010-3873",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3873"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The X.25 implementation in the Linux kernel before 2.6.36.2 does not properly parse facilities, which allows remote attackers to cause a denial of service (heap memory corruption and panic) or possibly have unspecified other impact via malformed (1) X25_FAC_CALLING_AE or (2) X25_FAC_CALLED_AE data, related to net/x25/x25_facilities.c and net/x25/x25_in.c, a different vulnerability than CVE-2010-4164.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3f140f7-9a7f-435d-bb5f-ad0fa523d4fc",  "id": "CVE-2022-49281",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix handlecache and multiuser\n\nIn multiuser each individual user has their own tcon structure for the\nshare and thus their own handle for a cached directory.\nWhen we umount such a share we much make sure to release the pinned down dentry\nfor each such tcon and not just the master tcon.\n\nOtherwise we will get nasty warnings on umount that dentries are still in use:\n[ 3459.590047] BUG: Dentry 00000000115c6f41{i=12000000019d95,n=/}  still in use\\\n (2) [unmount of cifs cifs]\n...\n[ 3459.590492] Call Trace:\n[ 3459.590500]  d_walk+0x61/0x2a0\n[ 3459.590518]  ? shrink_lock_dentry.part.0+0xe0/0xe0\n[ 3459.590526]  shrink_dcache_for_umount+0x49/0x110\n[ 3459.590535]  generic_shutdown_super+0x1a/0x110\n[ 3459.590542]  kill_anon_super+0x14/0x30\n[ 3459.590549]  cifs_kill_sb+0xf5/0x104 [cifs]\n[ 3459.590773]  deactivate_locked_super+0x36/0xa0\n[ 3459.590782]  cleanup_mnt+0x131/0x190\n[ 3459.590789]  task_work_run+0x5c/0x90\n[ 3459.590798]  exit_to_user_mode_loop+0x151/0x160\n[ 3459.590809]  exit_to_user_mode_prepare+0x83/0xd0\n[ 3459.590818]  syscall_exit_to_user_mode+0x12/0x30\n[ 3459.590828]  do_syscall_64+0x48/0x90\n[ 3459.590833]  entry_SYSCALL_64_after_hwframe+0x44/0xae",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b817c808-4748-4a6f-91ae-292185cd313f",  "id": "CVE-2022-48839",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: fix slab-out-of-bounds access in packet_recvmsg()\n\nsyzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH\nand mmap operations, tpacket_rcv() is queueing skbs with\ngarbage in skb->cb[], triggering a too big copy [1]\n\nPresumably, users of af_packet using mmap() already gets correct\nmetadata from the mapped buffer, we can simply make sure\nto clear 12 bytes that might be copied to user space later.\n\nBUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline]\nBUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489\nWrite of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631\n\nCPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-02396-g0b3660695e80 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255\n __kasan_report mm/kasan/report.c:442 [inline]\n kasan_report.cold+0x83/0xdf mm/kasan/report.c:459\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189\n memcpy+0x39/0x60 mm/kasan/shadow.c:66\n memcpy include/linux/fortify-string.h:225 [inline]\n packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489\n sock_recvmsg_nosec net/socket.c:948 [inline]\n sock_recvmsg net/socket.c:966 [inline]\n sock_recvmsg net/socket.c:962 [inline]\n ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632\n ___sys_recvmsg+0x127/0x200 net/socket.c:2674\n __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7fdfd5954c29\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29\nRDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005\nRBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcf8e71e60\nR13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54\n </TASK>\n\naddr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at offset 32 in frame:\n ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246\n\nthis frame has 1 object:\n [32, 160) 'addr'\n\nMemory state around the buggy address:\n ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00\n ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00\n>ffffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3\n                                                                ^\n ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1\n ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00\n==================================================================",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c0c0b433-03f5-4833-b889-083432fad4c1",  "id": "CVE-2021-47511",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47511"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Fix negative period/buffer sizes\n\nThe period size calculation in OSS layer may receive a negative value\nas an error, but the code there assumes only the positive values and\nhandle them with size_t.  Due to that, a too big value may be passed\nto the lower layers.\n\nThis patch changes the code to handle with ssize_t and adds the proper\nerror checks appropriately.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "59995d32-f39b-487e-97f7-068c28327bb8",  "id": "RLSA-2022:5818",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a66a52e-c11b-4ebc-9557-012b9d9cfdf7",  "id": "CVE-2010-4072",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4072"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The copy_shmid_to_user function in ipc/shm.c in the Linux kernel before 2.6.37-rc1 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to the shmctl system call and the \"old shm interface.\"",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9451be4-57d6-427d-89c5-1b1a91a40e52",  "id": "CVE-2011-1776",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1776"  },  "ratings": [    {      "score": 6.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allows physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "25830ada-6e30-4406-a656-3202c015737f",  "id": "CLSA-2024-1710183809",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0cbd64c5-4030-476c-b4a7-fbb1b13307fe",  "id": "CVE-2026-53397",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix posix_acl leak on SETACL decode failure\n\nnfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each\ncall nfs_stream_decode_acl() twice, first for NFS_ACL and then for\nNFS_DFACL.  Each successful call transfers ownership of a freshly\nallocated posix_acl into argp->acl_access or argp->acl_default.  If\nthe first call succeeds but the second fails, the decoder returns\nfalse and argp->acl_access is left dangling.\n\nACLPROC2_SETACL.pc_release was wired to nfssvc_release_attrstat and\nACLPROC3_SETACL.pc_release was wired to nfs3svc_release_fhandle.\nBoth only call fh_put() and have no knowledge of the ACL fields on\nargp.  The posix_acl_release() pairs sat at the out: labels inside\nnfsacld_proc_setacl() and nfsd3_proc_setacl(), but svc_process()\nskips pc_func when pc_decode returns false, so that cleanup is\nunreachable on decode failure:\n\n    svc_process_common()\n      pc_decode()                  /* decode_setaclargs: false */\n      /* pc_func skipped */\n      pc_release()                 /* fh_put only -- ACLs leaked */\n\nThe orphaned posix_acl is leaked for the lifetime of the server.\n\nFix by adding nfsaclsvc_release_setacl() and nfs3svc_release_setacl(),\nwhich release both argp->acl_access and argp->acl_default in addition\nto fh_put(), and wiring them as pc_release for their respective SETACL\nprocedures.  pc_release runs on every path svc_process() takes after\ndecode, including decode failure, so the posix_acl_release() pairs are\nremoved from the proc functions' out: labels to keep ownership in one\nplace.  This matches the existing release_getacl() pattern used by\nthe sibling GETACL procedures.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "76fd89bf-be70-49a5-b866-da908af8f11e",  "id": "CVE-2023-53429",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't check PageError in __extent_writepage\n\n__extent_writepage currenly sets PageError whenever any error happens,\nand the also checks for PageError to decide if to call error handling.\nThis leads to very unclear responsibility for cleaning up on errors.\nIn the VM and generic writeback helpers the basic idea is that once\nI/O is fired off all error handling responsibility is delegated to the\nend I/O handler.  But if that end I/O handler sets the PageError bit,\nand the submitter checks it, the bit could in some cases leak into the\nsubmission context for fast enough I/O.\n\nFix this by simply not checking PageError and just using the local\nret variable to check for submission errors.  This also fundamentally\nsolves the long problem documented in a comment in __extent_writepage\nby never leaking the error bit into the submission context.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eb4acc55-5748-47c3-8f15-b8e3a6a12119",  "id": "CVE-2024-49987",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpftool: Fix undefined behavior in qsort(NULL, 0, ...)\n\nWhen netfilter has no entry to display, qsort is called with\nqsort(NULL, 0, ...). This results in undefined behavior, as UBSan\nreports:\n\nnet.c:827:2: runtime error: null pointer passed as argument 1, which is declared to never be null\n\nAlthough the C standard does not explicitly state whether calling qsort\nwith a NULL pointer when the size is 0 constitutes undefined behavior,\nSection 7.1.4 of the C standard (Use of library functions) mentions:\n\n\"Each of the following statements applies unless explicitly stated\notherwise in the detailed descriptions that follow: If an argument to a\nfunction has an invalid value (such as a value outside the domain of\nthe function, or a pointer outside the address space of the program, or\na null pointer, or a pointer to non-modifiable storage when the\ncorresponding parameter is not const-qualified) or a type (after\npromotion) not expected by a function with variable number of\narguments, the behavior is undefined.\"\n\nTo avoid this, add an early return when nf_link_info is NULL to prevent\ncalling qsort with a NULL pointer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "65956c8c-662a-4c14-a00e-b22b5f4b9707",  "id": "CVE-2024-26955",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: prevent kernel bug at submit_bh_wbc()\n\nFix a bug where nilfs_get_block() returns a successful status when\nsearching and inserting the specified block both fail inconsistently.  If\nthis inconsistent behavior is not due to a previously fixed bug, then an\nunexpected race is occurring, so return a temporary error -EAGAIN instead.\n\nThis prevents callers such as __block_write_begin_int() from requesting a\nread into a buffer that is not mapped, which would cause the BUG_ON check\nfor the BH_Mapped flag in submit_bh_wbc() to fail.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c99367d5-40c4-4efa-ae5f-1c0be7a171fc",  "id": "DLA-3942-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bc554086-6ea8-460a-8a3e-ed47c6d4c069",  "id": "DSA-3673-2",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "68d6d540-6cec-4caf-a132-268c982a5884",  "id": "CVE-2023-3220",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3220"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d823ce32-4da1-460e-a683-5addad74882b",  "id": "CVE-2013-4312",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4312"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "29137941-c2af-49a5-9c71-cbf0adb0ccc7",  "id": "CVE-2013-3230",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3230"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The l2tp_ip6_recvmsg function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.9-rc7 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cddb4225-8d9a-4b44-a332-1a4a0e8bc90a",  "id": "CVE-2019-19057",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19057"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-d10dcb615c8e.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a67719c-e6b6-464f-97d6-f6e9e32dbf61",  "id": "DLA-1449-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "559386f1-3251-4bd6-a02f-ca89a5080fef",  "id": "CVE-2016-2185",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2185"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:136222/Linux-ati_remote2-Null-Pointer-Dereference.html'"    }  ]},{  "bom-ref": "51a8419f-316c-4ebd-a106-f8f5a3e95491",  "id": "CLSA-2022-1647550273",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a8bec22-d240-41da-832f-15618d1da39e",  "id": "CLSA-2026-1772112014",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "667d987a-7cab-422f-8f1f-fd2700a467a1",  "id": "ROOT-OS-DEBIAN-11-CVE-2026-14456",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "446f0a23-fd4a-4a65-adf5-846c3f80fbd7",  "id": "CVE-2013-2094",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2094"  },  "ratings": [    {      "score": 8.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:25444'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:121616/Linux-PERF_EVENTS-Local-Root.html'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'PSS:121976/Linux-perf_swevent_init-Local-Root.html'"    },    {      "name": "EMBA:sbom:4:exploit",      "value": "'PSS:125674/Linux-perf_swevent_init-Privilege-Escalation.html'"    },    {      "name": "EMBA:sbom:5:exploit",      "value": "'PSS:126880/Ubuntu-12.04-3.x-x86_64-perf_swevent_init-Local-Root.html'"    }  ]},{  "bom-ref": "655b137b-0b74-41e0-9c6d-7121b0f36939",  "id": "CVE-2025-46394",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46394"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    451  ],  "analysis": {    "state": "in_triage"  },  "description": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "53b33079-7ef3-42a4-8440-14e4b2b25fb9",  "id": "ROOT-OS-ALPINE-315-CVE-2024-4741",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d588317e-c5f6-4ed3-8f19-e018549d8049",  "id": "CVE-2022-49431",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/iommu: Add missing of_node_put in iommu_init_early_dart\n\nThe device_node pointer is returned by of_find_compatible_node\nwith refcount incremented. We should use of_node_put() to avoid\nthe refcount leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc459053-d476-47cf-8691-9492e9143069",  "id": "CVE-2022-49107",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix memory leak in ceph_readdir when note_last_dentry returns error\n\nReset the last_readdir at the same time, and add a comment explaining\nwhy we don't free last_readdir when dir_emit returns false.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "195140a9-547f-4b5a-a128-dfb6f0033d44",  "id": "CVE-2021-47319",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47319"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-blk: Fix memory leak among suspend/resume procedure\n\nThe vblk->vqs should be freed before we call init_vqs()\nin virtblk_restore().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fce06370-4879-479c-b30e-6d0f24df5305",  "id": "CVE-2025-38430",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: nfsd4_spo_must_allow() must check this is a v4 compound request\n\nIf the request being processed is not a v4 compound request, then\nexamining the cstate can have undefined results.\n\nThis patch adds a check that the rpc procedure being executed\n(rq_procinfo) is the NFSPROC4_COMPOUND procedure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a7759010-0325-412a-9f69-2cfbd016e19a",  "id": "CVE-2024-42075",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix remap of arena.\n\nThe bpf arena logic didn't account for mremap operation. Add a refcnt for\nmultiple mmap events to prevent use-after-free in arena_vm_close.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7781fb9d-0b69-4997-82db-13868bd094d6",  "id": "OESA-2022-1603",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9361e675-e33a-4ed5-9c81-ff64d24b0a76",  "id": "AZL-89940",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b9a79a3b-4a69-4c96-8ac9-30747a302324",  "id": "SUSE-SU-2021:3530-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc6a98d1-49af-49c9-8dd7-4bef8ce0a0e4",  "id": "CVE-2022-49302",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: host: isp116x: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d21e8db-517a-49a9-aed9-2d24b1bb1aaa",  "id": "CVE-2025-39686",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Make insn_rw_emulate_bits() do insn->n samples\n\nThe `insn_rw_emulate_bits()` function is used as a default handler for\n`INSN_READ` instructions for subdevices that have a handler for\n`INSN_BITS` but not for `INSN_READ`.  Similarly, it is used as a default\nhandler for `INSN_WRITE` instructions for subdevices that have a handler\nfor `INSN_BITS` but not for `INSN_WRITE`. It works by emulating the\n`INSN_READ` or `INSN_WRITE` instruction handling with a constructed\n`INSN_BITS` instruction.  However, `INSN_READ` and `INSN_WRITE`\ninstructions are supposed to be able read or write multiple samples,\nindicated by the `insn->n` value, but `insn_rw_emulate_bits()` currently\nonly handles a single sample.  For `INSN_READ`, the comedi core will\ncopy `insn->n` samples back to user-space.  (That triggered KASAN\nkernel-infoleak errors when `insn->n` was greater than 1, but that is\nbeing fixed more generally elsewhere in the comedi core.)\n\nMake `insn_rw_emulate_bits()` either handle `insn->n` samples, or return\nan error, to conform to the general expectation for `INSN_READ` and\n`INSN_WRITE` handlers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bb2d220f-2db7-4936-bb47-4185bb759795",  "id": "CVE-2019-13631",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13631"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ce11ab66-8581-4ae5-9edc-24911a95804a",  "id": "CVE-2022-49330",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix tcp_mtup_probe_success vs wrong snd_cwnd\n\nsyzbot got a new report [1] finally pointing to a very old bug,\nadded in initial support for MTU probing.\n\ntcp_mtu_probe() has checks about starting an MTU probe if\ntcp_snd_cwnd(tp) >= 11.\n\nBut nothing prevents tcp_snd_cwnd(tp) to be reduced later\nand before the MTU probe succeeds.\n\nThis bug would lead to potential zero-divides.\n\nDebugging added in commit 40570375356c (\"tcp: add accessors\nto read/set tp->snd_cwnd\") has paid off :)\n\nWhile we are at it, address potential overflows in this code.\n\n[1]\nWARNING: CPU: 1 PID: 14132 at include/net/tcp.h:1219 tcp_mtup_probe_success+0x366/0x570 net/ipv4/tcp_input.c:2712\nModules linked in:\nCPU: 1 PID: 14132 Comm: syz-executor.2 Not tainted 5.18.0-syzkaller-07857-gbabf0bb978e3 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:tcp_snd_cwnd_set include/net/tcp.h:1219 [inline]\nRIP: 0010:tcp_mtup_probe_success+0x366/0x570 net/ipv4/tcp_input.c:2712\nCode: 74 08 48 89 ef e8 da 80 17 f9 48 8b 45 00 65 48 ff 80 80 03 00 00 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 aa b0 c5 f8 <0f> 0b e9 16 fe ff ff 48 8b 4c 24 08 80 e1 07 38 c1 0f 8c c7 fc ff\nRSP: 0018:ffffc900079e70f8 EFLAGS: 00010287\nRAX: ffffffff88c0f7f6 RBX: ffff8880756e7a80 RCX: 0000000000040000\nRDX: ffffc9000c6c4000 RSI: 0000000000031f9e RDI: 0000000000031f9f\nRBP: 0000000000000000 R08: ffffffff88c0f606 R09: ffffc900079e7520\nR10: ffffed101011226d R11: 1ffff1101011226c R12: 1ffff1100eadcf50\nR13: ffff8880756e72c0 R14: 1ffff1100eadcf89 R15: dffffc0000000000\nFS:  00007f643236e700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1ab3f1e2a0 CR3: 0000000064fe7000 CR4: 00000000003506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n tcp_clean_rtx_queue+0x223a/0x2da0 net/ipv4/tcp_input.c:3356\n tcp_ack+0x1962/0x3c90 net/ipv4/tcp_input.c:3861\n tcp_rcv_established+0x7c8/0x1ac0 net/ipv4/tcp_input.c:5973\n tcp_v6_do_rcv+0x57b/0x1210 net/ipv6/tcp_ipv6.c:1476\n sk_backlog_rcv include/net/sock.h:1061 [inline]\n __release_sock+0x1d8/0x4c0 net/core/sock.c:2849\n release_sock+0x5d/0x1c0 net/core/sock.c:3404\n sk_stream_wait_memory+0x700/0xdc0 net/core/stream.c:145\n tcp_sendmsg_locked+0x111d/0x3fc0 net/ipv4/tcp.c:1410\n tcp_sendmsg+0x2c/0x40 net/ipv4/tcp.c:1448\n sock_sendmsg_nosec net/socket.c:714 [inline]\n sock_sendmsg net/socket.c:734 [inline]\n __sys_sendto+0x439/0x5c0 net/socket.c:2119\n __do_sys_sendto net/socket.c:2131 [inline]\n __se_sys_sendto net/socket.c:2127 [inline]\n __x64_sys_sendto+0xda/0xf0 net/socket.c:2127\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7f6431289109\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f643236e168 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00007f643139c100 RCX: 00007f6431289109\nRDX: 00000000d0d0c2ac RSI: 0000000020000080 RDI: 000000000000000a\nRBP: 00007f64312e308d R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007fff372533af R14: 00007f643236e300 R15: 0000000000022000",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f6dd1859-923e-4dc3-99c5-10c3dcb62730",  "id": "CVE-2022-3649",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3649"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211992.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a824b35a-ed41-4df3-90e4-fd304b7d937b",  "id": "openSUSE-SU-2026:10740-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d014a5e5-ec06-4acc-a641-1bbb1bb21029",  "id": "CLSA-2022-1647550603",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "71d2e82a-bd41-4f5b-8efc-6718f6671a8e",  "id": "CVE-2022-49938",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix small mempool leak in SMB2_negotiate()\n\nIn some cases of failure (dialect mismatches) in SMB2_negotiate(), after\nthe request is sent, the checks would return -EIO when they should be\nrather setting rc = -EIO and jumping to neg_exit to free the response\nbuffer from mempool.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a15871ba-b874-4353-853f-ebb23578efcb",  "id": "CVE-2014-7826",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7826"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2753cc33-f04b-43f0-93a0-436be50f9677",  "id": "CVE-2022-49492",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags\n\nIn nvme_alloc_admin_tags, the admin_q can be set to an error (typically\n-ENOMEM) if the blk_mq_init_queue call fails to set up the queue, which\nis checked immediately after the call. However, when we return the error\nmessage up the stack, to nvme_reset_work the error takes us to\nnvme_remove_dead_ctrl()\n  nvme_dev_disable()\n   nvme_suspend_queue(&dev->queues[0]).\n\nHere, we only check that the admin_q is non-NULL, rather than not\nan error or NULL, and begin quiescing a queue that never existed, leading\nto bad / NULL pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2b877480-8c35-4722-a468-9ad42cf3b5df",  "id": "OESA-2021-1447",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "55b7a1d5-1bb2-46de-93e6-5219f51b08b6",  "id": "DLA-3449-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95e35128-6376-44f4-a1e5-72c7beff07d2",  "id": "CVE-2024-40967",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: imx: Introduce timeout when waiting on transmitter empty\n\nBy waiting at most 1 second for USR2_TXDC to be set, we avoid a potential\ndeadlock.\n\nIn case of the timeout, there is not much we can do, so we simply ignore\nthe transmitter state and optimistically try to continue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4aae9f0a-16bf-4f24-a904-1cd3d172030e",  "id": "CVE-2017-18550",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18550"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_hba_info does not initialize the hbainfo structure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eb6afbbd-e6fb-484c-8123-d0eb56843739",  "id": "CVE-2024-50007",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: asihpi: Fix potential OOB array access\n\nASIHPI driver stores some values in the static array upon a response\nfrom the driver, and its index depends on the firmware.  We shouldn't\ntrust it blindly.\n\nThis patch adds a sanity check of the array index to fit in the array\nsize.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "353b1494-4df5-4fb8-8b1b-c1fced1b0a25",  "id": "DSA-6015-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "70140be8-f82d-4bb6-a9fe-7cc3cdf91170",  "id": "CVE-2021-47618",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47618"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: 9170/1: fix panic when kasan and kprobe are enabled\n\narm32 uses software to simulate the instruction replaced\nby kprobe. some instructions may be simulated by constructing\nassembly functions. therefore, before executing instruction\nsimulation, it is necessary to construct assembly function\nexecution environment in C language through binding registers.\nafter kasan is enabled, the register binding relationship will\nbe destroyed, resulting in instruction simulation errors and\ncausing kernel panic.\n\nthe kprobe emulate instruction function is distributed in three\nfiles: actions-common.c actions-arm.c actions-thumb.c, so disable\nKASAN when compiling these files.\n\nfor example, use kprobe insert on cap_capable+20 after kasan\nenabled, the cap_capable assembly code is as follows:\n<cap_capable>:\ne92d47f0\tpush\t{r4, r5, r6, r7, r8, r9, sl, lr}\ne1a05000\tmov\tr5, r0\ne280006c\tadd\tr0, r0, #108    ; 0x6c\ne1a04001\tmov\tr4, r1\ne1a06002\tmov\tr6, r2\ne59fa090\tldr\tsl, [pc, #144]  ;\nebfc7bf8\tbl\tc03aa4b4 <__asan_load4>\ne595706c\tldr\tr7, [r5, #108]  ; 0x6c\ne2859014\tadd\tr9, r5, #20\n......\nThe emulate_ldr assembly code after enabling kasan is as follows:\nc06f1384 <emulate_ldr>:\ne92d47f0\tpush\t{r4, r5, r6, r7, r8, r9, sl, lr}\ne282803c\tadd\tr8, r2, #60     ; 0x3c\ne1a05000\tmov\tr5, r0\ne7e37855\tubfx\tr7, r5, #16, #4\ne1a00008\tmov\tr0, r8\ne1a09001\tmov\tr9, r1\ne1a04002\tmov\tr4, r2\nebf35462\tbl\tc03c6530 <__asan_load4>\ne357000f\tcmp\tr7, #15\ne7e36655\tubfx\tr6, r5, #12, #4\ne205a00f\tand\tsl, r5, #15\n0a000001\tbeq\tc06f13bc <emulate_ldr+0x38>\ne0840107\tadd\tr0, r4, r7, lsl #2\nebf3545c\tbl\tc03c6530 <__asan_load4>\ne084010a\tadd\tr0, r4, sl, lsl #2\nebf3545a\tbl\tc03c6530 <__asan_load4>\ne2890010\tadd\tr0, r9, #16\nebf35458\tbl\tc03c6530 <__asan_load4>\ne5990010\tldr\tr0, [r9, #16]\ne12fff30\tblx\tr0\ne356000f\tcm\tr6, #15\n1a000014\tbne\tc06f1430 <emulate_ldr+0xac>\ne1a06000\tmov\tr6, r0\ne2840040\tadd\tr0, r4, #64     ; 0x40\n......\n\nwhen running in emulate_ldr to simulate the ldr instruction, panic\noccurred, and the log is as follows:\nUnable to handle kernel NULL pointer dereference at virtual address\n00000090\npgd = ecb46400\n[00000090] *pgd=2e0fa003, *pmd=00000000\nInternal error: Oops: 206 [#1] SMP ARM\nPC is at cap_capable+0x14/0xb0\nLR is at emulate_ldr+0x50/0xc0\npsr: 600d0293 sp : ecd63af8  ip : 00000004  fp : c0a7c30c\nr10: 00000000  r9 : c30897f4  r8 : ecd63cd4\nr7 : 0000000f  r6 : 0000000a  r5 : e59fa090  r4 : ecd63c98\nr3 : c06ae294  r2 : 00000000  r1 : b7611300  r0 : bf4ec008\nFlags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user\nControl: 32c5387d  Table: 2d546400  DAC: 55555555\nProcess bash (pid: 1643, stack limit = 0xecd60190)\n(cap_capable) from (kprobe_handler+0x218/0x340)\n(kprobe_handler) from (kprobe_trap_handler+0x24/0x48)\n(kprobe_trap_handler) from (do_undefinstr+0x13c/0x364)\n(do_undefinstr) from (__und_svc_finish+0x0/0x30)\n(__und_svc_finish) from (cap_capable+0x18/0xb0)\n(cap_capable) from (cap_vm_enough_memory+0x38/0x48)\n(cap_vm_enough_memory) from\n(security_vm_enough_memory_mm+0x48/0x6c)\n(security_vm_enough_memory_mm) from\n(copy_process.constprop.5+0x16b4/0x25c8)\n(copy_process.constprop.5) from (_do_fork+0xe8/0x55c)\n(_do_fork) from (SyS_clone+0x1c/0x24)\n(SyS_clone) from (__sys_trace_return+0x0/0x10)\nCode: 0050a0e1 6c0080e2 0140a0e1 0260a0e1 (f801f0e7)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "920ab803-0b6a-48e4-8346-a2b7ebb9d3ea",  "id": "CVE-2024-46844",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    824  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: line: always fill *error_out in setup_one_line()\n\nThe pointer isn't initialized by callers, but I have\nencountered cases where it's still printed; initialize\nit in all possible cases in setup_one_line().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7622b7fe-ce60-4856-874d-42aac6e7bdf1",  "id": "CVE-2016-10044",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10044"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae5e78ac-35ac-43ce-8c29-04497145cfe1",  "id": "CVE-2024-26767",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476,    835  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fixed integer types and null check locations\n\n[why]:\nissues fixed:\n- comparison with wider integer type in loop condition which can cause\ninfinite loops\n- pointer dereference before null check",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d7dfdebe-e7b2-4bc8-870f-5459303140e0",  "id": "RLSA-2026:19066",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "90ed668b-4786-47e8-9c2e-dc023db2d505",  "id": "CVE-2014-3158",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3158"  },  "ratings": [    {      "score": 7.5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to \"access privileged options\" via a long word in an options file, which triggers a heap-based buffer overflow that \"[corrupts] security-relevant variables.\"",  "affects": [    {      "ref": "73881d6c-a776-4513-80a9-27bcf656c60d",      "versions": [        {          "component": "point-to-point_protocol",          "version": "2.4.2b3"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a0369b41-b0f7-42de-8c30-787bf2cfef03",  "id": "CVE-2026-46200",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: mpc52xx: fix controller deregistration\n\nMake sure to deregister the controller before disabling and releasing\nunderlying resources like interrupts and gpios during driver unbind.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69c5b95a-15eb-40aa-84fd-7dcce26b222b",  "id": "MGASA-2026-0091",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ca591fa2-bf7a-4f94-81c2-edae63100461",  "id": "CVE-2019-19536",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19536"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c driver, aka CID-ead16e53c2f0.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d4fed914-6555-4ff7-953c-9a5fa1177bc6",  "id": "CVE-2011-1182",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1182"  },  "ratings": [    {      "score": 3.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:P"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/signal.c in the Linux kernel before 2.6.39 allows local users to spoof the uid and pid of a signal sender via a sigqueueinfo system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0ae2037-5093-4a1f-8028-83115a58f610",  "id": "CLSA-2026-1771955371",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a1add2a6-02f1-47be-94b0-134e241c4e29",  "id": "AZL-89931",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d8fe527d-3846-41ca-bf38-bd7c2ce7a04a",  "id": "CVE-2024-53063",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    755  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvbdev: prevent the risk of out of memory access\n\nThe dvbdev contains a static variable used to store dvb minors.\n\nThe behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set\nor not. When not set, dvb_register_device() won't check for\nboundaries, as it will rely that a previous call to\ndvb_register_adapter() would already be enforcing it.\n\nOn a similar way, dvb_device_open() uses the assumption\nthat the register functions already did the needed checks.\n\nThis can be fragile if some device ends using different\ncalls. This also generate warnings on static check analysers\nlike Coverity.\n\nSo, add explicit guards to prevent potential risk of OOM issues.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0751bf65-133c-4c1c-b2e0-2c1a331e1e46",  "id": "CVE-2019-19531",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19531"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.2.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/yurex.c driver, aka CID-fc05481b2fca.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ea35ae55-659a-4b60-bccf-c4056738c1db",  "id": "SUSE-SU-2020:14491-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f74639d7-4c48-42b0-af6f-8c23ff39726f",  "id": "CLSA-2023-1687269261",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b3ced324-5b60-44f5-beea-04e95680a71d",  "id": "SUSE-SU-2026:20726-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c7d0e718-369c-405c-b524-ab61ac82a323",  "id": "openSUSE-SU-2024:10846-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c59fc7b2-f992-45e0-8e3d-f81874a00164",  "id": "CVE-2022-49337",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: dlmfs: fix error handling of user_dlm_destroy_lock\n\nWhen user_dlm_destroy_lock failed, it didn't clean up the flags it set\nbefore exit.  For USER_LOCK_IN_TEARDOWN, if this function fails because of\nlock is still in used, next time when unlink invokes this function, it\nwill return succeed, and then unlink will remove inode and dentry if lock\nis not in used(file closed), but the dlm lock is still linked in dlm lock\nresource, then when bast come in, it will trigger a panic due to\nuser-after-free.  See the following panic call trace.  To fix this,\nUSER_LOCK_IN_TEARDOWN should be reverted if fail.  And also error should\nbe returned if USER_LOCK_IN_TEARDOWN is set to let user know that unlink\nfail.\n\nFor the case of ocfs2_dlm_unlock failure, besides USER_LOCK_IN_TEARDOWN,\nUSER_LOCK_BUSY is also required to be cleared.  Even though spin lock is\nreleased in between, but USER_LOCK_IN_TEARDOWN is still set, for\nUSER_LOCK_BUSY, if before every place that waits on this flag,\nUSER_LOCK_IN_TEARDOWN is checked to bail out, that will make sure no flow\nwaits on the busy flag set by user_dlm_destroy_lock(), then we can\nsimplely revert USER_LOCK_BUSY when ocfs2_dlm_unlock fails.  Fix\nuser_dlm_cluster_lock() which is the only function not following this.\n\n[  941.336392] (python,26174,16):dlmfs_unlink:562 ERROR: unlink\n004fb0000060000b5a90b8c847b72e1, error -16 from destroy\n[  989.757536] ------------[ cut here ]------------\n[  989.757709] kernel BUG at fs/ocfs2/dlmfs/userdlm.c:173!\n[  989.757876] invalid opcode: 0000 [#1] SMP\n[  989.758027] Modules linked in: ksplice_2zhuk2jr_ib_ipoib_new(O)\nksplice_2zhuk2jr(O) mptctl mptbase xen_netback xen_blkback xen_gntalloc\nxen_gntdev xen_evtchn cdc_ether usbnet mii ocfs2 jbd2 rpcsec_gss_krb5\nauth_rpcgss nfsv4 nfsv3 nfs_acl nfs fscache lockd grace ocfs2_dlmfs\nocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs bnx2fc\nfcoe libfcoe libfc scsi_transport_fc sunrpc ipmi_devintf bridge stp llc\nrds_rdma rds bonding ib_sdp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad\nrdma_cm ib_cm iw_cm falcon_lsm_serviceable(PE) falcon_nf_netcontain(PE)\nmlx4_vnic falcon_kal(E) falcon_lsm_pinned_13402(E) mlx4_ib ib_sa ib_mad\nib_core ib_addr xenfs xen_privcmd dm_multipath iTCO_wdt iTCO_vendor_support\npcspkr sb_edac edac_core i2c_i801 lpc_ich mfd_core ipmi_ssif i2c_core ipmi_si\nipmi_msghandler\n[  989.760686]  ioatdma sg ext3 jbd mbcache sd_mod ahci libahci ixgbe dca ptp\npps_core vxlan udp_tunnel ip6_udp_tunnel megaraid_sas mlx4_core crc32c_intel\nbe2iscsi bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi ipv6 cxgb3 mdio\nlibiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi wmi\ndm_mirror dm_region_hash dm_log dm_mod [last unloaded:\nksplice_2zhuk2jr_ib_ipoib_old]\n[  989.761987] CPU: 10 PID: 19102 Comm: dlm_thread Tainted: P           OE\n4.1.12-124.57.1.el6uek.x86_64 #2\n[  989.762290] Hardware name: Oracle Corporation ORACLE SERVER\nX5-2/ASM,MOTHERBOARD,1U, BIOS 30350100 06/17/2021\n[  989.762599] task: ffff880178af6200 ti: ffff88017f7c8000 task.ti:\nffff88017f7c8000\n[  989.762848] RIP: e030:[<ffffffffc07d4316>]  [<ffffffffc07d4316>]\n__user_dlm_queue_lockres.part.4+0x76/0x80 [ocfs2_dlmfs]\n[  989.763185] RSP: e02b:ffff88017f7cbcb8  EFLAGS: 00010246\n[  989.763353] RAX: 0000000000000000 RBX: ffff880174d48008 RCX:\n0000000000000003\n[  989.763565] RDX: 0000000000120012 RSI: 0000000000000003 RDI:\nffff880174d48170\n[  989.763778] RBP: ffff88017f7cbcc8 R08: ffff88021f4293b0 R09:\n0000000000000000\n[  989.763991] R10: ffff880179c8c000 R11: 0000000000000003 R12:\nffff880174d48008\n[  989.764204] R13: 0000000000000003 R14: ffff880179c8c000 R15:\nffff88021db7a000\n[  989.764422] FS:  0000000000000000(0000) GS:ffff880247480000(0000)\nknlGS:ffff880247480000\n[  989.764685] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  989.764865] CR2: ffff8000007f6800 CR3: 0000000001ae0000 CR4:\n0000000000042660\n[  989.765081] Stack:\n[  989.765167]  00000000000\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd65aea8-9735-47e4-a8f0-81aef829145b",  "id": "CVE-2024-41065",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: Whitelist dtl slub object for copying to userspace\n\nReading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-*\nresults in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as\nshown below.\n\n    kernel BUG at mm/usercopy.c:102!\n    Oops: Exception in kernel mode, sig: 5 [#1]\n    LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\n    Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc\n    scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse\n    CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85\n    Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries\n    NIP:  c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8\n    REGS: c000000120c078c0 TRAP: 0700   Not tainted  (6.10.0-rc3)\n    MSR:  8000000000029033 <SF,EE,ME,IR,DR,RI,LE>  CR: 2828220f  XER: 0000000e\n    CFAR: c0000000001fdc80 IRQMASK: 0\n    [ ... GPRs omitted ... ]\n    NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0\n    LR [c0000000005d23d0] usercopy_abort+0x74/0xb0\n    Call Trace:\n     usercopy_abort+0x74/0xb0 (unreliable)\n     __check_heap_object+0xf8/0x120\n     check_heap_object+0x218/0x240\n     __check_object_size+0x84/0x1a4\n     dtl_file_read+0x17c/0x2c4\n     full_proxy_read+0x8c/0x110\n     vfs_read+0xdc/0x3a0\n     ksys_read+0x84/0x144\n     system_call_exception+0x124/0x330\n     system_call_vectored_common+0x15c/0x2ec\n    --- interrupt: 3000 at 0x7fff81f3ab34\n\nCommit 6d07d1cd300f (\"usercopy: Restrict non-usercopy caches to size 0\")\nrequires that only whitelisted areas in slab/slub objects can be copied to\nuserspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY.\nDtl contains hypervisor dispatch events which are expected to be read by\nprivileged users. Hence mark this safe for user access.\nSpecify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the\nentire object.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "07bcc32c-a2dc-4077-aa5f-4e87e968dd85",  "id": "CVE-2022-50274",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvbdev: adopts refcnt to avoid UAF\n\ndvb_unregister_device() is known that prone to use-after-free.\nThat is, the cleanup from dvb_unregister_device() releases the dvb_device\neven if there are pointers stored in file->private_data still refer to it.\n\nThis patch adds a reference counter into struct dvb_device and delays its\ndeallocation until no pointer refers to the object.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db3c6cdf-9e8e-4549-be97-3dd95c29c7a7",  "id": "MGASA-2015-0216",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3d4abaec-9348-4aac-833c-28ae276c9243",  "id": "CVE-2022-49707",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: add reserved GDT blocks check\n\nWe capture a NULL pointer issue when resizing a corrupt ext4 image which\nis freshly clear resize_inode feature (not run e2fsck). It could be\nsimply reproduced by following steps. The problem is because of the\nresize_inode feature was cleared, and it will convert the filesystem to\nmeta_bg mode in ext4_resize_fs(), but the es->s_reserved_gdt_blocks was\nnot reduced to zero, so could we mistakenly call reserve_backup_gdb()\nand passing an uninitialized resize_inode to it when adding new group\ndescriptors.\n\n mkfs.ext4 /dev/sda 3G\n tune2fs -O ^resize_inode /dev/sda #forget to run requested e2fsck\n mount /dev/sda /mnt\n resize2fs /dev/sda 8G\n\n ========\n BUG: kernel NULL pointer dereference, address: 0000000000000028\n CPU: 19 PID: 3243 Comm: resize2fs Not tainted 5.18.0-rc7-00001-gfde086c5ebfd #748\n ...\n RIP: 0010:ext4_flex_group_add+0xe08/0x2570\n ...\n Call Trace:\n  <TASK>\n  ext4_resize_fs+0xbec/0x1660\n  __ext4_ioctl+0x1749/0x24e0\n  ext4_ioctl+0x12/0x20\n  __x64_sys_ioctl+0xa6/0x110\n  do_syscall_64+0x3b/0x90\n  entry_SYSCALL_64_after_hwframe+0x44/0xae\n RIP: 0033:0x7f2dd739617b\n ========\n\nThe fix is simple, add a check in ext4_resize_begin() to make sure that\nthe es->s_reserved_gdt_blocks is zero when the resize_inode feature is\ndisabled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d7a75149-1909-4f67-9cf7-f2e90918cb0a",  "id": "CVE-2024-53098",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/ufence: Prefetch ufence addr to catch bogus address\n\naccess_ok() only checks for addr overflow so also try to read the addr\nto catch invalid addr sent from userspace.\n\n(cherry picked from commit 9408c4508483ffc60811e910a93d6425b8e63928)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "633170c9-97fa-4497-ad16-2254d5b09699",  "id": "CVE-2023-51782",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51782"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "302a56cf-13df-4785-a557-84cfb49e43c1",  "id": "CVE-2024-56785",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a\n\nFix the dtc warnings:\n\n    arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning (interrupt_provider): /bus@10000000/pci@1a000000: '#interrupt-cells' found, but node is not an interrupt provider\n    arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning (interrupt_provider): /bus@10000000/pci@1a000000: '#interrupt-cells' found, but node is not an interrupt provider\n    arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dtb: Warning (interrupt_map): Failed prerequisite 'interrupt_provider'\n\nAnd a runtime warning introduced in commit 045b14ca5c36 (\"of: WARN on\ndeprecated #address-cells/#size-cells handling\"):\n\n    WARNING: CPU: 0 PID: 1 at drivers/of/base.c:106 of_bus_n_addr_cells+0x9c/0xe0\n    Missing '#address-cells' in /bus@10000000/pci@1a000000/pci_bridge@9,0\n\nThe fix is similar to commit d89a415ff8d5 (\"MIPS: Loongson64: DTS: Fix PCIe\nport nodes for ls7a\"), which has fixed the issue for ls2k (despite its\nsubject mentions ls7a).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7cf0e9d3-0115-4177-878e-2ee7ac262202",  "id": "CVE-2022-49176",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbfq: fix use-after-free in bfq_dispatch_request\n\nKASAN reports a use-after-free report when doing normal scsi-mq test\n\n[69832.239032] ==================================================================\n[69832.241810] BUG: KASAN: use-after-free in bfq_dispatch_request+0x1045/0x44b0\n[69832.243267] Read of size 8 at addr ffff88802622ba88 by task kworker/3:1H/155\n[69832.244656]\n[69832.245007] CPU: 3 PID: 155 Comm: kworker/3:1H Not tainted 5.10.0-10295-g576c6382529e #8\n[69832.246626] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[69832.249069] Workqueue: kblockd blk_mq_run_work_fn\n[69832.250022] Call Trace:\n[69832.250541]  dump_stack+0x9b/0xce\n[69832.251232]  ? bfq_dispatch_request+0x1045/0x44b0\n[69832.252243]  print_address_description.constprop.6+0x3e/0x60\n[69832.253381]  ? __cpuidle_text_end+0x5/0x5\n[69832.254211]  ? vprintk_func+0x6b/0x120\n[69832.254994]  ? bfq_dispatch_request+0x1045/0x44b0\n[69832.255952]  ? bfq_dispatch_request+0x1045/0x44b0\n[69832.256914]  kasan_report.cold.9+0x22/0x3a\n[69832.257753]  ? bfq_dispatch_request+0x1045/0x44b0\n[69832.258755]  check_memory_region+0x1c1/0x1e0\n[69832.260248]  bfq_dispatch_request+0x1045/0x44b0\n[69832.261181]  ? bfq_bfqq_expire+0x2440/0x2440\n[69832.262032]  ? blk_mq_delay_run_hw_queues+0xf9/0x170\n[69832.263022]  __blk_mq_do_dispatch_sched+0x52f/0x830\n[69832.264011]  ? blk_mq_sched_request_inserted+0x100/0x100\n[69832.265101]  __blk_mq_sched_dispatch_requests+0x398/0x4f0\n[69832.266206]  ? blk_mq_do_dispatch_ctx+0x570/0x570\n[69832.267147]  ? __switch_to+0x5f4/0xee0\n[69832.267898]  blk_mq_sched_dispatch_requests+0xdf/0x140\n[69832.268946]  __blk_mq_run_hw_queue+0xc0/0x270\n[69832.269840]  blk_mq_run_work_fn+0x51/0x60\n[69832.278170]  process_one_work+0x6d4/0xfe0\n[69832.278984]  worker_thread+0x91/0xc80\n[69832.279726]  ? __kthread_parkme+0xb0/0x110\n[69832.280554]  ? process_one_work+0xfe0/0xfe0\n[69832.281414]  kthread+0x32d/0x3f0\n[69832.282082]  ? kthread_park+0x170/0x170\n[69832.282849]  ret_from_fork+0x1f/0x30\n[69832.283573]\n[69832.283886] Allocated by task 7725:\n[69832.284599]  kasan_save_stack+0x19/0x40\n[69832.285385]  __kasan_kmalloc.constprop.2+0xc1/0xd0\n[69832.286350]  kmem_cache_alloc_node+0x13f/0x460\n[69832.287237]  bfq_get_queue+0x3d4/0x1140\n[69832.287993]  bfq_get_bfqq_handle_split+0x103/0x510\n[69832.289015]  bfq_init_rq+0x337/0x2d50\n[69832.289749]  bfq_insert_requests+0x304/0x4e10\n[69832.290634]  blk_mq_sched_insert_requests+0x13e/0x390\n[69832.291629]  blk_mq_flush_plug_list+0x4b4/0x760\n[69832.292538]  blk_flush_plug_list+0x2c5/0x480\n[69832.293392]  io_schedule_prepare+0xb2/0xd0\n[69832.294209]  io_schedule_timeout+0x13/0x80\n[69832.295014]  wait_for_common_io.constprop.1+0x13c/0x270\n[69832.296137]  submit_bio_wait+0x103/0x1a0\n[69832.296932]  blkdev_issue_discard+0xe6/0x160\n[69832.297794]  blk_ioctl_discard+0x219/0x290\n[69832.298614]  blkdev_common_ioctl+0x50a/0x1750\n[69832.304715]  blkdev_ioctl+0x470/0x600\n[69832.305474]  block_ioctl+0xde/0x120\n[69832.306232]  vfs_ioctl+0x6c/0xc0\n[69832.306877]  __se_sys_ioctl+0x90/0xa0\n[69832.307629]  do_syscall_64+0x2d/0x40\n[69832.308362]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n[69832.309382]\n[69832.309701] Freed by task 155:\n[69832.310328]  kasan_save_stack+0x19/0x40\n[69832.311121]  kasan_set_track+0x1c/0x30\n[69832.311868]  kasan_set_free_info+0x1b/0x30\n[69832.312699]  __kasan_slab_free+0x111/0x160\n[69832.313524]  kmem_cache_free+0x94/0x460\n[69832.314367]  bfq_put_queue+0x582/0x940\n[69832.315112]  __bfq_bfqd_reset_in_service+0x166/0x1d0\n[69832.317275]  bfq_bfqq_expire+0xb27/0x2440\n[69832.318084]  bfq_dispatch_request+0x697/0x44b0\n[69832.318991]  __blk_mq_do_dispatch_sched+0x52f/0x830\n[69832.319984]  __blk_mq_sched_dispatch_requests+0x398/0x4f0\n[69832.321087]  blk_mq_sched_dispatch_requests+0xdf/0x140\n[69832.322225]  __blk_mq_run_hw_queue+0xc0/0x270\n[69832.323114]  blk_mq_run_work_fn+0x51/0x6\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "587bd150-2ef9-4c89-a62d-c35d90a51703",  "id": "CVE-2009-3245",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3245"  },  "ratings": [    {      "score": 10,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48b25b24-011f-435f-ad69-cb20ac4952c9",  "id": "CVE-2024-50086",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix user-after-free from session log off\n\nThere is racy issue between smb2 session log off and smb2 session setup.\nIt will cause user-after-free from session log off.\nThis add session_lock when setting SMB2_SESSION_EXPIRED and referece\ncount to session struct not to free session while it is being used.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bb0a6230-ff17-47e0-b0c5-447b56ee78b4",  "id": "CVE-2026-63796",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reject oversized group bitmap descriptors\n\nocfs2_validate_gd_parent() only bounds bg_bits against the parent\nallocator's chain geometry.  A malicious descriptor can still claim a\nbg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in\nthe group descriptor block, so later bitmap scans and bit updates can run\npast bg_bitmap.\n\nAdd a physical-cap check based on ocfs2_group_bitmap_size() for the parent\nallocator type and reject descriptors whose bg_size or bg_bits exceed that\ncapacity.  Keep the existing chain geometry check so both the on-disk\nbitmap layout and the allocator metadata must agree before the descriptor\nis used.\n\nValidation reproduced this kernel report:\nKASAN use-after-free in _find_next_bit+0x7f/0xc0\nRead of size 8\nCall trace:\n  dump_stack_lvl+0x66/0xa0 (?:?)\n  print_report+0xd0/0x630 (?:?)\n  _find_next_bit+0x7f/0xc0 (?:?)\n  srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n  __virt_addr_valid+0x188/0x2f0 (?:?)\n  kasan_report+0xe4/0x120 (?:?)\n  ocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375)\n  ocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457)\n  ocfs2_cluster_group_search+0x16b/0x440 (fs/ocfs2/suballoc.c:86)\n  ocfs2_bg_discontig_fix_result+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786)\n  ocfs2_search_chain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886)\n  get_page_from_freelist+0x70e/0x2370 (?:?)\n  lock_release+0xc6/0x290 (?:?)\n  do_raw_spin_unlock+0x9a/0x100 (?:?)\n  kasan_unpoison+0x27/0x60 (?:?)\n  __bfs+0x147/0x240 (?:?)\n  get_page_from_freelist+0x83d/0x2370 (?:?)\n  ocfs2_claim_suballoc_bits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96)\n  sched_domains_numa_masks_clear+0x70/0xd0 (?:?)\n  check_irq_usage+0xe8/0xb70 (?:?)\n  __ocfs2_claim_clusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497)\n  check_path+0x24/0x50 (?:?)\n  rcu_is_watching+0x20/0x50 (?:?)\n  check_prev_add+0xfd/0xd00 (?:?)\n  ocfs2_add_clusters_in_btree+0x17d/0x810 (fs/ocfs2/suballoc.c:?)\n  __folio_batch_add_and_move+0x1f5/0x3d0 (?:?)\n  ocfs2_add_inode_data+0xd9/0x120 (fs/ocfs2/suballoc.c:?)\n  filemap_add_folio+0x105/0x1f0 (?:?)\n  ocfs2_write_begin_nolock+0x29f7/0x2f80 (fs/ocfs2/suballoc.c:3043)\n  ocfs2_read_inode_block+0xb5/0x110 (fs/ocfs2/suballoc.c:?)\n  down_write+0xf5/0x180 (?:?)\n  ocfs2_write_begin+0x180/0x240 (fs/ocfs2/suballoc.c:?)\n  __mark_inode_dirty+0x758/0x9a0 (?:?)\n  inode_to_bdi+0x41/0x90 (?:?)\n  balance_dirty_pages_ratelimited_flags+0xf8/0x1d0 (?:?)\n  generic_perform_write+0x252/0x440 (?:?)\n  mnt_put_write_access_file+0x16/0x70 (?:?)\n  file_update_time_flags+0xe4/0x200 (?:?)\n  ocfs2_file_write_iter+0x80a/0x1320 (fs/ocfs2/suballoc.c:?)\n  lock_acquire+0x184/0x2f0 (?:?)\n  ksys_write+0xd2/0x170 (?:?)\n  apparmor_file_permission+0xf5/0x310 (?:?)\n  read_zero+0x8d/0x140 (?:?)\n  lock_is_held_type+0x8f/0x100 (?:?)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fa0c45df-1b71-4006-8df9-e41045bbd765",  "id": "CVE-2023-52429",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52429"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    754,    789  ],  "analysis": {    "state": "in_triage"  },  "description": "dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f15d081-6d02-4cd5-a42e-cee21d445e65",  "id": "CVE-2024-1312",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1312"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in the Linux kernel's Memory Management subsystem when a user wins two races at the same time with a fail in the mas_prev_slot function. This issue could allow a local user to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52eb15a6-95a4-49c1-b57c-477b15382663",  "id": "CVE-2024-50148",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: fix wild-memory-access in proto_unregister\n\nThere's issue as follows:\n  KASAN: maybe wild-memory-access in range [0xdead...108-0xdead...10f]\n  CPU: 3 UID: 0 PID: 2805 Comm: rmmod Tainted: G        W\n  RIP: 0010:proto_unregister+0xee/0x400\n  Call Trace:\n   <TASK>\n   __do_sys_delete_module+0x318/0x580\n   do_syscall_64+0xc1/0x1d0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nAs bnep_init() ignore bnep_sock_init()'s return value, and bnep_sock_init()\nwill cleanup all resource. Then when remove bnep module will call\nbnep_sock_cleanup() to cleanup sock's resource.\nTo solve above issue just return bnep_sock_init()'s return value in\nbnep_exit().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "181cb4c7-50b3-41e6-99ff-da3b4eb35aa6",  "id": "CVE-2026-45994",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmasm: fix OOB reads in command_file_write due to missing size checks\n\nThe command_file_write() handler allocates a kernel buffer of exactly\ncount bytes and copies user data into it, but does not validate the\nbuffer against the dot command protocol before passing it to\nget_dot_command_size() and get_dot_command_timeout().\n\nSince both the allocation size (count) and the header fields (command_size,\ndata_size) are independently user-controlled, an attacker can cause\nget_dot_command_size() to return a value exceeding the allocation,\ntriggering OOB reads in get_dot_command_timeout() and an out-of-bounds\nmemcpy_toio() that leaks kernel heap memory to the service processor.\n\nFix with two guards: reject writes smaller than sizeof(struct\ndot_command_header) before allocation, then after copying user data\nreject commands where the buffer is smaller than the total size declared\nby the header (sizeof(header) + command_size + data_size). This ensures\nall subsequent header and payload field accesses stay within the buffer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d33dab7c-a88c-4c37-b249-fde6d5c21147",  "id": "CVE-2020-15437",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15437"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_ports() that allows local users to cause a denial of service by using the p->serial_in pointer which uninitialized.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "44a9b7e7-1ee5-41d8-8d20-4215085d8a20",  "id": "CVE-2026-53246",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n\nWhen a listening SCTP server processes a COOKIE_ECHO chunk, the cached\npeer INIT chunk embedded after the cookie is parsed and its parameters\nare later walked by sctp_process_init() using sctp_walk_params().\n\nHowever, the chunk header length of this cached INIT chunk was not\nvalidated against the remaining buffer in the COOKIE_ECHO payload. If\nthe length field is inflated, the parameter walk can run beyond the\nactual received data, leading to out-of-bounds reads and potential\nmemory corruption during later parameter handling (e.g. STATE_COOKIE\nprocessing and kmemdup() copies).\n\nAdd a bounds check in sctp_unpack_cookie() to ensure the cached INIT\nchunk length does not exceed the available data in the COOKIE_ECHO\nbuffer before it is used.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a1b6a7eb-445c-48f5-bf51-5e63355daa9f",  "id": "OESA-2026-3686",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0e42d187-badf-42f0-90dd-227798e00c22",  "id": "CVE-2024-57950",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Initialize denominator defaults to 1\n\n[WHAT & HOW]\nVariables, used as denominators and maybe not assigned to other values,\nshould be initialized to non-zero to avoid DIVIDE_BY_ZERO, as reported\nby Coverity.\n\n(cherry picked from commit e2c4c6c10542ccfe4a0830bb6c9fd5b177b7bbb7)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e3bbd685-62ca-473b-b431-c5d31fc1ff66",  "id": "CVE-2024-46679",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nethtool: check device is present when getting link settings\n\nA sysfs reader can race with a device reset or removal, attempting to\nread device state when the device is not actually present. eg:\n\n     [exception RIP: qed_get_current_link+17]\n  #8 [ffffb9e4f2907c48] qede_get_link_ksettings at ffffffffc07a994a [qede]\n  #9 [ffffb9e4f2907cd8] __rh_call_get_link_ksettings at ffffffff992b01a3\n #10 [ffffb9e4f2907d38] __ethtool_get_link_ksettings at ffffffff992b04e4\n #11 [ffffb9e4f2907d90] duplex_show at ffffffff99260300\n #12 [ffffb9e4f2907e38] dev_attr_show at ffffffff9905a01c\n #13 [ffffb9e4f2907e50] sysfs_kf_seq_show at ffffffff98e0145b\n #14 [ffffb9e4f2907e68] seq_read at ffffffff98d902e3\n #15 [ffffb9e4f2907ec8] vfs_read at ffffffff98d657d1\n #16 [ffffb9e4f2907f00] ksys_read at ffffffff98d65c3f\n #17 [ffffb9e4f2907f38] do_syscall_64 at ffffffff98a052fb\n\n crash> struct net_device.state ffff9a9d21336000\n    state = 5,\n\nstate 5 is __LINK_STATE_START (0b1) and __LINK_STATE_NOCARRIER (0b100).\nThe device is not present, note lack of __LINK_STATE_PRESENT (0b10).\n\nThis is the same sort of panic as observed in commit 4224cfd7fb65\n(\"net-sysfs: add check for netdevice being present to speed_show\").\n\nThere are many other callers of __ethtool_get_link_ksettings() which\ndon't have a device presence check.\n\nMove this check into ethtool to protect all callers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2b3a00a2-ba58-4f79-9bc2-da83d9ed006c",  "id": "CVE-2021-45095",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45095"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5696eeaf-c201-4900-b9dc-938785f4b651",  "id": "CVE-2016-6197",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6197"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not properly verify the upper dentry before proceeding with unlink and rename system-call processing, which allows local users to cause a denial of service (system crash) via a rename system call that specifies a self-hardlink.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a919cc26-2d5b-4cd4-8b82-4b5c131a748e",  "id": "openSUSE-SU-2022:0135-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "423ed67c-73d3-403b-810a-62fbb6ac258e",  "id": "CVE-2020-29373",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29373"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"    }  ],  "cwes": [    22  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations, aka CID-ff002b30181d.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f3d9ee99-3c05-4e7d-966b-5a21c788d82f",  "id": "OESA-2021-1441",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fba6378b-eb10-44c4-a1b5-954ea9cbc79c",  "id": "AZL-9311",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a0600394-51e8-4ff2-ac01-6e5f1855775c",  "id": "CLSA-2026-1777567181",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4968e496-66e3-4577-8945-32d21874403c",  "id": "CVE-2014-9585",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9585"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5d1b0a76-1551-4887-a56b-cd8a35c3817f",  "id": "CVE-2023-3108",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3108"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    400  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the subsequent get_user_pages_fast in the Linux kernel’s interface for symmetric key cipher algorithms in the skcipher_recvmsg of crypto/algif_skcipher.c function. This flaw allows a local user to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6c83a3f2-7805-45d7-8d0d-aac15c5dbfdf",  "id": "RHSA-2016:0008",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ce0bccde-074e-46d6-bfbe-2ace18bc3b2a",  "id": "CVE-2022-50210",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK\n\nWhen CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected,\ncpu_max_bits_warn() generates a runtime warning similar as below while\nwe show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit)\ninstead of NR_CPUS to iterate CPUs.\n\n[    3.052463] ------------[ cut here ]------------\n[    3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0\n[    3.070072] Modules linked in: efivarfs autofs4\n[    3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052\n[    3.084034] Hardware name: Loongson Loongson-3A4000-7A1000-1w-V0.1-CRB/Loongson-LS3A4000-7A1000-1w-EVB-V1.21, BIOS Loongson-UDK2018-V2.0.04082-beta7 04/27\n[    3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000\n[    3.109127]         9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430\n[    3.118774]         90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff\n[    3.128412]         0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890\n[    3.138056]         0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa\n[    3.147711]         ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000\n[    3.157364]         900000000101c998 0000000000000004 9000000000ef7430 0000000000000000\n[    3.167012]         0000000000000009 000000000000006c 0000000000000000 0000000000000000\n[    3.176641]         9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286\n[    3.186260]         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c\n[    3.195868]         ...\n[    3.199917] Call Trace:\n[    3.203941] [<98000000002086d8>] show_stack+0x38/0x14c\n[    3.210666] [<9800000000cf846c>] dump_stack_lvl+0x60/0x88\n[    3.217625] [<980000000023d268>] __warn+0xd0/0x100\n[    3.223958] [<9800000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc\n[    3.231150] [<9800000000210220>] show_cpuinfo+0x5e8/0x5f0\n[    3.238080] [<98000000004f578c>] seq_read_iter+0x354/0x4b4\n[    3.245098] [<98000000004c2e90>] new_sync_read+0x17c/0x1c4\n[    3.252114] [<98000000004c5174>] vfs_read+0x138/0x1d0\n[    3.258694] [<98000000004c55f8>] ksys_read+0x70/0x100\n[    3.265265] [<9800000000cfde9c>] do_syscall+0x7c/0x94\n[    3.271820] [<9800000000202fe4>] handle_syscall+0xc4/0x160\n[    3.281824] ---[ end trace 8b484262b4b8c24c ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "220ec7dd-2a09-4261-bbd2-82e3a4733b2d",  "id": "CVE-2021-47490",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47490"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: fix memleak in ttm_transfered_destroy\n\nWe need to cleanup the fences for ghost objects as well.\n\nBug: https://bugzilla.kernel.org/show_bug.cgi?id=214029\nBug: https://bugzilla.kernel.org/show_bug.cgi?id=214447",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c41d8a1d-aa6d-4163-8007-8f164eae1653",  "id": "CVE-2015-8963",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8963"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e4c6824-52fa-45cb-a29c-076b91486307",  "id": "CVE-2024-40984",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Revert \"ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.\"\n\nUndo the modifications made in commit d410ee5109a1 (\"ACPICA: avoid\n\"Info: mapping multiple BARs. Your kernel is fine.\"\"). The initial\npurpose of this commit was to stop memory mappings for operation\nregions from overlapping page boundaries, as it can trigger warnings\nif different page attributes are present.\n\nHowever, it was found that when this situation arises, mapping\ncontinues until the boundary's end, but there is still an attempt to\nread/write the entire length of the map, leading to a NULL pointer\ndeference. For example, if a four-byte mapping request is made but\nonly one byte is mapped because it hits the current page boundary's\nend, a four-byte read/write attempt is still made, resulting in a NULL\npointer deference.\n\nInstead, map the entire length, as the ACPI specification does not\nmandate that it must be within the same page boundary. It is\npermissible for it to be mapped across different regions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7eff09d9-4eef-4eae-8f4d-62e73dd6e8a3",  "id": "CVE-2022-50153",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: host: Fix refcount leak in ehci_hcd_ppc_of_probe\n\nof_find_compatible_node() returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() to avoid refcount leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b9c1c7d-6f7c-4513-a046-0309e3d61bc8",  "id": "CVE-2016-2147",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2147"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0c195acb-bc54-4a58-b8b9-339e7c089678",  "id": "CVE-2019-14821",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14821"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31035a6e-91f0-4ae3-a5a9-824c0e524067",  "id": "CVE-2015-5364",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5364"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "70a1933a-1230-43bd-a29c-ff563e266aad",  "id": "CVE-2012-1090",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1090"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The cifs_lookup function in fs/cifs/dir.c in the Linux kernel before 3.2.10 allows local users to cause a denial of service (OOPS) via attempted access to a special file, as demonstrated by a FIFO.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "38e30c43-93a8-4b6b-966c-3b17ccddecf2",  "id": "CVE-2024-53108",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Adjust VSDB parser for replay feature\n\nAt some point, the IEEE ID identification for the replay check in the\nAMD EDID was added. However, this check causes the following\nout-of-bounds issues when using KASAN:\n\n[   27.804016] BUG: KASAN: slab-out-of-bounds in amdgpu_dm_update_freesync_caps+0xefa/0x17a0 [amdgpu]\n[   27.804788] Read of size 1 at addr ffff8881647fdb00 by task systemd-udevd/383\n\n...\n\n[   27.821207] Memory state around the buggy address:\n[   27.821215]  ffff8881647fda00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   27.821224]  ffff8881647fda80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   27.821234] >ffff8881647fdb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[   27.821243]                    ^\n[   27.821250]  ffff8881647fdb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[   27.821259]  ffff8881647fdc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   27.821268] ==================================================================\n\nThis is caused because the ID extraction happens outside of the range of\nthe edid lenght. This commit addresses this issue by considering the\namd_vsdb_block size.\n\n(cherry picked from commit b7e381b1ccd5e778e3d9c44c669ad38439a861d8)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5897f32a-058d-4b6f-8601-a31400dec077",  "id": "CVE-2023-23455",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23455"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    843  ],  "analysis": {    "state": "in_triage"  },  "description": "atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84aac40c-d3fd-43ba-a827-f49010272e40",  "id": "CVE-2010-4157",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4157"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the ioc_general function in drivers/scsi/gdth.c in the Linux kernel before 2.6.36.1 on 64-bit platforms allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large argument in an ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c36ef689-a1a4-4b89-b415-de49d620524e",  "id": "CVE-2024-26601",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: regenerate buddy after block freeing failed if under fc replay\n\nThis mostly reverts commit 6bd97bf273bd (\"ext4: remove redundant\nmb_regenerate_buddy()\") and reintroduces mb_regenerate_buddy(). Based on\ncode in mb_free_blocks(), fast commit replay can end up marking as free\nblocks that are already marked as such. This causes corruption of the\nbuddy bitmap so we need to regenerate it in that case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aa2554f7-1b36-4269-b9ad-e5b553f3f624",  "id": "CVE-2024-47662",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Remove register from DCN35 DMCUB diagnostic collection\n\n[Why]\nThese registers should not be read from driver and triggering the\nsecurity violation when DMCUB work times out and diagnostics are\ncollected blocks Z8 entry.\n\n[How]\nRemove the register read from DCN35.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e4af5e15-3ed8-4cb2-bf4a-d1fc699717c9",  "id": "CVE-2026-23076",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix potential OOB access in audio mixer handling\n\nIn the audio mixer handling code of ctxfi driver, the conf field is\nused as a kind of loop index, and it's referred in the index callbacks\n(amixer_index() and sum_index()).\n\nAs spotted recently by fuzzers, the current code causes OOB access at\nthose functions.\n| UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48\n| index 8 is out of range for type 'unsigned char [8]'\n\nAfter the analysis, the cause was found to be the lack of the proper\n(re-)initialization of conj field.\n\nThis patch addresses those OOB accesses by adding the proper\ninitializations of the loop indices.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "468771ef-2907-48d8-bc68-388e11b840eb",  "id": "CVE-2019-15922",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15922"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.9. There is a NULL pointer dereference for a pf data structure if alloc_disk fails in drivers/block/paride/pf.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "82c1c637-5c15-4bbd-a6f4-3f01789fdbf7",  "id": "CVE-2017-18261",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18261"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "The arch_timer_reg_read_stable macro in arch/arm64/include/asm/arch_timer.h in the Linux kernel before 4.13 allows local users to cause a denial of service (infinite recursion) by writing to a file under /sys/kernel/debug in certain circumstances, as demonstrated by a scenario involving debugfs, ftrace, PREEMPT_TRACER, and FUNCTION_GRAPH_TRACER.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1cc87573-2ef3-4855-8f1b-37def7d29cd1",  "id": "CVE-2026-43040",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak\n\nWhen processing Router Advertisements with user options the kernel\nbuilds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct\nhas three padding fields that are never zeroed and can leak kernel data\n\nThe fix is simple, just zeroes the padding fields.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "742e7445-3b3d-45f4-8eca-d593f51cdf94",  "id": "CVE-2023-52753",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Avoid NULL dereference of timing generator\n\n[Why & How]\nCheck whether assigned timing generator is NULL or not before\naccessing its funcs to prevent NULL dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4cebdf69-26bb-498a-899b-2d1292727b1e",  "id": "CVE-2022-49738",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on i_extra_isize in is_alive()\n\nsyzbot found a f2fs bug:\n\nBUG: KASAN: slab-out-of-bounds in data_blkaddr fs/f2fs/f2fs.h:2891 [inline]\nBUG: KASAN: slab-out-of-bounds in is_alive fs/f2fs/gc.c:1117 [inline]\nBUG: KASAN: slab-out-of-bounds in gc_data_segment fs/f2fs/gc.c:1520 [inline]\nBUG: KASAN: slab-out-of-bounds in do_garbage_collect+0x386a/0x3df0 fs/f2fs/gc.c:1734\nRead of size 4 at addr ffff888076557568 by task kworker/u4:3/52\n\nCPU: 1 PID: 52 Comm: kworker/u4:3 Not tainted 6.1.0-rc4-syzkaller-00362-gfef7fd48922d #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nWorkqueue: writeback wb_workfn (flush-7:0)\nCall Trace:\n<TASK>\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\nprint_address_description mm/kasan/report.c:284 [inline]\nprint_report+0x15e/0x45d mm/kasan/report.c:395\nkasan_report+0xbb/0x1f0 mm/kasan/report.c:495\ndata_blkaddr fs/f2fs/f2fs.h:2891 [inline]\nis_alive fs/f2fs/gc.c:1117 [inline]\ngc_data_segment fs/f2fs/gc.c:1520 [inline]\ndo_garbage_collect+0x386a/0x3df0 fs/f2fs/gc.c:1734\nf2fs_gc+0x88c/0x20a0 fs/f2fs/gc.c:1831\nf2fs_balance_fs+0x544/0x6b0 fs/f2fs/segment.c:410\nf2fs_write_inode+0x57e/0xe20 fs/f2fs/inode.c:753\nwrite_inode fs/fs-writeback.c:1440 [inline]\n__writeback_single_inode+0xcfc/0x1440 fs/fs-writeback.c:1652\nwriteback_sb_inodes+0x54d/0xf90 fs/fs-writeback.c:1870\nwb_writeback+0x2c5/0xd70 fs/fs-writeback.c:2044\nwb_do_writeback fs/fs-writeback.c:2187 [inline]\nwb_workfn+0x2dc/0x12f0 fs/fs-writeback.c:2227\nprocess_one_work+0x9bf/0x1710 kernel/workqueue.c:2289\nworker_thread+0x665/0x1080 kernel/workqueue.c:2436\nkthread+0x2e4/0x3a0 kernel/kthread.c:376\nret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n\nThe root cause is that we forgot to do sanity check on .i_extra_isize\nin below path, result in accessing invalid address later, fix it.\n- gc_data_segment\n - is_alive\n  - data_blkaddr\n   - offset_in_addr",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7dae0fc7-d812-4b71-b9bf-138f1131dec1",  "id": "CVE-2017-18344",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18344"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:45175'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:148867/Linux-Kernel-4.14.7-Ubuntu-16.04-CentOS-7-Arbitrary-File-Read.html'"    }  ]},{  "bom-ref": "b7bebd64-46ea-4a32-9d3e-957caf80b723",  "id": "CVE-2026-53400",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: core: fix adapter registration race\n\nAdapters can be looked up based on their id using i2c_get_adapter()\nwhich takes a reference to the embedded struct device.\n\nMake sure that the adapter (including its struct device) has been\ninitialised before adding it to the IDR to avoid accessing uninitialised\ndata which could, for example, lead to NULL-pointer dereferences or\nuse-after-free.\n\nNote that the i2c-dev chardev, which is registered from a bus notifier,\ncurrently uses i2c_get_adapter() so the adapter needs to be added to the\nIDR before registration.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2aab4020-f4c0-457c-8d4a-16eaa1342402",  "id": "DSA-2908-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a53eeb20-e54a-4daf-92fb-d896d63cf624",  "id": "CVE-2024-46841",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()\n\nWe handle errors here properly, ENOMEM isn't fatal, return the error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f562a0b6-d572-44d4-acd3-95a2ef6957ae",  "id": "CVE-2026-43139",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.6,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm6: fix uninitialized saddr in xfrm6_get_saddr()\n\nxfrm6_get_saddr() does not check the return value of\nipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable\nsource address (returns -EADDRNOTAVAIL), saddr->in6 is left\nuninitialized, but xfrm6_get_saddr() still returns 0 (success).\n\nThis causes the caller xfrm_tmpl_resolve_one() to use the uninitialized\naddress in xfrm_state_find(), triggering KMSAN warning:\n\n=====================================================\nBUG: KMSAN: uninit-value in xfrm_state_find+0x2424/0xa940\n xfrm_state_find+0x2424/0xa940\n xfrm_resolve_and_create_bundle+0x906/0x5a20\n xfrm_lookup_with_ifid+0xcc0/0x3770\n xfrm_lookup_route+0x63/0x2b0\n ip_route_output_flow+0x1ce/0x270\n udp_sendmsg+0x2ce1/0x3400\n inet_sendmsg+0x1ef/0x2a0\n __sock_sendmsg+0x278/0x3d0\n __sys_sendto+0x593/0x720\n __x64_sys_sendto+0x130/0x200\n x64_sys_call+0x332b/0x3e70\n do_syscall_64+0xd3/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable tmp.i.i created at:\n xfrm_resolve_and_create_bundle+0x3e3/0x5a20\n xfrm_lookup_with_ifid+0xcc0/0x3770\n=====================================================\n\nFix by checking the return value of ipv6_dev_get_saddr() and propagating\nthe error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c48c98b5-175e-45c5-ab5e-c0ae34608716",  "id": "CVE-2024-35887",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: fix use-after-free bugs caused by ax25_ds_del_timer\n\nWhen the ax25 device is detaching, the ax25_dev_device_down()\ncalls ax25_ds_del_timer() to cleanup the slave_timer. When\nthe timer handler is running, the ax25_ds_del_timer() that\ncalls del_timer() in it will return directly. As a result,\nthe use-after-free bugs could happen, one of the scenarios\nis shown below:\n\n      (Thread 1)          |      (Thread 2)\n                          | ax25_ds_timeout()\nax25_dev_device_down()    |\n  ax25_ds_del_timer()     |\n    del_timer()           |\n  ax25_dev_put() //FREE   |\n                          |  ax25_dev-> //USE\n\nIn order to mitigate bugs, when the device is detaching, use\ntimer_shutdown_sync() to stop the timer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3085958f-2c1a-42cd-984a-860004507229",  "id": "CVE-2025-37742",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix uninit-value access of imap allocated in the diMount() function\n\nsyzbot reports that hex_dump_to_buffer is using uninit-value:\n\n=====================================================\nBUG: KMSAN: uninit-value in hex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171\nhex_dump_to_buffer+0x888/0x1100 lib/hexdump.c:171\nprint_hex_dump+0x13d/0x3e0 lib/hexdump.c:276\ndiFree+0x5ba/0x4350 fs/jfs/jfs_imap.c:876\njfs_evict_inode+0x510/0x550 fs/jfs/inode.c:156\nevict+0x723/0xd10 fs/inode.c:796\niput_final fs/inode.c:1946 [inline]\niput+0x97b/0xdb0 fs/inode.c:1972\ntxUpdateMap+0xf3e/0x1150 fs/jfs/jfs_txnmgr.c:2367\ntxLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]\njfs_lazycommit+0x627/0x11d0 fs/jfs/jfs_txnmgr.c:2733\nkthread+0x6b9/0xef0 kernel/kthread.c:464\nret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:148\nret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\nUninit was created at:\nslab_post_alloc_hook mm/slub.c:4121 [inline]\nslab_alloc_node mm/slub.c:4164 [inline]\n__kmalloc_cache_noprof+0x8e3/0xdf0 mm/slub.c:4320\nkmalloc_noprof include/linux/slab.h:901 [inline]\ndiMount+0x61/0x7f0 fs/jfs/jfs_imap.c:105\njfs_mount+0xa8e/0x11d0 fs/jfs/jfs_mount.c:176\njfs_fill_super+0xa47/0x17c0 fs/jfs/super.c:523\nget_tree_bdev_flags+0x6ec/0x910 fs/super.c:1636\nget_tree_bdev+0x37/0x50 fs/super.c:1659\njfs_get_tree+0x34/0x40 fs/jfs/super.c:635\nvfs_get_tree+0xb1/0x5a0 fs/super.c:1814\ndo_new_mount+0x71f/0x15e0 fs/namespace.c:3560\npath_mount+0x742/0x1f10 fs/namespace.c:3887\ndo_mount fs/namespace.c:3900 [inline]\n__do_sys_mount fs/namespace.c:4111 [inline]\n__se_sys_mount+0x71f/0x800 fs/namespace.c:4088\n__x64_sys_mount+0xe4/0x150 fs/namespace.c:4088\nx64_sys_call+0x39bf/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:166\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\n=====================================================\n\nThe reason is that imap is not properly initialized after memory\nallocation. It will cause the snprintf() function to write uninitialized\ndata into linebuf within hex_dump_to_buffer().\n\nFix this by using kzalloc instead of kmalloc to clear its content at the\nbeginning in diMount().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "767f2ac4-02bb-4aad-9e2d-ccdcd2b219e5",  "id": "CVE-2021-47347",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47347"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwl1251: Fix possible buffer overflow in wl1251_cmd_scan\n\nFunction wl1251_cmd_scan calls memcpy without checking the length.\nHarden by checking the length is within the maximum allowed size.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c677a6ae-4a06-4f68-8a97-8aaffb1f2bce",  "id": "CVE-2022-49434",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()\n\nThe sysfs sriov_numvfs_store() path acquires the device lock before the\nconfig space access lock:\n\n  sriov_numvfs_store\n    device_lock                 # A (1) acquire device lock\n    sriov_configure\n      vfio_pci_sriov_configure  # (for example)\n        vfio_pci_core_sriov_configure\n          pci_disable_sriov\n            sriov_disable\n              pci_cfg_access_lock\n                pci_wait_cfg    # B (4) wait for dev->block_cfg_access == 0\n\nPreviously, pci_dev_lock() acquired the config space access lock before the\ndevice lock:\n\n  pci_dev_lock\n    pci_cfg_access_lock\n      dev->block_cfg_access = 1 # B (2) set dev->block_cfg_access = 1\n    device_lock                 # A (3) wait for device lock\n\nAny path that uses pci_dev_lock(), e.g., pci_reset_function(), may\ndeadlock with sriov_numvfs_store() if the operations occur in the sequence\n(1) (2) (3) (4).\n\nAvoid the deadlock by reversing the order in pci_dev_lock() so it acquires\nthe device lock before the config space access lock, the same as the\nsriov_numvfs_store() path.\n\n[bhelgaas: combined and adapted commit log from Jay Zhou's independent\nsubsequent posting:\nhttps://lore.kernel.org/r/20220404062539.1710-1-jianjay.zhou@huawei.com]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e85a415b-34a5-4568-8bd9-5562e83d31f4",  "id": "CVE-2018-5803",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5803"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the \"_sctp_make_chunk()\" function (net/sctp/sm_make_chunk.c) when handling SCTP packets length can be exploited to cause a kernel crash.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84230e91-eb99-4154-a196-8fdc3da4b51b",  "id": "GHSA-9qwg-crg9-m2vc",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32236108-2466-4fac-b58d-58ab5a639a75",  "id": "CVE-2018-16862",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16862"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32e939d6-650b-4652-8530-96b106793c89",  "id": "CVE-2025-37838",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition\n\nIn the ssi_protocol_probe() function, &ssi->work is bound with\nssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function\nwithin the ssip_pn_ops structure is capable of starting the\nwork.\n\nIf we remove the module which will call ssi_protocol_remove()\nto make a cleanup, it will free ssi through kfree(ssi),\nwhile the work mentioned above will be used. The sequence\nof operations that may lead to a UAF bug is as follows:\n\nCPU0                                    CPU1\n\n                        | ssip_xmit_work\nssi_protocol_remove     |\nkfree(ssi);             |\n                        | struct hsi_client *cl = ssi->cl;\n                        | // use ssi\n\nFix it by ensuring that the work is canceled before proceeding\nwith the cleanup in ssi_protocol_remove().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "524d4d9d-eb51-40d0-b47c-73a95ee1aa9f",  "id": "CVE-2024-42076",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: can: j1939: Initialize unused data in j1939_send_one()\n\nsyzbot reported kernel-infoleak in raw_recvmsg() [1]. j1939_send_one()\ncreates full frame including unused data, but it doesn't initialize\nit. This causes the kernel-infoleak issue. Fix this by initializing\nunused data.\n\n[1]\nBUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\nBUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]\nBUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline]\nBUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\nBUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline]\nBUG: KMSAN: kernel-infoleak in _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185\n instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n copy_to_user_iter lib/iov_iter.c:24 [inline]\n iterate_ubuf include/linux/iov_iter.h:29 [inline]\n iterate_and_advance2 include/linux/iov_iter.h:245 [inline]\n iterate_and_advance include/linux/iov_iter.h:271 [inline]\n _copy_to_iter+0x366/0x2520 lib/iov_iter.c:185\n copy_to_iter include/linux/uio.h:196 [inline]\n memcpy_to_msg include/linux/skbuff.h:4113 [inline]\n raw_recvmsg+0x2b8/0x9e0 net/can/raw.c:1008\n sock_recvmsg_nosec net/socket.c:1046 [inline]\n sock_recvmsg+0x2c4/0x340 net/socket.c:1068\n ____sys_recvmsg+0x18a/0x620 net/socket.c:2803\n ___sys_recvmsg+0x223/0x840 net/socket.c:2845\n do_recvmmsg+0x4fc/0xfd0 net/socket.c:2939\n __sys_recvmmsg net/socket.c:3018 [inline]\n __do_sys_recvmmsg net/socket.c:3041 [inline]\n __se_sys_recvmmsg net/socket.c:3034 [inline]\n __x64_sys_recvmmsg+0x397/0x490 net/socket.c:3034\n x64_sys_call+0xf6c/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:300\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:3804 [inline]\n slab_alloc_node mm/slub.c:3845 [inline]\n kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577\n __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668\n alloc_skb include/linux/skbuff.h:1313 [inline]\n alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504\n sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795\n sock_alloc_send_skb include/net/sock.h:1842 [inline]\n j1939_sk_alloc_skb net/can/j1939/socket.c:878 [inline]\n j1939_sk_send_loop net/can/j1939/socket.c:1142 [inline]\n j1939_sk_sendmsg+0xc0a/0x2730 net/can/j1939/socket.c:1277\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x30f/0x380 net/socket.c:745\n ____sys_sendmsg+0x877/0xb60 net/socket.c:2584\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n __sys_sendmsg net/socket.c:2667 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2674\n x64_sys_call+0xc4b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nBytes 12-15 of 16 are uninitialized\nMemory access of size 16 starts at ffff888120969690\nData copied to user address 00000000200017c0\n\nCPU: 1 PID: 5050 Comm: syz-executor198 Not tainted 6.9.0-rc5-syzkaller-00031-g71b1543c83d6 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6294ab9d-d619-40a4-87e6-d42db9afc8cf",  "id": "CVE-2018-25020",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25020"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "The BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. This affects kernel/bpf/core.c and net/core/filter.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "249c6f32-f4cb-414a-b165-3cf2d07abe79",  "id": "CLSA-2023-1676025915",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f3015e5-3291-4032-861c-abab844911e6",  "id": "CVE-2010-0433",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0433"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8c0c1b7e-74ea-4ab6-a350-da754d5d2a93",  "id": "CVE-2022-49104",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: vchiq_core: handle NULL result of find_service_by_handle\n\nIn case of an invalid handle the function find_servive_by_handle\nreturns NULL. So take care of this and avoid a NULL pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c624490a-4b01-48ea-8fd0-c087e0c2c624",  "id": "CVE-2023-52476",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/lbr: Filter vsyscall addresses\n\nWe found that a panic can occur when a vsyscall is made while LBR sampling\nis active. If the vsyscall is interrupted (NMI) for perf sampling, this\ncall sequence can occur (most recent at top):\n\n    __insn_get_emulate_prefix()\n    insn_get_emulate_prefix()\n    insn_get_prefixes()\n    insn_get_opcode()\n    decode_branch_type()\n    get_branch_type()\n    intel_pmu_lbr_filter()\n    intel_pmu_handle_irq()\n    perf_event_nmi_handler()\n\nWithin __insn_get_emulate_prefix() at frame 0, a macro is called:\n\n    peek_nbyte_next(insn_byte_t, insn, i)\n\nWithin this macro, this dereference occurs:\n\n    (insn)->next_byte\n\nInspecting registers at this point, the value of the next_byte field is the\naddress of the vsyscall made, for example the location of the vsyscall\nversion of gettimeofday() at 0xffffffffff600000. The access to an address\nin the vsyscall region will trigger an oops due to an unhandled page fault.\n\nTo fix the bug, filtering for vsyscalls can be done when\ndetermining the branch type. This patch will return\na \"none\" branch if a kernel address if found to lie in the\nvsyscall region.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c4b4d7a-7d78-421d-a0f1-8fa9339b3c91",  "id": "CVE-2019-15923",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15923"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.9. There is a NULL pointer dereference for a cd data structure if alloc_disk fails in drivers/block/paride/pf.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2ad4dfa-6176-48d6-850b-d2e217d0174d",  "id": "DSA-2454-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0081ea11-c192-4b45-a557-da8699dffa53",  "id": "CVE-2024-47673",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: pause TCM when the firmware is stopped\n\nNot doing so will make us send a host command to the transport while the\nfirmware is not alive, which will trigger a WARNING.\n\nbad state = 0\nWARNING: CPU: 2 PID: 17434 at drivers/net/wireless/intel/iwlwifi/iwl-trans.c:115 iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi]\nRIP: 0010:iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi]\nCall Trace:\n <TASK>\n iwl_mvm_send_cmd+0x40/0xc0 [iwlmvm]\n iwl_mvm_config_scan+0x198/0x260 [iwlmvm]\n iwl_mvm_recalc_tcm+0x730/0x11d0 [iwlmvm]\n iwl_mvm_tcm_work+0x1d/0x30 [iwlmvm]\n process_one_work+0x29e/0x640\n worker_thread+0x2df/0x690\n ? rescuer_thread+0x540/0x540\n kthread+0x192/0x1e0\n ? set_kthread_struct+0x90/0x90\n ret_from_fork+0x22/0x30",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc159a48-c13f-478e-ba1f-e3e2b55b1d6d",  "id": "AZL-55889",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52256492-705a-48d9-89ce-cdceb42e513a",  "id": "CVE-2023-23003",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23003"  },  "ratings": [    {      "score": 4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    252  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5030bf42-e9ff-4ea1-a9cc-10f1ed082ede",  "id": "CVE-2023-53062",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: smsc95xx: Limit packet length to skb->len\n\nPacket length retrieved from descriptor may be larger than\nthe actual socket buffer length. In such case the cloned\nskb passed up the network stack will leak kernel memory contents.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3674bc55-060d-4cea-8c25-afb30b26e3bb",  "id": "DLA-3974-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e7ad46a-cd0a-4f6f-b217-3d37a9afcdaa",  "id": "CVE-2021-28951",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28951"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "742b9cdb-0ac8-4e90-a4d6-1980963f2088",  "id": "CVE-2013-1860",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1860"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "21f9534c-c396-498b-a9da-f01f16e46b5e",  "id": "CVE-2017-13694",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13694"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not flush the node and node_ext caches and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17bca9fd-feb4-422a-b301-341d418eb355",  "id": "CVE-2010-4529",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4529"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer underflow in the irda_getsockopt function in net/irda/af_irda.c in the Linux kernel before 2.6.37 on platforms other than x86 allows local users to obtain potentially sensitive information from kernel heap memory via an IRLMP_ENUMDEVICES getsockopt call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bc935222-4900-4eb6-91a6-51d7f563bdf2",  "id": "CVE-2025-37852",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create()\n\nAdd error handling to propagate amdgpu_cgs_create_device() failures\nto the caller. When amdgpu_cgs_create_device() fails, release hwmgr\nand return -ENOMEM to prevent null pointer dereference.\n\n[v1]->[v2]: Change error code from -EINVAL to -ENOMEM. Free hwmgr.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1b5d1c92-d7d5-4df1-a5c5-84d36e5659c4",  "id": "CVE-2018-12896",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12896"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically makes the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "222779cd-d567-439d-9fad-d5a6d15ae9ec",  "id": "OESA-2024-1531",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e6cdc704-8a71-42cc-b4af-7eb0b0d4eaac",  "id": "CVE-2024-56647",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix icmp host relookup triggering ip_rt_bug\n\narp link failure may trigger ip_rt_bug while xfrm enabled, call trace is:\n\nWARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 ip_rt_bug+0x14/0x20\nModules linked in:\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:ip_rt_bug+0x14/0x20\nCall Trace:\n <IRQ>\n ip_send_skb+0x14/0x40\n __icmp_send+0x42d/0x6a0\n ipv4_link_failure+0xe2/0x1d0\n arp_error_report+0x3c/0x50\n neigh_invalidate+0x8d/0x100\n neigh_timer_handler+0x2e1/0x330\n call_timer_fn+0x21/0x120\n __run_timer_base.part.0+0x1c9/0x270\n run_timer_softirq+0x4c/0x80\n handle_softirqs+0xac/0x280\n irq_exit_rcu+0x62/0x80\n sysvec_apic_timer_interrupt+0x77/0x90\n\nThe script below reproduces this scenario:\nip xfrm policy add src 0.0.0.0/0 dst 0.0.0.0/0 \\\n\tdir out priority 0 ptype main flag localok icmp\nip l a veth1 type veth\nip a a 192.168.141.111/24 dev veth0\nip l s veth0 up\nping 192.168.141.155 -c 1\n\nicmp_route_lookup() create input routes for locally generated packets\nwhile xfrm relookup ICMP traffic.Then it will set input route\n(dst->out = ip_rt_bug) to skb for DESTUNREACH.\n\nFor ICMP err triggered by locally generated packets, dst->dev of output\nroute is loopback. Generally, xfrm relookup verification is not required\non loopback interfaces (net.ipv4.conf.lo.disable_xfrm = 1).\n\nSkip icmp relookup for locally generated packets to fix it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7cb33709-d4fe-423e-941e-55cca6c4cb4e",  "id": "SUSE-SU-2021:0163-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "612f808a-b6eb-44d9-98cf-c3c6758d0c66",  "id": "CVE-2021-47352",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47352"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: Add validation for used length\n\nThis adds validation for used length (might come\nfrom an untrusted device) to avoid data corruption\nor loss.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "981cdf03-32f2-4bf8-b062-adb24e46457d",  "id": "CVE-2024-49935",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: PAD: fix crash in exit_round_robin()\n\nThe kernel occasionally crashes in cpumask_clear_cpu(), which is called\nwithin exit_round_robin(), because when executing clear_bit(nr, addr) with\nnr set to 0xffffffff, the address calculation may cause misalignment within\nthe memory, leading to access to an invalid memory address.\n\n----------\nBUG: unable to handle kernel paging request at ffffffffe0740618\n        ...\nCPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G           OE  X --------- -  - 4.18.0-425.19.2.el8_7.x86_64 #1\n        ...\nRIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad]\nCode: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 <f0> 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31\nRSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202\nRAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246\nRBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8\nR10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e\nR13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e\nFS:  0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n ? acpi_pad_add+0x120/0x120 [acpi_pad]\n kthread+0x10b/0x130\n ? set_kthread_struct+0x50/0x50\n ret_from_fork+0x1f/0x40\n        ...\nCR2: ffffffffe0740618\n\ncrash> dis -lr ffffffffc0726923\n        ...\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 114\n0xffffffffc0726918 <power_saving_thread+776>:\tmov    %r12d,%r12d\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 325\n0xffffffffc072691b <power_saving_thread+779>:\tmov    -0x3f8d7de0(,%r12,4),%eax\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./arch/x86/include/asm/bitops.h: 80\n0xffffffffc0726923 <power_saving_thread+787>:\tlock btr %rax,0x19cf4(%rip)        # 0xffffffffc0740620 <pad_busy_cpus_bits>\n\ncrash> px tsk_in_cpu[14]\n$66 = 0xffffffff\n\ncrash> px 0xffffffffc072692c+0x19cf4\n$99 = 0xffffffffc0740620\n\ncrash> sym 0xffffffffc0740620\nffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad]\n\ncrash> px pad_busy_cpus_bits[0]\n$42 = 0xfffc0\n----------\n\nTo fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling\ncpumask_clear_cpu() in exit_round_robin(), just as it is done in\nround_robin_cpu().\n\n[ rjw: Subject edit, avoid updates to the same value ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5b1555a4-6a92-42b5-ab2a-0c04dbb9369b",  "id": "CLSA-2026-1770668132",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fef225a5-8a8d-4063-99ea-132dec735207",  "id": "CVE-2021-3752",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3752"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "12d8380f-cfa5-46ca-b5e9-5333cbb8aef2",  "id": "CVE-2016-1576",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1576"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:41763'"    }  ]},{  "bom-ref": "13482244-9147-4fdd-b9c2-a183aa34d3ec",  "id": "CVE-2024-24861",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24861"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000 xc4000_get_frequency() function. This can result in return value overflow issue, possibly leading to malfunction or denial of service issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3266dcfc-7db6-4b14-a75d-89da01fc11c8",  "id": "CVE-2016-6198",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6198"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    284  ],  "analysis": {    "state": "in_triage"  },  "description": "The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a rename system call, related to fs/namei.c and fs/open.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "87be7ef7-6ebc-457e-8600-599c5e23f636",  "id": "CVE-2019-15217",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15217"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f6e40416-04bf-48ce-a3de-a52da2a741ef",  "id": "CVE-2023-2985",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2985"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e5a0928-f35c-4d40-81d7-e32b5e49b6b0",  "id": "CVE-2018-14617",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14617"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c137481a-d88e-4e77-a48b-6c52f3340cc8",  "id": "CVE-2023-53279",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: vmw_balloon: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic at\nonce.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "62cd96dd-bfe0-4ce9-88cb-c7911645bbef",  "id": "CVE-2024-40987",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix UBSAN warning in kv_dpm.c\n\nAdds bounds check for sumo_vid_mapping_entry.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d715fa0-71fe-425c-a3c2-e638d7f60c5a",  "id": "CVE-2011-1090",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1090"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a denial of service (panic) via a crafted attempt to set an ACL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "556be343-9a83-48ab-b042-6adfd9e4e325",  "id": "CVE-2020-27673",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27673"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b4d1b03-2eb5-4936-a865-44b0a3677eda",  "id": "ALSA-2026:20589",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e743aceb-2d60-4a67-b0b1-69d8d2d78893",  "id": "CVE-2025-22125",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1,raid10: don't ignore IO flags\n\nIf blk-wbt is enabled by default, it's found that raid write performance\nis quite bad because all IO are throttled by wbt of underlying disks,\ndue to flag REQ_IDLE is ignored. And turns out this behaviour exist since\nblk-wbt is introduced.\n\nOther than REQ_IDLE, other flags should not be ignored as well, for\nexample REQ_META can be set for filesystems, clearing it can cause priority\nreverse problems; And REQ_NOWAIT should not be cleared as well, because\nio will wait instead of failing directly in underlying disks.\n\nFix those problems by keep IO flags from master bio.\n\nFises: f51d46d0e7cb (\"md: add support for REQ_NOWAIT\")",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2a8fdec-6a01-4d93-88da-4a57bf84c931",  "id": "RHSA-2025:21562",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e65af7fd-2d91-41be-8b32-e1cede19e985",  "id": "CVE-2021-4439",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4439"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nisdn: cpai: check ctr->cnr to avoid array index out of bound\n\nThe cmtp_add_connection() would add a cmtp session to a controller\nand run a kernel thread to process cmtp.\n\n\t__module_get(THIS_MODULE);\n\tsession->task = kthread_run(cmtp_session, session, \"kcmtpd_ctr_%d\",\n\t\t\t\t\t\t\t\tsession->num);\n\nDuring this process, the kernel thread would call detach_capi_ctr()\nto detach a register controller. if the controller\nwas not attached yet, detach_capi_ctr() would\ntrigger an array-index-out-bounds bug.\n\n[   46.866069][ T6479] UBSAN: array-index-out-of-bounds in\ndrivers/isdn/capi/kcapi.c:483:21\n[   46.867196][ T6479] index -1 is out of range for type 'capi_ctr *[32]'\n[   46.867982][ T6479] CPU: 1 PID: 6479 Comm: kcmtpd_ctr_0 Not tainted\n5.15.0-rc2+ #8\n[   46.869002][ T6479] Hardware name: QEMU Standard PC (i440FX + PIIX,\n1996), BIOS 1.14.0-2 04/01/2014\n[   46.870107][ T6479] Call Trace:\n[   46.870473][ T6479]  dump_stack_lvl+0x57/0x7d\n[   46.870974][ T6479]  ubsan_epilogue+0x5/0x40\n[   46.871458][ T6479]  __ubsan_handle_out_of_bounds.cold+0x43/0x48\n[   46.872135][ T6479]  detach_capi_ctr+0x64/0xc0\n[   46.872639][ T6479]  cmtp_session+0x5c8/0x5d0\n[   46.873131][ T6479]  ? __init_waitqueue_head+0x60/0x60\n[   46.873712][ T6479]  ? cmtp_add_msgpart+0x120/0x120\n[   46.874256][ T6479]  kthread+0x147/0x170\n[   46.874709][ T6479]  ? set_kthread_struct+0x40/0x40\n[   46.875248][ T6479]  ret_from_fork+0x1f/0x30\n[   46.875773][ T6479]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "171b1caf-7ea3-463f-8809-14320fc65cb4",  "id": "CVE-2024-26656",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix use-after-free bug\n\nThe bug can be triggered by sending a single amdgpu_gem_userptr_ioctl\nto the AMDGPU DRM driver on any ASICs with an invalid address and size.\nThe bug was reported by Joonkyo Jung <joonkyoj@yonsei.ac.kr>.\nFor example the following code:\n\nstatic void Syzkaller1(int fd)\n{\n\tstruct drm_amdgpu_gem_userptr arg;\n\tint ret;\n\n\targ.addr = 0xffffffffffff0000;\n\targ.size = 0x80000000; /*2 Gb*/\n\targ.flags = 0x7;\n\tret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg);\n}\n\nDue to the address and size are not valid there is a failure in\namdgpu_hmm_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert->\ncheck_shl_overflow, but we even the amdgpu_hmm_register failure we still call\namdgpu_hmm_unregister into  amdgpu_gem_object_free which causes access to a bad address.\nThe following stack is below when the issue is reproduced when Kazan is enabled:\n\n[  +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020\n[  +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340\n[  +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff <0f> 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80\n[  +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246\n[  +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b\n[  +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260\n[  +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25\n[  +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00\n[  +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260\n[  +0.000011] FS:  00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000\n[  +0.000012] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0\n[  +0.000010] Call Trace:\n[  +0.000006]  <TASK>\n[  +0.000007]  ? show_regs+0x6a/0x80\n[  +0.000018]  ? __warn+0xa5/0x1b0\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\n[  +0.000018]  ? report_bug+0x24a/0x290\n[  +0.000022]  ? handle_bug+0x46/0x90\n[  +0.000015]  ? exc_invalid_op+0x19/0x50\n[  +0.000016]  ? asm_exc_invalid_op+0x1b/0x20\n[  +0.000017]  ? kasan_save_stack+0x26/0x50\n[  +0.000017]  ? mmu_interval_notifier_remove+0x23b/0x340\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\n[  +0.000019]  ? mmu_interval_notifier_remove+0x23b/0x340\n[  +0.000020]  ? __pfx_mmu_interval_notifier_remove+0x10/0x10\n[  +0.000017]  ? kasan_save_alloc_info+0x1e/0x30\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? __kasan_kmalloc+0xb1/0xc0\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? __kasan_check_read+0x11/0x20\n[  +0.000020]  amdgpu_hmm_unregister+0x34/0x50 [amdgpu]\n[  +0.004695]  amdgpu_gem_object_free+0x66/0xa0 [amdgpu]\n[  +0.004534]  ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu]\n[  +0.004291]  ? do_syscall_64+0x5f/0xe0\n[  +0.000023]  ? srso_return_thunk+0x5/0x5f\n[  +0.000017]  drm_gem_object_free+0x3b/0x50 [drm]\n[  +0.000489]  amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu]\n[  +0.004295]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[  +0.004270]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? __this_cpu_preempt_check+0x13/0x20\n[  +0.000015]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? sysvec_apic_timer_interrupt+0x57/0xc0\n[  +0.000020]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? asm_sysvec_apic_timer_interrupt+0x1b/0x20\n[  +0.000022]  ? drm_ioctl_kernel+0x17b/0x1f0 [drm]\n[  +0.000496]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[  +0.004272]  ? drm_ioctl_kernel+0x190/0x1f0 [drm]\n[  +0.000492]  drm_ioctl_kernel+0x140/0x1f0 [drm]\n[  +0.000497]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[  +0.004297]  ? __pfx_drm_ioctl_kernel+0x10/0x10 [d\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b849a01-c03d-44b8-8957-7364e5698709",  "id": "CVE-2023-53418",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69bf1ed7-e19a-44fa-b05c-c12755c1cbc8",  "id": "CVE-2015-4000",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4000"  },  "ratings": [    {      "score": 3.7,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    295,    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the \"Logjam\" issue.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'MSF:ssl_version'"    }  ]},{  "bom-ref": "99414475-52fb-4a46-8696-1dac118bae87",  "id": "CVE-2012-2313",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2313"  },  "ratings": [    {      "score": 1.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8204dde9-f1fe-4700-80a6-c5ce0856ff10",  "id": "CVE-2024-50008",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()\n\nReplace one-element array with a flexible-array member in\n`struct host_cmd_ds_802_11_scan_ext`.\n\nWith this, fix the following warning:\n\nelo 16 17:51:58 surfacebook kernel: ------------[ cut here ]------------\nelo 16 17:51:58 surfacebook kernel: memcpy: detected field-spanning write (size 243) of single field \"ext_scan->tlv_buffer\" at drivers/net/wireless/marvell/mwifiex/scan.c:2239 (size 1)\nelo 16 17:51:58 surfacebook kernel: WARNING: CPU: 0 PID: 498 at drivers/net/wireless/marvell/mwifiex/scan.c:2239 mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "613a4eb9-7b64-42a7-99cb-0d14a4a77634",  "id": "CVE-2024-50171",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: systemport: fix potential memory leak in bcm_sysport_xmit()\n\nThe bcm_sysport_xmit() returns NETDEV_TX_OK without freeing skb\nin case of dma_map_single() fails, add dev_kfree_skb() to fix it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69105e57-9ab3-470a-b951-591c19fe44ad",  "id": "CVE-2011-3637",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3637"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The m_stop function in fs/proc/task_mmu.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (OOPS) via vectors that trigger an m_start error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "34b240bf-33b4-4cd9-8537-322d4318b701",  "id": "CVE-2021-3178",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3178"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    22  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS. NOTE: some parties argue that such a subdirectory export is not intended to prevent this attack; see also the exports(5) no_subtree_check default behavior",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f1448d4e-6b1e-4261-8ed9-90e45f61898d",  "id": "CVE-2022-1204",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1204"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b6f5738-6444-448c-8e43-b65b599619ef",  "id": "CVE-2015-1805",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1805"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    17  ],  "analysis": {    "state": "in_triage"  },  "description": "The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an \"I/O vector array overrun.\"",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "477177cb-5cc5-43c5-ba87-c65b5ecfbc9d",  "id": "CVE-2024-41016",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()\n\nxattr in ocfs2 maybe 'non-indexed', which saved with additional space\nrequested.  It's better to check if the memory is out of bound before\nmemcmp, although this possibility mainly comes from crafted poisonous\nimages.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2ef8cc0e-864f-4b8b-9f5c-efc3cb6c4901",  "id": "CVE-2015-6526",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6526"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The perf_callchain_user_64 function in arch/powerpc/perf/callchain.c in the Linux kernel before 4.0.2 on ppc64 platforms allows local users to cause a denial of service (infinite loop) via a deep 64-bit userspace backtrace.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9d351ea-cbe0-4d32-b30f-93cf5ae757e1",  "id": "CVE-2015-3332",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3332"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "82d03990-9b5c-4160-b525-0e10bc428bcf",  "id": "CVE-2021-3847",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3847"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    281  ],  "analysis": {    "state": "in_triage"  },  "description": "An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d710457-47f6-4cef-bdb1-6718b6dddecd",  "id": "CLSA-2025-1751271968",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a34c714-0989-4426-9394-6e80cdfe8fc7",  "id": "SUSE-SU-2016:0620-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "19b533e3-4336-45ee-99fd-8acf68916031",  "id": "CVE-2010-5321",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5321"  },  "ratings": [    {      "score": 4.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    772  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in drivers/media/video/videobuf-core.c in the videobuf subsystem in the Linux kernel 2.6.x through 4.x allows local users to cause a denial of service (memory consumption) by leveraging /dev/video access for a series of mmap calls that require new allocations, a different vulnerability than CVE-2007-6761.  NOTE: as of 2016-06-18, this affects only 11 drivers that have not been updated to use videobuf2 instead of videobuf.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "19b8af8d-b680-4ac9-a8f8-b1c263437de3",  "id": "CVE-2014-9710",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9710"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0de608d7-2e40-45da-b3d4-4d377348f1ee",  "id": "CVE-2024-46761",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npci/hotplug/pnv_php: Fix hotplug driver crash on Powernv\n\nThe hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel\ncrash when we try to hot-unplug/disable the PCIe switch/bridge from\nthe PHB.\n\nThe crash occurs because although the MSI data structure has been\nreleased during disable/hot-unplug path and it has been assigned\nwith NULL, still during unregistration the code was again trying to\nexplicitly disable the MSI which causes the NULL pointer dereference and\nkernel crash.\n\nThe patch fixes the check during unregistration path to prevent invoking\npci_disable_msi/msix() since its data structure is already freed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3913aaa8-a4d3-4524-869a-c0ecaf693bcf",  "id": "CVE-2016-2069",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2069"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows local users to gain privileges by triggering access to a paging structure by a different CPU.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c91ee2d7-a068-46b4-9a79-5023e1aece44",  "id": "CVE-2020-16120",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16120"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    266  ],  "analysis": {    "state": "in_triage"  },  "description": "Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unprivileged user to be copied to a mountpoint controlled by the user, like a removable device. This was introduced in kernel version 4.19 by commit d1d04ef (\"ovl: stack file ops\"). This was fixed in kernel version 5.8 by commits 56230d9 (\"ovl: verify permissions in ovl_path_open()\"), 48bd024 (\"ovl: switch to mounter creds in readdir\") and 05acefb (\"ovl: check permission to open real file\"). Additionally, commits 130fdbc (\"ovl: pass correct flags for opening real directory\") and 292f902 (\"ovl: call secutiry hook in ovl_real_ioctl()\") in kernel 5.8 might also be desired or necessary. These additional commits introduced a regression in overlay mounts within user namespaces which prevented access to files with ownership outside of the user namespace. This regression was mitigated by subsequent commit b6650da (\"ovl: do not fail because of O_NOATIMEi\") in kernel 5.11.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c0aed83e-74e1-413a-bfa3-103a455bbf91",  "id": "CVE-2014-6410",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6410"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The __udf_read_inode function in fs/udf/inode.c in the Linux kernel through 3.16.3 does not restrict the amount of ICB indirection, which allows physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5df47d94-79d7-4372-958c-7b8645f91a4c",  "id": "RLSA-2021:4424",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9ddefb6-c899-4770-9aff-a221c8bec839",  "id": "CVE-2022-49541",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix potential double free during failed mount\n\nRHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2088799",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7693fac9-a652-421e-8b37-e3466967661f",  "id": "CVE-2022-45919",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45919"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3e1ed3d3-4077-4709-ba75-61c9844ac1b0",  "id": "CVE-2022-49975",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Don't redirect packets with invalid pkt_len\n\nSyzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any\nskbs, that is, the flow->head is null.\nThe root cause, as the [2] says, is because that bpf_prog_test_run_skb()\nrun a bpf prog which redirects empty skbs.\nSo we should determine whether the length of the packet modified by bpf\nprog or others like bpf_prog_test is valid before forwarding it directly.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1b96cf0d-692c-4622-98c9-7748557824a6",  "id": "CVE-2024-49902",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: check if leafidx greater than num leaves per dmap tree\n\nsyzbot report a out of bounds in dbSplit, it because dmt_leafidx greater\nthan num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.\n\nShaggy:\nModified sanity check to apply to control pages as well as leaf pages.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c41045e-7cf3-4ad2-8360-3d3b30c669ab",  "id": "CVE-2022-49095",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()\n\nThe error handling path of the probe releases a resource that is not freed\nin the remove function. In some cases, a ioremap() must be undone.\n\nAdd the missing iounmap() call in the remove function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "446035f0-06bd-4331-9ccf-b994b733bf6a",  "id": "CVE-2024-26956",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix failure to detect DAT corruption in btree and direct mappings\n\nPatch series \"nilfs2: fix kernel bug at submit_bh_wbc()\".\n\nThis resolves a kernel BUG reported by syzbot.  Since there are two\nflaws involved, I've made each one a separate patch.\n\nThe first patch alone resolves the syzbot-reported bug, but I think\nboth fixes should be sent to stable, so I've tagged them as such.\n\n\nThis patch (of 2):\n\nSyzbot has reported a kernel bug in submit_bh_wbc() when writing file data\nto a nilfs2 file system whose metadata is corrupted.\n\nThere are two flaws involved in this issue.\n\nThe first flaw is that when nilfs_get_block() locates a data block using\nbtree or direct mapping, if the disk address translation routine\nnilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata\ncorruption, it can be passed back to nilfs_get_block().  This causes\nnilfs_get_block() to misidentify an existing block as non-existent,\ncausing both data block lookup and insertion to fail inconsistently.\n\nThe second flaw is that nilfs_get_block() returns a successful status in\nthis inconsistent state.  This causes the caller __block_write_begin_int()\nor others to request a read even though the buffer is not mapped,\nresulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc()\nfailing.\n\nThis fixes the first issue by changing the return value to code -EINVAL\nwhen a conversion using DAT fails with code -ENOENT, avoiding the\nconflicting condition that leads to the kernel bug described above.  Here,\ncode -EINVAL indicates that metadata corruption was detected during the\nblock lookup, which will be properly handled as a file system error and\nconverted to -EIO when passing through the nilfs2 bmap layer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "426eb122-e1e3-493d-96b0-5fe42b52f981",  "id": "CVE-2014-4157",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4157"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/mips/include/asm/thread_info.h in the Linux kernel before 3.14.8 on the MIPS platform does not configure _TIF_SECCOMP checks on the fast system-call path, which allows local users to bypass intended PR_SET_SECCOMP restrictions by executing a crafted application without invoking a trace or audit subsystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "92a6edc6-a4a5-48af-a82e-2c9d10203667",  "id": "AZL-75783",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8854d740-7262-421d-bd7d-c8bfb1d80283",  "id": "CVE-2021-47656",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47656"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: fix use-after-free in jffs2_clear_xattr_subsystem\n\nWhen we mount a jffs2 image, assume that the first few blocks of\nthe image are normal and contain at least one xattr-related inode,\nbut the next block is abnormal. As a result, an error is returned\nin jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then\ncalled in jffs2_build_filesystem() and then again in\njffs2_do_fill_super().\n\nFinally we can observe the following report:\n ==================================================================\n BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac\n Read of size 8 at addr ffff8881243384e0 by task mount/719\n\n Call Trace:\n  dump_stack+0x115/0x16b\n  jffs2_clear_xattr_subsystem+0x95/0x6ac\n  jffs2_do_fill_super+0x84f/0xc30\n  jffs2_fill_super+0x2ea/0x4c0\n  mtd_get_sb+0x254/0x400\n  mtd_get_sb_by_nr+0x4f/0xd0\n  get_tree_mtd+0x498/0x840\n  jffs2_get_tree+0x25/0x30\n  vfs_get_tree+0x8d/0x2e0\n  path_mount+0x50f/0x1e50\n  do_mount+0x107/0x130\n  __se_sys_mount+0x1c5/0x2f0\n  __x64_sys_mount+0xc7/0x160\n  do_syscall_64+0x45/0x70\n  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\n Allocated by task 719:\n  kasan_save_stack+0x23/0x60\n  __kasan_kmalloc.constprop.0+0x10b/0x120\n  kasan_slab_alloc+0x12/0x20\n  kmem_cache_alloc+0x1c0/0x870\n  jffs2_alloc_xattr_ref+0x2f/0xa0\n  jffs2_scan_medium.cold+0x3713/0x4794\n  jffs2_do_mount_fs.cold+0xa7/0x2253\n  jffs2_do_fill_super+0x383/0xc30\n  jffs2_fill_super+0x2ea/0x4c0\n [...]\n\n Freed by task 719:\n  kmem_cache_free+0xcc/0x7b0\n  jffs2_free_xattr_ref+0x78/0x98\n  jffs2_clear_xattr_subsystem+0xa1/0x6ac\n  jffs2_do_mount_fs.cold+0x5e6/0x2253\n  jffs2_do_fill_super+0x383/0xc30\n  jffs2_fill_super+0x2ea/0x4c0\n [...]\n\n The buggy address belongs to the object at ffff8881243384b8\n  which belongs to the cache jffs2_xattr_ref of size 48\n The buggy address is located 40 bytes inside of\n  48-byte region [ffff8881243384b8, ffff8881243384e8)\n [...]\n ==================================================================\n\nThe triggering of the BUG is shown in the following stack:\n-----------------------------------------------------------\njffs2_fill_super\n  jffs2_do_fill_super\n    jffs2_do_mount_fs\n      jffs2_build_filesystem\n        jffs2_scan_medium\n          jffs2_scan_eraseblock        <--- ERROR\n        jffs2_clear_xattr_subsystem    <--- free\n    jffs2_clear_xattr_subsystem        <--- free again\n-----------------------------------------------------------\n\nAn error is returned in jffs2_do_mount_fs(). If the error is returned\nby jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to\nbe executed. If the error is returned by jffs2_build_filesystem(), the\njffs2_clear_xattr_subsystem() also does not need to be executed again.\nSo move jffs2_clear_xattr_subsystem() from 'out_inohash' to 'out_root'\nto fix this UAF problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "61528ca5-309a-464a-a3a8-b5c6491d056c",  "id": "CVE-2015-8962",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8962"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db4c92d2-2fd4-4387-bf2b-63c6dba48f72",  "id": "CVE-2024-53100",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: tcp: avoid race between queue_lock lock and destroy\n\nCommit 76d54bf20cdc (\"nvme-tcp: don't access released socket during\nerror recovery\") added a mutex_lock() call for the queue->queue_lock\nin nvme_tcp_get_address(). However, the mutex_lock() races with\nmutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below.\n\nDEBUG_LOCKS_WARN_ON(lock->magic != lock)\nWARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220\nModules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs]\nCPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:__mutex_lock+0xcf0/0x1220\nCode: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd <0f> 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1\nRSP: 0018:ffff88811305f760 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001\nRBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341\nR10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000\nR13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058\nFS:  00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n ? __warn.cold+0x5b/0x1af\n ? __mutex_lock+0xcf0/0x1220\n ? report_bug+0x1ec/0x390\n ? handle_bug+0x3c/0x80\n ? exc_invalid_op+0x13/0x40\n ? asm_exc_invalid_op+0x16/0x20\n ? __mutex_lock+0xcf0/0x1220\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\n ? __pfx___mutex_lock+0x10/0x10\n ? __lock_acquire+0xd6a/0x59e0\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\n nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\n ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp]\n nvme_sysfs_show_address+0x81/0xc0 [nvme_core]\n dev_attr_show+0x42/0x80\n ? __asan_memset+0x1f/0x40\n sysfs_kf_seq_show+0x1f0/0x370\n seq_read_iter+0x2cb/0x1130\n ? rw_verify_area+0x3b1/0x590\n ? __mutex_lock+0x433/0x1220\n vfs_read+0x6a6/0xa20\n ? lockdep_hardirqs_on+0x78/0x100\n ? __pfx_vfs_read+0x10/0x10\n ksys_read+0xf7/0x1d0\n ? __pfx_ksys_read+0x10/0x10\n ? __x64_sys_openat+0x105/0x1d0\n do_syscall_64+0x93/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? __pfx_ksys_read+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? do_syscall_64+0x9f/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7f9713f55cfa\nCode: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "941dac4a-9084-476d-b94f-6635f9b87349",  "id": "CVE-2021-20239",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20239"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    119,    822  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to confidentiality.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3737f7d0-d580-4a97-b713-85f822092803",  "id": "CLSA-2024-1718639881",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e071ddf4-6abd-414a-b66f-5794bd3b7667",  "id": "CVE-2025-39763",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered\n\nIf a synchronous error is detected as a result of user-space process\ntriggering a 2-bit uncorrected error, the CPU will take a synchronous\nerror exception such as Synchronous External Abort (SEA) on Arm64. The\nkernel will queue a memory_failure() work which poisons the related\npage, unmaps the page, and then sends a SIGBUS to the process, so that\na system wide panic can be avoided.\n\nHowever, no memory_failure() work will be queued when abnormal\nsynchronous errors occur. These errors can include situations like\ninvalid PA, unexpected severity, no memory failure config support,\ninvalid GUID section, etc. In such a case, the user-space process will\ntrigger SEA again.  This loop can potentially exceed the platform\nfirmware threshold or even trigger a kernel hard lockup, leading to a\nsystem reboot.\n\nFix it by performing a force kill if no memory_failure() work is queued\nfor synchronous errors.\n\n[ rjw: Changelog edits ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2f58419-f19d-42ea-8f34-abcfa02baf62",  "id": "CVE-2025-4598",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    364  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'SNYK:SNYK-UNMANAGED-SYSTEMDSYSTEMD-10658563'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'SNYK:SNYK-CONAN-LIBSYSTEMD-13057325'"    }  ]},{  "bom-ref": "e4b3821b-41d0-4450-b89e-7d85d3eae593",  "id": "OESA-2025-2487",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e5867d56-20b8-407f-97d8-e4b56b4da166",  "id": "ALSA-2026:19373",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d40848b2-21ce-4aee-ae4c-89d6bd11c0ec",  "id": "CVE-2024-36905",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets\n\nTCP_SYN_RECV state is really special, it is only used by\ncross-syn connections, mostly used by fuzzers.\n\nIn the following crash [1], syzbot managed to trigger a divide\nby zero in tcp_rcv_space_adjust()\n\nA socket makes the following state transitions,\nwithout ever calling tcp_init_transfer(),\nmeaning tcp_init_buffer_space() is also not called.\n\n         TCP_CLOSE\nconnect()\n         TCP_SYN_SENT\n         TCP_SYN_RECV\nshutdown() -> tcp_shutdown(sk, SEND_SHUTDOWN)\n         TCP_FIN_WAIT1\n\nTo fix this issue, change tcp_shutdown() to not\nperform a TCP_SYN_RECV -> TCP_FIN_WAIT1 transition,\nwhich makes no sense anyway.\n\nWhen tcp_rcv_state_process() later changes socket state\nfrom TCP_SYN_RECV to TCP_ESTABLISH, then look at\nsk->sk_shutdown to finally enter TCP_FIN_WAIT1 state,\nand send a FIN packet from a sane socket state.\n\nThis means tcp_send_fin() can now be called from BH\ncontext, and must use GFP_ATOMIC allocations.\n\n[1]\ndivide error: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 1 PID: 5084 Comm: syz-executor358 Not tainted 6.9.0-rc6-syzkaller-00022-g98369dccd2f8 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:tcp_rcv_space_adjust+0x2df/0x890 net/ipv4/tcp_input.c:767\nCode: e3 04 4c 01 eb 48 8b 44 24 38 0f b6 04 10 84 c0 49 89 d5 0f 85 a5 03 00 00 41 8b 8e c8 09 00 00 89 e8 29 c8 48 0f af c3 31 d2 <48> f7 f1 48 8d 1c 43 49 8d 96 76 08 00 00 48 89 d0 48 c1 e8 03 48\nRSP: 0018:ffffc900031ef3f0 EFLAGS: 00010246\nRAX: 0c677a10441f8f42 RBX: 000000004fb95e7e RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: 0000000027d4b11f R08: ffffffff89e535a4 R09: 1ffffffff25e6ab7\nR10: dffffc0000000000 R11: ffffffff8135e920 R12: ffff88802a9f8d30\nR13: dffffc0000000000 R14: ffff88802a9f8d00 R15: 1ffff1100553f2da\nFS:  00005555775c0380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1155bf2304 CR3: 000000002b9f2000 CR4: 0000000000350ef0\nCall Trace:\n <TASK>\n  tcp_recvmsg_locked+0x106d/0x25a0 net/ipv4/tcp.c:2513\n  tcp_recvmsg+0x25d/0x920 net/ipv4/tcp.c:2578\n  inet6_recvmsg+0x16a/0x730 net/ipv6/af_inet6.c:680\n  sock_recvmsg_nosec net/socket.c:1046 [inline]\n  sock_recvmsg+0x109/0x280 net/socket.c:1068\n  ____sys_recvmsg+0x1db/0x470 net/socket.c:2803\n  ___sys_recvmsg net/socket.c:2845 [inline]\n  do_recvmmsg+0x474/0xae0 net/socket.c:2939\n  __sys_recvmmsg net/socket.c:3018 [inline]\n  __do_sys_recvmmsg net/socket.c:3041 [inline]\n  __se_sys_recvmmsg net/socket.c:3034 [inline]\n  __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3034\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7faeb6363db9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffcc1997168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007faeb6363db9\nRDX: 0000000000000001 RSI: 0000000020000bc0 RDI: 0000000000000005\nRBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000001c\nR10: 0000000000000122 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ec9950f8-5cc0-4629-a6f6-120a92f9608e",  "id": "CVE-2024-53099",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check validity of link->type in bpf_link_show_fdinfo()\n\nIf a newly-added link type doesn't invoke BPF_LINK_TYPE(), accessing\nbpf_link_type_strs[link->type] may result in an out-of-bounds access.\n\nTo spot such missed invocations early in the future, checking the\nvalidity of link->type in bpf_link_show_fdinfo() and emitting a warning\nwhen such invocations are missed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95a7929d-f868-4a1c-a353-d19f19fc7757",  "id": "CVE-2015-8966",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8966"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local users to gain privileges via a crafted (1) F_OFD_GETLK, (2) F_OFD_SETLK, or (3) F_OFD_SETLKW command in an fcntl64 system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1bf2ba82-fb66-46cb-a42f-935401e945e8",  "id": "SUSE-SU-2018:1887-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "96070997-a7c8-46e5-9a8f-67b98e8e0782",  "id": "CVE-2012-0055",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0055"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    862  ],  "analysis": {    "state": "in_triage"  },  "description": "OverlayFS in the Linux kernel before 3.0.0-16.28, as used in Ubuntu 10.0.4 LTS and 11.10, is missing inode security checks which could allow attackers to bypass security restrictions and perform unauthorized actions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:36571'"    }  ]},{  "bom-ref": "1210a3ad-d2ea-4757-a5b5-5a386606652a",  "id": "ROOT-OS-ALPINE-315-CVE-2025-9230",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b1c0b0e7-eba4-4dc1-b081-6977e5fcd417",  "id": "CVE-2012-2663",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2663"  },  "ratings": [    {      "score": 7.5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets.  NOTE: the CVE-2012-6638 fix makes this issue less relevant.",  "affects": [    {      "ref": "1859ca2a-489d-4c53-8b85-a35fa8ab1d1b",      "versions": [        {          "component": "iptables",          "version": "1.4.7"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "209c3f01-6471-4cc9-8e37-1c44350db8a5",  "id": "CVE-2022-50126",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted\n\nFollowing process will fail assertion 'jh->b_frozen_data == NULL' in\njbd2_journal_dirty_metadata():\n\n                   jbd2_journal_commit_transaction\nunlink(dir/a)\n jh->b_transaction = trans1\n jh->b_jlist = BJ_Metadata\n                    journal->j_running_transaction = NULL\n                    trans1->t_state = T_COMMIT\nunlink(dir/b)\n handle->h_trans = trans2\n do_get_write_access\n  jh->b_modified = 0\n  jh->b_frozen_data = frozen_buffer\n  jh->b_next_transaction = trans2\n jbd2_journal_dirty_metadata\n  is_handle_aborted\n   is_journal_aborted // return false\n\n           --> jbd2 abort <--\n\n                     while (commit_transaction->t_buffers)\n                      if (is_journal_aborted)\n                       jbd2_journal_refile_buffer\n                        __jbd2_journal_refile_buffer\n                         WRITE_ONCE(jh->b_transaction,\n\t\t\t\t\t\tjh->b_next_transaction)\n                         WRITE_ONCE(jh->b_next_transaction, NULL)\n                         __jbd2_journal_file_buffer(jh, BJ_Reserved)\n        J_ASSERT_JH(jh, jh->b_frozen_data == NULL) // assertion failure !\n\nThe reproducer (See detail in [Link]) reports:\n ------------[ cut here ]------------\n kernel BUG at fs/jbd2/transaction.c:1629!\n invalid opcode: 0000 [#1] PREEMPT SMP\n CPU: 2 PID: 584 Comm: unlink Tainted: G        W\n 5.19.0-rc6-00115-g4a57a8400075-dirty #697\n RIP: 0010:jbd2_journal_dirty_metadata+0x3c5/0x470\n RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202\n Call Trace:\n  <TASK>\n  __ext4_handle_dirty_metadata+0xa0/0x290\n  ext4_handle_dirty_dirblock+0x10c/0x1d0\n  ext4_delete_entry+0x104/0x200\n  __ext4_unlink+0x22b/0x360\n  ext4_unlink+0x275/0x390\n  vfs_unlink+0x20b/0x4c0\n  do_unlinkat+0x42f/0x4c0\n  __x64_sys_unlink+0x37/0x50\n  do_syscall_64+0x35/0x80\n\nAfter journal aborting, __jbd2_journal_refile_buffer() is executed with\nholding @jh->b_state_lock, we can fix it by moving 'is_handle_aborted()'\ninto the area protected by @jh->b_state_lock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3904eae3-9ca8-4b5c-b61a-b30761186a94",  "id": "CVE-2024-46714",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Skip wbscl_set_scaler_filter if filter is null\n\nCallers can pass null in filter (i.e. from returned from the function\nwbscl_get_filter_coeffs_16p) and a null check is added to ensure that is\nnot the case.\n\nThis fixes 4 NULL_RETURNS issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "72e4e823-8a91-42c1-93d0-f68668694aef",  "id": "CVE-2023-39197",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39197"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a1307d52-7f0a-4557-b4f3-363e97e9cc31",  "id": "CVE-2023-53302",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwl4965: Add missing check for create_singlethread_workqueue()\n\nAdd the check for the return value of the create_singlethread_workqueue()\nin order to avoid NULL pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8d18e289-79c2-4c36-851c-bc374cd863fc",  "id": "CVE-2024-42070",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers\n\nregister store validation for NFT_DATA_VALUE is conditional, however,\nthe datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This\nonly requires a new helper function to infer the register type from the\nset datatype so this conditional check can be removed. Otherwise,\npointer to chain object can be leaked through the registers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cf5ca0bc-a177-4a95-9c29-5dc8b8993d6f",  "id": "CVE-2014-9922",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9922"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The eCryptfs subsystem in the Linux kernel before 3.18 allows local users to gain privileges via a large filesystem stack that includes an overlayfs layer, related to fs/ecryptfs/main.c and fs/overlayfs/super.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b227b881-0b04-4178-8038-188eed868977",  "id": "CVE-2011-4604",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4604"  },  "ratings": [    {      "score": 6.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The bat_socket_read function in net/batman-adv/icmp_socket.c in the Linux kernel before 3.3 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted batman-adv ICMP packet.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ad1f9f28-13c3-49bd-8d4c-1e1fc130a186",  "id": "CVE-2022-50334",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()\n\nSyzkaller reports a null-ptr-deref bug as follows:\n======================================================\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nRIP: 0010:hugetlbfs_parse_param+0x1dd/0x8e0 fs/hugetlbfs/inode.c:1380\n[...]\nCall Trace:\n <TASK>\n vfs_parse_fs_param fs/fs_context.c:148 [inline]\n vfs_parse_fs_param+0x1f9/0x3c0 fs/fs_context.c:129\n vfs_parse_fs_string+0xdb/0x170 fs/fs_context.c:191\n generic_parse_monolithic+0x16f/0x1f0 fs/fs_context.c:231\n do_new_mount fs/namespace.c:3036 [inline]\n path_mount+0x12de/0x1e20 fs/namespace.c:3370\n do_mount fs/namespace.c:3383 [inline]\n __do_sys_mount fs/namespace.c:3591 [inline]\n __se_sys_mount fs/namespace.c:3568 [inline]\n __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n [...]\n </TASK>\n======================================================\n\nAccording to commit \"vfs: parse: deal with zero length string value\",\nkernel will set the param->string to null pointer in vfs_parse_fs_string()\nif fs string has zero length.\n\nYet the problem is that, hugetlbfs_parse_param() will dereference the\nparam->string, without checking whether it is a null pointer.  To be more\nspecific, if hugetlbfs_parse_param() parses an illegal mount parameter,\nsuch as \"size=,\", kernel will constructs struct fs_parameter with null\npointer in vfs_parse_fs_string(), then passes this struct fs_parameter to\nhugetlbfs_parse_param(), which triggers the above null-ptr-deref bug.\n\nThis patch solves it by adding sanity check on param->string\nin hugetlbfs_parse_param().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6e655b52-5fd1-4062-a3ee-505d31382ae5",  "id": "CVE-2016-0703",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0703"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c9a92cb-d86c-4efd-82c2-c5f63ade14d8",  "id": "CVE-2014-1739",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1739"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:39214'"    }  ]},{  "bom-ref": "e242faba-631a-4c5d-84cb-c04df7992c82",  "id": "CVE-2024-42101",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix null pointer dereference in nouveau_connector_get_modes\n\nIn nouveau_connector_get_modes(), the return value of drm_mode_duplicate()\nis assigned to mode, which will lead to a possible NULL pointer\ndereference on failure of drm_mode_duplicate(). Add a check to avoid npd.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e634618d-7690-421a-ace8-bc8d859d52fe",  "id": "CVE-2015-5156",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5156"  },  "ratings": [    {      "score": 6.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "518de5cf-44b2-4c4b-8f39-d98f1f25b48f",  "id": "MGASA-2021-0009",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b97d5b8f-e682-4f53-9ad5-0456d2f6a794",  "id": "CVE-2014-1444",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1444"  },  "ratings": [    {      "score": 1.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:S/C:P/I:N/A:N"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17e2da67-b49a-4a07-b40c-1ff9338be1fe",  "id": "OESA-2026-2809",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3a8669d1-32cc-4c66-b446-3d7c58208768",      "versions": [        {          "component": "radvd",          "version": "1.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "397910ab-99a2-43b2-81af-c5e019ffd3b6",  "id": "CVE-2021-3609",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3609"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": ".A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6897a3f1-fad5-4b62-a108-57e752e6f10c",  "id": "CVE-2022-1015",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1015"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fcdfda94-31de-4646-a6c6-63bf697a478c",  "id": "CVE-2021-47119",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47119"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix memory leak in ext4_fill_super\n\nBuffer head references must be released before calling kill_bdev();\notherwise the buffer head (and its page referenced by b_data) will not\nbe freed by kill_bdev, and subsequently that bh will be leaked.\n\nIf blocksizes differ, sb_set_blocksize() will kill current buffers and\npage cache by using kill_bdev(). And then super block will be reread\nagain but using correct blocksize this time. sb_set_blocksize() didn't\nfully free superblock page and buffer head, and being busy, they were\nnot freed and instead leaked.\n\nThis can easily be reproduced by calling an infinite loop of:\n\n  systemctl start <ext4_on_lvm>.mount, and\n  systemctl stop <ext4_on_lvm>.mount\n\n... since systemd creates a cgroup for each slice which it mounts, and\nthe bh leak get amplified by a dying memory cgroup that also never\ngets freed, and memory consumption is much more easily noticed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed125c5d-ed69-4e71-9339-212b4762f1a9",  "id": "CVE-2024-47658",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: stm32/cryp - call finalize with bh disabled\n\nThe finalize operation in interrupt mode produce a produces a spinlock\nrecursion warning. The reason is the fact that BH must be disabled\nduring this process.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d16ad002-14ec-4e6d-bc16-e3dfc2543c2c",  "id": "SUSE-SU-2018:2486-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5bd6193d-ef46-4d68-b3ce-ace8bfd52caf",  "id": "CVE-2011-1771",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1771"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The cifs_close function in fs/cifs/file.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact by setting the O_DIRECT flag during an attempt to open a file on a CIFS filesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f697069d-a5f1-4e96-adf1-de317657e9a7",  "id": "CVE-2024-26840",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: fix memory leak in cachefiles_add_cache()\n\nThe following memory leak was reported after unbinding /dev/cachefiles:\n\n==================================================================\nunreferenced object 0xffff9b674176e3c0 (size 192):\n  comm \"cachefilesd2\", pid 680, jiffies 4294881224\n  hex dump (first 32 bytes):\n    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc ea38a44b):\n    [<ffffffff8eb8a1a5>] kmem_cache_alloc+0x2d5/0x370\n    [<ffffffff8e917f86>] prepare_creds+0x26/0x2e0\n    [<ffffffffc002eeef>] cachefiles_determine_cache_security+0x1f/0x120\n    [<ffffffffc00243ec>] cachefiles_add_cache+0x13c/0x3a0\n    [<ffffffffc0025216>] cachefiles_daemon_write+0x146/0x1c0\n    [<ffffffff8ebc4a3b>] vfs_write+0xcb/0x520\n    [<ffffffff8ebc5069>] ksys_write+0x69/0xf0\n    [<ffffffff8f6d4662>] do_syscall_64+0x72/0x140\n    [<ffffffff8f8000aa>] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n==================================================================\n\nPut the reference count of cache_cred in cachefiles_daemon_unbind() to\nfix the problem. And also put cache_cred in cachefiles_add_cache() error\nbranch to avoid memory leaks.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "05a05080-5572-4fb2-87be-82d252ab7d56",  "id": "CVE-2024-42098",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ecdh - explicitly zeroize private_key\n\nprivate_key is overwritten with the key parameter passed in by the\ncaller (if present), or alternatively a newly generated private key.\nHowever, it is possible that the caller provides a key (or the newly\ngenerated key) which is shorter than the previous key. In that\nscenario, some key material from the previous key would not be\noverwritten. The easiest solution is to explicitly zeroize the entire\nprivate_key array first.\n\nNote that this patch slightly changes the behavior of this function:\npreviously, if the ecc_gen_privkey failed, the old private_key would\nremain. Now, the private_key is always zeroized. This behavior is\nconsistent with the case where params.key is set and ecc_is_key_valid\nfails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4a36e987-0087-4b27-a3ce-e88fbe862386",  "id": "CVE-2023-52826",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panel/panel-tpo-tpg110: fix a possible null pointer dereference\n\nIn tpg110_get_modes(), the return value of drm_mode_duplicate() is\nassigned to mode, which will lead to a NULL pointer dereference on\nfailure of drm_mode_duplicate(). Add a check to avoid npd.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "87c360ff-52e2-4b54-befc-53de6bdca4d8",  "id": "CVE-2021-4037",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4037"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    284  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not.  This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "753205be-5b12-45df-a4f2-81fe047f8f0d",  "id": "CVE-2014-0102",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0102"  },  "ratings": [    {      "score": 5.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:S/C:N/I:N/A:C"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The keyring_detect_cycle_iterator function in security/keys/keyring.c in the Linux kernel through 3.13.6 does not properly determine whether keyrings are identical, which allows local users to cause a denial of service (OOPS) via crafted keyctl commands.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3c87c86-5dc9-4e58-8c50-99424a25e6b5",  "id": "ROOT-OS-DEBIAN-11-CVE-2026-63076",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "de3ee711-5b57-48d2-828e-61f6f8f6c192",  "id": "CVE-2024-36922",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: read txq->read_ptr under lock\n\nIf we read txq->read_ptr without lock, we can read the same\nvalue twice, then obtain the lock, and reclaim from there\nto two different places, but crucially reclaim the same\nentry twice, resulting in the WARN_ONCE() a little later.\nFix that by reading txq->read_ptr under lock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3cc55e0e-f2c1-4ece-82be-a08a4dceaf6a",  "id": "CVE-2024-50286",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix slab-use-after-free in ksmbd_smb2_session_create\n\nThere is a race condition between ksmbd_smb2_session_create and\nksmbd_expire_session. This patch add missing sessions_table_lock\nwhile adding/deleting session from global session table.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51ca126a-2a37-4426-9909-90bef1677a45",  "id": "CVE-2024-46722",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix mc_data out-of-bounds read warning\n\nClear warning that read mc_data[i-1] may out-of-bounds.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "09af644c-049c-46bc-b8cc-9e9f288aea62",  "id": "CVE-2024-41017",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: don't walk off the end of ealist\n\nAdd a check before visiting the members of ea to\nmake sure each ea stays within the ealist.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ceca160-4566-460d-af5e-e246a47ac416",  "id": "CVE-2018-13095",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13095"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3. A denial of service (memory corruption and BUG) can occur for a corrupted xfs image upon encountering an inode that is in extent format, but has more extents than fit in the inode fork.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1b53daed-0700-4d9b-951b-0111934b9626",  "id": "RHSA-2021:5226",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "094ee68a-7bfb-489e-9838-41985880c09f",  "id": "CVE-2021-35477",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35477"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    203  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "beb36b7f-5625-43bc-b846-a21a20180368",  "id": "CVE-2026-23307",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message\n\nWhen looking at the data in a USB urb, the actual_length is the size of\nthe buffer passed to the driver, not the transfer_buffer_length which is\nset by the driver as the max size of the buffer.\n\nWhen parsing the messages in ems_usb_read_bulk_callback() properly check\nthe size both at the beginning of parsing the message to make sure it is\nbig enough for the expected structure, and at the end of the message to\nmake sure we don't overflow past the end of the buffer for the next\nmessage.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32650132-6495-4d0c-b10e-5a07891716c3",  "id": "CVE-2015-2830",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2830"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32af3783-458b-408b-8a78-969dd492cb80",  "id": "CVE-2016-8658",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8658"  },  "ratings": [    {      "score": 6.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Stack-based buffer overflow in the brcmf_cfg80211_start_ap function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.7.5 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a long SSID Information Element in a command to a Netlink socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b38c601-a1e9-4280-9d6a-958bc80c2474",  "id": "CVE-2024-39468",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix deadlock in smb2_find_smb_tcon()\n\nUnlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such\ndeadlock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2d7db942-f4c7-465a-947c-f7c97983861b",  "id": "CVE-2013-1774",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1774"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before 3.7.4 allows local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f700970f-c5cd-4aca-9a7b-83fb2c895286",  "id": "CLSA-2021-1634922881",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6776709e-d7a3-4b8c-8728-986404e441bf",  "id": "CVE-2013-1928",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1928"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ac878ae-0645-4b7a-8795-6e2883cc32d7",  "id": "CVE-2022-48633",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: Fix WARN_ON(lock->magic != lock) error\n\npsb_gem_unpin() calls dma_resv_lock() but the underlying ww_mutex\ngets destroyed by drm_gem_object_release() move the\ndrm_gem_object_release() call in psb_gem_free_object() to after\nthe unpin to fix the below warning:\n\n[   79.693962] ------------[ cut here ]------------\n[   79.693992] DEBUG_LOCKS_WARN_ON(lock->magic != lock)\n[   79.694015] WARNING: CPU: 0 PID: 240 at kernel/locking/mutex.c:582 __ww_mutex_lock.constprop.0+0x569/0xfb0\n[   79.694052] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer qrtr bnep ath9k ath9k_common ath9k_hw snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel ath3k snd_intel_dspcfg mac80211 snd_intel_sdw_acpi btusb snd_hda_codec btrtl btbcm btintel btmtk bluetooth at24 snd_hda_core snd_hwdep uvcvideo snd_seq libarc4 videobuf2_vmalloc ath videobuf2_memops videobuf2_v4l2 videobuf2_common snd_seq_device videodev acer_wmi intel_powerclamp coretemp mc snd_pcm joydev sparse_keymap ecdh_generic pcspkr wmi_bmof cfg80211 i2c_i801 i2c_smbus snd_timer snd r8169 rfkill lpc_ich soundcore acpi_cpufreq zram rtsx_pci_sdmmc mmc_core serio_raw rtsx_pci gma500_gfx(E) video wmi ip6_tables ip_tables i2c_dev fuse\n[   79.694436] CPU: 0 PID: 240 Comm: plymouthd Tainted: G        W   E      6.0.0-rc3+ #490\n[   79.694457] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[   79.694469] RIP: 0010:__ww_mutex_lock.constprop.0+0x569/0xfb0\n[   79.694496] Code: ff 85 c0 0f 84 15 fb ff ff 8b 05 ca 3c 11 01 85 c0 0f 85 07 fb ff ff 48 c7 c6 30 cb 84 aa 48 c7 c7 a3 e1 82 aa e8 ac 29 f8 ff <0f> 0b e9 ed fa ff ff e8 5b 83 8a ff 85 c0 74 10 44 8b 0d 98 3c 11\n[   79.694513] RSP: 0018:ffffad1dc048bbe0 EFLAGS: 00010282\n[   79.694623] RAX: 0000000000000028 RBX: 0000000000000000 RCX: 0000000000000000\n[   79.694636] RDX: 0000000000000001 RSI: ffffffffaa8b0ffc RDI: 00000000ffffffff\n[   79.694650] RBP: ffffad1dc048bc80 R08: 0000000000000000 R09: ffffad1dc048ba90\n[   79.694662] R10: 0000000000000003 R11: ffffffffaad62fe8 R12: ffff9ff302103138\n[   79.694675] R13: ffff9ff306ec8000 R14: ffff9ff307779078 R15: ffff9ff3014c0270\n[   79.694690] FS:  00007ff1cccf1740(0000) GS:ffff9ff3bc200000(0000) knlGS:0000000000000000\n[   79.694705] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   79.694719] CR2: 0000559ecbcb4420 CR3: 0000000013210000 CR4: 00000000000006f0\n[   79.694734] Call Trace:\n[   79.694749]  <TASK>\n[   79.694761]  ? __schedule+0x47f/0x1670\n[   79.694796]  ? psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[   79.694830]  ? lock_is_held_type+0xe3/0x140\n[   79.694864]  ? ww_mutex_lock+0x38/0xa0\n[   79.694885]  ? __cond_resched+0x1c/0x30\n[   79.694902]  ww_mutex_lock+0x38/0xa0\n[   79.694925]  psb_gem_unpin+0x27/0x1a0 [gma500_gfx]\n[   79.694964]  psb_gem_unpin+0x199/0x1a0 [gma500_gfx]\n[   79.694996]  drm_gem_object_release_handle+0x50/0x60\n[   79.695020]  ? drm_gem_object_handle_put_unlocked+0xf0/0xf0\n[   79.695042]  idr_for_each+0x4b/0xb0\n[   79.695066]  ? _raw_spin_unlock_irqrestore+0x30/0x60\n[   79.695095]  drm_gem_release+0x1c/0x30\n[   79.695118]  drm_file_free.part.0+0x1ea/0x260\n[   79.695150]  drm_release+0x6a/0x120\n[   79.695175]  __fput+0x9f/0x260\n[   79.695203]  task_work_run+0x59/0xa0\n[   79.695227]  do_exit+0x387/0xbe0\n[   79.695250]  ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90\n[   79.695275]  ? lockdep_hardirqs_on+0x7d/0x100\n[   79.695304]  do_group_exit+0x33/0xb0\n[   79.695331]  __x64_sys_exit_group+0x14/0x20\n[   79.695353]  do_syscall_64+0x58/0x80\n[   79.695376]  ? up_read+0x17/0x20\n[   79.695401]  ? lock_is_held_type+0xe3/0x140\n[   79.695429]  ? asm_exc_page_fault+0x22/0x30\n[   79.695450]  ? lockdep_hardirqs_on+0x7d/0x100\n[   79.695473]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[   79.695493] RIP: 0033:0x7ff1ccefe3f1\n[   79.695516] Code: Unable to access opcode bytes at RIP 0x7ff1ccefe3c7.\n[   79.695607] RSP: 002b:00007ffed4413378 EFLAGS: \n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c5fd3de-4fe8-4c81-93ce-3c3dbc244be3",  "id": "CVE-2010-4249",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4249"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125 does not properly select times for garbage collection of inflight sockets, which allows local users to cause a denial of service (system hang) via crafted use of the socketpair and sendmsg system calls for SOCK_SEQPACKET sockets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:15622'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:96141/Linux-Kernel-Unix-Sockets-Denial-Of-Service.html'"    }  ]},{  "bom-ref": "56a4cc35-ec78-4312-8597-aecc213ce375",  "id": "CVE-2024-35784",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock with fiemap and extent locking\n\nWhile working on the patchset to remove extent locking I got a lockdep\nsplat with fiemap and pagefaulting with my new extent lock replacement\nlock.\n\nThis deadlock exists with our normal code, we just don't have lockdep\nannotations with the extent locking so we've never noticed it.\n\nSince we're copying the fiemap extent to user space on every iteration\nwe have the chance of pagefaulting.  Because we hold the extent lock for\nthe entire range we could mkwrite into a range in the file that we have\nmmap'ed.  This would deadlock with the following stack trace\n\n[<0>] lock_extent+0x28d/0x2f0\n[<0>] btrfs_page_mkwrite+0x273/0x8a0\n[<0>] do_page_mkwrite+0x50/0xb0\n[<0>] do_fault+0xc1/0x7b0\n[<0>] __handle_mm_fault+0x2fa/0x460\n[<0>] handle_mm_fault+0xa4/0x330\n[<0>] do_user_addr_fault+0x1f4/0x800\n[<0>] exc_page_fault+0x7c/0x1e0\n[<0>] asm_exc_page_fault+0x26/0x30\n[<0>] rep_movs_alternative+0x33/0x70\n[<0>] _copy_to_user+0x49/0x70\n[<0>] fiemap_fill_next_extent+0xc8/0x120\n[<0>] emit_fiemap_extent+0x4d/0xa0\n[<0>] extent_fiemap+0x7f8/0xad0\n[<0>] btrfs_fiemap+0x49/0x80\n[<0>] __x64_sys_ioctl+0x3e1/0xb50\n[<0>] do_syscall_64+0x94/0x1a0\n[<0>] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nI wrote an fstest to reproduce this deadlock without my replacement lock\nand verified that the deadlock exists with our existing locking.\n\nTo fix this simply don't take the extent lock for the entire duration of\nthe fiemap.  This is safe in general because we keep track of where we\nare when we're searching the tree, so if an ordered extent updates in\nthe middle of our fiemap call we'll still emit the correct extents\nbecause we know what offset we were on before.\n\nThe only place we maintain the lock is searching delalloc.  Since the\ndelalloc stuff can change during writeback we want to lock the extent\nrange so we have a consistent view of delalloc at the time we're\nchecking to see if we need to set the delalloc flag.\n\nWith this patch applied we no longer deadlock with my testcase.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d71861b-04f4-4925-8a9c-48c487616c25",  "id": "CVE-2024-35849",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix information leak in btrfs_ioctl_logical_to_ino()\n\nSyzbot reported the following information leak for in\nbtrfs_ioctl_logical_to_ino():\n\n  BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n  BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x110 lib/usercopy.c:40\n   instrument_copy_to_user include/linux/instrumented.h:114 [inline]\n   _copy_to_user+0xbc/0x110 lib/usercopy.c:40\n   copy_to_user include/linux/uaccess.h:191 [inline]\n   btrfs_ioctl_logical_to_ino+0x440/0x750 fs/btrfs/ioctl.c:3499\n   btrfs_ioctl+0x714/0x1260\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:904 [inline]\n   __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890\n   __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890\n   x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n  Uninit was created at:\n   __kmalloc_large_node+0x231/0x370 mm/slub.c:3921\n   __do_kmalloc_node mm/slub.c:3954 [inline]\n   __kmalloc_node+0xb07/0x1060 mm/slub.c:3973\n   kmalloc_node include/linux/slab.h:648 [inline]\n   kvmalloc_node+0xc0/0x2d0 mm/util.c:634\n   kvmalloc include/linux/slab.h:766 [inline]\n   init_data_container+0x49/0x1e0 fs/btrfs/backref.c:2779\n   btrfs_ioctl_logical_to_ino+0x17c/0x750 fs/btrfs/ioctl.c:3480\n   btrfs_ioctl+0x714/0x1260\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:904 [inline]\n   __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890\n   __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890\n   x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n  Bytes 40-65535 of 65536 are uninitialized\n  Memory access of size 65536 starts at ffff888045a40000\n\nThis happens, because we're copying a 'struct btrfs_data_container' back\nto user-space. This btrfs_data_container is allocated in\n'init_data_container()' via kvmalloc(), which does not zero-fill the\nmemory.\n\nFix this by using kvzalloc() which zeroes out the memory on allocation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32b5ed7c-37df-4a43-a6f6-c1d4dcadd99d",  "id": "CVE-2010-3015",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3015"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the ext4_ext_get_blocks function in fs/ext4/extents.c in the Linux kernel before 2.6.34 allows local users to cause a denial of service (BUG and system crash) via a write operation on the last block of a large file, followed by a sync operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b352645b-4e1f-45c6-a73a-5cd02d671404",  "id": "CVE-2025-23143",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.\n\nWhen I ran the repro [0] and waited a few seconds, I observed two\nLOCKDEP splats: a warning immediately followed by a null-ptr-deref. [1]\n\nReproduction Steps:\n\n  1) Mount CIFS\n  2) Add an iptables rule to drop incoming FIN packets for CIFS\n  3) Unmount CIFS\n  4) Unload the CIFS module\n  5) Remove the iptables rule\n\nAt step 3), the CIFS module calls sock_release() for the underlying\nTCP socket, and it returns quickly.  However, the socket remains in\nFIN_WAIT_1 because incoming FIN packets are dropped.\n\nAt this point, the module's refcnt is 0 while the socket is still\nalive, so the following rmmod command succeeds.\n\n  # ss -tan\n  State      Recv-Q Send-Q Local Address:Port  Peer Address:Port\n  FIN-WAIT-1 0      477        10.0.2.15:51062   10.0.0.137:445\n\n  # lsmod | grep cifs\n  cifs                 1159168  0\n\nThis highlights a discrepancy between the lifetime of the CIFS module\nand the underlying TCP socket.  Even after CIFS calls sock_release()\nand it returns, the TCP socket does not die immediately in order to\nclose the connection gracefully.\n\nWhile this is generally fine, it causes an issue with LOCKDEP because\nCIFS assigns a different lock class to the TCP socket's sk->sk_lock\nusing sock_lock_init_class_and_name().\n\nOnce an incoming packet is processed for the socket or a timer fires,\nsk->sk_lock is acquired.\n\nThen, LOCKDEP checks the lock context in check_wait_context(), where\nhlock_class() is called to retrieve the lock class.  However, since\nthe module has already been unloaded, hlock_class() logs a warning\nand returns NULL, triggering the null-ptr-deref.\n\nIf LOCKDEP is enabled, we must ensure that a module calling\nsock_lock_init_class_and_name() (CIFS, NFS, etc) cannot be unloaded\nwhile such a socket is still alive to prevent this issue.\n\nLet's hold the module reference in sock_lock_init_class_and_name()\nand release it when the socket is freed in sk_prot_free().\n\nNote that sock_lock_init() clears sk->sk_owner for svc_create_socket()\nthat calls sock_lock_init_class_and_name() for a listening socket,\nwhich clones a socket by sk_clone_lock() without GFP_ZERO.\n\n[0]:\nCIFS_SERVER=\"10.0.0.137\"\nCIFS_PATH=\"//${CIFS_SERVER}/Users/Administrator/Desktop/CIFS_TEST\"\nDEV=\"enp0s3\"\nCRED=\"/root/WindowsCredential.txt\"\n\nMNT=$(mktemp -d /tmp/XXXXXX)\nmount -t cifs ${CIFS_PATH} ${MNT} -o vers=3.0,credentials=${CRED},cache=none,echo_interval=1\n\niptables -A INPUT -s ${CIFS_SERVER} -j DROP\n\nfor i in $(seq 10);\ndo\n    umount ${MNT}\n    rmmod cifs\n    sleep 1\ndone\n\nrm -r ${MNT}\n\niptables -D INPUT -s ${CIFS_SERVER} -j DROP\n\n[1]:\nDEBUG_LOCKS_WARN_ON(1)\nWARNING: CPU: 10 PID: 0 at kernel/locking/lockdep.c:234 hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223)\nModules linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs]\nCPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.14.0 #36\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223)\n...\nCall Trace:\n <IRQ>\n __lock_acquire (kernel/locking/lockdep.c:4853 kernel/locking/lockdep.c:5178)\n lock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853 kernel/locking/lockdep.c:5816)\n _raw_spin_lock_nested (kernel/locking/spinlock.c:379)\n tcp_v4_rcv (./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547 net/ipv4/tcp_ipv4.c:2350)\n...\n\nBUG: kernel NULL pointer dereference, address: 00000000000000c4\n PF: supervisor read access in kernel mode\n PF: error_code(0x0000) - not-present page\nPGD 0\nOops: Oops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 10 UID: 0 PID: 0 Comm: swapper/10 Tainted: G        W          6.14.0 #36\nTainted: [W]=WARN\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:__lock_acquire (kernel/\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ac7cb75-e9da-4409-af74-d10aff700a6f",  "id": "CVE-2024-47723",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix out-of-bounds in dbNextAG() and diAlloc()\n\nIn dbNextAG() , there is no check for the case where bmp->db_numag is\ngreater or same than MAXAG due to a polluted image, which causes an\nout-of-bounds. Therefore, a bounds check should be added in dbMount().\n\nAnd in dbNextAG(), a check for the case where agpref is greater than\nbmp->db_numag should be added, so an out-of-bounds exception should be\nprevented.\n\nAdditionally, a check for the case where agno is greater or same than\nMAXAG should be added in diAlloc() to prevent out-of-bounds.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "74edd90b-ccd4-48c3-ac71-cd325b420431",  "id": "CVE-2025-37834",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmscan: don't try to reclaim hwpoison folio\n\nSyzkaller reports a bug as follows:\n\nInjecting memory failure for pfn 0x18b00e at process virtual address 0x20ffd000\nMemory failure: 0x18b00e: dirty swapcache page still referenced by 2 users\nMemory failure: 0x18b00e: recovery action for dirty swapcache page: Failed\npage: refcount:2 mapcount:0 mapping:0000000000000000 index:0x20ffd pfn:0x18b00e\nmemcg:ffff0000dd6d9000\nanon flags: 0x5ffffe00482011(locked|dirty|arch_1|swapbacked|hwpoison|node=0|zone=2|lastcpupid=0xfffff)\nraw: 005ffffe00482011 dead000000000100 dead000000000122 ffff0000e232a7c9\nraw: 0000000000020ffd 0000000000000000 00000002ffffffff ffff0000dd6d9000\npage dumped because: VM_BUG_ON_FOLIO(!folio_test_uptodate(folio))\n------------[ cut here ]------------\nkernel BUG at mm/swap_state.c:184!\nInternal error: Oops - BUG: 00000000f2000800 [#1] SMP\nModules linked in:\nCPU: 0 PID: 60 Comm: kswapd0 Not tainted 6.6.0-gcb097e7de84e #3\nHardware name: linux,dummy-virt (DT)\npstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : add_to_swap+0xbc/0x158\nlr : add_to_swap+0xbc/0x158\nsp : ffff800087f37340\nx29: ffff800087f37340 x28: fffffc00052c0380 x27: ffff800087f37780\nx26: ffff800087f37490 x25: ffff800087f37c78 x24: ffff800087f377a0\nx23: ffff800087f37c50 x22: 0000000000000000 x21: fffffc00052c03b4\nx20: 0000000000000000 x19: fffffc00052c0380 x18: 0000000000000000\nx17: 296f696c6f662865 x16: 7461646f7470755f x15: 747365745f6f696c\nx14: 6f6621284f494c4f x13: 0000000000000001 x12: ffff600036d8b97b\nx11: 1fffe00036d8b97a x10: ffff600036d8b97a x9 : dfff800000000000\nx8 : 00009fffc9274686 x7 : ffff0001b6c5cbd3 x6 : 0000000000000001\nx5 : ffff0000c25896c0 x4 : 0000000000000000 x3 : 0000000000000000\nx2 : 0000000000000000 x1 : ffff0000c25896c0 x0 : 0000000000000000\nCall trace:\n add_to_swap+0xbc/0x158\n shrink_folio_list+0x12ac/0x2648\n shrink_inactive_list+0x318/0x948\n shrink_lruvec+0x450/0x720\n shrink_node_memcgs+0x280/0x4a8\n shrink_node+0x128/0x978\n balance_pgdat+0x4f0/0xb20\n kswapd+0x228/0x438\n kthread+0x214/0x230\n ret_from_fork+0x10/0x20\n\nI can reproduce this issue with the following steps:\n\n1) When a dirty swapcache page is isolated by reclaim process and the\n   page isn't locked, inject memory failure for the page. \n   me_swapcache_dirty() clears uptodate flag and tries to delete from lru,\n   but fails.  Reclaim process will put the hwpoisoned page back to lru.\n\n2) The process that maps the hwpoisoned page exits, the page is deleted\n   the page will never be freed and will be in the lru forever.\n\n3) If we trigger a reclaim again and tries to reclaim the page,\n   add_to_swap() will trigger VM_BUG_ON_FOLIO due to the uptodate flag is\n   cleared.\n\nTo fix it, skip the hwpoisoned page in shrink_folio_list().  Besides, the\nhwpoison folio may not be unmapped by hwpoison_user_mappings() yet, unmap\nit in shrink_folio_list(), otherwise the folio will fail to be unmaped by\nhwpoison_user_mappings() since the folio isn't in lru list.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f0669c20-9e66-44ac-baa2-b64a5c1a5b50",  "id": "SUSE-SU-2018:2492-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dee3eb6b-2802-434e-8591-2498b7d4d317",  "id": "CVE-2023-1513",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1513"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    665  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "008a13ae-ffe9-41d4-8679-1d8a6869a6b0",  "id": "CVE-2007-4998",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4998"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    59  ],  "analysis": {    "state": "in_triage"  },  "description": "cp, when running with an option to preserve symlinks on multiple OSes, allows local, user-assisted attackers to overwrite arbitrary files via a symlink attack using crafted directories containing multiple source files that are copied to the same destination.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e4971b5b-cf97-45bd-beeb-8f9d58400d7e",  "id": "CVE-2024-27073",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ttpci: fix two memleaks in budget_av_attach\n\nWhen saa7146_register_device and saa7146_vv_init fails, budget_av_attach\nshould free the resources it allocates, like the error-handling of\nttpci_budget_init does. Besides, there are two fixme comment refers to\nsuch deallocations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fff3d0a1-d6cd-4f5a-9a2d-3340bc120f4b",  "id": "openSUSE-SU-2026:11116-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ba52c8dc-c186-4889-9587-e90ce995f1e7",  "id": "MGASA-2019-0392",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3d4f52fb-925d-4636-930e-6ffeb9a02414",  "id": "CVE-2019-15666",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15666"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.19. There is an out-of-bounds array access in __xfrm_policy_unlink, which will cause denial of service, because verify_newpolicy_info in net/xfrm/xfrm_user.c mishandles directory validation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6fcf449c-e82a-46fb-9b6b-056ab851245d",  "id": "CVE-2021-3764",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3764"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400,    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9d8d2b9-a155-4dcf-828e-389f40404dee",  "id": "CVE-2018-14613",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14613"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in io_ctl_map_page() when mounting and operating a crafted btrfs image, because of a lack of block group item validation in check_leaf_item in fs/btrfs/tree-checker.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1b0594d5-59b9-4669-bb52-aa2a86668685",  "id": "CVE-2011-0006",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0006"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The ima_lsm_rule_init function in security/integrity/ima/ima_policy.c in the Linux kernel before 2.6.37, when the Linux Security Modules (LSM) framework is disabled, allows local users to bypass Integrity Measurement Architecture (IMA) rules in opportunistic circumstances by leveraging an administrator's addition of an IMA rule for LSM.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cf325271-5c42-4b55-9cad-767c81273250",  "id": "CVE-2010-2955",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2955"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    193  ],  "analysis": {    "state": "in_triage"  },  "description": "The cfg80211_wext_giwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctl_standard_iw_point function in net/wireless/wext-core.c, and obtain potentially sensitive information from kernel heap memory, via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5bf6fe93-1584-40dc-b122-6f49546270bf",  "id": "CVE-2024-56659",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lapb: increase LAPB_HEADER_LEN\n\nIt is unclear if net/lapb code is supposed to be ready for 8021q.\n\nWe can at least avoid crashes like the following :\n\nskbuff: skb_under_panic: text:ffffffff8aabe1f6 len:24 put:20 head:ffff88802824a400 data:ffff88802824a3fe tail:0x16 end:0x140 dev:nr0.2\n------------[ cut here ]------------\n kernel BUG at net/core/skbuff.c:206 !\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 1 UID: 0 PID: 5508 Comm: dhcpcd Not tainted 6.12.0-rc7-syzkaller-00144-g66418447d27b #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024\n RIP: 0010:skb_panic net/core/skbuff.c:206 [inline]\n RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216\nCode: 0d 8d 48 c7 c6 2e 9e 29 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 1a 6f 37 02 48 83 c4 20 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3\nRSP: 0018:ffffc90002ddf638 EFLAGS: 00010282\nRAX: 0000000000000086 RBX: dffffc0000000000 RCX: 7a24750e538ff600\nRDX: 0000000000000000 RSI: 0000000000000201 RDI: 0000000000000000\nRBP: ffff888034a86650 R08: ffffffff8174b13c R09: 1ffff920005bbe60\nR10: dffffc0000000000 R11: fffff520005bbe61 R12: 0000000000000140\nR13: ffff88802824a400 R14: ffff88802824a3fe R15: 0000000000000016\nFS:  00007f2a5990d740(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000110c2631fd CR3: 0000000029504000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n  skb_push+0xe5/0x100 net/core/skbuff.c:2636\n  nr_header+0x36/0x320 net/netrom/nr_dev.c:69\n  dev_hard_header include/linux/netdevice.h:3148 [inline]\n  vlan_dev_hard_header+0x359/0x480 net/8021q/vlan_dev.c:83\n  dev_hard_header include/linux/netdevice.h:3148 [inline]\n  lapbeth_data_transmit+0x1f6/0x2a0 drivers/net/wan/lapbether.c:257\n  lapb_data_transmit+0x91/0xb0 net/lapb/lapb_iface.c:447\n  lapb_transmit_buffer+0x168/0x1f0 net/lapb/lapb_out.c:149\n lapb_establish_data_link+0x84/0xd0\n lapb_device_event+0x4e0/0x670\n  notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93\n __dev_notify_flags+0x207/0x400\n  dev_change_flags+0xf0/0x1a0 net/core/dev.c:8922\n  devinet_ioctl+0xa4e/0x1aa0 net/ipv4/devinet.c:1188\n  inet_ioctl+0x3d7/0x4f0 net/ipv4/af_inet.c:1003\n  sock_do_ioctl+0x158/0x460 net/socket.c:1227\n  sock_ioctl+0x626/0x8e0 net/socket.c:1346\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\n  __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9f52dda5-a2e5-460e-8fa7-c130aae43a0c",  "id": "CVE-2024-47659",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: tcp: ipv4, fix incorrect labeling\n\nCurrently, Smack mirrors the label of incoming tcp/ipv4 connections:\nwhen a label 'foo' connects to a label 'bar' with tcp/ipv4,\n'foo' always gets 'foo' in returned ipv4 packets. So,\n1) returned packets are incorrectly labeled ('foo' instead of 'bar')\n2) 'bar' can write to 'foo' without being authorized to write.\n\nHere is a scenario how to see this:\n\n* Take two machines, let's call them C and S,\n   with active Smack in the default state\n   (no settings, no rules, no labeled hosts, only builtin labels)\n\n* At S, add Smack rule 'foo bar w'\n   (labels 'foo' and 'bar' are instantiated at S at this moment)\n\n* At S, at label 'bar', launch a program\n   that listens for incoming tcp/ipv4 connections\n\n* From C, at label 'foo', connect to the listener at S.\n   (label 'foo' is instantiated at C at this moment)\n   Connection succeedes and works.\n\n* Send some data in both directions.\n* Collect network traffic of this connection.\n\nAll packets in both directions are labeled with the CIPSO\nof the label 'foo'. Hence, label 'bar' writes to 'foo' without\nbeing authorized, and even without ever being known at C.\n\nIf anybody cares: exactly the same happens with DCCP.\n\nThis behavior 1st manifested in release 2.6.29.4 (see Fixes below)\nand it looks unintentional. At least, no explanation was provided.\n\nI changed returned packes label into the 'bar',\nto bring it into line with the Smack documentation claims.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "89094ca0-55a9-46fa-a8fa-93b716011156",  "id": "CVE-2024-24859",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24859"  },  "ratings": [    {      "score": 4.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function. This can result in a bluetooth sniffing exception issue, possibly leading denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c99c83a-eca4-4a88-9315-22593186db96",  "id": "RHSA-2026:0337",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be94fc8c-f949-4e30-977d-ed6246161988",  "id": "CLSA-2023-1683234934",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eb821d83-177e-46de-b14c-02e925a7e6ac",  "id": "RHSA-2023:1405",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "36437866-0354-438c-9454-d4df9581b7bf",  "id": "CVE-2022-49021",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: fix null-ptr-deref while probe() failed\n\nI got a null-ptr-deref report as following when doing fault injection test:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000058\nOops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 1 PID: 253 Comm: 507-spi-dm9051 Tainted: G    B            N 6.1.0-rc3+\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\nRIP: 0010:klist_put+0x2d/0xd0\nCall Trace:\n <TASK>\n klist_remove+0xf1/0x1c0\n device_release_driver_internal+0x23e/0x2d0\n bus_remove_device+0x1bd/0x240\n device_del+0x357/0x770\n phy_device_remove+0x11/0x30\n mdiobus_unregister+0xa5/0x140\n release_nodes+0x6a/0xa0\n devres_release_all+0xf8/0x150\n device_unbind_cleanup+0x19/0xd0\n\n//probe path:\nphy_device_register()\n  device_add()\n\nphy_connect\n  phy_attach_direct() //set device driver\n    probe() //it's failed, driver is not bound\n    device_bind_driver() // probe failed, it's not called\n\n//remove path:\nphy_device_remove()\n  device_del()\n    device_release_driver_internal()\n      __device_release_driver() //dev->drv is not NULL\n        klist_remove() <- knode_driver is not added yet, cause null-ptr-deref\n\nIn phy_attach_direct(), after setting the 'dev->driver', probe() fails,\ndevice_bind_driver() is not called, so the knode_driver->n_klist is not\nset, then it causes null-ptr-deref in __device_release_driver() while\ndeleting device. Fix this by setting dev->driver to NULL in the error\npath in phy_attach_direct().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5448aae9-84d8-46b3-8bd4-83613371baff",  "id": "CVE-2011-2213",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2213"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "The inet_diag_bc_audit function in net/ipv4/inet_diag.c in the Linux kernel before 2.6.39.3 does not properly audit INET_DIAG bytecode, which allows local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message, as demonstrated by an INET_DIAG_BC_JMP instruction with a zero yes value, a different vulnerability than CVE-2010-3880.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b26d0af3-3352-4ff3-83ac-f23016dabfca",  "id": "CVE-2018-13094",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13094"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "23def139-9334-4d32-a47b-30cca1ba65fc",  "id": "CVE-2023-52590",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: Avoid touching renamed directory if parent does not change\n\nThe VFS will not be locking moved directory if its parent does not\nchange. Change ocfs2 rename code to avoid touching renamed directory if\nits parent does not change as without locking that can corrupt the\nfilesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0e756d41-e5af-4760-bd19-d59e67dba8de",  "id": "CVE-2016-9191",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9191"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20,    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application, as demonstrated by trinity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7b0c7c15-bc52-459b-ae80-2033fbdc74bf",  "id": "CVE-2022-50010",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: i740fb: Check the argument of i740_calc_vclk()\n\nSince the user can control the arguments of the ioctl() from the user\nspace, under special arguments that may result in a divide-by-zero bug.\n\nIf the user provides an improper 'pixclock' value that makes the argumet\nof i740_calc_vclk() less than 'I740_RFREQ_FIX', it will cause a\ndivide-by-zero bug in:\n    drivers/video/fbdev/i740fb.c:353 p_best = min(15, ilog2(I740_MAX_VCO_FREQ / (freq / I740_RFREQ_FIX)));\n\nThe following log can reveal it:\n\ndivide error: 0000 [#1] PREEMPT SMP KASAN PTI\nRIP: 0010:i740_calc_vclk drivers/video/fbdev/i740fb.c:353 [inline]\nRIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:646 [inline]\nRIP: 0010:i740fb_set_par+0x163f/0x3b70 drivers/video/fbdev/i740fb.c:742\nCall Trace:\n fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034\n do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110\n fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189\n\nFix this by checking the argument of i740_calc_vclk() first.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d36253c8-4169-4153-b607-136326d4881a",  "id": "CVE-2019-19058",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19058"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering alloc_page() failures, aka CID-b4b814fec1a5.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95b975b7-15ff-4e0a-8a92-1cfa2ab509c9",  "id": "ALSA-2026:25237",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e3cbdf5f-241f-45e5-99ee-f56c508fa845",  "id": "CVE-2024-50282",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()\n\nAvoid a possible buffer overflow if size is larger than 4K.\n\n(cherry picked from commit f5d873f5825b40d886d03bd2aede91d4cf002434)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "653d7f31-df55-43b9-8764-c0dda756c15b",  "id": "CVE-2023-22999",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22999"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.16.3, drivers/usb/dwc3/dwc3-qcom.c misinterprets the dwc3_qcom_create_urs_usb_platdev return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb7970cb-3746-4f2a-87f2-29667f0b27b9",  "id": "CVE-2015-6252",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6252"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers permanent file-descriptor allocation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1513fbe2-14b9-4322-adfa-1d79760922a4",  "id": "CVE-2025-21760",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nndisc: extend RCU protection in ndisc_send_skb()\n\nndisc_send_skb() can be called without RTNL or RCU held.\n\nAcquire rcu_read_lock() earlier, so that we can use dev_net_rcu()\nand avoid a potential UAF.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ebb9663-5565-4aff-8187-953c8dee83f0",  "id": "CVE-2024-46733",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix qgroup reserve leaks in cow_file_range\n\nIn the buffered write path, the dirty page owns the qgroup reserve until\nit creates an ordered_extent.\n\nTherefore, any errors that occur before the ordered_extent is created\nmust free that reservation, or else the space is leaked. The fstest\ngeneric/475 exercises various IO error paths, and is able to trigger\nerrors in cow_file_range where we fail to get to allocating the ordered\nextent. Note that because we *do* clear delalloc, we are likely to\nremove the inode from the delalloc list, so the inodes/pages to not have\ninvalidate/launder called on them in the commit abort path.\n\nThis results in failures at the unmount stage of the test that look like:\n\n  BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure\n  BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure\n  BTRFS warning (device dm-8 state EA): qgroup 0/5 has unreleased space, type 0 rsv 28672\n  ------------[ cut here ]------------\n  WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-io.c:4333 close_ctree+0x222/0x4d0 [btrfs]\n  Modules linked in: btrfs blake2b_generic libcrc32c xor zstd_compress raid6_pq\n  CPU: 3 PID: 22588 Comm: umount Kdump: loaded Tainted: G W          6.10.0-rc7-gab56fde445b8 #21\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014\n  RIP: 0010:close_ctree+0x222/0x4d0 [btrfs]\n  RSP: 0018:ffffb4465283be00 EFLAGS: 00010202\n  RAX: 0000000000000001 RBX: ffffa1a1818e1000 RCX: 0000000000000001\n  RDX: 0000000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8\n  RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 0000000000000000\n  R10: 0000000000000003 R11: 0000000000000003 R12: ffffa1a18ad7972c\n  R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n  FS:  00007f9168312b80(0000) GS:ffffa1a4afcc0000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f91683c9140 CR3: 000000010acaa000 CR4: 00000000000006f0\n  Call Trace:\n   <TASK>\n   ? close_ctree+0x222/0x4d0 [btrfs]\n   ? __warn.cold+0x8e/0xea\n   ? close_ctree+0x222/0x4d0 [btrfs]\n   ? report_bug+0xff/0x140\n   ? handle_bug+0x3b/0x70\n   ? exc_invalid_op+0x17/0x70\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? close_ctree+0x222/0x4d0 [btrfs]\n   generic_shutdown_super+0x70/0x160\n   kill_anon_super+0x11/0x40\n   btrfs_kill_super+0x11/0x20 [btrfs]\n   deactivate_locked_super+0x2e/0xa0\n   cleanup_mnt+0xb5/0x150\n   task_work_run+0x57/0x80\n   syscall_exit_to_user_mode+0x121/0x130\n   do_syscall_64+0xab/0x1a0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  RIP: 0033:0x7f916847a887\n  ---[ end trace 0000000000000000 ]---\n  BTRFS error (device dm-8 state EA): qgroup reserved space leaked\n\nCases 2 and 3 in the out_reserve path both pertain to this type of leak\nand must free the reserved qgroup data. Because it is already an error\npath, I opted not to handle the possible errors in\nbtrfs_free_qgroup_data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'SNYK:SNYK-UNMANAGED-TORVALDSLINUX-20697076'"    }  ]},{  "bom-ref": "cebe3748-f54c-4bc8-9c65-ac84032ab818",  "id": "CVE-2025-38468",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree\n\nhtb_lookup_leaf has a BUG_ON that can trigger with the following:\n\ntc qdisc del dev lo root\ntc qdisc add dev lo root handle 1: htb default 1\ntc class add dev lo parent 1: classid 1:1 htb rate 64bit\ntc qdisc add dev lo parent 1:1 handle 2: netem\ntc qdisc add dev lo parent 2:1 handle 3: blackhole\nping -I lo -c1 -W0.001 127.0.0.1\n\nThe root cause is the following:\n\n1. htb_dequeue calls htb_dequeue_tree which calls the dequeue handler on\n   the selected leaf qdisc\n2. netem_dequeue calls enqueue on the child qdisc\n3. blackhole_enqueue drops the packet and returns a value that is not\n   just NET_XMIT_SUCCESS\n4. Because of this, netem_dequeue calls qdisc_tree_reduce_backlog, and\n   since qlen is now 0, it calls htb_qlen_notify -> htb_deactivate ->\n   htb_deactiviate_prios -> htb_remove_class_from_row -> htb_safe_rb_erase\n5. As this is the only class in the selected hprio rbtree,\n   __rb_change_child in __rb_erase_augmented sets the rb_root pointer to\n   NULL\n6. Because blackhole_dequeue returns NULL, netem_dequeue returns NULL,\n   which causes htb_dequeue_tree to call htb_lookup_leaf with the same\n   hprio rbtree, and fail the BUG_ON\n\nThe function graph for this scenario is shown here:\n 0)               |  htb_enqueue() {\n 0) + 13.635 us   |    netem_enqueue();\n 0)   4.719 us    |    htb_activate_prios();\n 0) # 2249.199 us |  }\n 0)               |  htb_dequeue() {\n 0)   2.355 us    |    htb_lookup_leaf();\n 0)               |    netem_dequeue() {\n 0) + 11.061 us   |      blackhole_enqueue();\n 0)               |      qdisc_tree_reduce_backlog() {\n 0)               |        qdisc_lookup_rcu() {\n 0)   1.873 us    |          qdisc_match_from_root();\n 0)   6.292 us    |        }\n 0)   1.894 us    |        htb_search();\n 0)               |        htb_qlen_notify() {\n 0)   2.655 us    |          htb_deactivate_prios();\n 0)   6.933 us    |        }\n 0) + 25.227 us   |      }\n 0)   1.983 us    |      blackhole_dequeue();\n 0) + 86.553 us   |    }\n 0) # 2932.761 us |    qdisc_warn_nonwc();\n 0)               |    htb_lookup_leaf() {\n 0)               |      BUG_ON();\n ------------------------------------------\n\nThe full original bug report can be seen here [1].\n\nWe can fix this just by returning NULL instead of the BUG_ON,\nas htb_dequeue_tree returns NULL when htb_lookup_leaf returns\nNULL.\n\n[1] https://lore.kernel.org/netdev/pF5XOOIim0IuEfhI-SOxTgRvNoDwuux7UHKnE_Y5-zVd4wmGvNk2ceHjKb8ORnzw0cGwfmVu42g9dL7XyJLf1NEzaztboTWcm0Ogxuojoeo=@willsroot.io/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "406f404b-269b-4af0-8af2-c5c048d81d3a",  "id": "CVE-2024-42064",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Skip pipe if the pipe idx not set properly\n\n[why]\nDriver crashes when pipe idx not set properly\n\n[how]\nAdd code to skip the pipe that idx not set properly",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "750eb377-9990-413c-bf8c-4cee737c09b6",  "id": "CVE-2023-0590",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0590"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (\"net: sched: fix race condition in qdisc_graft()\") not applied yet, then kernel could be affected.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1629e3d0-1dd0-4c8f-a5d1-b404aefab90b",  "id": "CVE-2021-47354",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47354"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Avoid data corruptions\n\nWait for all dependencies of a job  to complete before\nkilling it to avoid data corruptions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "603612bf-3f55-42a6-b0c2-66442b883347",  "id": "CVE-2024-26842",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix shift issue in ufshcd_clear_cmd()\n\nWhen task_tag >= 32 (in MCQ mode) and sizeof(unsigned int) == 4, 1U <<\ntask_tag will out of bounds for a u32 mask. Fix this up to prevent\nSHIFT_ISSUE (bitwise shifts that are out of bounds for their data type).\n\n[name:debug_monitors&]Unexpected kernel BRK exception at EL1\n[name:traps&]Internal error: BRK handler: 00000000f2005514 [#1] PREEMPT SMP\n[name:mediatek_cpufreq_hw&]cpufreq stop DVFS log done\n[name:mrdump&]Kernel Offset: 0x1ba5800000 from 0xffffffc008000000\n[name:mrdump&]PHYS_OFFSET: 0x80000000\n[name:mrdump&]pstate: 22400005 (nzCv daif +PAN -UAO)\n[name:mrdump&]pc : [0xffffffdbaf52bb2c] ufshcd_clear_cmd+0x280/0x288\n[name:mrdump&]lr : [0xffffffdbaf52a774] ufshcd_wait_for_dev_cmd+0x3e4/0x82c\n[name:mrdump&]sp : ffffffc0081471b0\n<snip>\nWorkqueue: ufs_eh_wq_0 ufshcd_err_handler\nCall trace:\n dump_backtrace+0xf8/0x144\n show_stack+0x18/0x24\n dump_stack_lvl+0x78/0x9c\n dump_stack+0x18/0x44\n mrdump_common_die+0x254/0x480 [mrdump]\n ipanic_die+0x20/0x30 [mrdump]\n notify_die+0x15c/0x204\n die+0x10c/0x5f8\n arm64_notify_die+0x74/0x13c\n do_debug_exception+0x164/0x26c\n el1_dbg+0x64/0x80\n el1h_64_sync_handler+0x3c/0x90\n el1h_64_sync+0x68/0x6c\n ufshcd_clear_cmd+0x280/0x288\n ufshcd_wait_for_dev_cmd+0x3e4/0x82c\n ufshcd_exec_dev_cmd+0x5bc/0x9ac\n ufshcd_verify_dev_init+0x84/0x1c8\n ufshcd_probe_hba+0x724/0x1ce0\n ufshcd_host_reset_and_restore+0x260/0x574\n ufshcd_reset_and_restore+0x138/0xbd0\n ufshcd_err_handler+0x1218/0x2f28\n process_one_work+0x5fc/0x1140\n worker_thread+0x7d8/0xe20\n kthread+0x25c/0x468\n ret_from_fork+0x10/0x20",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f8d0a44c-5c19-43e4-9dcb-818c4f07c9fc",  "id": "CVE-2018-13053",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13053"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "50355cfa-5ed9-49ce-8896-cab19c7cc38f",  "id": "CVE-2024-40973",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mtk-vcodec: potential null pointer deference in SCP\n\nThe return value of devm_kzalloc() needs to be checked to avoid\nNULL pointer deference. This is similar to CVE-2022-3113.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ee332fc-b9c2-47d6-b05e-a7e3ca309132",  "id": "CVE-2022-29582",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29582"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99488b9a-0ffe-4349-a94f-440319976f46",  "id": "CVE-2022-50314",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: Fix hung when signal interrupts nbd_start_device_ioctl()\n\nsyzbot reported hung task [1].  The following program is a simplified\nversion of the reproducer:\n\nint main(void)\n{\n\tint sv[2], fd;\n\n\tif (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) < 0)\n\t\treturn 1;\n\tif ((fd = open(\"/dev/nbd0\", 0)) < 0)\n\t\treturn 1;\n\tif (ioctl(fd, NBD_SET_SIZE_BLOCKS, 0x81) < 0)\n\t\treturn 1;\n\tif (ioctl(fd, NBD_SET_SOCK, sv[0]) < 0)\n\t\treturn 1;\n\tif (ioctl(fd, NBD_DO_IT) < 0)\n\t\treturn 1;\n\treturn 0;\n}\n\nWhen signal interrupt nbd_start_device_ioctl() waiting the condition\natomic_read(&config->recv_threads) == 0, the task can hung because it\nwaits the completion of the inflight IOs.\n\nThis patch fixes the issue by clearing queue, not just shutdown, when\nsignal interrupt nbd_start_device_ioctl().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b36dbaa-374d-4da9-9bb4-bba138cf5936",  "id": "CVE-2026-53002",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: remove sprintf usage\n\nReplace it with scnprintf, the buffer sizes are expected to be large enough\nto hold the result, no need for snprintf+overflow check.\n\nIncrease buffer size in mangle_content_len() while at it.\n\nBUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270\nWrite of size 1 at addr [..]\n vsnprintf+0xea5/0x1270\n sprintf+0xb1/0xe0\n mangle_content_len+0x1ac/0x280\n nf_nat_sdp_session+0x1cc/0x240\n process_sdp+0x8f8/0xb80\n process_invite_request+0x108/0x2b0\n process_sip_msg+0x5da/0xf50\n sip_help_tcp+0x45e/0x780\n nf_confirm+0x34d/0x990\n [..]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b523edff-73d6-43f7-aa76-fa5533820e8c",  "id": "CLSA-2026-1770804474",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "40391755-9cb9-4333-9661-6d8b3da6846c",  "id": "CVE-2024-47757",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential oob read in nilfs_btree_check_delete()\n\nThe function nilfs_btree_check_delete(), which checks whether degeneration\nto direct mapping occurs before deleting a b-tree entry, causes memory\naccess outside the block buffer when retrieving the maximum key if the\nroot node has no entries.\n\nThis does not usually happen because b-tree mappings with 0 child nodes\nare never created by mkfs.nilfs2 or nilfs2 itself.  However, it can happen\nif the b-tree root node read from a device is configured that way, so fix\nthis potential issue by adding a check for that case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "184d55d5-d26b-41f6-b1a1-a239cb996871",  "id": "CVE-2016-2053",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2053"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "970e7fd3-3fd8-4d88-b088-28a0f7084985",  "id": "CVE-2024-49966",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: cancel dqi_sync_work before freeing oinfo\n\nocfs2_global_read_info() will initialize and schedule dqi_sync_work at the\nend, if error occurs after successfully reading global quota, it will\ntrigger the following warning with CONFIG_DEBUG_OBJECTS_* enabled:\n\nODEBUG: free active (active state 0) object: 00000000d8b0ce28 object type: timer_list hint: qsync_work_fn+0x0/0x16c\n\nThis reports that there is an active delayed work when freeing oinfo in\nerror handling, so cancel dqi_sync_work first.  BTW, return status instead\nof -1 when .read_file_info fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed7280de-ced0-4f41-97c9-bd5bb1421f4b",  "id": "CVE-2021-47206",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47206"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: host: ohci-tmio: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "41ac44a4-7dd9-4111-95f1-a518811cc340",  "id": "CVE-2022-48931",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: fix a race in configfs_{,un}register_subsystem()\n\nWhen configfs_register_subsystem() or configfs_unregister_subsystem()\nis executing link_group() or unlink_group(),\nit is possible that two processes add or delete list concurrently.\nSome unfortunate interleavings of them can cause kernel panic.\n\nOne of cases is:\nA --> B --> C --> D\nA <-- B <-- C <-- D\n\n     delete list_head *B        |      delete list_head *C\n--------------------------------|-----------------------------------\nconfigfs_unregister_subsystem   |   configfs_unregister_subsystem\n  unlink_group                  |     unlink_group\n    unlink_obj                  |       unlink_obj\n      list_del_init             |         list_del_init\n        __list_del_entry        |           __list_del_entry\n          __list_del            |             __list_del\n            // next == C        |\n            next->prev = prev   |\n                                |               next->prev = prev\n            prev->next = next   |\n                                |                 // prev == B\n                                |                 prev->next = next\n\nFix this by adding mutex when calling link_group() or unlink_group(),\nbut parent configfs_subsystem is NULL when config_item is root.\nSo I create a mutex configfs_subsystem_mutex.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a573b9f6-0f5f-4001-89f3-2d9fbeb83f94",  "id": "CVE-2013-2894",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2894"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/hid/hid-lenovo-tpkbd.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_LENOVO_TPKBD is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8770d9d8-97a1-4c66-a22b-71dbf66696e0",  "id": "CVE-2022-49537",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix call trace observed during I/O with CMF enabled\n\nThe following was seen with CMF enabled:\n\nBUG: using smp_processor_id() in preemptible\ncode: systemd-udevd/31711\nkernel: caller is lpfc_update_cmf_cmd+0x214/0x420  [lpfc]\nkernel: CPU: 12 PID: 31711 Comm: systemd-udevd\nkernel: Call Trace:\nkernel: <TASK>\nkernel: dump_stack_lvl+0x44/0x57\nkernel: check_preemption_disabled+0xbf/0xe0\nkernel: lpfc_update_cmf_cmd+0x214/0x420 [lpfc]\nkernel: lpfc_nvme_fcp_io_submit+0x23b4/0x4df0 [lpfc]\n\nthis_cpu_ptr() calls smp_processor_id() in a preemptible context.\n\nFix by using per_cpu_ptr() with raw_smp_processor_id() instead.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1786ab53-e562-4c9f-88a0-5d42d6163795",  "id": "CVE-2021-4148",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4148"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    354  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in the filesystem. A missing sanity check may allow a local attacker with user privilege to cause a denial of service (DOS) problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "96a5f94c-9ca0-4e54-a7b8-4efae4994343",  "id": "CVE-2017-18257",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18257"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "The __get_data_block function in fs/f2fs/data.c in the Linux kernel before 4.11 allows local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2553c677-dcfa-4fbc-9005-47090634b782",  "id": "CVE-2018-8087",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8087"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    772  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in the hwsim_new_radio_nl function in drivers/net/wireless/mac80211_hwsim.c in the Linux kernel through 4.15.9 allows local users to cause a denial of service (memory consumption) by triggering an out-of-array error case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "11b71531-ea65-4f38-8890-f432fa97bef6",  "id": "CVE-2025-37882",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix isochronous Ring Underrun/Overrun event handling\n\nThe TRB pointer of these events points at enqueue at the time of error\noccurrence on xHCI 1.1+ HCs or it's NULL on older ones. By the time we\nare handling the event, a new TD may be queued at this ring position.\n\nI can trigger this race by rising interrupt moderation to increase IRQ\nhandling delay. Similar delay may occur naturally due to system load.\n\nIf this ever happens after a Missed Service Error, missed TDs will be\nskipped and the new TD processed as if it matched the event. It could\nbe given back prematurely, risking data loss or buffer UAF by the xHC.\n\nDon't complete TDs on xrun events and don't warn if queued TDs don't\nmatch the event's TRB pointer, which can be NULL or a link/no-op TRB.\nDon't warn if there are no queued TDs at all.\n\nNow that it's safe, also handle xrun events if the skip flag is clear.\nThis ensures completion of any TD stuck in 'error mid TD' state right\nbefore the xrun event, which could happen if a driver submits a finite\nnumber of URBs to a buggy HC and then an error occurs on the last TD.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "237357ff-a85c-49bd-8303-f165862dae52",  "id": "DSA-2343-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a070c10-7adf-47c9-af45-1bf3e770684e",  "id": "CVE-2015-0289",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0289"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fd45ef30-a482-4806-9802-7deaa40c12f3",  "id": "CVE-2022-49313",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: usb: host: Fix deadlock in oxu_bus_suspend()\n\nThere is a deadlock in oxu_bus_suspend(), which is shown below:\n\n   (Thread 1)              |      (Thread 2)\n                           | timer_action()\noxu_bus_suspend()          |  mod_timer()\n spin_lock_irq() //(1)     |  (wait a time)\n ...                       | oxu_watchdog()\n del_timer_sync()          |  spin_lock_irq() //(2)\n (wait timer to stop)      |  ...\n\nWe hold oxu->lock in position (1) of thread 1, and use\ndel_timer_sync() to wait timer to stop, but timer handler\nalso need oxu->lock in position (2) of thread 2. As a result,\noxu_bus_suspend() will block forever.\n\nThis patch extracts del_timer_sync() from the protection of\nspin_lock_irq(), which could let timer handler to obtain\nthe needed lock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5f7b4ab2-009d-4bf6-8d2e-337a6fe43aa7",  "id": "CVE-2026-53224",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate embedded INIT chunk and address list lengths in cookie\n\nsctp_unpack_cookie() only checked that the embedded INIT chunk length\ndid not exceed the remaining cookie payload, but did not ensure that the\nINIT chunk is large enough to contain a complete INIT header.\n\nA malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose\nlength field is smaller than sizeof(struct sctp_init_chunk).  Later,\nsctp_process_init() accesses INIT parameters unconditionally, which may\nlead to out-of-bounds reads.\n\nIn addition, raw_addr_list_len is not fully validated against the\nremaining cookie payload. When cookie authentication is disabled, an\nattacker can supply an oversized raw_addr_list_len and cause\nsctp_raw_to_bind_addrs() to read beyond the end of the cookie. The\naddress parser also lacks sufficient bounds checks for parameter headers\nand lengths, allowing malformed address parameters to trigger\nout-of-bounds reads.\n\nFix this by:\n\n- requiring the embedded INIT chunk length to be at least sizeof(struct\n  sctp_init_chunk);\n- validating that the INIT chunk and raw address list together fit\n  within the cookie payload;\n- verifying sufficient data exists for each address parameter header and\n  payload before parsing it.\n\nNote that sctp_verify_init() must be called after sctp_unpack_cookie()\nand before sctp_process_init() when cookie authentication is disabled.\nThis will be addressed in a separate patch.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "42a1c120-1add-457b-8ca1-5c4ca1d10043",  "id": "CVE-2014-9529",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9529"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f95abb7c-70f4-47f5-a288-e6f3ae2900e9",  "id": "CVE-2010-3301",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3301"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    269  ],  "analysis": {    "state": "in_triage"  },  "description": "The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register.  NOTE: this vulnerability exists because of a CVE-2007-4573 regression.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:15023'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:93869/Linux-Kernel-ia32syscall-Emulation-Local-Root.html'"    }  ]},{  "bom-ref": "4dde5e67-de04-42b1-8728-c751bc7f62e8",  "id": "CVE-2024-46745",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: uinput - reject requests with unreasonable number of slots\n\n\nWhen exercising uinput interface syzkaller may try setting up device\nwith a really large number of slots, which causes memory allocation\nfailure in input_mt_init_slots(). While this allocation failure is\nhandled properly and request is rejected, it results in syzkaller\nreports. Additionally, such request may put undue burden on the\nsystem which will try to free a lot of memory for a bogus request.\n\nFix it by limiting allowed number of slots to 100. This can easily\nbe extended if we see devices that can track more than 100 contacts.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a7353c35-61fc-4615-b551-3f4ec0642c1c",  "id": "SUSE-SU-2023:1738-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b4930da-4845-4d6a-a5eb-1dcec7170d8e",  "id": "CVE-2026-43053",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    367  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: close crash window in attr dabtree inactivation\n\nWhen inactivating an inode with node-format extended attributes,\nxfs_attr3_node_inactive() invalidates all child leaf/node blocks via\nxfs_trans_binval(), but intentionally does not remove the corresponding\nentries from their parent node blocks.  The implicit assumption is that\nxfs_attr_inactive() will truncate the entire attr fork to zero extents\nafterwards, so log recovery will never reach the root node and follow\nthose stale pointers.\n\nHowever, if a log shutdown occurs after the leaf/node block cancellations\ncommit but before the attr bmap truncation commits, this assumption\nbreaks.  Recovery replays the attr bmap intact (the inode still has\nattr fork extents), but suppresses replay of all cancelled leaf/node\nblocks, maybe leaving them as stale data on disk.  On the next mount,\nxlog_recover_process_iunlinks() retries inactivation and attempts to\nread the root node via the attr bmap. If the root node was not replayed,\nreading the unreplayed root block triggers a metadata verification\nfailure immediately; if it was replayed, following its child pointers\nto unreplayed child blocks triggers the same failure:\n\n XFS (pmem0): Metadata corruption detected at\n xfs_da3_node_read_verify+0x53/0x220, xfs_da3_node block 0x78\n XFS (pmem0): Unmount and run xfs_repair\n XFS (pmem0): First 128 bytes of corrupted metadata buffer:\n 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n XFS (pmem0): metadata I/O error in \"xfs_da_read_buf+0x104/0x190\" at daddr 0x78 len 8 error 117\n\nFix this in two places:\n\nIn xfs_attr3_node_inactive(), after calling xfs_trans_binval() on a\nchild block, immediately remove the entry that references it from the\nparent node in the same transaction.  This eliminates the window where\nthe parent holds a pointer to a cancelled block.  Once all children are\nremoved, the now-empty root node is converted to a leaf block within the\nsame transaction. This node-to-leaf conversion is necessary for crash\nsafety. If the system shutdown after the empty node is written to the\nlog but before the second-phase bmap truncation commits, log recovery\nwill attempt to verify the root block on disk. xfs_da3_node_verify()\ndoes not permit a node block with count == 0; such a block will fail\nverification and trigger a metadata corruption shutdown. on the other\nhand, leaf blocks are allowed to have this transient state.\n\nIn xfs_attr_inactive(), split the attr fork truncation into two explicit\nphases.  First, truncate all extents beyond the root block (the child\nextents whose parent references have already been removed above).\nSecond, invalidate the root block and truncate the attr bmap to zero in\na single transaction.  The two operations in the second phase must be\natomic: as long as the attr bmap has any non-zero length, recovery can\nfollow it to the root block, so the root block invalidation must commit\ntogether with the bmap-to-zero truncation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a9b2f0b4-a1b4-4ff0-bffd-cb9325456169",  "id": "CVE-2022-49767",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p/trans_fd: always use O_NONBLOCK read/write\n\nsyzbot is reporting hung task at p9_fd_close() [1], for p9_mux_poll_stop()\n from p9_conn_destroy() from p9_fd_close() is failing to interrupt already\nstarted kernel_read() from p9_fd_read() from p9_read_work() and/or\nkernel_write() from p9_fd_write() from p9_write_work() requests.\n\nSince p9_socket_open() sets O_NONBLOCK flag, p9_mux_poll_stop() does not\nneed to interrupt kernel_read()/kernel_write(). However, since p9_fd_open()\ndoes not set O_NONBLOCK flag, but pipe blocks unless signal is pending,\np9_mux_poll_stop() needs to interrupt kernel_read()/kernel_write() when\nthe file descriptor refers to a pipe. In other words, pipe file descriptor\nneeds to be handled as if socket file descriptor.\n\nWe somehow need to interrupt kernel_read()/kernel_write() on pipes.\n\nA minimal change, which this patch is doing, is to set O_NONBLOCK flag\n from p9_fd_open(), for O_NONBLOCK flag does not affect reading/writing\nof regular files. But this approach changes O_NONBLOCK flag on userspace-\nsupplied file descriptors (which might break userspace programs), and\nO_NONBLOCK flag could be changed by userspace. It would be possible to set\nO_NONBLOCK flag every time p9_fd_read()/p9_fd_write() is invoked, but still\nremains small race window for clearing O_NONBLOCK flag.\n\nIf we don't want to manipulate O_NONBLOCK flag, we might be able to\nsurround kernel_read()/kernel_write() with set_thread_flag(TIF_SIGPENDING)\nand recalc_sigpending(). Since p9_read_work()/p9_write_work() works are\nprocessed by kernel threads which process global system_wq workqueue,\nsignals could not be delivered from remote threads when p9_mux_poll_stop()\n from p9_conn_destroy() from p9_fd_close() is called. Therefore, calling\nset_thread_flag(TIF_SIGPENDING)/recalc_sigpending() every time would be\nneeded if we count on signals for making kernel_read()/kernel_write()\nnon-blocking.\n\n[Dominique: add comment at Christian's suggestion]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fa58125e-0c2c-4480-935a-0b821d7eb3c3",  "id": "CVE-2021-47284",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47284"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nisdn: mISDN: netjet: Fix crash in nj_probe:\n\n'nj_setup' in netjet.c might fail with -EIO and in this case\n'card->irq' is initialized and is bigger than zero. A subsequent call to\n'nj_release' will free the irq that has not been requested.\n\nFix this bug by deleting the previous assignment to 'card->irq' and just\nkeep the assignment before 'request_irq'.\n\nThe KASAN's log reveals it:\n\n[    3.354615 ] WARNING: CPU: 0 PID: 1 at kernel/irq/manage.c:1826\nfree_irq+0x100/0x480\n[    3.355112 ] Modules linked in:\n[    3.355310 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted\n5.13.0-rc1-00144-g25a1298726e #13\n[    3.355816 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\nrel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\n[    3.356552 ] RIP: 0010:free_irq+0x100/0x480\n[    3.356820 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18\n4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5\nff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80\n[    3.358012 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082\n[    3.358357 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX:\n0000000000000000\n[    3.358814 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI:\n00000000ffffffff\n[    3.359272 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09:\n0000000000000000\n[    3.359732 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12:\n0000000000000000\n[    3.360195 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15:\nffff888104dc80a8\n[    3.360652 ] FS:  0000000000000000(0000) GS:ffff88817bc00000(0000)\nknlGS:0000000000000000\n[    3.361170 ] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    3.361538 ] CR2: 0000000000000000 CR3: 000000000582e000 CR4:\n00000000000006f0\n[    3.362003 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2:\n0000000000000000\n[    3.362175 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:\n0000000000000400\n[    3.362175 ] Call Trace:\n[    3.362175 ]  nj_release+0x51/0x1e0\n[    3.362175 ]  nj_probe+0x450/0x950\n[    3.362175 ]  ? pci_device_remove+0x110/0x110\n[    3.362175 ]  local_pci_probe+0x45/0xa0\n[    3.362175 ]  pci_device_probe+0x12b/0x1d0\n[    3.362175 ]  really_probe+0x2a9/0x610\n[    3.362175 ]  driver_probe_device+0x90/0x1d0\n[    3.362175 ]  ? mutex_lock_nested+0x1b/0x20\n[    3.362175 ]  device_driver_attach+0x68/0x70\n[    3.362175 ]  __driver_attach+0x124/0x1b0\n[    3.362175 ]  ? device_driver_attach+0x70/0x70\n[    3.362175 ]  bus_for_each_dev+0xbb/0x110\n[    3.362175 ]  ? rdinit_setup+0x45/0x45\n[    3.362175 ]  driver_attach+0x27/0x30\n[    3.362175 ]  bus_add_driver+0x1eb/0x2a0\n[    3.362175 ]  driver_register+0xa9/0x180\n[    3.362175 ]  __pci_register_driver+0x82/0x90\n[    3.362175 ]  ? w6692_init+0x38/0x38\n[    3.362175 ]  nj_init+0x36/0x38\n[    3.362175 ]  do_one_initcall+0x7f/0x3d0\n[    3.362175 ]  ? rdinit_setup+0x45/0x45\n[    3.362175 ]  ? rcu_read_lock_sched_held+0x4f/0x80\n[    3.362175 ]  kernel_init_freeable+0x2aa/0x301\n[    3.362175 ]  ? rest_init+0x2c0/0x2c0\n[    3.362175 ]  kernel_init+0x18/0x190\n[    3.362175 ]  ? rest_init+0x2c0/0x2c0\n[    3.362175 ]  ? rest_init+0x2c0/0x2c0\n[    3.362175 ]  ret_from_fork+0x1f/0x30\n[    3.362175 ] Kernel panic - not syncing: panic_on_warn set ...\n[    3.362175 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted\n5.13.0-rc1-00144-g25a1298726e #13\n[    3.362175 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\nrel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\n[    3.362175 ] Call Trace:\n[    3.362175 ]  dump_stack+0xba/0xf5\n[    3.362175 ]  ? free_irq+0x100/0x480\n[    3.362175 ]  panic+0x15a/0x3f2\n[    3.362175 ]  ? __warn+0xf2/0x150\n[    3.362175 ]  ? free_irq+0x100/0x480\n[    3.362175 ]  __warn+0x108/0x150\n[    3.362175 ]  ? free_irq+0x100/0x480\n[    3.362175 ]  report_bug+0x119/0x1c0\n[    3.362175 ]  handle_bug+0x3b/0x80\n[    3.362175 ]  exc_invalid_op+0x18/0x70\n[    3.362175 ]  asm_exc_invalid_op+0x12/0x20\n[    3.362175 ] RIP: 0010:free_irq+0x100\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ceb1ca7f-0c32-4da7-95e5-dc29cbc7042f",  "id": "CVE-2024-44987",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent UAF in ip6_send_skb()\n\nsyzbot reported an UAF in ip6_send_skb() [1]\n\nAfter ip6_local_out() has returned, we no longer can safely\ndereference rt, unless we hold rcu_read_lock().\n\nA similar issue has been fixed in commit\na688caa34beb (\"ipv6: take rcu lock in rawv6_send_hdrinc()\")\n\nAnother potential issue in ip6_finish_output2() is handled in a\nseparate patch.\n\n[1]\n BUG: KASAN: slab-use-after-free in ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964\nRead of size 8 at addr ffff88806dde4858 by task syz.1.380/6530\n\nCPU: 1 UID: 0 PID: 6530 Comm: syz.1.380 Not tainted 6.11.0-rc3-syzkaller-00306-gdf6cbc62cc9b #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nCall Trace:\n <TASK>\n  __dump_stack lib/dump_stack.c:93 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964\n  rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588\n  rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x1a6/0x270 net/socket.c:745\n  sock_write_iter+0x2dd/0x400 net/socket.c:1160\n do_iter_readv_writev+0x60a/0x890\n  vfs_writev+0x37c/0xbb0 fs/read_write.c:971\n  do_writev+0x1b1/0x350 fs/read_write.c:1018\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f936bf79e79\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f936cd7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014\nRAX: ffffffffffffffda RBX: 00007f936c115f80 RCX: 00007f936bf79e79\nRDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004\nRBP: 00007f936bfe7916 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 00007f936c115f80 R15: 00007fff2860a7a8\n </TASK>\n\nAllocated by task 6530:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  unpoison_slab_object mm/kasan/common.c:312 [inline]\n  __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338\n  kasan_slab_alloc include/linux/kasan.h:201 [inline]\n  slab_post_alloc_hook mm/slub.c:3988 [inline]\n  slab_alloc_node mm/slub.c:4037 [inline]\n  kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4044\n  dst_alloc+0x12b/0x190 net/core/dst.c:89\n  ip6_blackhole_route+0x59/0x340 net/ipv6/route.c:2670\n  make_blackhole net/xfrm/xfrm_policy.c:3120 [inline]\n  xfrm_lookup_route+0xd1/0x1c0 net/xfrm/xfrm_policy.c:3313\n  ip6_dst_lookup_flow+0x13e/0x180 net/ipv6/ip6_output.c:1257\n  rawv6_sendmsg+0x1283/0x23c0 net/ipv6/raw.c:898\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x1a6/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597\n  ___sys_sendmsg net/socket.c:2651 [inline]\n  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 45:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579\n  poison_slab_object+0xe0/0x150 mm/kasan/common.c:240\n  __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256\n  kasan_slab_free include/linux/kasan.h:184 [inline]\n  slab_free_hook mm/slub.c:2252 [inline]\n  slab_free mm/slub.c:4473 [inline]\n  kmem_cache_free+0x145/0x350 mm/slub.c:4548\n  dst_destroy+0x2ac/0x460 net/core/dst.c:124\n  rcu_do_batch kernel/rcu/tree.c:2569 [inline]\n  rcu_core+0xafd/0x1830 kernel/rcu/tree.\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c5669c2-771f-4823-a639-661678982a28",  "id": "CVE-2024-47809",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix possible lkb_resource null dereference\n\nThis patch fixes a possible null pointer dereference when this function is\ncalled from request_lock() as lkb->lkb_resource is not assigned yet,\nonly after validate_lock_args() by calling attach_lkb(). Another issue\nis that a resource name could be a non printable bytearray and we cannot\nassume to be ASCII coded.\n\nThe log functionality is probably never being hit when DLM is used in\nnormal way and no debug logging is enabled. The null pointer dereference\ncan only occur on a new created lkb that does not have the resource\nassigned yet, it probably never hits the null pointer dereference but we\nshould be sure that other changes might not change this behaviour and we\nactually can hit the mentioned null pointer dereference.\n\nIn this patch we just drop the printout of the resource name, the lkb id\nis enough to make a possible connection to a resource name if this\nexists.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a07b76b2-f884-4a7c-b593-3ddae41dc8d4",  "id": "OESA-2025-1857",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c48fadb6-681d-46a1-840d-0fe075740e4c",  "id": "SUSE-SU-2020:3763-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2228d6d4-8f1d-40a5-b6aa-4311e1f1dbd4",  "id": "CVE-2024-35922",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbmon: prevent division by zero in fb_videomode_from_videomode()\n\nThe expression htotal * vtotal can have a zero value on\noverflow. It is necessary to prevent division by zero like in\nfb_var_to_videomode().\n\nFound by Linux Verification Center (linuxtesting.org) with Svace.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fa2a5a2b-4b03-49e8-a570-633f4427be31",  "id": "CVE-2015-0239",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0239"  },  "ratings": [    {      "score": 4.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    269  ],  "analysis": {    "state": "in_triage"  },  "description": "The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6f579b62-bf90-47cd-8128-3a73f7336f5f",  "id": "DLA-1445-2",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f20f7782-1ec7-4f37-addf-2c6780413b01",  "id": "CVE-2022-49034",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK\n\nWhen CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected,\ncpu_max_bits_warn() generates a runtime warning similar as below when\nshowing /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit)\ninstead of NR_CPUS to iterate CPUs.\n\n[    3.052463] ------------[ cut here ]------------\n[    3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0\n[    3.070072] Modules linked in: efivarfs autofs4\n[    3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052\n[    3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000\n[    3.109127]         9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430\n[    3.118774]         90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff\n[    3.128412]         0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890\n[    3.138056]         0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa\n[    3.147711]         ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000\n[    3.157364]         900000000101c998 0000000000000004 9000000000ef7430 0000000000000000\n[    3.167012]         0000000000000009 000000000000006c 0000000000000000 0000000000000000\n[    3.176641]         9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286\n[    3.186260]         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c\n[    3.195868]         ...\n[    3.199917] Call Trace:\n[    3.203941] [<90000000002086d8>] show_stack+0x38/0x14c\n[    3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88\n[    3.217625] [<900000000023d268>] __warn+0xd0/0x100\n[    3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc\n[    3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0\n[    3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4\n[    3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4\n[    3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0\n[    3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100\n[    3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94\n[    3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160\n[    3.281824] ---[ end trace 8b484262b4b8c24c ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "58bcb4a0-f964-4e79-bf61-0cff89d94372",  "id": "CVE-2025-38359",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Fix in_atomic() handling in do_secure_storage_access()\n\nKernel user spaces accesses to not exported pages in atomic context\nincorrectly try to resolve the page fault.\nWith debug options enabled call traces like this can be seen:\n\nBUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1523\nin_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 419074, name: qemu-system-s39\npreempt_count: 1, expected: 0\nRCU nest depth: 0, expected: 0\nINFO: lockdep is turned off.\nPreemption disabled at:\n[<00000383ea47cfa2>] copy_page_from_iter_atomic+0xa2/0x8a0\nCPU: 12 UID: 0 PID: 419074 Comm: qemu-system-s39\nTainted: G        W           6.16.0-20250531.rc0.git0.69b3a602feac.63.fc42.s390x+debug #1 PREEMPT\nTainted: [W]=WARN\nHardware name: IBM 3931 A01 703 (LPAR)\nCall Trace:\n [<00000383e990d282>] dump_stack_lvl+0xa2/0xe8\n [<00000383e99bf152>] __might_resched+0x292/0x2d0\n [<00000383eaa7c374>] down_read+0x34/0x2d0\n [<00000383e99432f8>] do_secure_storage_access+0x108/0x360\n [<00000383eaa724b0>] __do_pgm_check+0x130/0x220\n [<00000383eaa842e4>] pgm_check_handler+0x114/0x160\n [<00000383ea47d028>] copy_page_from_iter_atomic+0x128/0x8a0\n([<00000383ea47d016>] copy_page_from_iter_atomic+0x116/0x8a0)\n [<00000383e9c45eae>] generic_perform_write+0x16e/0x310\n [<00000383e9eb87f4>] ext4_buffered_write_iter+0x84/0x160\n [<00000383e9da0de4>] vfs_write+0x1c4/0x460\n [<00000383e9da123c>] ksys_write+0x7c/0x100\n [<00000383eaa7284e>] __do_syscall+0x15e/0x280\n [<00000383eaa8417e>] system_call+0x6e/0x90\nINFO: lockdep is turned off.\n\nIt is not allowed to take the mmap_lock while in atomic context. Therefore\nhandle such a secure storage access fault as if the accessed page is not\nmapped: the uaccess function will return -EFAULT, and the caller has to\ndeal with this. Usually this means that the access is retried in process\ncontext, which allows to resolve the page fault (or in this case export the\npage).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf7934c9-2dac-4303-81bc-1d91689f5b34",  "id": "CLSA-2023-1683235759",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d38c0c83-497f-4ec5-9e58-15c9b4cfd118",  "id": "CVE-2017-6348",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6348"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages lock dropping, which allows local users to cause a denial of service (deadlock) via crafted operations on IrDA devices.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0a3563bf-d6f8-498c-98e3-550a279b1835",  "id": "CVE-2022-49682",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxtensa: Fix refcount leak bug in time.c\n\nIn calibrate_ccount(), of_find_compatible_node() will return a node\npointer with refcount incremented. We should use of_node_put() when\nit is not used anymore.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "57530cbd-6f90-4f99-a056-b157bab96272",  "id": "DLA-4490-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a1101b15-2a61-4cfc-b08c-ac0134fcd226",  "id": "CVE-2023-53089",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix task hung in ext4_xattr_delete_inode\n\nSyzbot reported a hung task problem:\n==================================================================\nINFO: task syz-executor232:5073 blocked for more than 143 seconds.\n      Not tainted 6.2.0-rc2-syzkaller-00024-g512dee0c00ad #0\n\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:syz-exec232 state:D stack:21024 pid:5073 ppid:5072 flags:0x00004004\nCall Trace:\n <TASK>\n context_switch kernel/sched/core.c:5244 [inline]\n __schedule+0x995/0xe20 kernel/sched/core.c:6555\n schedule+0xcb/0x190 kernel/sched/core.c:6631\n __wait_on_freeing_inode fs/inode.c:2196 [inline]\n find_inode_fast+0x35a/0x4c0 fs/inode.c:950\n iget_locked+0xb1/0x830 fs/inode.c:1273\n __ext4_iget+0x22e/0x3ed0 fs/ext4/inode.c:4861\n ext4_xattr_inode_iget+0x68/0x4e0 fs/ext4/xattr.c:389\n ext4_xattr_inode_dec_ref_all+0x1a7/0xe50 fs/ext4/xattr.c:1148\n ext4_xattr_delete_inode+0xb04/0xcd0 fs/ext4/xattr.c:2880\n ext4_evict_inode+0xd7c/0x10b0 fs/ext4/inode.c:296\n evict+0x2a4/0x620 fs/inode.c:664\n ext4_orphan_cleanup+0xb60/0x1340 fs/ext4/orphan.c:474\n __ext4_fill_super fs/ext4/super.c:5516 [inline]\n ext4_fill_super+0x81cd/0x8700 fs/ext4/super.c:5644\n get_tree_bdev+0x400/0x620 fs/super.c:1282\n vfs_get_tree+0x88/0x270 fs/super.c:1489\n do_new_mount+0x289/0xad0 fs/namespace.c:3145\n do_mount fs/namespace.c:3488 [inline]\n __do_sys_mount fs/namespace.c:3697 [inline]\n __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7fa5406fd5ea\nRSP: 002b:00007ffc7232f968 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fa5406fd5ea\nRDX: 0000000020000440 RSI: 0000000020000000 RDI: 00007ffc7232f970\nRBP: 00007ffc7232f970 R08: 00007ffc7232f9b0 R09: 0000000000000432\nR10: 0000000000804a03 R11: 0000000000000202 R12: 0000000000000004\nR13: 0000555556a7a2c0 R14: 00007ffc7232f9b0 R15: 0000000000000000\n </TASK>\n==================================================================\n\nThe problem is that the inode contains an xattr entry with ea_inum of 15\nwhen cleaning up an orphan inode <15>. When evict inode <15>, the reference\ncounting of the corresponding EA inode is decreased. When EA inode <15> is\nfound by find_inode_fast() in __ext4_iget(), it is found that the EA inode\nholds the I_FREEING flag and waits for the EA inode to complete deletion.\nAs a result, when inode <15> is being deleted, we wait for inode <15> to\ncomplete the deletion, resulting in an infinite loop and triggering Hung\nTask. To solve this problem, we only need to check whether the ino of EA\ninode and parent is the same before getting EA inode.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b9bbca53-1f69-4521-a133-a1560145c4ec",  "id": "CVE-2026-46004",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: Handle probe errors properly\n\nThe probe procedure of setup_card() in caiaq driver doesn't treat the\nerror cases gracefully, e.g. the error from snd_card_register() calls\nsnd_card_free() but continues.  This would lead to a UAF for the\nfurther calls like snd_usb_caiaq_control_init(), as Berk suggested in\nanother patch in the link below.\n\nHowever, the problem is not only that; in general, this function drops\nthe all error handlings (as it's a void function) although its caller\ncan propagate an error to snd_probe(), which eventually calls\nsnd_card_free() as a proper error path.  That said, we should treat\neach error case in setup_card(), and just return the error code\npromptly, which is then handled later as a fatal error in snd_probe().\n\nThis patch achieves it by changing the setup_card() to return an error\ncode.  Also, the superfluous snd_card_free() call is removed, too.\n\nNote that card->private_free can be set still safely at returning an\nerror.  All called functions in card_free() have checks of the\nunassigned resources or NULL checks.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "87ab3fda-3c33-4e12-889f-8f882686ebbb",  "id": "CVE-2019-13648",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13648"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8044379e-7948-4696-b2de-b8cfa7f5cdf6",  "id": "CVE-2017-13704",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13704"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5e41f3b-280b-4711-adf6-4b9fd05d1c72",  "id": "SUSE-SU-2022:2098-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ed69605-bede-443d-bd94-7d7da4a85726",  "id": "CVE-2010-1148",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1148"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The cifs_create function in fs/cifs/dir.c in the Linux kernel 2.6.33.2 and earlier allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a NULL nameidata (aka nd) field in a POSIX file-creation request to a server that supports UNIX extensions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9bf51e14-c006-4b7f-991b-83ac48ae7d54",  "id": "DSA-3566-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c200e2c0-2866-4e77-bca0-951f878d7b49",  "id": "RHSA-2026:0714",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a30fae80-5455-4575-ad01-9f8bf9345048",  "id": "CVE-2023-7192",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7192"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b04b903c-dc2d-4ff6-bdf4-01cfdfe86919",  "id": "CVE-2018-10940",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10940"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "12596391-61a6-43c1-831d-efc812f83cd6",  "id": "CVE-2016-1575",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1575"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    269  ],  "analysis": {    "state": "in_triage"  },  "description": "The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:41762'"    }  ]},{  "bom-ref": "ecbd966f-d175-4bb9-80f4-a169651911cf",  "id": "CVE-2015-1789",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1789"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1749cd46-035a-450f-b377-abe47b69f064",  "id": "OESA-2024-2385",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0f083be2-020e-4bf8-9b98-e267c662382a",  "id": "ALSA-2024:2447",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "26345f8a-bd55-4a70-b55c-6114bb2a14fd",  "id": "CVE-2021-47642",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47642"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow\n\nCoverity complains of a possible buffer overflow. However,\ngiven the 'static' scope of nvidia_setup_i2c_bus() it looks\nlike that can't happen after examiniing the call sites.\n\nCID 19036 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW)\n1. fixed_size_dest: You might overrun the 48-character fixed-size string\n  chan->adapter.name by copying name without checking the length.\n2. parameter_as_source: Note: This defect has an elevated risk because the\n  source argument is a parameter of the current function.\n 89        strcpy(chan->adapter.name, name);\n\nFix this warning by using strscpy() which will silence the warning and\nprevent any future buffer overflows should the names used to identify the\nchannel become much longer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7eefd571-5461-497a-8230-9a89dcffdd41",  "id": "CVE-2024-53128",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/task_stack: fix object_is_on_stack() for KASAN tagged pointers\n\nWhen CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the\nobject_is_on_stack() function may produce incorrect results due to the\npresence of tags in the obj pointer, while the stack pointer does not have\ntags.  This discrepancy can lead to incorrect stack object detection and\nsubsequently trigger warnings if CONFIG_DEBUG_OBJECTS is also enabled.\n\nExample of the warning:\n\nODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated.\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 1 at lib/debugobjects.c:557 __debug_object_init+0x330/0x364\nModules linked in:\nCPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc5 #4\nHardware name: linux,dummy-virt (DT)\npstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : __debug_object_init+0x330/0x364\nlr : __debug_object_init+0x330/0x364\nsp : ffff800082ea7b40\nx29: ffff800082ea7b40 x28: 98ff0000c0164518 x27: 98ff0000c0164534\nx26: ffff800082d93ec8 x25: 0000000000000001 x24: 1cff0000c00172a0\nx23: 0000000000000000 x22: ffff800082d93ed0 x21: ffff800081a24418\nx20: 3eff800082ea7bb0 x19: efff800000000000 x18: 0000000000000000\nx17: 00000000000000ff x16: 0000000000000047 x15: 206b63617473206e\nx14: 0000000000000018 x13: ffff800082ea7780 x12: 0ffff800082ea78e\nx11: 0ffff800082ea790 x10: 0ffff800082ea79d x9 : 34d77febe173e800\nx8 : 34d77febe173e800 x7 : 0000000000000001 x6 : 0000000000000001\nx5 : feff800082ea74b8 x4 : ffff800082870a90 x3 : ffff80008018d3c4\nx2 : 0000000000000001 x1 : ffff800082858810 x0 : 0000000000000050\nCall trace:\n __debug_object_init+0x330/0x364\n debug_object_init_on_stack+0x30/0x3c\n schedule_hrtimeout_range_clock+0xac/0x26c\n schedule_hrtimeout+0x1c/0x30\n wait_task_inactive+0x1d4/0x25c\n kthread_bind_mask+0x28/0x98\n init_rescuer+0x1e8/0x280\n workqueue_init+0x1a0/0x3cc\n kernel_init_freeable+0x118/0x200\n kernel_init+0x28/0x1f0\n ret_from_fork+0x10/0x20\n---[ end trace 0000000000000000 ]---\nODEBUG: object 3eff800082ea7bb0 is NOT on stack ffff800082ea0000, but annotated.\n------------[ cut here ]------------",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fe613bd9-e0cd-4dac-b190-cd2a31ea5845",  "id": "CVE-2012-2110",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2110"  },  "ratings": [    {      "score": 7.5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:18756'"    }  ]},{  "bom-ref": "081de7df-11cf-43c2-8f03-0d12ce85618d",  "id": "SUSE-SU-2025:0071-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cc80920a-efa1-44a2-934f-4d62ad5cbe34",  "id": "AZL-6345",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.2,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d1990fe2-2b60-40f9-96bf-037018dd24e9",  "id": "SUSE-SU-2021:14670-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "795b0b88-3132-4e5f-a18c-a455df7210eb",  "id": "CVE-2023-52604",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nFS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree\n\nSyzkaller reported the following issue:\n\nUBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6\nindex 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]')\nCPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:217 [inline]\n __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348\n dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867\n dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834\n dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331\n dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline]\n dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402\n txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534\n txUpdateMap+0x342/0x9e0\n txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]\n jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732\n kthread+0x2d3/0x370 kernel/kthread.c:388\n ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304\n </TASK>\n================================================================================\nKernel panic - not syncing: UBSAN: panic_on_warn set ...\nCPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106\n panic+0x30f/0x770 kernel/panic.c:340\n check_panic_on_warn+0x82/0xa0 kernel/panic.c:236\n ubsan_epilogue lib/ubsan.c:223 [inline]\n __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348\n dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867\n dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834\n dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331\n dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline]\n dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402\n txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534\n txUpdateMap+0x342/0x9e0\n txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]\n jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732\n kthread+0x2d3/0x370 kernel/kthread.c:388\n ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304\n </TASK>\nKernel Offset: disabled\nRebooting in 86400 seconds..\n\nThe issue is caused when the value of lp becomes greater than\nCTLTREESIZE which is the max size of stree. Adding a simple check\nsolves this issue.\n\nDave:\nAs the function returns a void, good error handling\nwould require a more intrusive code reorganization, so I modified\nOsama's patch at use WARN_ON_ONCE for lack of a cleaner option.\n\nThe patch is tested via syzbot.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b8095c4-bfe7-46eb-9bd4-ee3f99ca635a",  "id": "CVE-2024-50178",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: loongson3: Use raw_smp_processor_id() in do_service_request()\n\nUse raw_smp_processor_id() instead of plain smp_processor_id() in\ndo_service_request(), otherwise we may get some errors with the driver\nenabled:\n\n BUG: using smp_processor_id() in preemptible [00000000] code: (udev-worker)/208\n caller is loongson3_cpufreq_probe+0x5c/0x250 [loongson3_cpufreq]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f86211c6-dafe-47e8-8c98-1f3fb5eee47c",  "id": "CVE-2021-33033",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33033"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9b569c0-1859-4251-b459-254e941d7248",  "id": "CVE-2025-39905",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phylink: add lock for serializing concurrent pl->phydev writes with resolver\n\nCurrently phylink_resolve() protects itself against concurrent\nphylink_bringup_phy() or phylink_disconnect_phy() calls which modify\npl->phydev by relying on pl->state_mutex.\n\nThe problem is that in phylink_resolve(), pl->state_mutex is in a lock\ninversion state with pl->phydev->lock. So pl->phydev->lock needs to be\nacquired prior to pl->state_mutex. But that requires dereferencing\npl->phydev in the first place, and without pl->state_mutex, that is\nracy.\n\nHence the reason for the extra lock. Currently it is redundant, but it\nwill serve a functional purpose once mutex_lock(&phy->lock) will be\nmoved outside of the mutex_lock(&pl->state_mutex) section.\n\nAnother alternative considered would have been to let phylink_resolve()\nacquire the rtnl_mutex, which is also held when phylink_bringup_phy()\nand phylink_disconnect_phy() are called. But since phylink_disconnect_phy()\nruns under rtnl_lock(), it would deadlock with phylink_resolve() when\ncalling flush_work(&pl->resolve). Additionally, it would have been\nundesirable because it would have unnecessarily blocked many other call\npaths as well in the entire kernel, so the smaller-scoped lock was\npreferred.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "74bdc6fc-c96a-49b4-9c47-285f3ba2996f",  "id": "CVE-2021-20261",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20261"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver software. The impact of this issue is lessened by the fact that the default permissions on the floppy device (/dev/fd0) are restricted to root. If the permissions on the device have changed the impact changes greatly. In the default configuration root (or equivalent) permissions are required to attack this flaw.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a39dffc-cf0e-4378-9ee3-e473954ba472",  "id": "CVE-2025-38099",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken\n\nA SCO connection without the proper voice_setting can cause\nthe controller to lock up.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c1603bb9-40ce-4eea-8835-32f49c2f40b3",  "id": "CVE-2017-9605",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9605"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle variable but does not give it an initial value. If one attempts to create a GB surface, with a previously allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and is then later returned to user space, allowing local users to obtain sensitive information from uninitialized kernel memory via a crafted ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e40d3247-d4a6-47ef-9807-059b27513f4a",  "id": "AZL-25937",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5df6a494-5c1b-4659-955d-28dab784c1c0",  "id": "CVE-2019-20422",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20422"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    755  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.3.4, fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in a reference-count decision, leading to (for example) a crash that was identified by syzkaller, aka CID-7b09c2d052db.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd825901-7a12-4ebc-ad65-6332d82c3da1",  "id": "CVE-2011-1573",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1573"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    682  ],  "analysis": {    "state": "in_triage"  },  "description": "net/sctp/sm_make_chunk.c in the Linux kernel before 2.6.34, when addip_enable and auth_enable are used, does not consider the amount of zero padding during calculation of chunk lengths for (1) INIT and (2) INIT ACK chunks, which allows remote attackers to cause a denial of service (OOPS) via crafted packet data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a00779ba-59ab-47f7-8601-ec5846a50da6",  "id": "RHSA-2020:5623",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "34ec9f52-8707-4378-aa20-bde1dddd792c",  "id": "CVE-2025-38713",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()\n\nThe hfsplus_readdir() method is capable to crash by calling\nhfsplus_uni2asc():\n\n[  667.121659][ T9805] ==================================================================\n[  667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10\n[  667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805\n[  667.124578][ T9805]\n[  667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full)\n[  667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  667.124890][ T9805] Call Trace:\n[  667.124893][ T9805]  <TASK>\n[  667.124896][ T9805]  dump_stack_lvl+0x10e/0x1f0\n[  667.124911][ T9805]  print_report+0xd0/0x660\n[  667.124920][ T9805]  ? __virt_addr_valid+0x81/0x610\n[  667.124928][ T9805]  ? __phys_addr+0xe8/0x180\n[  667.124934][ T9805]  ? hfsplus_uni2asc+0x902/0xa10\n[  667.124942][ T9805]  kasan_report+0xc6/0x100\n[  667.124950][ T9805]  ? hfsplus_uni2asc+0x902/0xa10\n[  667.124959][ T9805]  hfsplus_uni2asc+0x902/0xa10\n[  667.124966][ T9805]  ? hfsplus_bnode_read+0x14b/0x360\n[  667.124974][ T9805]  hfsplus_readdir+0x845/0xfc0\n[  667.124984][ T9805]  ? __pfx_hfsplus_readdir+0x10/0x10\n[  667.124994][ T9805]  ? stack_trace_save+0x8e/0xc0\n[  667.125008][ T9805]  ? iterate_dir+0x18b/0xb20\n[  667.125015][ T9805]  ? trace_lock_acquire+0x85/0xd0\n[  667.125022][ T9805]  ? lock_acquire+0x30/0x80\n[  667.125029][ T9805]  ? iterate_dir+0x18b/0xb20\n[  667.125037][ T9805]  ? down_read_killable+0x1ed/0x4c0\n[  667.125044][ T9805]  ? putname+0x154/0x1a0\n[  667.125051][ T9805]  ? __pfx_down_read_killable+0x10/0x10\n[  667.125058][ T9805]  ? apparmor_file_permission+0x239/0x3e0\n[  667.125069][ T9805]  iterate_dir+0x296/0xb20\n[  667.125076][ T9805]  __x64_sys_getdents64+0x13c/0x2c0\n[  667.125084][ T9805]  ? __pfx___x64_sys_getdents64+0x10/0x10\n[  667.125091][ T9805]  ? __x64_sys_openat+0x141/0x200\n[  667.125126][ T9805]  ? __pfx_filldir64+0x10/0x10\n[  667.125134][ T9805]  ? do_user_addr_fault+0x7fe/0x12f0\n[  667.125143][ T9805]  do_syscall_64+0xc9/0x480\n[  667.125151][ T9805]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9\n[  667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48\n[  667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9\n[  667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9\n[  667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004\n[  667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110\n[  667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260\n[  667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[  667.125207][ T9805]  </TASK>\n[  667.125210][ T9805]\n[  667.145632][ T9805] Allocated by task 9805:\n[  667.145991][ T9805]  kasan_save_stack+0x20/0x40\n[  667.146352][ T9805]  kasan_save_track+0x14/0x30\n[  667.146717][ T9805]  __kasan_kmalloc+0xaa/0xb0\n[  667.147065][ T9805]  __kmalloc_noprof+0x205/0x550\n[  667.147448][ T9805]  hfsplus_find_init+0x95/0x1f0\n[  667.147813][ T9805]  hfsplus_readdir+0x220/0xfc0\n[  667.148174][ T9805]  iterate_dir+0x296/0xb20\n[  667.148549][ T9805]  __x64_sys_getdents64+0x13c/0x2c0\n[  667.148937][ T9805]  do_syscall_64+0xc9/0x480\n[  667.149291][ T9805]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  667.149809][ T9805]\n[  667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000\n[  667.150030][ T9805]  which belongs to the cache kmalloc-2k of size 2048\n[  667.151282][ T9805] The buggy address is located 0 bytes to the right of\n[  667.151282][ T9805]  allocated 1036-byte region [ffff88802592f000, ffff88802592f40c)\n[  667.1\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b0b7a7cc-ba41-4470-ac7f-602b3683f337",  "id": "CVE-2021-47372",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47372"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: fix use after free on rmmod\n\nplat_dev->dev->platform_data is released by platform_device_unregister(),\nuse of pclk and hclk is a use-after-free. Since device unregister won't\nneed a clk device we adjust the function call sequence to fix this issue.\n\n[   31.261225] BUG: KASAN: use-after-free in macb_remove+0x77/0xc6 [macb_pci]\n[   31.275563] Freed by task 306:\n[   30.276782]  platform_device_release+0x25/0x80",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8b9182e-18de-4341-a4f1-f11cf381c7bb",  "id": "CVE-2022-49769",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Check sb_bsize_shift after reading superblock\n\nFuzzers like to scribble over sb_bsize_shift but in reality it's very\nunlikely that this field would be corrupted on its own. Nevertheless it\nshould be checked to avoid the possibility of messy mount errors due to\nbad calculations. It's always a fixed value based on the block size so\nwe can just check that it's the expected value.\n\nTested with:\n\n    mkfs.gfs2 -O -p lock_nolock /dev/vdb\n    for i in 0 -1 64 65 32 33; do\n        gfs2_edit -p sb field sb_bsize_shift $i /dev/vdb\n        mount /dev/vdb /mnt/test && umount /mnt/test\n    done\n\nBefore this patch we get a withdraw after\n\n[   76.413681] gfs2: fsid=loop0.0: fatal: invalid metadata block\n[   76.413681]   bh = 19 (type: exp=5, found=4)\n[   76.413681]   function = gfs2_meta_buffer, file = fs/gfs2/meta_io.c, line = 492\n\nand with UBSAN configured we also get complaints like\n\n[   76.373395] UBSAN: shift-out-of-bounds in fs/gfs2/ops_fstype.c:295:19\n[   76.373815] shift exponent 4294967287 is too large for 64-bit type 'long unsigned int'\n\nAfter the patch, these complaints don't appear, mount fails immediately\nand we get an explanation in dmesg.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1ada27af-ceb1-47a9-836a-80aa1d6f41a1",  "id": "CVE-2010-4162",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4162"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple integer overflows in fs/bio.c in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (system crash) via a crafted device ioctl to a SCSI device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2d88e45-27f9-486f-b012-b90a2d4b4613",  "id": "CVE-2024-26672",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'\n\nFixes the below:\n\ndrivers/gpu/drm/amd/amdgpu/amdgpu_mca.c:377 amdgpu_mca_smu_get_mca_entry() warn: variable dereferenced before check 'mca_funcs' (see line 368)\n\n357 int amdgpu_mca_smu_get_mca_entry(struct amdgpu_device *adev,\n\t\t\t\t     enum amdgpu_mca_error_type type,\n358                                  int idx, struct mca_bank_entry *entry)\n359 {\n360         const struct amdgpu_mca_smu_funcs *mca_funcs =\n\t\t\t\t\t\tadev->mca.mca_funcs;\n361         int count;\n362\n363         switch (type) {\n364         case AMDGPU_MCA_ERROR_TYPE_UE:\n365                 count = mca_funcs->max_ue_count;\n\nmca_funcs is dereferenced here.\n\n366                 break;\n367         case AMDGPU_MCA_ERROR_TYPE_CE:\n368                 count = mca_funcs->max_ce_count;\n\nmca_funcs is dereferenced here.\n\n369                 break;\n370         default:\n371                 return -EINVAL;\n372         }\n373\n374         if (idx >= count)\n375                 return -EINVAL;\n376\n377         if (mca_funcs && mca_funcs->mca_get_mca_entry)\n\t        ^^^^^^^^^\n\nChecked too late!",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dbe8a14f-9f1c-49a9-b128-36b690f0875d",  "id": "CVE-2017-17862",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17862"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b619991-3c20-41a8-ab32-10cf92594129",  "id": "CVE-2022-49264",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: Force single empty string when argv is empty\n\nQuoting[1] Ariadne Conill:\n\n\"In several other operating systems, it is a hard requirement that the\nsecond argument to execve(2) be the name of a program, thus prohibiting\na scenario where argc < 1. POSIX 2017 also recommends this behaviour,\nbut it is not an explicit requirement[2]:\n\n    The argument arg0 should point to a filename string that is\n    associated with the process being started by one of the exec\n    functions.\n...\nInterestingly, Michael Kerrisk opened an issue about this in 2008[3],\nbut there was no consensus to support fixing this issue then.\nHopefully now that CVE-2021-4034 shows practical exploitative use[4]\nof this bug in a shellcode, we can reconsider.\n\nThis issue is being tracked in the KSPP issue tracker[5].\"\n\nWhile the initial code searches[6][7] turned up what appeared to be\nmostly corner case tests, trying to that just reject argv == NULL\n(or an immediately terminated pointer list) quickly started tripping[8]\nexisting userspace programs.\n\nThe next best approach is forcing a single empty string into argv and\nadjusting argc to match. The number of programs depending on argc == 0\nseems a smaller set than those calling execve with a NULL argv.\n\nAccount for the additional stack space in bprm_stack_limits(). Inject an\nempty string when argc == 0 (and set argc = 1). Warn about the case so\nuserspace has some notice about the change:\n\n    process './argc0' launched './argc0' with NULL argv: empty string added\n\nAdditionally WARN() and reject NULL argv usage for kernel threads.\n\n[1] https://lore.kernel.org/lkml/20220127000724.15106-1-ariadne@dereferenced.org/\n[2] https://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html\n[3] https://bugzilla.kernel.org/show_bug.cgi?id=8408\n[4] https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt\n[5] https://github.com/KSPP/linux/issues/176\n[6] https://codesearch.debian.net/search?q=execve%5C+*%5C%28%5B%5E%2C%5D%2B%2C+*NULL&literal=0\n[7] https://codesearch.debian.net/search?q=execlp%3F%5Cs*%5C%28%5B%5E%2C%5D%2B%2C%5Cs*NULL&literal=0\n[8] https://lore.kernel.org/lkml/20220131144352.GE16385@xsang-OptiPlex-9020/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7809df69-af1d-4f38-8063-883a27aaa7ae",  "id": "CVE-2021-3347",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3347"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f63b27ea-f912-460b-9a91-904fb56a89f7",  "id": "CVE-2017-15102",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15102"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "628a3305-c823-49da-9f40-abe01ec339b8",  "id": "CVE-2018-5344",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5344"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified other impact.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e822570-01c7-488d-bf7b-00bc13e95233",  "id": "SUSE-SU-2022:2180-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f4b4a04-ec41-4f8f-ae66-0b1f5a175be6",  "id": "RLSA-2023:7877",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "363b09d0-7a0c-48a3-89af-e8753e690bcc",  "id": "CVE-2024-40943",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix races between hole punching and AIO+DIO\n\nAfter commit \"ocfs2: return real error code in ocfs2_dio_wr_get_block\",\nfstests/generic/300 become from always failed to sometimes failed:\n\n========================================================================\n[  473.293420 ] run fstests generic/300\n\n[  475.296983 ] JBD2: Ignoring recovery information on journal\n[  475.302473 ] ocfs2: Mounting device (253,1) on (node local, slot 0) with ordered data mode.\n[  494.290998 ] OCFS2: ERROR (device dm-1): ocfs2_change_extent_flag: Owner 5668 has an extent at cpos 78723 which can no longer be found\n[  494.291609 ] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.\n[  494.292018 ] OCFS2: File system is now read-only.\n[  494.292224 ] (kworker/19:11,2628,19):ocfs2_mark_extent_written:5272 ERROR: status = -30\n[  494.292602 ] (kworker/19:11,2628,19):ocfs2_dio_end_io_write:2374 ERROR: status = -3\nfio: io_u error on file /mnt/scratch/racer: Read-only file system: write offset=460849152, buflen=131072\n=========================================================================\n\nIn __blockdev_direct_IO, ocfs2_dio_wr_get_block is called to add unwritten\nextents to a list.  extents are also inserted into extent tree in\nocfs2_write_begin_nolock.  Then another thread call fallocate to puch a\nhole at one of the unwritten extent.  The extent at cpos was removed by\nocfs2_remove_extent().  At end io worker thread, ocfs2_search_extent_list\nfound there is no such extent at the cpos.\n\n    T1                        T2                T3\n                              inode lock\n                                ...\n                                insert extents\n                                ...\n                              inode unlock\nocfs2_fallocate\n __ocfs2_change_file_space\n  inode lock\n  lock ip_alloc_sem\n  ocfs2_remove_inode_range inode\n   ocfs2_remove_btree_range\n    ocfs2_remove_extent\n    ^---remove the extent at cpos 78723\n  ...\n  unlock ip_alloc_sem\n  inode unlock\n                                       ocfs2_dio_end_io\n                                        ocfs2_dio_end_io_write\n                                         lock ip_alloc_sem\n                                         ocfs2_mark_extent_written\n                                          ocfs2_change_extent_flag\n                                           ocfs2_search_extent_list\n                                           ^---failed to find extent\n                                          ...\n                                          unlock ip_alloc_sem\n\nIn most filesystems, fallocate is not compatible with racing with AIO+DIO,\nso fix it by adding to wait for all dio before fallocate/punch_hole like\next4.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e5c1c02d-8a84-4ef0-91eb-9b96ddabd61b",  "id": "CVE-2017-18249",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18249"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid, which allows local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6d3cdb28-6f35-4094-b15c-4faf7a57c3ce",  "id": "CVE-2025-38699",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bfa: Double-free fix\n\nWhen the bfad_im_probe() function fails during initialization, the memory\npointed to by bfad->im is freed without setting bfad->im to NULL.\n\nSubsequently, during driver uninstallation, when the state machine enters\nthe bfad_sm_stopping state and calls the bfad_im_probe_undo() function,\nit attempts to free the memory pointed to by bfad->im again, thereby\ntriggering a double-free vulnerability.\n\nSet bfad->im to NULL if probing fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7a9f451f-10a6-4062-beb5-fbb8644e5a32",  "id": "CVE-2019-15218",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15218"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/siano/smsusb.c driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f0cdcbb3-cff6-4a9a-b674-848d92626e36",  "id": "CVE-2026-31519",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create\n\nWe have recently observed a number of subvolumes with broken dentries.\nls-ing the parent dir looks like:\n\ndrwxrwxrwt 1 root root 16 Jan 23 16:49 .\ndrwxr-xr-x 1 root root 24 Jan 23 16:48 ..\nd????????? ? ?    ?     ?            ? broken_subvol\n\nand similarly stat-ing the file fails.\n\nIn this state, deleting the subvol fails with ENOENT, but attempting to\ncreate a new file or subvol over it errors out with EEXIST and even\naborts the fs. Which leaves us a bit stuck.\n\ndmesg contains a single notable error message reading:\n\"could not do orphan cleanup -2\"\n\n2 is ENOENT and the error comes from the failure handling path of\nbtrfs_orphan_cleanup(), with the stack leading back up to\nbtrfs_lookup().\n\nbtrfs_lookup\nbtrfs_lookup_dentry\nbtrfs_orphan_cleanup // prints that message and returns -ENOENT\n\nAfter some detailed inspection of the internal state, it became clear\nthat:\n- there are no orphan items for the subvol\n- the subvol is otherwise healthy looking, it is not half-deleted or\n  anything, there is no drop progress, etc.\n- the subvol was created a while ago and does the meaningful first\n  btrfs_orphan_cleanup() call that sets BTRFS_ROOT_ORPHAN_CLEANUP much\n  later.\n- after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns -ENOENT,\n  which results in a negative dentry for the subvolume via\n  d_splice_alias(NULL, dentry), leading to the observed behavior. The\n  bug can be mitigated by dropping the dentry cache, at which point we\n  can successfully delete the subvolume if we want.\n\ni.e.,\nbtrfs_lookup()\n  btrfs_lookup_dentry()\n    if (!sb_rdonly(inode->vfs_inode)->vfs_inode)\n    btrfs_orphan_cleanup(sub_root)\n      test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP)\n      btrfs_search_slot() // finds orphan item for inode N\n      ...\n      prints \"could not do orphan cleanup -2\"\n  if (inode == ERR_PTR(-ENOENT))\n    inode = NULL;\n  return d_splice_alias(NULL, dentry) // NEGATIVE DENTRY for valid subvolume\n\nbtrfs_orphan_cleanup() does test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP)\non the root when it runs, so it cannot run more than once on a given\nroot, so something else must run concurrently. However, the obvious\nroutes to deleting an orphan when nlinks goes to 0 should not be able to\nrun without first doing a lookup into the subvolume, which should run\nbtrfs_orphan_cleanup() and set the bit.\n\nThe final important observation is that create_subvol() calls\nd_instantiate_new() but does not set BTRFS_ROOT_ORPHAN_CLEANUP, so if\nthe dentry cache gets dropped, the next lookup into the subvolume will\nmake a real call into btrfs_orphan_cleanup() for the first time. This\nopens up the possibility of concurrently deleting the inode/orphan items\nbut most typical evict() paths will be holding a reference on the parent\ndentry (child dentry holds parent->d_lockref.count via dget in\nd_alloc(), released in __dentry_kill()) and prevent the parent from\nbeing removed from the dentry cache.\n\nThe one exception is delayed iputs. Ordered extent creation calls\nigrab() on the inode. If the file is unlinked and closed while those\nrefs are held, iput() in __dentry_kill() decrements i_count but does\nnot trigger eviction (i_count > 0). The child dentry is freed and the\nsubvol dentry's d_lockref.count drops to 0, making it evictable while\nthe inode is still alive.\n\nSince there are two races (the race between writeback and unlink and\nthe race between lookup and delayed iputs), and there are too many moving\nparts, the following three diagrams show the complete picture.\n(Only the second and third are races)\n\nPhase 1:\nCreate Subvol in dentry cache without BTRFS_ROOT_ORPHAN_CLEANUP set\n\nbtrfs_mksubvol()\n  lookup_one_len()\n    __lookup_slow()\n      d_alloc_parallel()\n        __d_alloc() // d_lockref.count = 1\n  create_subvol(dentry)\n    // doesn't touch the bit..\n    d_instantiate_new(dentry, inode) // dentry in cache with d_lockref.c\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "82ece896-318a-4451-93ee-98111dac88f0",  "id": "CVE-2022-49177",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwrng: cavium - fix NULL but dereferenced coccicheck error\n\nFix following coccicheck warning:\n./drivers/char/hw_random/cavium-rng-vf.c:182:17-20: ERROR:\npdev is NULL but dereferenced.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b9ac2c6a-70ee-4028-9d02-e6613cc3c1f5",  "id": "RHSA-2026:3364",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6a23107e-6a79-4c22-83e1-e109c9599961",  "id": "CVE-2011-1013",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1013"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer signedness error in the drm_modeset_ctl function in (1) drivers/gpu/drm/drm_irq.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.38 and (2) sys/dev/pci/drm/drm_irq.c in the kernel in OpenBSD before 4.9 allows local users to trigger out-of-bounds write operations, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via a crafted num_crtcs (aka vb_num) structure member in an ioctl argument.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8df252dc-f610-4c20-b757-b007c527399b",  "id": "OESA-2025-2485",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eef42707-5c19-4ff2-874a-e32cb08f3864",  "id": "CVE-2017-1000252",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000252"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20,    617  ],  "analysis": {    "state": "in_triage"  },  "description": "The KVM subsystem in the Linux kernel through 4.13.3 allows guest OS users to cause a denial of service (assertion failure, and hypervisor hang or crash) via an out-of bounds guest_irq value, related to arch/x86/kvm/vmx.c and virt/kvm/eventfd.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "367916b6-9d7e-42b5-ae16-970127083498",  "id": "CVE-2022-50328",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: fix potential use-after-free in jbd2_fc_wait_bufs\n\nIn 'jbd2_fc_wait_bufs' use 'bh' after put buffer head reference count\nwhich may lead to use-after-free.\nSo judge buffer if uptodate before put buffer head reference count.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bc2587ec-1b3b-4f00-a7e0-a73405a30de9",  "id": "RHSA-2020:5642",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a875b70-b3e3-4273-a0e2-5dddc27c8a37",  "id": "CVE-2021-27363",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27363"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "29a54d2c-3263-4582-abb6-bfc57457817c",  "id": "CVE-2023-52485",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wake DMCUB before sending a command\n\n[Why]\nWe can hang in place trying to send commands when the DMCUB isn't\npowered on.\n\n[How]\nFor functions that execute within a DC context or DC lock we can\nwrap the direct calls to dm_execute_dmub_cmd/list with code that\nexits idle power optimizations and reallows once we're done with\nthe command submission on success.\n\nFor DM direct submissions the DM will need to manage the enter/exit\nsequencing manually.\n\nWe cannot invoke a DMCUB command directly within the DM execution\nhelper or we can deadlock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "017d208e-feb7-4e1f-845a-8a9d1769e71c",  "id": "CVE-2026-31423",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_hfsc: fix divide-by-zero in rtsc_min()\n\nm2sm() converts a u32 slope to a u64 scaled value.  For large inputs\n(e.g. m1=4000000000), the result can reach 2^32.  rtsc_min() stores\nthe difference of two such u64 values in a u32 variable `dsm` and\nuses it as a divisor.  When the difference is exactly 2^32 the\ntruncation yields zero, causing a divide-by-zero oops in the\nconcave-curve intersection path:\n\n  Oops: divide error: 0000\n  RIP: 0010:rtsc_min (net/sched/sch_hfsc.c:601)\n  Call Trace:\n   init_ed (net/sched/sch_hfsc.c:629)\n   hfsc_enqueue (net/sched/sch_hfsc.c:1569)\n   [...]\n\nWiden `dsm` to u64 and replace do_div() with div64_u64() so the full\ndifference is preserved.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f82e0d57-c92e-4a1e-80ad-683e43d30b41",  "id": "CVE-2023-52606",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/lib: Validate size for vector operations\n\nSome of the fp/vmx code in sstep.c assume a certain maximum size for the\ninstructions being emulated. The size of those operations however is\ndetermined separately in analyse_instr().\n\nAdd a check to validate the assumption on the maximum size of the\noperations, so as to prevent any unintended kernel stack corruption.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "616c1142-51b2-404a-9ef9-aea7f742d8d7",  "id": "OESA-2022-1833",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "00353c59-1008-466c-9507-47a48665c3cc",  "id": "CVE-2010-4076",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4076"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The rs_ioctl function in drivers/char/amiserial.c in the Linux kernel 2.6.36.1 and earlier does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "34a77bbe-1db2-4d9e-a0f9-c906f5848790",  "id": "CVE-2024-41066",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmvnic: Add tx check to prevent skb leak\n\nBelow is a summary of how the driver stores a reference to an skb during\ntransmit:\n    tx_buff[free_map[consumer_index]]->skb = new_skb;\n    free_map[consumer_index] = IBMVNIC_INVALID_MAP;\n    consumer_index ++;\nWhere variable data looks like this:\n    free_map == [4, IBMVNIC_INVALID_MAP, IBMVNIC_INVALID_MAP, 0, 3]\n                                               \tconsumer_index^\n    tx_buff == [skb=null, skb=<ptr>, skb=<ptr>, skb=null, skb=null]\n\nThe driver has checks to ensure that free_map[consumer_index] pointed to\na valid index but there was no check to ensure that this index pointed\nto an unused/null skb address. So, if, by some chance, our free_map and\ntx_buff lists become out of sync then we were previously risking an\nskb memory leak. This could then cause tcp congestion control to stop\nsending packets, eventually leading to ETIMEDOUT.\n\nTherefore, add a conditional to ensure that the skb address is null. If\nnot then warn the user (because this is still a bug that should be\npatched) and free the old pointer to prevent memleak/tcp problems.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b571000f-969a-401a-b2a2-6db345faef66",  "id": "CVE-2011-4127",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4127"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 3.2.2 does not properly restrict SG_IO ioctl calls, which allows local users to bypass intended restrictions on disk read and write operations by sending a SCSI command to (1) a partition block device or (2) an LVM volume.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "348359e1-cc2e-41a9-b0ff-456ee06c3b9b",  "id": "CVE-2024-43900",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: xc2028: avoid use-after-free in load_firmware_cb()\n\nsyzkaller reported use-after-free in load_firmware_cb() [1].\nThe reason is because the module allocated a struct tuner in tuner_probe(),\nand then the module initialization failed, the struct tuner was released.\nA worker which created during module initialization accesses this struct\ntuner later, it caused use-after-free.\n\nThe process is as follows:\n\ntask-6504           worker_thread\ntuner_probe                             <= alloc dvb_frontend [2]\n...\nrequest_firmware_nowait                 <= create a worker\n...\ntuner_remove                            <= free dvb_frontend\n...\n                    request_firmware_work_func  <= the firmware is ready\n                    load_firmware_cb    <= but now the dvb_frontend has been freed\n\nTo fix the issue, check the dvd_frontend in load_firmware_cb(), if it is\nnull, report a warning and just return.\n\n[1]:\n    ==================================================================\n     BUG: KASAN: use-after-free in load_firmware_cb+0x1310/0x17a0\n     Read of size 8 at addr ffff8000d7ca2308 by task kworker/2:3/6504\n\n     Call trace:\n      load_firmware_cb+0x1310/0x17a0\n      request_firmware_work_func+0x128/0x220\n      process_one_work+0x770/0x1824\n      worker_thread+0x488/0xea0\n      kthread+0x300/0x430\n      ret_from_fork+0x10/0x20\n\n     Allocated by task 6504:\n      kzalloc\n      tuner_probe+0xb0/0x1430\n      i2c_device_probe+0x92c/0xaf0\n      really_probe+0x678/0xcd0\n      driver_probe_device+0x280/0x370\n      __device_attach_driver+0x220/0x330\n      bus_for_each_drv+0x134/0x1c0\n      __device_attach+0x1f4/0x410\n      device_initial_probe+0x20/0x30\n      bus_probe_device+0x184/0x200\n      device_add+0x924/0x12c0\n      device_register+0x24/0x30\n      i2c_new_device+0x4e0/0xc44\n      v4l2_i2c_new_subdev_board+0xbc/0x290\n      v4l2_i2c_new_subdev+0xc8/0x104\n      em28xx_v4l2_init+0x1dd0/0x3770\n\n     Freed by task 6504:\n      kfree+0x238/0x4e4\n      tuner_remove+0x144/0x1c0\n      i2c_device_remove+0xc8/0x290\n      __device_release_driver+0x314/0x5fc\n      device_release_driver+0x30/0x44\n      bus_remove_device+0x244/0x490\n      device_del+0x350/0x900\n      device_unregister+0x28/0xd0\n      i2c_unregister_device+0x174/0x1d0\n      v4l2_device_unregister+0x224/0x380\n      em28xx_v4l2_init+0x1d90/0x3770\n\n     The buggy address belongs to the object at ffff8000d7ca2000\n      which belongs to the cache kmalloc-2k of size 2048\n     The buggy address is located 776 bytes inside of\n      2048-byte region [ffff8000d7ca2000, ffff8000d7ca2800)\n     The buggy address belongs to the page:\n     page:ffff7fe00035f280 count:1 mapcount:0 mapping:ffff8000c001f000 index:0x0\n     flags: 0x7ff800000000100(slab)\n     raw: 07ff800000000100 ffff7fe00049d880 0000000300000003 ffff8000c001f000\n     raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000\n     page dumped because: kasan: bad access detected\n\n     Memory state around the buggy address:\n      ffff8000d7ca2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n      ffff8000d7ca2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n     >ffff8000d7ca2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                           ^\n      ffff8000d7ca2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n      ffff8000d7ca2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n     ==================================================================\n\n[2]\n    Actually, it is allocated for struct tuner, and dvb_frontend is inside.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a29099f-2335-4d6c-870f-3eb26e679a54",  "id": "CVE-2026-46191",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Avoid OOB font access if console rotation fails\n\nClear the font buffer if the reallocation during console rotation fails\nin fbcon_rotate_font(). The putcs implementations for the rotated buffer\nwill return early in this case. See [1] for an example.\n\nCurrently, fbcon_rotate_font() keeps the old buffer, which is too small\nfor the rotated font. Printing to the rotated console with a high-enough\ncharacter code will overflow the font buffer.\n\nv2:\n- fix typos in commit message",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3fbe02bd-5fb1-40f4-9331-dd65a8051f5b",  "id": "RHSA-2022:1091",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9e3a362-91fa-42a2-b39c-97c49c89bacb",  "id": "RHSA-2019:0483",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ad029e25-23b9-4b83-bd0b-20ebe190a235",  "id": "CVE-2024-35995",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: CPPC: Use access_width over bit_width for system memory accesses\n\nTo align with ACPI 6.3+, since bit_width can be any 8-bit value, it\ncannot be depended on to be always on a clean 8b boundary. This was\nuncovered on the Cobalt 100 platform.\n\nSError Interrupt on CPU26, code 0xbe000011 -- SError\n CPU: 26 PID: 1510 Comm: systemd-udevd Not tainted 5.15.2.1-13 #1\n Hardware name: MICROSOFT CORPORATION, BIOS MICROSOFT CORPORATION\n pstate: 62400009 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)\n pc : cppc_get_perf_caps+0xec/0x410\n lr : cppc_get_perf_caps+0xe8/0x410\n sp : ffff8000155ab730\n x29: ffff8000155ab730 x28: ffff0080139d0038 x27: ffff0080139d0078\n x26: 0000000000000000 x25: ffff0080139d0058 x24: 00000000ffffffff\n x23: ffff0080139d0298 x22: ffff0080139d0278 x21: 0000000000000000\n x20: ffff00802b251910 x19: ffff0080139d0000 x18: ffffffffffffffff\n x17: 0000000000000000 x16: ffffdc7e111bad04 x15: ffff00802b251008\n x14: ffffffffffffffff x13: ffff013f1fd63300 x12: 0000000000000006\n x11: ffffdc7e128f4420 x10: 0000000000000000 x9 : ffffdc7e111badec\n x8 : ffff00802b251980 x7 : 0000000000000000 x6 : ffff0080139d0028\n x5 : 0000000000000000 x4 : ffff0080139d0018 x3 : 00000000ffffffff\n x2 : 0000000000000008 x1 : ffff8000155ab7a0 x0 : 0000000000000000\n Kernel panic - not syncing: Asynchronous SError Interrupt\n CPU: 26 PID: 1510 Comm: systemd-udevd Not tainted\n5.15.2.1-13 #1\n Hardware name: MICROSOFT CORPORATION, BIOS MICROSOFT CORPORATION\n Call trace:\n  dump_backtrace+0x0/0x1e0\n  show_stack+0x24/0x30\n  dump_stack_lvl+0x8c/0xb8\n  dump_stack+0x18/0x34\n  panic+0x16c/0x384\n  add_taint+0x0/0xc0\n  arm64_serror_panic+0x7c/0x90\n  arm64_is_fatal_ras_serror+0x34/0xa4\n  do_serror+0x50/0x6c\n  el1h_64_error_handler+0x40/0x74\n  el1h_64_error+0x7c/0x80\n  cppc_get_perf_caps+0xec/0x410\n  cppc_cpufreq_cpu_init+0x74/0x400 [cppc_cpufreq]\n  cpufreq_online+0x2dc/0xa30\n  cpufreq_add_dev+0xc0/0xd4\n  subsys_interface_register+0x134/0x14c\n  cpufreq_register_driver+0x1b0/0x354\n  cppc_cpufreq_init+0x1a8/0x1000 [cppc_cpufreq]\n  do_one_initcall+0x50/0x250\n  do_init_module+0x60/0x27c\n  load_module+0x2300/0x2570\n  __do_sys_finit_module+0xa8/0x114\n  __arm64_sys_finit_module+0x2c/0x3c\n  invoke_syscall+0x78/0x100\n  el0_svc_common.constprop.0+0x180/0x1a0\n  do_el0_svc+0x84/0xa0\n  el0_svc+0x2c/0xc0\n  el0t_64_sync_handler+0xa4/0x12c\n  el0t_64_sync+0x1a4/0x1a8\n\nInstead, use access_width to determine the size and use the offset and\nwidth to shift and mask the bits to read/write out. Make sure to add a\ncheck for system memory since pcc redefines the access_width to\nsubspace id.\n\nIf access_width is not set, then fall back to using bit_width.\n\n[ rjw: Subject and changelog edits, comment adjustments ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "140beecc-e114-4ef2-af81-0e577da82fb5",  "id": "CVE-2021-47408",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47408"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: serialize hash resizes and cleanups\n\nSyzbot was able to trigger the following warning [1]\n\nNo repro found by syzbot yet but I was able to trigger similar issue\nby having 2 scripts running in parallel, changing conntrack hash sizes,\nand:\n\nfor j in `seq 1 1000` ; do unshare -n /bin/true >/dev/null ; done\n\nIt would take more than 5 minutes for net_namespace structures\nto be cleaned up.\n\nThis is because nf_ct_iterate_cleanup() has to restart everytime\na resize happened.\n\nBy adding a mutex, we can serialize hash resizes and cleanups\nand also make get_next_corpse() faster by skipping over empty\nbuckets.\n\nEven without resizes in the picture, this patch considerably\nspeeds up network namespace dismantles.\n\n[1]\nINFO: task syz-executor.0:8312 can't die for more than 144 seconds.\ntask:syz-executor.0  state:R  running task     stack:25672 pid: 8312 ppid:  6573 flags:0x00004006\nCall Trace:\n context_switch kernel/sched/core.c:4955 [inline]\n __schedule+0x940/0x26f0 kernel/sched/core.c:6236\n preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6408\n preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35\n __local_bh_enable_ip+0x109/0x120 kernel/softirq.c:390\n local_bh_enable include/linux/bottom_half.h:32 [inline]\n get_next_corpse net/netfilter/nf_conntrack_core.c:2252 [inline]\n nf_ct_iterate_cleanup+0x15a/0x450 net/netfilter/nf_conntrack_core.c:2275\n nf_conntrack_cleanup_net_list+0x14c/0x4f0 net/netfilter/nf_conntrack_core.c:2469\n ops_exit_list+0x10d/0x160 net/core/net_namespace.c:171\n setup_net+0x639/0xa30 net/core/net_namespace.c:349\n copy_net_ns+0x319/0x760 net/core/net_namespace.c:470\n create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110\n unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226\n ksys_unshare+0x445/0x920 kernel/fork.c:3128\n __do_sys_unshare kernel/fork.c:3202 [inline]\n __se_sys_unshare kernel/fork.c:3200 [inline]\n __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3200\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f63da68e739\nRSP: 002b:00007f63d7c05188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110\nRAX: ffffffffffffffda RBX: 00007f63da792f80 RCX: 00007f63da68e739\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000\nRBP: 00007f63da6e8cc4 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007f63da792f80\nR13: 00007fff50b75d3f R14: 00007f63d7c05300 R15: 0000000000022000\n\nShowing all locks held in the system:\n1 lock held by khungtaskd/27:\n #0: ffffffff8b980020 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446\n2 locks held by kworker/u4:2/153:\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]\n #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268\n #1: ffffc9000140fdb0 ((kfence_timer).work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272\n1 lock held by systemd-udevd/2970:\n1 lock held by in:imklog/6258:\n #0: ffff88807f970ff0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990\n3 locks held by kworker/1:6/8158:\n1 lock held by syz-executor.0/8312:\n2 locks held by kworker/u4:13/9320:\n1 lock held by\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9df672dd-f900-474f-84d6-d41c2147fd49",  "id": "CVE-2014-7841",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7841"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The sctp_process_param function in net/sctp/sm_make_chunk.c in the SCTP implementation in the Linux kernel before 3.17.4, when ASCONF is used, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a malformed INIT chunk.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b384b16d-281c-42c2-a43c-4f2cf9aa209f",  "id": "CVE-2024-42295",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: handle inconsistent state in nilfs_btnode_create_block()\n\nSyzbot reported that a buffer state inconsistency was detected in\nnilfs_btnode_create_block(), triggering a kernel bug.\n\nIt is not appropriate to treat this inconsistency as a bug; it can occur\nif the argument block address (the buffer index of the newly created\nblock) is a virtual block number and has been reallocated due to\ncorruption of the bitmap used to manage its allocation state.\n\nSo, modify nilfs_btnode_create_block() and its callers to treat it as a\npossible filesystem error, rather than triggering a kernel bug.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "146481dd-16ad-4e01-8ed5-95749b89573a",  "id": "CVE-2024-36969",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix division by zero in setup_dsc_config\n\nWhen slice_height is 0, the division by slice_height in the calculation\nof the number of slices will cause a division by zero driver crash. This\nleaves the kernel in a state that requires a reboot. This patch adds a\ncheck to avoid the division by zero.\n\nThe stack trace below is for the 6.8.4 Kernel. I reproduced the issue on\na Z16 Gen 2 Lenovo Thinkpad with a Apple Studio Display monitor\nconnected via Thunderbolt. The amdgpu driver crashed with this exception\nwhen I rebooted the system with the monitor connected.\n\nkernel: ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447)\nkernel: ? do_trap (arch/x86/kernel/traps.c:113 arch/x86/kernel/traps.c:154)\nkernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu\nkernel: ? do_error_trap (./arch/x86/include/asm/traps.h:58 arch/x86/kernel/traps.c:175)\nkernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu\nkernel: ? exc_divide_error (arch/x86/kernel/traps.c:194 (discriminator 2))\nkernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu\nkernel: ? asm_exc_divide_error (./arch/x86/include/asm/idtentry.h:548)\nkernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu\nkernel: dc_dsc_compute_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1109) amdgpu\n\nAfter applying this patch, the driver no longer crashes when the monitor\nis connected and the system is rebooted. I believe this is the same\nissue reported for 3113.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d1b1915-5dd3-4175-9239-f2d1f0a10a82",  "id": "CVE-2022-49321",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: treat all calls not a bcall when bc_serv is NULL\n\nWhen a rdma server returns a fault format reply, nfs v3 client may\ntreats it as a bcall when bc service is not exist.\n\nThe debug message at rpcrdma_bc_receive_call are,\n\n[56579.837169] RPC:       rpcrdma_bc_receive_call: callback XID\n00000001, length=20\n[56579.837174] RPC:       rpcrdma_bc_receive_call: 00 00 00 01 00 00 00\n00 00 00 00 00 00 00 00 00 00 00 00 04\n\nAfter that, rpcrdma_bc_receive_call will meets NULL pointer as,\n\n[  226.057890] BUG: unable to handle kernel NULL pointer dereference at\n00000000000000c8\n...\n[  226.058704] RIP: 0010:_raw_spin_lock+0xc/0x20\n...\n[  226.059732] Call Trace:\n[  226.059878]  rpcrdma_bc_receive_call+0x138/0x327 [rpcrdma]\n[  226.060011]  __ib_process_cq+0x89/0x170 [ib_core]\n[  226.060092]  ib_cq_poll_work+0x26/0x80 [ib_core]\n[  226.060257]  process_one_work+0x1a7/0x360\n[  226.060367]  ? create_worker+0x1a0/0x1a0\n[  226.060440]  worker_thread+0x30/0x390\n[  226.060500]  ? create_worker+0x1a0/0x1a0\n[  226.060574]  kthread+0x116/0x130\n[  226.060661]  ? kthread_flush_work_fn+0x10/0x10\n[  226.060724]  ret_from_fork+0x35/0x40\n...",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eb1e51db-2c36-49bf-a925-f91916f20452",  "id": "CVE-2018-1000517",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000517"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f964d3e3-aa2a-4c56-86b9-045a0b71a643",  "id": "CVE-2020-28374",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28374"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    22  ],  "analysis": {    "state": "in_triage"  },  "description": "In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6430c045-747b-4bcc-86ca-46e068fc0fc0",  "id": "CVE-2017-7487",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7487"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2175cc94-84e6-48d7-a3c4-9681d2347f65",  "id": "CVE-2023-54321",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: fix potential null-ptr-deref in device_add()\n\nI got the following null-ptr-deref report while doing fault injection test:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000058\nCPU: 2 PID: 278 Comm: 37-i2c-ds2482 Tainted: G    B   W        N 6.1.0-rc3+\nRIP: 0010:klist_put+0x2d/0xd0\nCall Trace:\n <TASK>\n klist_remove+0xf1/0x1c0\n device_release_driver_internal+0x196/0x210\n bus_remove_device+0x1bd/0x240\n device_add+0xd3d/0x1100\n w1_add_master_device+0x476/0x490 [wire]\n ds2482_probe+0x303/0x3e0 [ds2482]\n\nThis is how it happened:\n\nw1_alloc_dev()\n  // The dev->driver is set to w1_master_driver.\n  memcpy(&dev->dev, device, sizeof(struct device));\n  device_add()\n    bus_add_device()\n    dpm_sysfs_add() // It fails, calls bus_remove_device.\n\n    // error path\n    bus_remove_device()\n      // The dev->driver is not null, but driver is not bound.\n      __device_release_driver()\n        klist_remove(&dev->p->knode_driver) <-- It causes null-ptr-deref.\n\n    // normal path\n    bus_probe_device() // It's not called yet.\n      device_bind_driver()\n\nIf dev->driver is set, in the error path after calling bus_add_device()\nin device_add(), bus_remove_device() is called, then the device will be\ndetached from driver. But device_bind_driver() is not called yet, so it\ncauses null-ptr-deref while access the 'knode_driver'. To fix this, set\ndev->driver to null in the error path before calling bus_remove_device().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "828ca360-6798-4009-980d-e73e4d9d9d71",  "id": "CVE-2023-52436",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: explicitly null-terminate the xattr list\n\nWhen setting an xattr, explicitly null-terminate the xattr list.  This\neliminates the fragile assumption that the unused xattr space is always\nzeroed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "16f2b1cb-07bd-44cb-b3d7-4e9c4793914e",  "id": "CVE-2024-42129",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: mlxreg: Use devm_mutex_init() for mutex initialization\n\nIn this driver LEDs are registered using devm_led_classdev_register()\nso they are automatically unregistered after module's remove() is done.\nled_classdev_unregister() calls module's led_set_brightness() to turn off\nthe LEDs and that callback uses mutex which was destroyed already\nin module's remove() so use devm API instead.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "88bdcd2c-2f5f-4e6b-9452-5c4d99466300",  "id": "CVE-2018-12633",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12633"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header part of the user data is double-fetched, and a malicious user thread can tamper with the critical variables (hdr.size_in and hdr.size_out) in the header between the two fetches because of a race condition, leading to severe kernel errors, such as buffer over-accesses. This bug can cause a local denial of service and information leakage.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fd7dae28-515d-4764-97c2-9f5076caf882",  "id": "CVE-2025-39827",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rose: include node references in rose_neigh refcount\n\nCurrent implementation maintains two separate reference counting\nmechanisms: the 'count' field in struct rose_neigh tracks references from\nrose_node structures, while the 'use' field (now refcount_t) tracks\nreferences from rose_sock.\n\nThis patch merges these two reference counting systems using 'use' field\nfor proper reference management. Specifically, this patch adds incrementing\nand decrementing of rose_neigh->use when rose_neigh->count is incremented\nor decremented.\n\nThis patch also modifies rose_rt_free(), rose_rt_device_down() and\nrose_clear_route() to properly release references to rose_neigh objects\nbefore freeing a rose_node through rose_remove_node().\n\nThese changes ensure rose_neigh structures are properly freed only when\nall references, including those from rose_node structures, are released.\nAs a result, this resolves a slab-use-after-free issue reported by Syzbot.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "29d4b3ac-9d46-4ffe-a4ce-de4bf96a7b2d",  "id": "CVE-2022-49727",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix signed integer overflow in l2tp_ip6_sendmsg\n\nWhen len >= INT_MAX - transhdrlen, ulen = len + transhdrlen will be\noverflow. To fix, we can follow what udpv6 does and subtract the\ntranshdrlen from the max.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1055eb35-4236-481d-98ea-d5103f13e83c",  "id": "SUSE-SU-2025:03271-2",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2a7542f6-6192-4709-af75-3a242e4dbf9a",  "id": "CVE-2025-38044",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx231xx: set device_caps for 417\n\nThe video_device for the MPEG encoder did not set device_caps.\n\nAdd this, otherwise the video device can't be registered (you get a\nWARN_ON instead).\n\nNot seen before since currently 417 support is disabled, but I found\nthis while experimenting with it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a6d79e2-958e-499c-bb93-6b9f85b09fc9",  "id": "CVE-2022-49939",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF of ref->proc caused by race condition\n\nA transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the\nreference for a node. In this case, the target proc normally releases\nthe failed reference upon close as expected. However, if the target is\ndying in parallel the call will race with binder_deferred_release(), so\nthe target could have released all of its references by now leaving the\ncleanup of the new failed reference unhandled.\n\nThe transaction then ends and the target proc gets released making the\nref->proc now a dangling pointer. Later on, ref->node is closed and we\nattempt to take spin_lock(&ref->proc->inner_lock), which leads to the\nuse-after-free bug reported below. Let's fix this by cleaning up the\nfailed reference on the spot instead of relying on the target to do so.\n\n  ==================================================================\n  BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150\n  Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590\n\n  CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10\n  Hardware name: linux,dummy-virt (DT)\n  Workqueue: events binder_deferred_func\n  Call trace:\n   dump_backtrace.part.0+0x1d0/0x1e0\n   show_stack+0x18/0x70\n   dump_stack_lvl+0x68/0x84\n   print_report+0x2e4/0x61c\n   kasan_report+0xa4/0x110\n   kasan_check_range+0xfc/0x1a4\n   __kasan_check_write+0x3c/0x50\n   _raw_spin_lock+0xa8/0x150\n   binder_deferred_func+0x5e0/0x9b0\n   process_one_work+0x38c/0x5f0\n   worker_thread+0x9c/0x694\n   kthread+0x188/0x190\n   ret_from_fork+0x10/0x20",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b02c49a2-52fb-474b-88fb-b72acd939ffe",  "id": "CVE-2023-53373",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: seqiv - Handle EBUSY correctly\n\nAs it is seqiv only handles the special return value of EINPROGERSS,\nwhich means that in all other cases it will free data related to the\nrequest.\n\nHowever, as the caller of seqiv may specify MAY_BACKLOG, we also need\nto expect EBUSY and treat it in the same way.  Otherwise backlogged\nrequests will trigger a use-after-free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eaf8a017-c5a8-4e47-8093-0fc141593972",  "id": "CVE-2024-35998",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: fix lock ordering potential deadlock in cifs_sync_mid_result\n\nCoverity spotted that the cifs_sync_mid_result function could deadlock\n\n\"Thread deadlock (ORDER_REVERSAL) lock_order: Calling spin_lock acquires\nlock TCP_Server_Info.srv_lock while holding lock TCP_Server_Info.mid_lock\"\n\nAddresses-Coverity: 1590401 (\"Thread deadlock (ORDER_REVERSAL)\")",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0c3bff7d-c8d2-451f-88e1-1056e5b57ede",  "id": "CVE-2020-12826",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12826"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because exec_id in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a do_notify_parent protection mechanism. A child process can send an arbitrary signal to a parent process in a different security domain. Exploitation limitations include the amount of elapsed time before an integer overflow occurs, and the lack of scenarios where signals to a parent process present a substantial operational threat.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "67b1694a-7f81-4e17-97c9-f573011934d5",  "id": "CVE-2017-11176",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11176"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:45553'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:149707/Linux-Kernel-mq_notify-double-sock_put-Local-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "00ae1c62-5434-4b1c-aa5b-a0294c55c767",  "id": "CVE-2013-2017",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2017"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion, which allows remote attackers to cause a denial of service (system crash) by leveraging lack of skb consumption in conjunction with a double-free error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae27c990-1cbd-4014-bdae-18d468532f9b",  "id": "DSA-2162-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99f40867-9969-408b-a73e-fb17c614291e",  "id": "SUSE-SU-2019:0803-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e80065c-ffc9-4e32-b5bd-6ee8c26f414a",  "id": "CVE-2017-1000363",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000363"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is static, a 'secure boot' kernel command line adversary (can happen due to bootloader vulns, e.g. Google Nexus 6's CVE-2016-10277, where due to a vulnerability the adversary has partial control over the command line) can overflow the parport_nr array in the following code, by appending many (>LP_NO) 'lp=none' arguments to the command line.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "34d6b1c8-2c47-41be-9723-e66e9bf2ad4c",  "id": "AZL-33492",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45234a03-6da0-4cb2-9211-309c39fa0212",  "id": "CVE-2024-26647",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix late derefrence 'dsc' check in 'link_set_dsc_pps_packet()'\n\nIn link_set_dsc_pps_packet(), 'struct display_stream_compressor *dsc'\nwas dereferenced in a DC_LOGGER_INIT(dsc->ctx->logger); before the 'dsc'\nNULL pointer check.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/link/link_dpms.c:905 link_set_dsc_pps_packet() warn: variable dereferenced before check 'dsc' (see line 903)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7cd09311-b2c6-4e04-a471-bb7fb6f333ba",  "id": "CVE-2024-47141",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinmux: Use sequential access to access desc->pinmux data\n\nWhen two client of the same gpio call pinctrl_select_state() for the\nsame functionality, we are seeing NULL pointer issue while accessing\ndesc->mux_owner.\n\nLet's say two processes A, B executing in pin_request() for the same pin\nand process A updates the desc->mux_usecount but not yet updated the\ndesc->mux_owner while process B see the desc->mux_usecount which got\nupdated by A path and further executes strcmp and while accessing\ndesc->mux_owner it crashes with NULL pointer.\n\nSerialize the access to mux related setting with a mutex lock.\n\n\tcpu0 (process A)\t\t\tcpu1(process B)\n\npinctrl_select_state() {\t\t  pinctrl_select_state() {\n  pin_request() {\t\t\t\tpin_request() {\n  ...\n\t\t\t\t\t\t ....\n    } else {\n         desc->mux_usecount++;\n    \t\t\t\t\t\tdesc->mux_usecount && strcmp(desc->mux_owner, owner)) {\n\n         if (desc->mux_usecount > 1)\n               return 0;\n         desc->mux_owner = owner;\n\n  }\t\t\t\t\t\t}",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a0acd205-608e-4c91-93ed-a1ff692c15d8",  "id": "RHSA-2022:1077",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b960c2ee-7bd7-4c99-a5c1-b7d0c7fd08c8",  "id": "CVE-2017-13084",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13084"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    323,    330  ],  "analysis": {    "state": "in_triage"  },  "description": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9061b8a9-52da-40d5-ba53-a00c41f1e63c",  "id": "CVE-2015-3636",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3636"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0da0c589-084c-4f60-8e19-f6ddd8149dbd",  "id": "CLSA-2024-1718291413",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "438093bf-39fd-46a5-8cea-2fe96729feeb",  "id": "CVE-2024-49900",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix uninit-value access of new_ea in ea_buffer\n\nsyzbot reports that lzo1x_1_do_compress is using uninit-value:\n\n=====================================================\nBUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178\n\n...\n\nUninit was stored to memory at:\n ea_put fs/jfs/xattr.c:639 [inline]\n\n...\n\nLocal variable ea_buf created at:\n __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662\n __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934\n\n=====================================================\n\nThe reason is ea_buf->new_ea is not initialized properly.\n\nFix this by using memset to empty its content at the beginning\nin ea_get().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ccf4f865-fffd-4196-a233-adb4717601e9",  "id": "CVE-2024-46822",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry\n\nIn a review discussion of the changes to support vCPU hotplug where\na check was added on the GICC being enabled if was online, it was\nnoted that there is need to map back to the cpu and use that to index\ninto a cpumask. As such, a valid ID is needed.\n\nIf an MPIDR check fails in acpi_map_gic_cpu_interface() it is possible\nfor the entry in cpu_madt_gicc[cpu] == NULL.  This function would\nthen cause a NULL pointer dereference.   Whilst a path to trigger\nthis has not been established, harden this caller against the\npossibility.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b36b2cf-0b9f-4094-8821-f628f39c7658",  "id": "CVE-2024-43912",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: disallow setting special AP channel widths\n\nSetting the AP channel width is meant for use with the normal\n20/40/... MHz channel width progression, and switching around\nin S1G or narrow channels isn't supported. Disallow that.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2ddf226-3dd0-4101-8fe7-473ff742aad1",  "id": "CVE-2023-52622",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid online resizing failures due to oversized flex bg\n\nWhen we online resize an ext4 filesystem with a oversized flexbg_size,\n\n     mkfs.ext4 -F -G 67108864 $dev -b 4096 100M\n     mount $dev $dir\n     resize2fs $dev 16G\n\nthe following WARN_ON is triggered:\n==================================================================\nWARNING: CPU: 0 PID: 427 at mm/page_alloc.c:4402 __alloc_pages+0x411/0x550\nModules linked in: sg(E)\nCPU: 0 PID: 427 Comm: resize2fs Tainted: G  E  6.6.0-rc5+ #314\nRIP: 0010:__alloc_pages+0x411/0x550\nCall Trace:\n <TASK>\n __kmalloc_large_node+0xa2/0x200\n __kmalloc+0x16e/0x290\n ext4_resize_fs+0x481/0xd80\n __ext4_ioctl+0x1616/0x1d90\n ext4_ioctl+0x12/0x20\n __x64_sys_ioctl+0xf0/0x150\n do_syscall_64+0x3b/0x90\n==================================================================\n\nThis is because flexbg_size is too large and the size of the new_group_data\narray to be allocated exceeds MAX_ORDER. Currently, the minimum value of\nMAX_ORDER is 8, the minimum value of PAGE_SIZE is 4096, the corresponding\nmaximum number of groups that can be allocated is:\n\n (PAGE_SIZE << MAX_ORDER) / sizeof(struct ext4_new_group_data) ≈ 21845\n\nAnd the value that is down-aligned to the power of 2 is 16384. Therefore,\nthis value is defined as MAX_RESIZE_BG, and the number of groups added\neach time does not exceed this value during resizing, and is added multiple\ntimes to complete the online resizing. The difference is that the metadata\nin a flex_bg may be more dispersed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b07c0208-555e-493d-82cc-29b950ae81fb",  "id": "CVE-2011-4087",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4087"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    665  ],  "analysis": {    "state": "in_triage"  },  "description": "The br_parse_ip_options function in net/bridge/br_netfilter.c in the Linux kernel before 2.6.39 does not properly initialize a certain data structure, which allows remote attackers to cause a denial of service by leveraging connectivity to a network interface that uses an Ethernet bridge device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b582d1f9-c838-41be-9d73-1b6a584fa759",  "id": "CVE-2023-3159",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3159"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "55c0bcec-931d-4afa-acd1-35ae22bc27b8",  "id": "OESA-2025-1855",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "83effb50-b563-4c56-946f-aabe6f3f6b0e",  "id": "SUSE-SU-2017:0461-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fcbd1a8f-c360-47c2-b62e-19a6059d8255",  "id": "CVE-2022-50020",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    1284  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid resizing to a partial cluster size\n\nThis patch avoids an attempt to resize the filesystem to an\nunaligned cluster boundary.  An online resize to a size that is not\nintegral to cluster size results in the last iteration attempting to\ngrow the fs by a negative amount, which trips a BUG_ON and leaves the fs\nwith a corrupted in-memory superblock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fabb1d39-353a-4fb2-9707-51346d6af598",  "id": "CVE-2024-44949",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: fix a possible DMA corruption\n\nARCH_DMA_MINALIGN was defined as 16 - this is too small - it may be\npossible that two unrelated 16-byte allocations share a cache line. If\none of these allocations is written using DMA and the other is written\nusing cached write, the value that was written with DMA may be\ncorrupted.\n\nThis commit changes ARCH_DMA_MINALIGN to be 128 on PA20 and 32 on PA1.1 -\nthat's the largest possible cache line size.\n\nAs different parisc microarchitectures have different cache line size, we\ndefine arch_slab_minalign(), cache_line_size() and\ndma_get_cache_alignment() so that the kernel may tune slab cache\nparameters dynamically, based on the detected cache line size.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eb5ab726-4eeb-44a5-9513-85b42bee075f",  "id": "CVE-2013-7264",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7264"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1dcbcae3-4a02-41ad-ab7a-fc4444e09d79",  "id": "CVE-2012-4398",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4398"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "816c41cc-f2d0-4f8d-a41c-18d8a5f9a81f",  "id": "CVE-2013-1979",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1979"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95be4b00-ef54-4c7b-9ad6-2fd4a2479741",  "id": "CVE-2013-4205",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4205"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in the unshare_userns function in kernel/user_namespace.c in the Linux kernel before 3.10.6 allows local users to cause a denial of service (memory consumption) via an invalid CLONE_NEWUSER unshare call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c7f73bb7-ee2c-49b6-be66-0ad870a6d462",  "id": "CVE-2016-4580",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4580"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9575a70f-65c4-4bd6-b9f6-cf5ab12bf347",  "id": "CVE-2026-43209",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nminix: Add required sanity checking to minix_check_superblock()\n\nThe fs/minix implementation of the minix filesystem does not currently\nsupport any other value for s_log_zone_size than 0. This is also the\nonly value supported in util-linux; see mkfs.minix.c line 511. In\naddition, this patch adds some sanity checking for the other minix\nsuperblock fields, and moves the minix_blocks_needed() checks for the\nzmap and imap also to minix_check_super_block().\n\nThis also closes a related syzbot bug report.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8e8bc382-ea89-4496-82d3-12be8b89e41e",  "id": "CVE-2022-50097",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: s3fb: Check the size of screen before memset_io()\n\nIn the function s3fb_set_par(), the value of 'screen_size' is\ncalculated by the user input. If the user provides the improper value,\nthe value of 'screen_size' may larger than 'info->screen_size', which\nmay cause the following bug:\n\n[   54.083733] BUG: unable to handle page fault for address: ffffc90003000000\n[   54.083742] #PF: supervisor write access in kernel mode\n[   54.083744] #PF: error_code(0x0002) - not-present page\n[   54.083760] RIP: 0010:memset_orig+0x33/0xb0\n[   54.083782] Call Trace:\n[   54.083788]  s3fb_set_par+0x1ec6/0x4040\n[   54.083806]  fb_set_var+0x604/0xeb0\n[   54.083836]  do_fb_ioctl+0x234/0x670\n\nFix the this by checking the value of 'screen_size' before memset_io().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f6e5cb9f-ffb2-4fb6-9a7b-f8e33b1c929d",  "id": "CVE-2022-48741",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix NULL pointer dereference in copy up warning\n\nThis patch is fixing a NULL pointer dereference to get a recently\nintroduced warning message working.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ffb48c5-fee0-41f2-b789-0daf41b9583d",  "id": "CVE-2022-2602",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2602"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "io_uring UAF, Unix SCM garbage collection",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:176533/Linux-Broken-Unix-GC-Interaction-Use-After-Free.html'"    }  ]},{  "bom-ref": "34e315cf-8f6e-4d12-8dc2-72491f6edcca",  "id": "CVE-2022-3344",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3344"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    440  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel panic in the host (L0).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9c82cff-9dc9-454f-b523-16338d0ad621",  "id": "CVE-2024-26851",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: Add protection for bmp length out of range\n\nUBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts\nthat are out of bounds for their data type.\n\nvmlinux   get_bitmap(b=75) + 712\n<net/netfilter/nf_conntrack_h323_asn1.c:0>\nvmlinux   decode_seq(bs=0xFFFFFFD008037000, f=0xFFFFFFD008037018, level=134443100) + 1956\n<net/netfilter/nf_conntrack_h323_asn1.c:592>\nvmlinux   decode_choice(base=0xFFFFFFD0080370F0, level=23843636) + 1216\n<net/netfilter/nf_conntrack_h323_asn1.c:814>\nvmlinux   decode_seq(f=0xFFFFFFD0080371A8, level=134443500) + 812\n<net/netfilter/nf_conntrack_h323_asn1.c:576>\nvmlinux   decode_choice(base=0xFFFFFFD008037280, level=0) + 1216\n<net/netfilter/nf_conntrack_h323_asn1.c:814>\nvmlinux   DecodeRasMessage() + 304\n<net/netfilter/nf_conntrack_h323_asn1.c:833>\nvmlinux   ras_help() + 684\n<net/netfilter/nf_conntrack_h323_main.c:1728>\nvmlinux   nf_confirm() + 188\n<net/netfilter/nf_conntrack_proto.c:137>\n\nDue to abnormal data in skb->data, the extension bitmap length\nexceeds 32 when decoding ras message then uses the length to make\na shift operation. It will change into negative after several loop.\nUBSAN load could detect a negative shift as an undefined behaviour\nand reports exception.\nSo we add the protection to avoid the length exceeding 32. Or else\nit will return out of range error and stop decoding.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd7c1267-ed26-4f5c-9f41-c3147b75276f",  "id": "SUSE-SU-2018:0902-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b7b46a96-73e5-4036-8881-01814a3bd0aa",  "id": "CVE-2017-3735",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3735"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04ce8a05-e408-4951-baa4-e165b7a4874e",  "id": "CVE-2022-41848",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41848"  },  "ratings": [    {      "score": 4.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race condition between mgslpc_ioctl and mgslpc_detach.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "187b5970-696b-497a-a7f1-cc036624936d",  "id": "AZL-43309",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dcef1fbb-9add-44e0-84d8-81c9c2340aef",  "id": "CVE-2011-4611",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4611"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the perf_event_interrupt function in arch/powerpc/kernel/perf_event.c in the Linux kernel before 2.6.39 on powerpc platforms allows local users to cause a denial of service (unhandled performance monitor exception) via vectors that trigger certain outcomes of performance events.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6752d2af-1cf3-4351-93e3-73921e54136f",  "id": "CVE-2018-5953",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5953"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The swiotlb_print_info function in lib/swiotlb.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dmesg data from a \"software IO TLB\" printk call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "81bc5e8a-7cd1-4c4b-9513-da4845382f08",  "id": "CVE-2012-6548",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6548"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1df8c9ed-a197-4e8f-9e9d-c9d992d2b962",  "id": "CVE-2023-53346",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernel/fail_function: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "244f1223-aa95-40bb-a189-6e1820f32255",  "id": "CVE-2023-46343",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46343"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9e08c67a-be1f-458b-a3f7-2d8504dba0c0",  "id": "CLSA-2026-1771237525",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aee0c8dd-c4d8-4b7b-a75f-a017b854c434",  "id": "CVE-2011-0695",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0695"  },  "ratings": [    {      "score": 5.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the cm_work_handler function in the InfiniBand driver (drivers/infiniband/core/cma.c) in Linux kernel 2.6.x allows remote attackers to cause a denial of service (panic) by sending an InfiniBand request while other request handlers are still running, which triggers an invalid pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "06e9de93-2958-4c32-b120-a2057d6606b8",  "id": "RUSTSEC-2023-0044",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4617996b-46b0-4e34-bca9-20709d6fa0e8",  "id": "CVE-2019-19525",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19525"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.3.6, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver, aka CID-7fd25e6fc035.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "03bd1931-7aec-490b-b5eb-9d078adffc78",  "id": "CVE-2024-49867",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: wait for fixup workers before stopping cleaner kthread during umount\n\nDuring unmount, at close_ctree(), we have the following steps in this order:\n\n1) Park the cleaner kthread - this doesn't destroy the kthread, it basically\n   halts its execution (wake ups against it work but do nothing);\n\n2) We stop the cleaner kthread - this results in freeing the respective\n   struct task_struct;\n\n3) We call btrfs_stop_all_workers() which waits for any jobs running in all\n   the work queues and then free the work queues.\n\nSyzbot reported a case where a fixup worker resulted in a crash when doing\na delayed iput on its inode while attempting to wake up the cleaner at\nbtrfs_add_delayed_iput(), because the task_struct of the cleaner kthread\nwas already freed. This can happen during unmount because we don't wait\nfor any fixup workers still running before we call kthread_stop() against\nthe cleaner kthread, which stops and free all its resources.\n\nFix this by waiting for any fixup workers at close_ctree() before we call\nkthread_stop() against the cleaner and run pending delayed iputs.\n\nThe stack traces reported by syzbot were the following:\n\n  BUG: KASAN: slab-use-after-free in __lock_acquire+0x77/0x2050 kernel/locking/lockdep.c:5065\n  Read of size 8 at addr ffff8880272a8a18 by task kworker/u8:3/52\n\n  CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.12.0-rc1-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n  Workqueue: btrfs-fixup btrfs_work_helper\n  Call Trace:\n   <TASK>\n   __dump_stack lib/dump_stack.c:94 [inline]\n   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n   print_address_description mm/kasan/report.c:377 [inline]\n   print_report+0x169/0x550 mm/kasan/report.c:488\n   kasan_report+0x143/0x180 mm/kasan/report.c:601\n   __lock_acquire+0x77/0x2050 kernel/locking/lockdep.c:5065\n   lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825\n   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n   _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162\n   class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]\n   try_to_wake_up+0xb0/0x1480 kernel/sched/core.c:4154\n   btrfs_writepage_fixup_worker+0xc16/0xdf0 fs/btrfs/inode.c:2842\n   btrfs_work_helper+0x390/0xc50 fs/btrfs/async-thread.c:314\n   process_one_work kernel/workqueue.c:3229 [inline]\n   process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310\n   worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n   kthread+0x2f0/0x390 kernel/kthread.c:389\n   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n   </TASK>\n\n  Allocated by task 2:\n   kasan_save_stack mm/kasan/common.c:47 [inline]\n   kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n   unpoison_slab_object mm/kasan/common.c:319 [inline]\n   __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345\n   kasan_slab_alloc include/linux/kasan.h:247 [inline]\n   slab_post_alloc_hook mm/slub.c:4086 [inline]\n   slab_alloc_node mm/slub.c:4135 [inline]\n   kmem_cache_alloc_node_noprof+0x16b/0x320 mm/slub.c:4187\n   alloc_task_struct_node kernel/fork.c:180 [inline]\n   dup_task_struct+0x57/0x8c0 kernel/fork.c:1107\n   copy_process+0x5d1/0x3d50 kernel/fork.c:2206\n   kernel_clone+0x223/0x880 kernel/fork.c:2787\n   kernel_thread+0x1bc/0x240 kernel/fork.c:2849\n   create_kthread kernel/kthread.c:412 [inline]\n   kthreadd+0x60d/0x810 kernel/kthread.c:765\n   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\n  Freed by task 61:\n   kasan_save_stack mm/kasan/common.c:47 [inline]\n   kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n   kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579\n   poison_slab_object mm/kasan/common.c:247 [inline]\n   __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n   kasan_slab_free include/linux/kasan.h:230 [inline]\n   slab_free_h\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1de779e0-9e73-4b33-9b84-cc99dfd3790e",  "id": "CVE-2023-52620",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: disallow timeout for anonymous sets\n\nNever used from userspace, disallow these parameters.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b5155b09-5311-42fc-aff4-873b7855d2f7",  "id": "CVE-2017-7472",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7472"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    404  ],  "analysis": {    "state": "in_triage"  },  "description": "The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:42136'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:142871/Linux-Kernel-keyctl_set_reqkey_keyring-Denial-Of-Service.html'"    }  ]},{  "bom-ref": "805a3a74-3598-4501-9fd4-bdb35fbec585",  "id": "CVE-2024-36911",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhv_netvsc: Don't free decrypted memory\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nThe netvsc driver could free decrypted/shared pages if\nset_memory_decrypted() fails. Check the decrypted field in the gpadl\nto decide whether to free the memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1ac96e3e-11a3-4799-9f3b-c5e2ff374180",  "id": "CVE-2024-49930",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix array out-of-bound access in SoC stats\n\nCurrently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a\nmaximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx()\nfunction access ath11k_soc_dp_stats::hal_reo_error using the REO\ndestination SRNG ring ID, which is incorrect. SRNG ring ID differ from\nnormal ring ID, and this usage leads to out-of-bounds array access. To fix\nthis issue, modify ath11k_dp_process_rx() to use the normal ring ID\ndirectly instead of the SRNG ring ID to avoid out-of-bounds array access.\n\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d7c50d4-7406-4e20-982d-b022d4727f21",  "id": "CVE-2016-2550",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2550"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-4312.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "28108d18-fa2d-499d-9712-71db676c1f93",  "id": "CVE-2012-6689",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6689"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    284  ],  "analysis": {    "state": "in_triage"  },  "description": "The netlink_sendmsg function in net/netlink/af_netlink.c in the Linux kernel before 3.5.5 does not validate the dst_pid field, which allows local users to have an unspecified impact by spoofing Netlink messages.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ac7b24e-0649-40ab-9c83-cfcdfe237c2c",  "id": "CVE-2024-26772",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()\n\nPlaces the logic for checking if the group's block bitmap is corrupt under\nthe protection of the group lock to avoid allocating blocks from the group\nwith a corrupted block bitmap.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "358485f9-aa92-4e4e-9f5f-34eb1581bff7",  "id": "CVE-2026-31582",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (powerz) Fix use-after-free on USB disconnect\n\nAfter powerz_disconnect() frees the URB and releases the mutex, a\nsubsequent powerz_read() call can acquire the mutex and call\npowerz_read_data(), which dereferences the freed URB pointer.\n\nFix by:\n - Setting priv->urb to NULL in powerz_disconnect() so that\n   powerz_read_data() can detect the disconnected state.\n - Adding a !priv->urb check at the start of powerz_read_data()\n   to return -ENODEV on a disconnected device.\n - Moving usb_set_intfdata() before hwmon registration so the\n   disconnect handler can always find the priv pointer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "42daa232-137f-4d3a-ba3b-0758ccfd9394",  "id": "CVE-2019-19056",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19056"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-db8fd2cde932.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b182104f-ea6a-406a-a137-c0efdba4da8f",  "id": "OESA-2025-1881",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "47c77024-2681-4d35-b021-cc1d6cbace8a",  "id": "CVE-2026-31583",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: em28xx: fix use-after-free in em28xx_v4l2_open()\n\nem28xx_v4l2_open() reads dev->v4l2 without holding dev->lock,\ncreating a race with em28xx_v4l2_init()'s error path and\nem28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct\nand set dev->v4l2 to NULL under dev->lock.\n\nThis race leads to two issues:\n - use-after-free in v4l2_fh_init() when accessing vdev->ctrl_handler,\n   since the video_device is embedded in the freed em28xx_v4l2 struct.\n - NULL pointer dereference in em28xx_resolution_set() when accessing\n   v4l2->norm, since dev->v4l2 has been set to NULL.\n\nFix this by moving the mutex_lock() before the dev->v4l2 read and\nadding a NULL check for dev->v4l2 under the lock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b71d943f-6a68-4c90-ba9f-2d8e72c69c54",  "id": "CVE-2022-49130",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath11k: mhi: use mhi_sync_power_up()\n\nIf amss.bin was missing ath11k would crash during 'rmmod ath11k_pci'. The\nreason for that was that we were using mhi_async_power_up() which does not\ncheck any errors. But mhi_sync_power_up() on the other hand does check for\nerrors so let's use that to fix the crash.\n\nI was not able to find a reason why an async version was used.\nath11k_mhi_start() (which enables state ATH11K_MHI_POWER_ON) is called from\nath11k_hif_power_up(), which can sleep. So sync version should be safe to use\nhere.\n\n[  145.569731] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN PTI\n[  145.569789] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n[  145.569843] CPU: 2 PID: 1628 Comm: rmmod Kdump: loaded Tainted: G        W         5.16.0-wt-ath+ #567\n[  145.569898] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021\n[  145.569956] RIP: 0010:ath11k_hal_srng_access_begin+0xb5/0x2b0 [ath11k]\n[  145.570028] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 ec 01 00 00 48 8b ab a8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 <0f> b6 14 02 48 89 e8 83 e0 07 83 c0 03 45 85 ed 75 48 38 d0 7c 08\n[  145.570089] RSP: 0018:ffffc900025d7ac0 EFLAGS: 00010246\n[  145.570144] RAX: dffffc0000000000 RBX: ffff88814fca2dd8 RCX: 1ffffffff50cb455\n[  145.570196] RDX: 0000000000000000 RSI: ffff88814fca2dd8 RDI: ffff88814fca2e80\n[  145.570252] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffa8659497\n[  145.570329] R10: fffffbfff50cb292 R11: 0000000000000001 R12: ffff88814fca0000\n[  145.570410] R13: 0000000000000000 R14: ffff88814fca2798 R15: ffff88814fca2dd8\n[  145.570465] FS:  00007fa399988540(0000) GS:ffff888233e00000(0000) knlGS:0000000000000000\n[  145.570519] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  145.570571] CR2: 00007fa399b51421 CR3: 0000000137898002 CR4: 00000000003706e0\n[  145.570623] Call Trace:\n[  145.570675]  <TASK>\n[  145.570727]  ? ath11k_ce_tx_process_cb+0x34b/0x860 [ath11k]\n[  145.570797]  ath11k_ce_tx_process_cb+0x356/0x860 [ath11k]\n[  145.570864]  ? tasklet_init+0x150/0x150\n[  145.570919]  ? ath11k_ce_alloc_pipes+0x280/0x280 [ath11k]\n[  145.570986]  ? tasklet_clear_sched+0x42/0xe0\n[  145.571042]  ? tasklet_kill+0xe9/0x1b0\n[  145.571095]  ? tasklet_clear_sched+0xe0/0xe0\n[  145.571148]  ? irq_has_action+0x120/0x120\n[  145.571202]  ath11k_ce_cleanup_pipes+0x45a/0x580 [ath11k]\n[  145.571270]  ? ath11k_pci_stop+0x10e/0x170 [ath11k_pci]\n[  145.571345]  ath11k_core_stop+0x8a/0xc0 [ath11k]\n[  145.571434]  ath11k_core_deinit+0x9e/0x150 [ath11k]\n[  145.571499]  ath11k_pci_remove+0xd2/0x260 [ath11k_pci]\n[  145.571553]  pci_device_remove+0x9a/0x1c0\n[  145.571605]  __device_release_driver+0x332/0x660\n[  145.571659]  driver_detach+0x1e7/0x2c0\n[  145.571712]  bus_remove_driver+0xe2/0x2d0\n[  145.571772]  pci_unregister_driver+0x21/0x250\n[  145.571826]  __do_sys_delete_module+0x30a/0x4b0\n[  145.571879]  ? free_module+0xac0/0xac0\n[  145.571933]  ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370\n[  145.571986]  ? syscall_enter_from_user_mode+0x1d/0x50\n[  145.572039]  ? lockdep_hardirqs_on+0x79/0x100\n[  145.572097]  do_syscall_64+0x3b/0x90\n[  145.572153]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nTested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "532ebf18-cc40-4b1e-94fe-837bc5af0315",  "id": "CVE-2024-49919",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn201_acquire_free_pipe_for_layer` function. The issue could occur\nwhen `head_pipe` is null.\n\nThe fix adds a check to ensure `head_pipe` is not null before asserting\nit. If `head_pipe` is null, the function returns NULL to prevent a\npotential null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn201/dcn201_resource.c:1016 dcn201_acquire_free_pipe_for_layer() error: we previously assumed 'head_pipe' could be null (see line 1010)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84a7f39d-55cb-4754-8260-3d8b8febe27d",  "id": "OESA-2024-1900",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c651f8ec-bc0c-4982-8ae9-5b1efdad7d64",  "id": "OESA-2025-2325",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d8ff38f3-db09-45e6-9234-c5e3c32ebca1",  "id": "CVE-2014-9717",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9717"  },  "ratings": [    {      "score": 6.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"    }  ],  "cwes": [    284  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 system calls without verifying that the MNT_LOCKED flag is unset, which allows local users to bypass intended access restrictions and navigate to filesystem locations beneath a mount by calling umount2 within a user namespace.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ba0c4905-b531-4f53-934f-8c85e02694e3",  "id": "CVE-2022-49315",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()\n\nThere is a deadlock in rtllib_beacons_stop(), which is shown\nbelow:\n\n   (Thread 1)              |      (Thread 2)\n                           | rtllib_send_beacon()\nrtllib_beacons_stop()      |  mod_timer()\n spin_lock_irqsave() //(1) |  (wait a time)\n ...                       | rtllib_send_beacon_cb()\n del_timer_sync()          |  spin_lock_irqsave() //(2)\n (wait timer to stop)      |  ...\n\nWe hold ieee->beacon_lock in position (1) of thread 1 and\nuse del_timer_sync() to wait timer to stop, but timer handler\nalso need ieee->beacon_lock in position (2) of thread 2.\nAs a result, rtllib_beacons_stop() will block forever.\n\nThis patch extracts del_timer_sync() from the protection of\nspin_lock_irqsave(), which could let timer handler to obtain\nthe needed lock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "13c9c115-c682-46f5-8ea8-c07aa2fecf92",  "id": "CVE-2019-10220",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10220"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    22  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f1866441-84b4-44e6-91fe-932bced2894e",  "id": "CVE-2026-48715",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    121  ],  "analysis": {    "state": "in_triage"  },  "description": "radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, `print_ff()` copies up to 2032 bytes from attacker-controlled packet data into a 16-byte `struct in6_addr` on the stack, overflowing by up to 2016 bytes. Note that the main `radvd` daemon is not affected by the vulnerability. Version 2.21 patches the issue.",  "affects": [    {      "ref": "3a8669d1-32cc-4c66-b446-3d7c58208768",      "versions": [        {          "component": "radvd",          "version": "1.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae1cd3a4-5ca0-4ed1-afd9-ef7c92329f4d",  "id": "RLSA-2024:6783",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ac7afbb0-b064-42f7-80d4-f907aab6f621",  "id": "CVE-2025-37741",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Prevent copying of nlink with value 0 from disk inode\n\nsyzbot report a deadlock in diFree. [1]\n\nWhen calling \"ioctl$LOOP_SET_STATUS64\", the offset value passed in is 4,\nwhich does not match the mounted loop device, causing the mapping of the\nmounted loop device to be invalidated.\n\nWhen creating the directory and creating the inode of iag in diReadSpecial(),\nread the page of fixed disk inode (AIT) in raw mode in read_metapage(), the\nmetapage data it returns is corrupted, which causes the nlink value of 0 to be\nassigned to the iag inode when executing copy_from_dinode(), which ultimately\ncauses a deadlock when entering diFree().\n\nTo avoid this, first check the nlink value of dinode before setting iag inode.\n\n[1]\nWARNING: possible recursive locking detected\n6.12.0-rc7-syzkaller-00212-g4a5df3796467 #0 Not tainted\n--------------------------------------------\nsyz-executor301/5309 is trying to acquire lock:\nffff888044548920 (&(imap->im_aglock[index])){+.+.}-{3:3}, at: diFree+0x37c/0x2fb0 fs/jfs/jfs_imap.c:889\n\nbut task is already holding lock:\nffff888044548920 (&(imap->im_aglock[index])){+.+.}-{3:3}, at: diAlloc+0x1b6/0x1630\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n       CPU0\n       ----\n  lock(&(imap->im_aglock[index]));\n  lock(&(imap->im_aglock[index]));\n\n *** DEADLOCK ***\n\n May be due to missing lock nesting notation\n\n5 locks held by syz-executor301/5309:\n #0: ffff8880422a4420 (sb_writers#9){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:515\n #1: ffff88804755b390 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:850 [inline]\n #1: ffff88804755b390 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x260/0x540 fs/namei.c:4026\n #2: ffff888044548920 (&(imap->im_aglock[index])){+.+.}-{3:3}, at: diAlloc+0x1b6/0x1630\n #3: ffff888044548890 (&imap->im_freelock){+.+.}-{3:3}, at: diNewIAG fs/jfs/jfs_imap.c:2460 [inline]\n #3: ffff888044548890 (&imap->im_freelock){+.+.}-{3:3}, at: diAllocExt fs/jfs/jfs_imap.c:1905 [inline]\n #3: ffff888044548890 (&imap->im_freelock){+.+.}-{3:3}, at: diAllocAG+0x4b7/0x1e50 fs/jfs/jfs_imap.c:1669\n #4: ffff88804755a618 (&jfs_ip->rdwrlock/1){++++}-{3:3}, at: diNewIAG fs/jfs/jfs_imap.c:2477 [inline]\n #4: ffff88804755a618 (&jfs_ip->rdwrlock/1){++++}-{3:3}, at: diAllocExt fs/jfs/jfs_imap.c:1905 [inline]\n #4: ffff88804755a618 (&jfs_ip->rdwrlock/1){++++}-{3:3}, at: diAllocAG+0x869/0x1e50 fs/jfs/jfs_imap.c:1669\n\nstack backtrace:\nCPU: 0 UID: 0 PID: 5309 Comm: syz-executor301 Not tainted 6.12.0-rc7-syzkaller-00212-g4a5df3796467 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3037\n check_deadlock kernel/locking/lockdep.c:3089 [inline]\n validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3891\n __lock_acquire+0x1384/0x2050 kernel/locking/lockdep.c:5202\n lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825\n __mutex_lock_common kernel/locking/mutex.c:608 [inline]\n __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752\n diFree+0x37c/0x2fb0 fs/jfs/jfs_imap.c:889\n jfs_evict_inode+0x32d/0x440 fs/jfs/inode.c:156\n evict+0x4e8/0x9b0 fs/inode.c:725\n diFreeSpecial fs/jfs/jfs_imap.c:552 [inline]\n duplicateIXtree+0x3c6/0x550 fs/jfs/jfs_imap.c:3022\n diNewIAG fs/jfs/jfs_imap.c:2597 [inline]\n diAllocExt fs/jfs/jfs_imap.c:1905 [inline]\n diAllocAG+0x17dc/0x1e50 fs/jfs/jfs_imap.c:1669\n diAlloc+0x1d2/0x1630 fs/jfs/jfs_imap.c:1590\n ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56\n jfs_mkdir+0x1c5/0xba0 fs/jfs/namei.c:225\n vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257\n do_mkdirat+0x264/0x3a0 fs/namei.c:4280\n __do_sys_mkdirat fs/namei.c:4295 [inline]\n __se_sys_mkdirat fs/namei.c:4293 [inline]\n __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293\n do_syscall_x64 arch/x86/en\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7ae4b3b8-920e-44f2-bc74-f1b96e25ad2b",  "id": "CVE-2024-44963",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not BUG_ON() when freeing tree block after error\n\nWhen freeing a tree block, at btrfs_free_tree_block(), if we fail to\ncreate a delayed reference we don't deal with the error and just do a\nBUG_ON(). The error most likely to happen is -ENOMEM, and we have a\ncomment mentioning that only -ENOMEM can happen, but that is not true,\nbecause in case qgroups are enabled any error returned from\nbtrfs_qgroup_trace_extent_post() (can be -EUCLEAN or anything returned\nfrom btrfs_search_slot() for example) can be propagated back to\nbtrfs_free_tree_block().\n\nSo stop doing a BUG_ON() and return the error to the callers and make\nthem abort the transaction to prevent leaking space. Syzbot was\ntriggering this, likely due to memory allocation failure injection.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e07949d7-a693-45ac-877e-b6761d2d712e",  "id": "DLA-0003-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5467fedd-16e0-45ae-ae34-80e648ecda82",  "id": "AZL-39946",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c6469a4-aaa3-4e54-9abb-c134a43d668d",  "id": "CVE-2011-4619",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4619"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a395c23-9585-44ef-8d42-532ed94ad81f",  "id": "CVE-2024-50055",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: bus: Fix double free in driver API bus_register()\n\nFor bus_register(), any error which happens after kset_register() will\ncause that @priv are freed twice, fixed by setting @priv with NULL after\nthe first free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2a6f19d-132a-4411-a511-16a85acb5c99",  "id": "CVE-2020-25684",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25684"  },  "ratings": [    {      "score": 3.7,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    358  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in dnsmasq before version 2.83. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "995e88c8-9a68-44b2-a583-681aa40aa99b",  "id": "CVE-2022-28356",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28356"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "af648327-63b5-4099-967d-afd76cf3c4fe",  "id": "openSUSE-SU-2026:10605-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45579fad-48e6-42ab-b40d-f26bc17936b3",  "id": "CVE-2023-4132",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4132"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "33d4a819-4ae0-48e7-af2b-6f669e6bdb0d",  "id": "CVE-2021-3732",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3732"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be accessible.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4c5f555f-7453-4748-b776-73c2b1047790",  "id": "CVE-2017-7895",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7895"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d33837f8-ffa1-4cf6-86bc-08bd0c6fdd79",  "id": "CVE-2026-64178",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: Fix UAF read of dev->name\n\nbnep_add_connection() needs to keep holding the bnep_session_sem while\nreading dev->name (just like bnep_get_connlist() does); otherwise the\nbnep_session() thread can concurrently free the net_device, which can for\nexample be triggered by a concurrent bnep_del_connection().\n\n(This UAF is fairly uninteresting from a security perspective;\ncalling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN)\ncheck. It also requires completely tearing down a netdev during a fairly\ntight race window.)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9bfef12c-a017-4997-9f29-a92f24416a0f",  "id": "CVE-2020-29660",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29660"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    416,    667  ],  "analysis": {    "state": "in_triage"  },  "description": "A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3e0ebffd-d43c-4eb4-90f7-6401a891eb69",  "id": "CVE-2024-56588",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: hisi_sas: Create all dump files during debugfs initialization\n\nFor the current debugfs of hisi_sas, after user triggers dump, the\ndriver allocate memory space to save the register information and create\ndebugfs files to display the saved information. In this process, the\ndebugfs files created after each dump.\n\nTherefore, when the dump is triggered while the driver is unbind, the\nfollowing hang occurs:\n\n[67840.853907] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0\n[67840.862947] Mem abort info:\n[67840.865855]   ESR = 0x0000000096000004\n[67840.869713]   EC = 0x25: DABT (current EL), IL = 32 bits\n[67840.875125]   SET = 0, FnV = 0\n[67840.878291]   EA = 0, S1PTW = 0\n[67840.881545]   FSC = 0x04: level 0 translation fault\n[67840.886528] Data abort info:\n[67840.889524]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[67840.895117]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[67840.900284]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[67840.905709] user pgtable: 4k pages, 48-bit VAs, pgdp=0000002803a1f000\n[67840.912263] [00000000000000a0] pgd=0000000000000000, p4d=0000000000000000\n[67840.919177] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[67840.996435] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[67841.003628] pc : down_write+0x30/0x98\n[67841.007546] lr : start_creating.part.0+0x60/0x198\n[67841.012495] sp : ffff8000b979ba20\n[67841.016046] x29: ffff8000b979ba20 x28: 0000000000000010 x27: 0000000000024b40\n[67841.023412] x26: 0000000000000012 x25: ffff20202b355ae8 x24: ffff20202b35a8c8\n[67841.030779] x23: ffffa36877928208 x22: ffffa368b4972240 x21: ffff8000b979bb18\n[67841.038147] x20: ffff00281dc1e3c0 x19: fffffffffffffffe x18: 0000000000000020\n[67841.045515] x17: 0000000000000000 x16: ffffa368b128a530 x15: ffffffffffffffff\n[67841.052888] x14: ffff8000b979bc18 x13: ffffffffffffffff x12: ffff8000b979bb18\n[67841.060263] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa368b1289b18\n[67841.067640] x8 : 0000000000000012 x7 : 0000000000000000 x6 : 00000000000003a9\n[67841.075014] x5 : 0000000000000000 x4 : ffff002818c5cb00 x3 : 0000000000000001\n[67841.082388] x2 : 0000000000000000 x1 : ffff002818c5cb00 x0 : 00000000000000a0\n[67841.089759] Call trace:\n[67841.092456]  down_write+0x30/0x98\n[67841.096017]  start_creating.part.0+0x60/0x198\n[67841.100613]  debugfs_create_dir+0x48/0x1f8\n[67841.104950]  debugfs_create_files_v3_hw+0x88/0x348 [hisi_sas_v3_hw]\n[67841.111447]  debugfs_snapshot_regs_v3_hw+0x708/0x798 [hisi_sas_v3_hw]\n[67841.118111]  debugfs_trigger_dump_v3_hw_write+0x9c/0x120 [hisi_sas_v3_hw]\n[67841.125115]  full_proxy_write+0x68/0xc8\n[67841.129175]  vfs_write+0xd8/0x3f0\n[67841.132708]  ksys_write+0x70/0x108\n[67841.136317]  __arm64_sys_write+0x24/0x38\n[67841.140440]  invoke_syscall+0x50/0x128\n[67841.144385]  el0_svc_common.constprop.0+0xc8/0xf0\n[67841.149273]  do_el0_svc+0x24/0x38\n[67841.152773]  el0_svc+0x38/0xd8\n[67841.156009]  el0t_64_sync_handler+0xc0/0xc8\n[67841.160361]  el0t_64_sync+0x1a4/0x1a8\n[67841.164189] Code: b9000882 d2800002 d2800023 f9800011 (c85ffc05)\n[67841.170443] ---[ end trace 0000000000000000 ]---\n\nTo fix this issue, create all directories and files during debugfs\ninitialization. In this way, the driver only needs to allocate memory\nspace to save information each time the user triggers dumping.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "585f0167-2685-48cc-9369-a8e284391f35",  "id": "CVE-2014-3122",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3122"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local users to cause a denial of service (system crash) by triggering a memory-usage pattern that requires removal of page-table mappings.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9f8b6fda-f34c-4a69-8e08-5ad4f1376f1a",  "id": "CVE-2024-50017",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/ident_map: Use gbpages only where full GB page should be mapped.\n\nWhen ident_pud_init() uses only GB pages to create identity maps, large\nranges of addresses not actually requested can be included in the resulting\ntable; a 4K request will map a full GB.  This can include a lot of extra\naddress space past that requested, including areas marked reserved by the\nBIOS.  That allows processor speculation into reserved regions, that on UV\nsystems can cause system halts.\n\nOnly use GB pages when map creation requests include the full GB page of\nspace.  Fall back to using smaller 2M pages when only portions of a GB page\nare included in the request.\n\nNo attempt is made to coalesce mapping requests. If a request requires a\nmap entry at the 2M (pmd) level, subsequent mapping requests within the\nsame 1G region will also be at the pmd level, even if adjacent or\noverlapping such requests could have been combined to map a full GB page.\nExisting usage starts with larger regions and then adds smaller regions, so\nthis should not have any great consequence.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5c554b5c-63a2-45b2-9292-0d974a020780",  "id": "CVE-2015-8215",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8215"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272.  NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b0256f41-695a-4226-9e12-500aa00ce70e",  "id": "CVE-2016-2847",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2847"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes, which allows local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "afab6add-9fab-42a6-a28c-1ed04217dd63",  "id": "openSUSE-SU-2024:11653-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a0b40fc-b464-4937-a285-705a82d92b83",  "id": "CVE-2010-2954",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2954"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The irda_bind function in net/irda/af_irda.c in the Linux kernel before 2.6.36-rc3-next-20100901 does not properly handle failure of the irda_open_tsap function, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact via multiple unsuccessful calls to bind on an AF_IRDA (aka PF_IRDA) socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9fc2bd9d-2b56-497b-a8ee-e2eee93ffc19",  "id": "CVE-2019-5747",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5747"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0cb0fce4-7ac2-418f-9c38-055a4eba2e41",  "id": "AZL-92832",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a99735b4-e946-4e68-b3e6-f042248d9929",  "id": "DSA-2557-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f4f24136-6192-44bb-8479-4ea69cf299d0",  "id": "CVE-2013-2899",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2899"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/hid/hid-picolcd_core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PICOLCD is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be2b38d4-406a-4176-b81f-9bb4c962a384",  "id": "CVE-2023-33288",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33288"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race condition.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "275eca37-d4c8-4988-af1c-8dce8b5db78f",  "id": "CVE-2022-49523",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath11k: disable spectral scan during spectral deinit\n\nWhen ath11k modules are removed using rmmod with spectral scan enabled,\ncrash is observed. Different crash trace is observed for each crash.\n\nSend spectral scan disable WMI command to firmware before cleaning\nthe spectral dbring in the spectral_deinit API to avoid this crash.\n\ncall trace from one of the crash observed:\n[ 1252.880802] Unable to handle kernel NULL pointer dereference at virtual address 00000008\n[ 1252.882722] pgd = 0f42e886\n[ 1252.890955] [00000008] *pgd=00000000\n[ 1252.893478] Internal error: Oops: 5 [#1] PREEMPT SMP ARM\n[ 1253.093035] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.89 #0\n[ 1253.115261] Hardware name: Generic DT based system\n[ 1253.121149] PC is at ath11k_spectral_process_data+0x434/0x574 [ath11k]\n[ 1253.125940] LR is at 0x88e31017\n[ 1253.132448] pc : [<7f9387b8>]    lr : [<88e31017>]    psr: a0000193\n[ 1253.135488] sp : 80d01bc8  ip : 00000001  fp : 970e0000\n[ 1253.141737] r10: 88e31000  r9 : 970ec000  r8 : 00000080\n[ 1253.146946] r7 : 94734040  r6 : a0000113  r5 : 00000057  r4 : 00000000\n[ 1253.152159] r3 : e18cb694  r2 : 00000217  r1 : 1df1f000  r0 : 00000001\n[ 1253.158755] Flags: NzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user\n[ 1253.165266] Control: 10c0383d  Table: 5e71006a  DAC: 00000055\n[ 1253.172472] Process swapper/0 (pid: 0, stack limit = 0x60870141)\n[ 1253.458055] [<7f9387b8>] (ath11k_spectral_process_data [ath11k]) from [<7f917fdc>] (ath11k_dbring_buffer_release_event+0x214/0x2e4 [ath11k])\n[ 1253.466139] [<7f917fdc>] (ath11k_dbring_buffer_release_event [ath11k]) from [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx+0x1840/0x29cc [ath11k])\n[ 1253.478807] [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx [ath11k]) from [<7f8fe868>] (ath11k_htc_rx_completion_handler+0x180/0x4e0 [ath11k])\n[ 1253.490699] [<7f8fe868>] (ath11k_htc_rx_completion_handler [ath11k]) from [<7f91308c>] (ath11k_ce_per_engine_service+0x2c4/0x3b4 [ath11k])\n[ 1253.502386] [<7f91308c>] (ath11k_ce_per_engine_service [ath11k]) from [<7f9a4198>] (ath11k_pci_ce_tasklet+0x28/0x80 [ath11k_pci])\n[ 1253.514811] [<7f9a4198>] (ath11k_pci_ce_tasklet [ath11k_pci]) from [<8032227c>] (tasklet_action_common.constprop.2+0x64/0xe8)\n[ 1253.526476] [<8032227c>] (tasklet_action_common.constprop.2) from [<803021e8>] (__do_softirq+0x130/0x2d0)\n[ 1253.537756] [<803021e8>] (__do_softirq) from [<80322610>] (irq_exit+0xcc/0xe8)\n[ 1253.547304] [<80322610>] (irq_exit) from [<8036a4a4>] (__handle_domain_irq+0x60/0xb4)\n[ 1253.554428] [<8036a4a4>] (__handle_domain_irq) from [<805eb348>] (gic_handle_irq+0x4c/0x90)\n[ 1253.562321] [<805eb348>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c)\n\nTested-on: QCN6122 hw1.0 AHB WLAN.HK.2.6.0.1-00851-QCAHKSWPL_SILICONZ-1",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c4f529a-2fd3-43b5-bbc2-ad2837130343",  "id": "CVE-2023-1382",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1382"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a432b153-002c-403a-8b05-dfa9ff7081de",  "id": "CVE-2019-16275",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16275"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    346  ],  "analysis": {    "state": "in_triage"  },  "description": "hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The attacker must send a crafted 802.11 frame from a location that is within the 802.11 communications range.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f8189bdd-b178-4c65-81a8-e135616f2fe3",  "id": "CVE-2024-26677",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix delayed ACKs to not set the reference serial number\n\nFix the construction of delayed ACKs to not set the reference serial number\nas they can't be used as an RTT reference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b3fd124d-d25d-4d43-ac92-3f687b31c2d2",  "id": "CVE-2017-15274",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15274"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction with a nonzero length value, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f527fb51-252f-4e65-8c69-6c9153a46a89",  "id": "CVE-2020-8648",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8648"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3fb87816-8f20-4784-a065-3287c1599482",  "id": "DLA-4019-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "91485323-9b7d-40df-a6b2-d77e67741dc6",  "id": "CVE-2015-1328",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1328"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:40688'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'MSF:overlayfs_priv_esc'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'PSS:132334/Ubuntu-12.04-14.04-14.10-15.04-overlayfs-Local-Root.html'"    }  ]},{  "bom-ref": "54b162ce-626b-4fda-97c6-88607d259f4a",  "id": "CVE-2016-5243",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5243"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel through 4.6.3 does not properly copy a certain string, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "85c31092-75e1-4b89-9a21-8578a0cd02b1",  "id": "OESA-2026-1880",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff652bdf-a60b-44e3-8e0c-8984bc59002a",  "id": "CVE-2026-43046",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reject root items with drop_progress and zero drop_level\n\n[BUG]\nWhen recovering relocation at mount time, merge_reloc_root() and\nbtrfs_drop_snapshot() both use BUG_ON(level == 0) to guard against\nan impossible state: a non-zero drop_progress combined with a zero\ndrop_level in a root_item, which can be triggered:\n\n------------[ cut here ]------------\nkernel BUG at fs/btrfs/relocation.c:1545!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nCPU: 1 UID: 0 PID: 283 ... Tainted: 6.18.0+ #16 PREEMPT(voluntary)\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nHardware name: QEMU Ubuntu 24.04 PC v2, BIOS 1.16.3-debian-1.16.3-2\nRIP: 0010:merge_reloc_root+0x1266/0x1650 fs/btrfs/relocation.c:1545\nCode: ffff0000 00004589 d7e9acfa ffffe8a1 79bafebe 02000000\nCall Trace:\n merge_reloc_roots+0x295/0x890 fs/btrfs/relocation.c:1861\n btrfs_recover_relocation+0xd6e/0x11d0 fs/btrfs/relocation.c:4195\n btrfs_start_pre_rw_mount+0xa4d/0x1810 fs/btrfs/disk-io.c:3130\n open_ctree+0x5824/0x5fe0 fs/btrfs/disk-io.c:3640\n btrfs_fill_super fs/btrfs/super.c:987 [inline]\n btrfs_get_tree_super fs/btrfs/super.c:1951 [inline]\n btrfs_get_tree_subvol fs/btrfs/super.c:2094 [inline]\n btrfs_get_tree+0x111c/0x2190 fs/btrfs/super.c:2128\n vfs_get_tree+0x9a/0x370 fs/super.c:1758\n fc_mount fs/namespace.c:1199 [inline]\n do_new_mount_fc fs/namespace.c:3642 [inline]\n do_new_mount fs/namespace.c:3718 [inline]\n path_mount+0x5b8/0x1ea0 fs/namespace.c:4028\n do_mount fs/namespace.c:4041 [inline]\n __do_sys_mount fs/namespace.c:4229 [inline]\n __se_sys_mount fs/namespace.c:4206 [inline]\n __x64_sys_mount+0x282/0x320 fs/namespace.c:4206\n ...\nRIP: 0033:0x7f969c9a8fde\nCode: 0f1f4000 48c7c2b0 fffffff7 d8648902 b8ffffff ffc3660f\n---[ end trace 0000000000000000 ]---\n\nThe bug is reproducible on 7.0.0-rc2-next-20260310 with our dynamic\nmetadata fuzzing tool that corrupts btrfs metadata at runtime.\n\n[CAUSE]\nA non-zero drop_progress.objectid means an interrupted\nbtrfs_drop_snapshot() left a resume point on disk, and in that case\ndrop_level must be greater than 0 because the checkpoint is only\nsaved at internal node levels.\n\nAlthough this invariant is enforced when the kernel writes the root\nitem, it is not validated when the root item is read back from disk.\nThat allows on-disk corruption to provide an invalid state with\ndrop_progress.objectid != 0 and drop_level == 0.\n\nWhen relocation recovery later processes such a root item,\nmerge_reloc_root() reads drop_level and hits BUG_ON(level == 0). The\nsame invalid metadata can also trigger the corresponding BUG_ON() in\nbtrfs_drop_snapshot().\n\n[FIX]\nFix this by validating the root_item invariant in tree-checker when\nreading root items from disk: if drop_progress.objectid is non-zero,\ndrop_level must also be non-zero. Reject such malformed metadata with\n-EUCLEAN before it reaches merge_reloc_root() or btrfs_drop_snapshot()\nand triggers the BUG_ON.\n\nAfter the fix, the same corruption is correctly rejected by tree-checker\nand the BUG_ON is no longer triggered.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ad8c7bb-e8bd-4c4c-a00d-60e1dc445557",  "id": "CLSA-2025-1760556795",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "22b3f05d-87a1-4ff1-a7dc-91a3214d7870",  "id": "RHSA-2023:1439",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8317fff3-3f7d-4753-b0bc-dd57e75e9cde",  "id": "CVE-2024-39495",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: Fix use-after-free bug in gb_interface_release due to race condition.\n\nIn gb_interface_create, &intf->mode_switch_completion is bound with\ngb_interface_mode_switch_work. Then it will be started by\ngb_interface_request_mode_switch. Here is the relevant code.\nif (!queue_work(system_long_wq, &intf->mode_switch_work)) {\n\t...\n}\n\nIf we call gb_interface_release to make cleanup, there may be an\nunfinished work. This function will call kfree to free the object\n\"intf\". However, if gb_interface_mode_switch_work is scheduled to\nrun after kfree, it may cause use-after-free error as\ngb_interface_mode_switch_work will use the object \"intf\".\nThe possible execution flow that may lead to the issue is as follows:\n\nCPU0                            CPU1\n\n                            |   gb_interface_create\n                            |   gb_interface_request_mode_switch\ngb_interface_release        |\nkfree(intf) (free)          |\n                            |   gb_interface_mode_switch_work\n                            |   mutex_lock(&intf->mutex) (use)\n\nFix it by canceling the work before kfree.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99d4f5eb-f7b7-4580-b485-584b250babaf",  "id": "CVE-2026-52948",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl\n\nWhile fuzzing with Syzkaller, a persistent `schedule_timeout: wrong\ntimeout value` warning was observed, accompanied by SMBus controller\nstate machine corruption.\n\nThe I2C_TIMEOUT ioctl accepts a user-provided timeout in multiples of\n10 ms. The user argument is checked against INT_MAX, but it is\nsubsequently multiplied by 10 before being passed to msecs_to_jiffies().\n\nA malicious user can pass a large value (e.g., 429496729) that passes\nthe `arg > INT_MAX` check but overflows when multiplied by 10. This\nresults in a truncated 32-bit unsigned value that bypasses the\ninternal `(int)m < 0` check in `msecs_to_jiffies()`.\n\nThe truncated value is then assigned to `client->adapter->timeout`\n(a signed 32-bit int), which is reinterpreted as a negative number.\nWhen passed to wait_for_completion_timeout(), this negative value\nundergoes sign extension to a 64-bit unsigned long, triggering the\n`schedule_timeout` warning and causing premature returns. This leaves\nthe SMBus state machine in an unrecoverable state, constituting a\nlocal Denial of Service (DoS).\n\nFix this by bounding the user argument to `INT_MAX / 10`.\n\n[wsa: move the comment as well]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "660e2316-7f0a-494d-8bf5-4faa9c43f9d5",  "id": "CVE-2025-21912",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: rcar: Use raw_spinlock to protect register access\n\nUse raw_spinlock in order to fix spurious messages about invalid context\nwhen spinlock debugging is enabled. The lock is only used to serialize\nregister access.\n\n    [    4.239592] =============================\n    [    4.239595] [ BUG: Invalid wait context ]\n    [    4.239599] 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35 Not tainted\n    [    4.239603] -----------------------------\n    [    4.239606] kworker/u8:5/76 is trying to lock:\n    [    4.239609] ffff0000091898a0 (&p->lock){....}-{3:3}, at: gpio_rcar_config_interrupt_input_mode+0x34/0x164\n    [    4.239641] other info that might help us debug this:\n    [    4.239643] context-{5:5}\n    [    4.239646] 5 locks held by kworker/u8:5/76:\n    [    4.239651]  #0: ffff0000080fb148 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x190/0x62c\n    [    4.250180] OF: /soc/sound@ec500000/ports/port@0/endpoint: Read of boolean property 'frame-master' with a value.\n    [    4.254094]  #1: ffff80008299bd80 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x1b8/0x62c\n    [    4.254109]  #2: ffff00000920c8f8\n    [    4.258345] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'bitclock-master' with a value.\n    [    4.264803]  (&dev->mutex){....}-{4:4}, at: __device_attach_async_helper+0x3c/0xdc\n    [    4.264820]  #3: ffff00000a50ca40 (request_class#2){+.+.}-{4:4}, at: __setup_irq+0xa0/0x690\n    [    4.264840]  #4:\n    [    4.268872] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'frame-master' with a value.\n    [    4.273275] ffff00000a50c8c8 (lock_class){....}-{2:2}, at: __setup_irq+0xc4/0x690\n    [    4.296130] renesas_sdhi_internal_dmac ee100000.mmc: mmc1 base at 0x00000000ee100000, max clock rate 200 MHz\n    [    4.304082] stack backtrace:\n    [    4.304086] CPU: 1 UID: 0 PID: 76 Comm: kworker/u8:5 Not tainted 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35\n    [    4.304092] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)\n    [    4.304097] Workqueue: async async_run_entry_fn\n    [    4.304106] Call trace:\n    [    4.304110]  show_stack+0x14/0x20 (C)\n    [    4.304122]  dump_stack_lvl+0x6c/0x90\n    [    4.304131]  dump_stack+0x14/0x1c\n    [    4.304138]  __lock_acquire+0xdfc/0x1584\n    [    4.426274]  lock_acquire+0x1c4/0x33c\n    [    4.429942]  _raw_spin_lock_irqsave+0x5c/0x80\n    [    4.434307]  gpio_rcar_config_interrupt_input_mode+0x34/0x164\n    [    4.440061]  gpio_rcar_irq_set_type+0xd4/0xd8\n    [    4.444422]  __irq_set_trigger+0x5c/0x178\n    [    4.448435]  __setup_irq+0x2e4/0x690\n    [    4.452012]  request_threaded_irq+0xc4/0x190\n    [    4.456285]  devm_request_threaded_irq+0x7c/0xf4\n    [    4.459398] ata1: link resume succeeded after 1 retries\n    [    4.460902]  mmc_gpiod_request_cd_irq+0x68/0xe0\n    [    4.470660]  mmc_start_host+0x50/0xac\n    [    4.474327]  mmc_add_host+0x80/0xe4\n    [    4.477817]  tmio_mmc_host_probe+0x2b0/0x440\n    [    4.482094]  renesas_sdhi_probe+0x488/0x6f4\n    [    4.486281]  renesas_sdhi_internal_dmac_probe+0x60/0x78\n    [    4.491509]  platform_probe+0x64/0xd8\n    [    4.495178]  really_probe+0xb8/0x2a8\n    [    4.498756]  __driver_probe_device+0x74/0x118\n    [    4.503116]  driver_probe_device+0x3c/0x154\n    [    4.507303]  __device_attach_driver+0xd4/0x160\n    [    4.511750]  bus_for_each_drv+0x84/0xe0\n    [    4.515588]  __device_attach_async_helper+0xb0/0xdc\n    [    4.520470]  async_run_entry_fn+0x30/0xd8\n    [    4.524481]  process_one_work+0x210/0x62c\n    [    4.528494]  worker_thread+0x1ac/0x340\n    [    4.532245]  kthread+0x10c/0x110\n    [    4.535476]  ret_from_fork+0x10/0x20",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "26302190-3da8-4e48-b37d-bbc009bba329",  "id": "RHSA-2026:1519",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d7f0d7e3-8556-4937-b88b-2a5f84f52b68",  "id": "CVE-2024-35966",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix not validating setsockopt user input\n\nsyzbot reported rfcomm_sock_setsockopt_old() is copying data without\nchecking user input length.\n\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset\ninclude/linux/sockptr.h:49 [inline]\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr\ninclude/linux/sockptr.h:55 [inline]\nBUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old\nnet/bluetooth/rfcomm/sock.c:632 [inline]\nBUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70\nnet/bluetooth/rfcomm/sock.c:673\nRead of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99b697aa-4904-4937-80db-b9899b695303",  "id": "CVE-2022-50067",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: unset reloc control if transaction commit fails in prepare_to_relocate()\n\nIn btrfs_relocate_block_group(), the rc is allocated.  Then\nbtrfs_relocate_block_group() calls\n\nrelocate_block_group()\n  prepare_to_relocate()\n    set_reloc_control()\n\nthat assigns rc to the variable fs_info->reloc_ctl. When\nprepare_to_relocate() returns, it calls\n\nbtrfs_commit_transaction()\n  btrfs_start_dirty_block_groups()\n    btrfs_alloc_path()\n      kmem_cache_zalloc()\n\nwhich may fail for example (or other errors could happen). When the\nfailure occurs, btrfs_relocate_block_group() detects the error and frees\nrc and doesn't set fs_info->reloc_ctl to NULL. After that, in\nbtrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and\nthen used, which may cause a use-after-free bug.\n\nThis possible bug can be triggered by calling btrfs_ioctl_balance()\nbefore calling btrfs_ioctl_defrag().\n\nTo fix this possible bug, in prepare_to_relocate(), check if\nbtrfs_commit_transaction() fails. If the failure occurs,\nunset_reloc_control() is called to set fs_info->reloc_ctl to NULL.\n\nThe error log in our fault-injection testing is shown as follows:\n\n  [   58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\n  ...\n  [   58.753577] Call Trace:\n  ...\n  [   58.755800]  kasan_report+0x45/0x60\n  [   58.756066]  btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\n  [   58.757304]  record_root_in_trans+0x792/0xa10 [btrfs]\n  [   58.757748]  btrfs_record_root_in_trans+0x463/0x4f0 [btrfs]\n  [   58.758231]  start_transaction+0x896/0x2950 [btrfs]\n  [   58.758661]  btrfs_defrag_root+0x250/0xc00 [btrfs]\n  [   58.759083]  btrfs_ioctl_defrag+0x467/0xa00 [btrfs]\n  [   58.759513]  btrfs_ioctl+0x3c95/0x114e0 [btrfs]\n  ...\n  [   58.768510] Allocated by task 23683:\n  [   58.768777]  ____kasan_kmalloc+0xb5/0xf0\n  [   58.769069]  __kmalloc+0x227/0x3d0\n  [   58.769325]  alloc_reloc_control+0x10a/0x3d0 [btrfs]\n  [   58.769755]  btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs]\n  [   58.770228]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]\n  [   58.770655]  __btrfs_balance+0x1326/0x1f10 [btrfs]\n  [   58.771071]  btrfs_balance+0x3150/0x3d30 [btrfs]\n  [   58.771472]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\n  [   58.771902]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]\n  ...\n  [   58.773337] Freed by task 23683:\n  ...\n  [   58.774815]  kfree+0xda/0x2b0\n  [   58.775038]  free_reloc_control+0x1d6/0x220 [btrfs]\n  [   58.775465]  btrfs_relocate_block_group+0x115c/0x1e20 [btrfs]\n  [   58.775944]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]\n  [   58.776369]  __btrfs_balance+0x1326/0x1f10 [btrfs]\n  [   58.776784]  btrfs_balance+0x3150/0x3d30 [btrfs]\n  [   58.777185]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\n  [   58.777621]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]\n  ...",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9294ea45-032b-4c7c-a512-5a1d9a3ca6c5",  "id": "CVE-2010-3448",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3448"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/platform/x86/thinkpad_acpi.c in the Linux kernel before 2.6.34 on ThinkPad devices, when the X.Org X server is used, does not properly restrict access to the video output control state, which allows local users to cause a denial of service (system hang) via a (1) read or (2) write operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "200f2fc0-4d95-4828-89e6-7479a1a76728",  "id": "CVE-2021-47183",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47183"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix link down processing to address NULL pointer dereference\n\nIf an FC link down transition while PLOGIs are outstanding to fabric well\nknown addresses, outstanding ABTS requests may result in a NULL pointer\ndereference. Driver unload requests may hang with repeated \"2878\" log\nmessages.\n\nThe Link down processing results in ABTS requests for outstanding ELS\nrequests. The Abort WQEs are sent for the ELSs before the driver had set\nthe link state to down. Thus the driver is sending the Abort with the\nexpectation that an ABTS will be sent on the wire. The Abort request is\nstalled waiting for the link to come up. In some conditions the driver may\nauto-complete the ELSs thus if the link does come up, the Abort completions\nmay reference an invalid structure.\n\nFix by ensuring that Abort set the flag to avoid link traffic if issued due\nto conditions where the link failed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52c5ff7b-86a7-40d7-a405-66d79434b07d",  "id": "CVE-2021-47458",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47458"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: mount fails with buffer overflow in strlen\n\nStarting with kernel 5.11 built with CONFIG_FORTIFY_SOURCE mouting an\nocfs2 filesystem with either o2cb or pcmk cluster stack fails with the\ntrace below.  Problem seems to be that strings for cluster stack and\ncluster name are not guaranteed to be null terminated in the disk\nrepresentation, while strlcpy assumes that the source string is always\nnull terminated.  This causes a read outside of the source string\ntriggering the buffer overflow detection.\n\n  detected buffer overflow in strlen\n  ------------[ cut here ]------------\n  kernel BUG at lib/string.c:1149!\n  invalid opcode: 0000 [#1] SMP PTI\n  CPU: 1 PID: 910 Comm: mount.ocfs2 Not tainted 5.14.0-1-amd64 #1\n    Debian 5.14.6-2\n  RIP: 0010:fortify_panic+0xf/0x11\n  ...\n  Call Trace:\n   ocfs2_initialize_super.isra.0.cold+0xc/0x18 [ocfs2]\n   ocfs2_fill_super+0x359/0x19b0 [ocfs2]\n   mount_bdev+0x185/0x1b0\n   legacy_get_tree+0x27/0x40\n   vfs_get_tree+0x25/0xb0\n   path_mount+0x454/0xa20\n   __x64_sys_mount+0x103/0x140\n   do_syscall_64+0x3b/0xc0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "063e28c8-2d6a-4781-90fc-317a868e6c71",  "id": "CVE-2022-36946",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36946"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "55095853-3757-4313-a9ae-f52e3bab4b1f",  "id": "CVE-2016-4805",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4805"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel before 4.5.2 allows local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and ppp_unregister_channel functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3277efaf-cfdb-4bf4-85b4-e13521f620d3",  "id": "CVE-2026-43156",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: enable basic endpoint checking\n\npegasus_probe() fills URBs with hardcoded endpoint pipes without\nverifying the endpoint descriptors:\n\n  - usb_rcvbulkpipe(dev, 1) for RX data\n  - usb_sndbulkpipe(dev, 2) for TX data\n  - usb_rcvintpipe(dev, 3)  for status interrupts\n\nA malformed USB device can present these endpoints with transfer types\nthat differ from what the driver assumes.\n\nAdd a pegasus_usb_ep enum for endpoint numbers, replacing magic\nconstants throughout. Add usb_check_bulk_endpoints() and\nusb_check_int_endpoints() calls before any resource allocation to\nverify endpoint types before use, rejecting devices with mismatched\ndescriptors at probe time, and avoid triggering assertion.\n\nSimilar fix to\n- commit 90b7f2961798 (\"net: usb: rtl8150: enable basic endpoint checking\")\n- commit 9e7021d2aeae (\"net: usb: catc: enable basic endpoint checking\")",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69c8f391-14e1-46f6-bf24-421a25e7f1ed",  "id": "SUSE-SU-2026:0236-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "463c7b2c-131a-4f4c-b0a8-bb37da288235",  "id": "CVE-2024-57843",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix overflow inside virtnet_rq_alloc\n\nWhen the frag just got a page, then may lead to regression on VM.\nSpecially if the sysctl net.core.high_order_alloc_disable value is 1,\nthen the frag always get a page when do refill.\n\nWhich could see reliable crashes or scp failure (scp a file 100M in size\nto VM).\n\nThe issue is that the virtnet_rq_dma takes up 16 bytes at the beginning\nof a new frag. When the frag size is larger than PAGE_SIZE,\neverything is fine. However, if the frag is only one page and the\ntotal size of the buffer and virtnet_rq_dma is larger than one page, an\noverflow may occur.\n\nThe commit f9dac92ba908 (\"virtio_ring: enable premapped mode whatever\nuse_dma_api\") introduced this problem. And we reverted some commits to\nfix this in last linux version. Now we try to enable it and fix this\nbug directly.\n\nHere, when the frag size is not enough, we reduce the buffer len to fix\nthis problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9ba10785-955d-4ee0-a1d3-b10914c0eba8",  "id": "openSUSE-SU-2021:0129-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dbf8f5a2-62d8-4c19-9715-374ff18cd5de",  "id": "CVE-2010-3849",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3849"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a sendmsg call that specifies a NULL value for the remote address field.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:15704'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:96484/Linux-Kernel-2.6.37-Local-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "23017cfe-c820-422c-8fa5-1f03c1fcf53f",  "id": "CVE-2011-4914",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4914"  },  "ratings": [    {      "score": 6.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The ROSE protocol implementation in the Linux kernel before 2.6.39 does not verify that certain data-length values are consistent with the amount of data sent, which might allow remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) via crafted data to a ROSE socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3117224a-89c5-4180-80b8-2279b61e1584",  "id": "CVE-2019-19063",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19063"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka CID-3f9361695113.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f3fb4016-9b55-437e-bd2b-616fd985a158",  "id": "CVE-2022-49538",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: jack: Access input_dev under mutex\n\nIt is possible when using ASoC that input_dev is unregistered while\ncalling snd_jack_report, which causes NULL pointer dereference.\nIn order to prevent this serialize access to input_dev using mutex lock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f2f4188d-5820-48b0-8614-df7a8674cdc4",  "id": "CVE-2014-100005",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-100005"  },  "ratings": [    {      "score": 8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    352  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.",  "affects": [    {      "ref": "0f9017f6-bd13-4064-97b2-6cfc35c2947d",      "versions": [        {          "component": "dir-600_firmware",          "version": "2.14b01"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'MSF:dlink_diagnostic_exec_noauth'"    }  ]},{  "bom-ref": "6f26471a-30e3-45ae-bae3-573ab5b03757",  "id": "CVE-2017-16536",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16536"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bcc43e43-0a01-4494-8615-96f5e1ea85ea",  "id": "RLSA-2026:25239",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ffc7acc8-8526-491d-ac1c-1e252771818d",  "id": "CVE-2024-27059",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: usb-storage: Prevent divide-by-0 error in isd200_ata_command\n\nThe isd200 sub-driver in usb-storage uses the HEADS and SECTORS values\nin the ATA ID information to calculate cylinder and head values when\ncreating a CDB for READ or WRITE commands.  The calculation involves\ndivision and modulus operations, which will cause a crash if either of\nthese values is 0.  While this never happens with a genuine device, it\ncould happen with a flawed or subversive emulation, as reported by the\nsyzbot fuzzer.\n\nProtect against this possibility by refusing to bind to the device if\neither the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID\ninformation is 0.  This requires isd200_Initialization() to return a\nnegative error code when initialization fails; currently it always\nreturns 0 (even when there is an error).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "df29d421-b20c-41e9-86da-8f2c11b11329",  "id": "CVE-2023-6270",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6270"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "de632095-ef96-4488-8cf3-46dcc5373ef5",  "id": "CVE-2013-6380",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6380"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The aac_send_raw_srb function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 3.12.1 does not properly validate a certain size value, which allows local users to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via an FSACTL_SEND_RAW_SRB ioctl call that triggers a crafted SRB command.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a50d1c97-63ee-40dc-94ea-1ead39ddc3ba",  "id": "CVE-2017-16649",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16649"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ab546340-7c5f-4037-bfee-597776d4c62d",  "id": "SUSE-SU-2021:0166-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "26cbba42-1251-44e3-8dfa-e43c362fe71d",  "id": "CVE-2025-21690",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: storvsc: Ratelimit warning logs to prevent VM denial of service\n\nIf there's a persistent error in the hypervisor, the SCSI warning for\nfailed I/O can flood the kernel log and max out CPU utilization,\npreventing troubleshooting from the VM side. Ratelimit the warning so\nit doesn't DoS the VM.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b6cc1960-5818-47fe-9f26-1e3976cf9fe0",  "id": "CVE-2012-2121",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2121"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The KVM implementation in the Linux kernel before 3.3.4 does not properly manage the relationships between memory slots and the iommu, which allows guest OS users to cause a denial of service (memory leak and host OS crash) by leveraging administrative access to the guest OS to conduct hotunplug and hotplug operations on devices.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fe46fe53-7fff-4f9f-a268-d6010b33866a",  "id": "CVE-2013-6763",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6763"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The uio_mmap_physical function in drivers/uio/uio.c in the Linux kernel before 3.12 does not validate the size of a memory block, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via crafted mmap operations, a different vulnerability than CVE-2013-4511.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9a6a4f6b-ca98-48a1-a19a-cb3f0db72a7c",  "id": "CVE-2024-50014",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix access to uninitialised lock in fc replay path\n\nThe following kernel trace can be triggered with fstest generic/629 when\nexecuted against a filesystem with fast-commit feature enabled:\n\nINFO: trying to register non-static key.\nThe code is fine but needs lockdep annotation, or maybe\nyou didn't initialize this object before use?\nturning off the locking correctness validator.\nCPU: 0 PID: 866 Comm: mount Not tainted 6.10.0+ #11\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014\nCall Trace:\n <TASK>\n dump_stack_lvl+0x66/0x90\n register_lock_class+0x759/0x7d0\n __lock_acquire+0x85/0x2630\n ? __find_get_block+0xb4/0x380\n lock_acquire+0xd1/0x2d0\n ? __ext4_journal_get_write_access+0xd5/0x160\n _raw_spin_lock+0x33/0x40\n ? __ext4_journal_get_write_access+0xd5/0x160\n __ext4_journal_get_write_access+0xd5/0x160\n ext4_reserve_inode_write+0x61/0xb0\n __ext4_mark_inode_dirty+0x79/0x270\n ? ext4_ext_replay_set_iblocks+0x2f8/0x450\n ext4_ext_replay_set_iblocks+0x330/0x450\n ext4_fc_replay+0x14c8/0x1540\n ? jread+0x88/0x2e0\n ? rcu_is_watching+0x11/0x40\n do_one_pass+0x447/0xd00\n jbd2_journal_recover+0x139/0x1b0\n jbd2_journal_load+0x96/0x390\n ext4_load_and_init_journal+0x253/0xd40\n ext4_fill_super+0x2cc6/0x3180\n...\n\nIn the replay path there's an attempt to lock sbi->s_bdev_wb_lock in\nfunction ext4_check_bdev_write_error().  Unfortunately, at this point this\nspinlock has not been initialized yet.  Moving it's initialization to an\nearlier point in __ext4_fill_super() fixes this splat.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bb13576e-41cc-4b03-af6b-bf0e27e2b57d",  "id": "CVE-2023-52880",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc\n\nAny unprivileged user can attach N_GSM0710 ldisc, but it requires\nCAP_NET_ADMIN to create a GSM network anyway.\n\nRequire initial namespace CAP_NET_ADMIN to do that.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "037ff31e-d8e0-4a2f-b99f-aa23648e6486",  "id": "CVE-2026-46065",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info\n\nHold state of deferred I/O in struct fb_deferred_io_state. Allocate an\ninstance as part of initializing deferred I/O and remove it only after\nthe final mapping has been closed. If the fb_info and the contained\ndeferred I/O meanwhile goes away, clear struct fb_deferred_io_state.info\nto invalidate the mapping. Any access will then result in a SIGBUS\nsignal.\n\nFixes a long-standing problem, where a device hot-unplug happens while\nuser space still has an active mapping of the graphics memory. The hot-\nunplug frees the instance of struct fb_info. Accessing the memory will\noperate on undefined state.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "259c129a-9c19-4be7-a922-48a372c370ff",  "id": "CVE-2016-9604",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9604"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    347,    732  ],  "analysis": {    "state": "in_triage"  },  "description": "It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "56b9f9e3-b54e-4dd4-8833-e75669555aae",  "id": "RHSA-2026:0602",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "33c0c957-5557-45ce-ae1c-09bccaeea9dc",  "id": "CVE-2013-4163",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4163"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The ip6_append_data_mtu function in net/ipv6/ip6_output.c in the IPv6 implementation in the Linux kernel through 3.10.3 does not properly maintain information about whether the IPV6_MTU setsockopt option had been specified, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4b2bc4f0-e31f-4388-b4fb-84b7ee41c553",  "id": "CVE-2021-47181",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47181"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: musb: tusb6010: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "85357914-2efc-429c-b6e0-9fc9c3c89f0a",  "id": "CVE-2013-4350",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4350"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote attackers to obtain sensitive information by sniffing the network.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "98030a6d-596c-4277-b3ae-73cf2f6e13f9",  "id": "CVE-2022-44033",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44033"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4de030a7-50c8-4cf0-b2eb-02ad6d943ece",  "id": "CVE-2023-1206",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1206"  },  "ratings": [    {      "score": 5.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "74bab0a6-38f0-4311-9454-55a3650a7fe0",  "id": "CVE-2020-11725",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11725"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    704  ],  "analysis": {    "state": "in_triage"  },  "description": "snd_ctl_elem_add in sound/core/control.c in the Linux kernel through 5.6.3 has a count=info->owner line, which later affects a private_size*count multiplication for unspecified \"interesting side effects.\" NOTE: kernel engineers dispute this finding, because it could be relevant only if new callers were added that were unfamiliar with the misuse of the info->owner field to represent data unrelated to the \"owner\" concept. The existing callers, SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE, have been designed to misuse the info->owner field in a safe way",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "49e0e390-e85b-4bdd-90c3-db4c0d653625",  "id": "CVE-2024-26769",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fc: avoid deadlock on delete association path\n\nWhen deleting an association the shutdown path is deadlocking because we\ntry to flush the nvmet_wq nested. Avoid this by deadlock by deferring\nthe put work into its own work item.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7a0b11c0-b168-41f3-92dd-da1049433088",  "id": "CVE-2011-1169",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1169"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "Array index error in the asihpi_hpi_ioctl function in sound/pci/asihpi/hpioctl.c in the AudioScience HPI driver in the Linux kernel before 2.6.38.1 might allow local users to cause a denial of service (memory corruption) or possibly gain privileges via a crafted adapter index value that triggers access to an invalid kernel pointer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "648bc47d-6aec-4c6a-9ec3-14aa63da50cb",  "id": "AZL-75791",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2741315-2ff3-4c7c-b6c8-87566d86b233",  "id": "CVE-2021-47142",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47142"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix a use-after-free\n\nlooks like we forget to set ttm->sg to NULL.\nHit panic below\n\n[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI\n[ 1235.989074] Call Trace:\n[ 1235.991751]  sg_free_table+0x17/0x20\n[ 1235.995667]  amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu]\n[ 1236.002288]  amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu]\n[ 1236.008464]  ttm_tt_destroy+0x1e/0x30 [ttm]\n[ 1236.013066]  ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm]\n[ 1236.018783]  ttm_bo_release+0x262/0xa50 [ttm]\n[ 1236.023547]  ttm_bo_put+0x82/0xd0 [ttm]\n[ 1236.027766]  amdgpu_bo_unref+0x26/0x50 [amdgpu]\n[ 1236.032809]  amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu]\n[ 1236.040400]  kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu]\n[ 1236.046912]  kfd_ioctl+0x463/0x690 [amdgpu]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "890c6c61-28e7-4478-bb81-b8b084c83df7",  "id": "ROOT-OS-ALPINE-317-CVE-2026-63072",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a05421b3-b120-45c4-a7bd-71fad702ac81",  "id": "CVE-2022-48769",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi: runtime: avoid EFIv2 runtime services on Apple x86 machines\n\nAditya reports [0] that his recent MacbookPro crashes in the firmware\nwhen using the variable services at runtime. The culprit appears to be a\ncall to QueryVariableInfo(), which we did not use to call on Apple x86\nmachines in the past as they only upgraded from EFI v1.10 to EFI v2.40\nfirmware fairly recently, and QueryVariableInfo() (along with\nUpdateCapsule() et al) was added in EFI v2.00.\n\nThe only runtime service introduced in EFI v2.00 that we actually use in\nLinux is QueryVariableInfo(), as the capsule based ones are optional,\ngenerally not used at runtime (all the LVFS/fwupd firmware update\ninfrastructure uses helper EFI programs that invoke capsule update at\nboot time, not runtime), and not implemented by Apple machines in the\nfirst place. QueryVariableInfo() is used to 'safely' set variables,\ni.e., only when there is enough space. This prevents machines with buggy\nfirmwares from corrupting their NVRAMs when they run out of space.\n\nGiven that Apple machines have been using EFI v1.10 services only for\nthe longest time (the EFI v2.0 spec was released in 2006, and Linux\nsupport for the newly introduced runtime services was added in 2011, but\nthe MacbookPro12,1 released in 2015 still claims to be EFI v1.10 only),\nlet's avoid the EFI v2.0 ones on all Apple x86 machines.\n\n[0] https://lore.kernel.org/all/6D757C75-65B1-468B-842D-10410081A8E4@live.com/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "86a27b38-03e1-4ce8-b637-fb099ff9adf6",  "id": "SUSE-SU-2016:1290-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "974f08b7-3f4d-40ee-a48a-4b258f252b41",  "id": "CVE-2022-49761",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: always report error in run_one_delayed_ref()\n\nCurrently we have a btrfs_debug() for run_one_delayed_ref() failure, but\nif end users hit such problem, there will be no chance that\nbtrfs_debug() is enabled.  This can lead to very little useful info for\ndebugging.\n\nThis patch will:\n\n- Add extra info for error reporting\n  Including:\n  * logical bytenr\n  * num_bytes\n  * type\n  * action\n  * ref_mod\n\n- Replace the btrfs_debug() with btrfs_err()\n\n- Move the error reporting into run_one_delayed_ref()\n  This is to avoid use-after-free, the @node can be freed in the caller.\n\nThis error should only be triggered at most once.\n\nAs if run_one_delayed_ref() failed, we trigger the error message, then\ncausing the call chain to error out:\n\nbtrfs_run_delayed_refs()\n`- btrfs_run_delayed_refs()\n   `- btrfs_run_delayed_refs_for_head()\n      `- run_one_delayed_ref()\n\nAnd we will abort the current transaction in btrfs_run_delayed_refs().\nIf we have to run delayed refs for the abort transaction,\nrun_one_delayed_ref() will just cleanup the refs and do nothing, thus no\nnew error messages would be output.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd4dd519-f21a-460d-a784-dd38c554ae7b",  "id": "CVE-2019-12614",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12614"  },  "ratings": [    {      "score": 4.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e841704b-39be-42a1-a53c-f6adbfaf82c0",  "id": "CVE-2018-15572",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15572"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-userspace spectreRSB attacks.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6e5f5c2d-2760-4022-9a02-0358ef840494",  "id": "CVE-2024-40972",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: do not create EA inode under buffer lock\n\next4_xattr_set_entry() creates new EA inodes while holding buffer lock\non the external xattr block. This is problematic as it nests all the\nallocation locking (which acquires locks on other buffers) under the\nbuffer lock. This can even deadlock when the filesystem is corrupted and\ne.g. quota file is setup to contain xattr block as data block. Move the\nallocation of EA inode out of ext4_xattr_set_entry() into the callers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fdc449f8-c5c0-4677-87cc-20d978fb40c0",  "id": "CVE-2023-52974",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress\n\nIf during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails,\nuserspace could be accessing the host's ipaddress attr. If we then free the\nsession via iscsi_session_teardown() while userspace is still accessing the\nsession we will hit a use after free bug.\n\nSet the tcp_sw_host->session after we have completed session creation and\ncan no longer fail.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "85afafec-cd4c-4991-9a1d-e43dbc4920e2",  "id": "CVE-2022-48795",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Fix data TLB miss in sba_unmap_sg\n\nRolf Eike Beer reported the following bug:\n\n[1274934.746891] Bad Address (null pointer deref?): Code=15 (Data TLB miss fault) at addr 0000004140000018\n[1274934.746891] CPU: 3 PID: 5549 Comm: cmake Not tainted 5.15.4-gentoo-parisc64 #4\n[1274934.746891] Hardware name: 9000/785/C8000\n[1274934.746891]\n[1274934.746891]      YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI\n[1274934.746891] PSW: 00001000000001001111111000001110 Not tainted\n[1274934.746891] r00-03  000000ff0804fe0e 0000000040bc9bc0 00000000406760e4 0000004140000000\n[1274934.746891] r04-07  0000000040b693c0 0000004140000000 000000004a2b08b0 0000000000000001\n[1274934.746891] r08-11  0000000041f98810 0000000000000000 000000004a0a7000 0000000000000001\n[1274934.746891] r12-15  0000000040bddbc0 0000000040c0cbc0 0000000040bddbc0 0000000040bddbc0\n[1274934.746891] r16-19  0000000040bde3c0 0000000040bddbc0 0000000040bde3c0 0000000000000007\n[1274934.746891] r20-23  0000000000000006 000000004a368950 0000000000000000 0000000000000001\n[1274934.746891] r24-27  0000000000001fff 000000000800000e 000000004a1710f0 0000000040b693c0\n[1274934.746891] r28-31  0000000000000001 0000000041f988b0 0000000041f98840 000000004a171118\n[1274934.746891] sr00-03  00000000066e5800 0000000000000000 0000000000000000 00000000066e5800\n[1274934.746891] sr04-07  0000000000000000 0000000000000000 0000000000000000 0000000000000000\n[1274934.746891]\n[1274934.746891] IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000406760e8 00000000406760ec\n[1274934.746891]  IIR: 48780030    ISR: 0000000000000000  IOR: 0000004140000018\n[1274934.746891]  CPU:        3   CR30: 00000040e3a9c000 CR31: ffffffffffffffff\n[1274934.746891]  ORIG_R28: 0000000040acdd58\n[1274934.746891]  IAOQ[0]: sba_unmap_sg+0xb0/0x118\n[1274934.746891]  IAOQ[1]: sba_unmap_sg+0xb4/0x118\n[1274934.746891]  RP(r2): sba_unmap_sg+0xac/0x118\n[1274934.746891] Backtrace:\n[1274934.746891]  [<00000000402740cc>] dma_unmap_sg_attrs+0x6c/0x70\n[1274934.746891]  [<000000004074d6bc>] scsi_dma_unmap+0x54/0x60\n[1274934.746891]  [<00000000407a3488>] mptscsih_io_done+0x150/0xd70\n[1274934.746891]  [<0000000040798600>] mpt_interrupt+0x168/0xa68\n[1274934.746891]  [<0000000040255a48>] __handle_irq_event_percpu+0xc8/0x278\n[1274934.746891]  [<0000000040255c34>] handle_irq_event_percpu+0x3c/0xd8\n[1274934.746891]  [<000000004025ecb4>] handle_percpu_irq+0xb4/0xf0\n[1274934.746891]  [<00000000402548e0>] generic_handle_irq+0x50/0x70\n[1274934.746891]  [<000000004019a254>] call_on_stack+0x18/0x24\n[1274934.746891]\n[1274934.746891] Kernel panic - not syncing: Bad Address (null pointer deref?)\n\nThe bug is caused by overrunning the sglist and incorrectly testing\nsg_dma_len(sglist) before nents. Normally this doesn't cause a crash,\nbut in this case sglist crossed a page boundary. This occurs in the\nfollowing code:\n\n\twhile (sg_dma_len(sglist) && nents--) {\n\nThe fix is simply to test nents first and move the decrement of nents\ninto the loop.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b655ca1-b58b-4f80-a9f8-a6f8ed609e9d",  "id": "CVE-2024-50047",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix UAF in async decryption\n\nDoing an async decryption (large read) crashes with a\nslab-use-after-free way down in the crypto API.\n\nReproducer:\n    # mount.cifs -o ...,seal,esize=1 //srv/share /mnt\n    # dd if=/mnt/largefile of=/dev/null\n    ...\n    [  194.196391] ==================================================================\n    [  194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110\n    [  194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899\n    [  194.197707]\n    [  194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43\n    [  194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014\n    [  194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs]\n    [  194.200032] Call Trace:\n    [  194.200191]  <TASK>\n    [  194.200327]  dump_stack_lvl+0x4e/0x70\n    [  194.200558]  ? gf128mul_4k_lle+0xc1/0x110\n    [  194.200809]  print_report+0x174/0x505\n    [  194.201040]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n    [  194.201352]  ? srso_return_thunk+0x5/0x5f\n    [  194.201604]  ? __virt_addr_valid+0xdf/0x1c0\n    [  194.201868]  ? gf128mul_4k_lle+0xc1/0x110\n    [  194.202128]  kasan_report+0xc8/0x150\n    [  194.202361]  ? gf128mul_4k_lle+0xc1/0x110\n    [  194.202616]  gf128mul_4k_lle+0xc1/0x110\n    [  194.202863]  ghash_update+0x184/0x210\n    [  194.203103]  shash_ahash_update+0x184/0x2a0\n    [  194.203377]  ? __pfx_shash_ahash_update+0x10/0x10\n    [  194.203651]  ? srso_return_thunk+0x5/0x5f\n    [  194.203877]  ? crypto_gcm_init_common+0x1ba/0x340\n    [  194.204142]  gcm_hash_assoc_remain_continue+0x10a/0x140\n    [  194.204434]  crypt_message+0xec1/0x10a0 [cifs]\n    [  194.206489]  ? __pfx_crypt_message+0x10/0x10 [cifs]\n    [  194.208507]  ? srso_return_thunk+0x5/0x5f\n    [  194.209205]  ? srso_return_thunk+0x5/0x5f\n    [  194.209925]  ? srso_return_thunk+0x5/0x5f\n    [  194.210443]  ? srso_return_thunk+0x5/0x5f\n    [  194.211037]  decrypt_raw_data+0x15f/0x250 [cifs]\n    [  194.212906]  ? __pfx_decrypt_raw_data+0x10/0x10 [cifs]\n    [  194.214670]  ? srso_return_thunk+0x5/0x5f\n    [  194.215193]  smb2_decrypt_offload+0x12a/0x6c0 [cifs]\n\nThis is because TFM is being used in parallel.\n\nFix this by allocating a new AEAD TFM for async decryption, but keep\nthe existing one for synchronous READ cases (similar to what is done\nin smb3_calc_signature()).\n\nAlso remove the calls to aead_request_set_callback() and\ncrypto_wait_req() since it's always going to be a synchronous operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "70bf2a95-b2ea-487f-bd4a-507141a12eca",  "id": "CVE-2021-47522",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47522"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bigbenff: prevent null pointer dereference\n\nWhen emulating the device through uhid, there is a chance we don't have\noutput reports and so report_field is null.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dff36206-5c15-4934-9fb2-3c9013fd84f0",  "id": "CVE-2025-38666",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: appletalk: Fix use-after-free in AARP proxy probe\n\nThe AARP proxy‐probe routine (aarp_proxy_probe_network) sends a probe,\nreleases the aarp_lock, sleeps, then re-acquires the lock.  During that\nwindow an expire timer thread (__aarp_expire_timer) can remove and\nkfree() the same entry, leading to a use-after-free.\n\nrace condition:\n\n         cpu 0                          |            cpu 1\n    atalk_sendmsg()                     |   atif_proxy_probe_device()\n    aarp_send_ddp()                     |   aarp_proxy_probe_network()\n    mod_timer()                         |   lock(aarp_lock) // LOCK!!\n    timeout around 200ms                |   alloc(aarp_entry)\n    and then call                       |   proxies[hash] = aarp_entry\n    aarp_expire_timeout()               |   aarp_send_probe()\n                                        |   unlock(aarp_lock) // UNLOCK!!\n    lock(aarp_lock) // LOCK!!           |   msleep(100);\n    __aarp_expire_timer(&proxies[ct])   |\n    free(aarp_entry)                    |\n    unlock(aarp_lock) // UNLOCK!!       |\n                                        |   lock(aarp_lock) // LOCK!!\n                                        |   UAF aarp_entry !!\n\n==================================================================\nBUG: KASAN: slab-use-after-free in aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493\nRead of size 4 at addr ffff8880123aa360 by task repro/13278\n\nCPU: 3 UID: 0 PID: 13278 Comm: repro Not tainted 6.15.2 #3 PREEMPT(full)\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0xc1/0x630 mm/kasan/report.c:521\n kasan_report+0xca/0x100 mm/kasan/report.c:634\n aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493\n atif_proxy_probe_device net/appletalk/ddp.c:332 [inline]\n atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857\n atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818\n sock_do_ioctl+0xdc/0x260 net/socket.c:1190\n sock_ioctl+0x239/0x6a0 net/socket.c:1311\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl fs/ioctl.c:892 [inline]\n __x64_sys_ioctl+0x194/0x200 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcb/0x250 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nAllocated:\n aarp_alloc net/appletalk/aarp.c:382 [inline]\n aarp_proxy_probe_network+0xd8/0x630 net/appletalk/aarp.c:468\n atif_proxy_probe_device net/appletalk/ddp.c:332 [inline]\n atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857\n atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818\n\nFreed:\n kfree+0x148/0x4d0 mm/slub.c:4841\n __aarp_expire net/appletalk/aarp.c:90 [inline]\n __aarp_expire_timer net/appletalk/aarp.c:261 [inline]\n aarp_expire_timeout+0x480/0x6e0 net/appletalk/aarp.c:317\n\nThe buggy address belongs to the object at ffff8880123aa300\n which belongs to the cache kmalloc-192 of size 192\nThe buggy address is located 96 bytes inside of\n freed 192-byte region [ffff8880123aa300, ffff8880123aa3c0)\n\nMemory state around the buggy address:\n ffff8880123aa200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff8880123aa280: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc\n>ffff8880123aa300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                                       ^\n ffff8880123aa380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ffff8880123aa400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n==================================================================",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a92cd7f4-a8ef-476e-b712-78f30b66d4f2",  "id": "CVE-2023-53608",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()\n\nThe finalization of nilfs_segctor_thread() can race with\nnilfs_segctor_kill_thread() which terminates that thread, potentially\ncausing a use-after-free BUG as KASAN detected.\n\nAt the end of nilfs_segctor_thread(), it assigns NULL to \"sc_task\" member\nof \"struct nilfs_sc_info\" to indicate the thread has finished, and then\nnotifies nilfs_segctor_kill_thread() of this using waitqueue\n\"sc_wait_task\" on the struct nilfs_sc_info.\n\nHowever, here, immediately after the NULL assignment to \"sc_task\", it is\npossible that nilfs_segctor_kill_thread() will detect it and return to\ncontinue the deallocation, freeing the nilfs_sc_info structure before the\nthread does the notification.\n\nThis fixes the issue by protecting the NULL assignment to \"sc_task\" and\nits notification, with spinlock \"sc_state_lock\" of the struct\nnilfs_sc_info.  Since nilfs_segctor_kill_thread() does a final check to\nsee if \"sc_task\" is NULL with \"sc_state_lock\" locked, this can eliminate\nthe race.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a80f0cf6-7e67-4db7-9dc3-26c5494b36ca",  "id": "CVE-2023-53437",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Handle cameras with invalid descriptors\n\nIf the source entity does not contain any pads, do not create a link.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4df9788f-a9a8-4841-ae7f-4674f4f8a43c",  "id": "DSA-2309-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0f12af25-c27c-4c0d-bacc-d40d2c5c1610",  "id": "CVE-2015-9289",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9289"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ddca1de9-d6ef-4b1d-aca0-ca35fab8cc55",  "id": "CVE-2014-8884",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8884"  },  "ratings": [    {      "score": 6.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ec9d7993-a9b8-459d-8250-c3dac07b2500",  "id": "CVE-2023-3358",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3358"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "948af94e-1238-466f-9f2b-1224d5dc36e1",  "id": "CVE-2019-15919",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15919"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52292a09-bddc-42fa-b1a0-4cbb5a47c870",  "id": "CVE-2014-3572",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3572"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "02f65c86-c484-4d34-a2a5-e6d4a17f7178",  "id": "SUSE-SU-2016:3199-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cac13ee1-e3d1-40d5-ae13-009cf2488d6a",  "id": "CVE-2026-53208",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig\n\nnet/bluetooth/l2cap_core.c:l2cap_sig_channel() accepts BR/EDR\nsignaling packets up to the channel MTU and dispatches each command\nwithout enforcing the signaling MTU (MTUsig). A Bluetooth BR/EDR peer\nwithin radio range can send a fixed-channel CID 0x0001 packet that is\nlarger than MTUsig and contains many L2CAP_ECHO_REQ commands before\npairing. In a real-radio stock-kernel run, one 681-byte signaling\npacket containing 168 zero-length ECHO_REQ commands made the target\ntransmit 168 ECHO_RSP frames over about 220 ms.\n\nImpact: a Bluetooth BR/EDR peer within radio range, before pairing, can\nforce 168 ECHO_RSP frames from one 681-byte fixed-channel signaling\npacket containing packed ECHO_REQ commands.\n\nDefine Linux's BR/EDR signaling MTU as the spec minimum of 48 bytes and\nreject any larger signaling packet with one L2CAP_COMMAND_REJECT_RSP\ncarrying L2CAP_REJ_MTU_EXCEEDED before any command is dispatched.\n\nThe Bluetooth Core spec wording for MTUExceeded says the reject\nidentifier shall match the first request command in the packet, and\nthat packets containing only responses shall be silently discarded.\nLinux intentionally deviates from that prescription: silently\ndiscarding desynchronizes the peer because the remote stack never\nlearns its responses were dropped, and locating the first request\ncommand requires walking command headers past MTUsig, i.e. processing\nbytes from a packet we have already decided is too large to process.\nWe therefore always emit one reject and use the identifier from the\nfirst command header, a single fixed-offset byte read.\n\nThe unrestricted BR/EDR signaling parser and ECHO_REQ response path both\ntrace to the initial git import; no later introducing commit is\navailable for a Fixes tag.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3087919-a7dd-44b9-b986-389e8e88e284",  "id": "CVE-2023-5158",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5158"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    684  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in vringh_kiov_advance in drivers/vhost/vringh.c in the host side of a virtio ring in the Linux Kernel. This issue may result in a denial of service from guest to host via zero length descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2bc0bbd-8961-44ef-8a9f-0cbd0bb7d9a8",  "id": "CVE-2026-43203",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: fore200e: fix use-after-free in tasklets during device removal\n\nWhen the PCA-200E or SBA-200E adapter is being detached, the fore200e\nis deallocated. However, the tx_tasklet or rx_tasklet may still be running\nor pending, leading to use-after-free bug when the already freed fore200e\nis accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet().\n\nOne of the race conditions can occur as follows:\n\nCPU 0 (cleanup)           | CPU 1 (tasklet)\nfore200e_pca_remove_one() | fore200e_interrupt()\n  fore200e_shutdown()     |   tasklet_schedule()\n    kfree(fore200e)       | fore200e_tx_tasklet()\n                          |   fore200e-> // UAF\n\nFix this by ensuring tx_tasklet or rx_tasklet is properly canceled before\nthe fore200e is released. Add tasklet_kill() in fore200e_shutdown() to\nsynchronize with any pending or running tasklets. Moreover, since\nfore200e_reset() could prevent further interrupts or data transfers,\nthe tasklet_kill() should be placed after fore200e_reset() to prevent\nthe tasklet from being rescheduled in fore200e_interrupt(). Finally,\nit only needs to do tasklet_kill() when the fore200e state is greater\nthan or equal to FORE200E_STATE_IRQ, since tasklets are uninitialized\nin earlier states. In a word, the tasklet_kill() should be placed in\nthe FORE200E_STATE_IRQ branch within the switch...case structure.\n\nThis bug was identified through static analysis.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6580ece5-4d5c-4351-b031-04014214e941",  "id": "CVE-2013-3233",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3233"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The llcp_sock_recvmsg function in net/nfc/llcp/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable and a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b64a014-a359-416b-9453-17b26186e6f1",  "id": "CVE-2017-2647",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2647"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "22779c79-6710-4f2b-a840-121f0c08d7de",  "id": "CVE-2017-17864",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17864"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially sensitive address information, aka a \"pointer leak.\"",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5cf08b9-e4be-4a0f-a47c-d4fe69683645",  "id": "CVE-2024-46863",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item\n\nThere is no links_num in struct snd_soc_acpi_mach {}, and we test\n!link->num_adr as a condition to end the loop in hda_sdw_machine_select().\nSo an empty item in struct snd_soc_acpi_link_adr array is required.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fe25fa30-1c50-49bd-9a84-4387a18a6654",  "id": "CVE-2021-46283",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46283"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    665  ],  "analysis": {    "state": "in_triage"  },  "description": "nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "55f28507-5e19-4295-853d-57c4e83d5a25",  "id": "CVE-2015-5283",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5283"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The sctp_init function in net/sctp/protocol.c in the Linux kernel before 4.2.3 has an incorrect sequence of protocol-initialization steps, which allows local users to cause a denial of service (panic or memory corruption) by creating SCTP sockets before all of the steps have finished.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e807527-8d83-49c5-9cf4-666390e86f67",  "id": "CVE-2024-42134",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-pci: Check if is_avq is NULL\n\n[bug]\nIn the virtio_pci_common.c function vp_del_vqs, vp_dev->is_avq is involved\nto determine whether it is admin virtqueue, but this function vp_dev->is_avq\n may be empty. For installations, virtio_pci_legacy does not assign a value\n to vp_dev->is_avq.\n\n[fix]\nCheck whether it is vp_dev->is_avq before use.\n\n[test]\nTest with virsh Attach device\nBefore this patch, the following command would crash the guest system\n\nAfter applying the patch, everything seems to be working fine.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ebafad78-1ab0-4d72-8fc9-9d4e1bd3da56",  "id": "CVE-2021-47348",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47348"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Avoid HDCP over-read and corruption\n\nInstead of reading the desired 5 bytes of the actual target field,\nthe code was reading 8. This could result in a corrupted value if the\ntrailing 3 bytes were non-zero, so instead use an appropriately sized\nand zero-initialized bounce buffer, and read only 5 bytes before casting\nto u64.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "21ac0512-fc16-49cb-9290-621856ae56c5",  "id": "CVE-2017-2671",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2671"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:42135'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:142872/Linux-Kernel-ping-Denial-Of-Service.html'"    }  ]},{  "bom-ref": "f215387e-c5cc-4244-b0d4-e797b1bb84e5",  "id": "AZL-34577",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f5ef6f31-eee3-4045-a0d8-44311ef2fa1e",  "id": "CVE-2021-29649",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29649"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.11.11. The user mode driver (UMD) has a copy_process() memory leak, related to a lack of cleanup steps in kernel/usermode_driver.c and kernel/bpf/preload/bpf_preload_kern.c, aka CID-f60a85cad677.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bbc7f4b3-09c1-4ff3-ba90-cffa2ed13831",  "id": "CVE-2016-6516",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6516"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119,    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the ioctl_file_dedupe_range function in fs/ioctl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (heap-based buffer overflow) or possibly gain privileges by changing a certain count value, aka a \"double fetch\" vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a550cfb7-43eb-4e2e-bfd1-b02bf7ac2362",  "id": "CVE-2024-26643",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout\n\nWhile the rhashtable set gc runs asynchronously, a race allows it to\ncollect elements from anonymous sets with timeouts while it is being\nreleased from the commit path.\n\nMingi Cho originally reported this issue in a different path in 6.1.x\nwith a pipapo set with low timeouts which is not possible upstream since\n7395dfacfff6 (\"netfilter: nf_tables: use timestamp to check for set\nelement timeout\").\n\nFix this by setting on the dead flag for anonymous sets to skip async gc\nin this case.\n\nAccording to 08e4c8c5919f (\"netfilter: nf_tables: mark newset as dead on\ntransaction abort\"), Florian plans to accelerate abort path by releasing\nobjects via workqueue, therefore, this sets on the dead flag for abort\npath too.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5aec8448-90b0-43fb-8a4b-790624efce15",  "id": "CVE-2022-48423",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48423"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2dc56c86-0a67-4e15-8fc4-d0d47c6f4dac",  "id": "CVE-2008-5077",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5077"  },  "ratings": [    {      "score": 5.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a07abb8-397c-48bd-94aa-4db348794fbc",  "id": "DLA-3325-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ac198325-b6a4-4494-b1f4-954e5b31b41d",  "id": "CVE-2023-33951",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33951"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N"    }  ],  "cwes": [    362,    413,    667  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c0e660af-e86a-4450-a6a7-fe535ff0fcea",  "id": "AZL-91275",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3a8669d1-32cc-4c66-b446-3d7c58208768",      "versions": [        {          "component": "radvd",          "version": "1.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d777472-701f-4521-a461-b944e77130e7",  "id": "AZL-86760",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0875382-2880-4409-b92d-ba5845ff1f81",  "id": "CLSA-2025-1760712798",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a4cdc29d-5da4-441a-aead-925bfd29efa0",  "id": "RHSA-2026:3042",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "331f33ed-6b0e-4b61-9452-7ead6052463e",  "id": "AZL-25936",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "efc70491-5c65-49dc-961e-ff8914c5a8a9",  "id": "CVE-2013-2058",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2058"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The host_start function in drivers/usb/chipidea/host.c in the Linux kernel before 3.7.4 does not properly support a certain non-streaming option, which allows local users to cause a denial of service (system crash) by sending a large amount of network traffic through a USB/Ethernet adapter.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ca0545dd-c828-4ae8-8844-5d3b44f3267c",  "id": "CVE-2022-50474",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacintosh: fix possible memory leak in macio_add_one_device()\n\nAfer commit 1fa5ae857bb1 (\"driver core: get rid of struct device's\nbus_id string array\"), the name of device is allocated dynamically. It\nneeds to be freed when of_device_register() fails. Call put_device() to\ngive up the reference that's taken in device_initialize(), so that it\ncan be freed in kobject_cleanup() when the refcount hits 0.\n\nmacio device is freed in macio_release_dev(), so the kfree() can be\nremoved.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c7aefcdc-b757-4801-8aa3-f492603a8bad",  "id": "CVE-2020-25643",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25643"  },  "ratings": [    {      "score": 7.2,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bb8f32d3-d490-4d26-8fbb-76468523d3ae",  "id": "CVE-2023-52831",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpu/hotplug: Don't offline the last non-isolated CPU\n\nIf a system has isolated CPUs via the \"isolcpus=\" command line parameter,\nthen an attempt to offline the last housekeeping CPU will result in a\nWARN_ON() when rebuilding the scheduler domains and a subsequent panic due\nto and unhandled empty CPU mas in partition_sched_domains_locked().\n\ncpuset_hotplug_workfn()\n  rebuild_sched_domains_locked()\n    ndoms = generate_sched_domains(&doms, &attr);\n      cpumask_and(doms[0], top_cpuset.effective_cpus, housekeeping_cpumask(HK_FLAG_DOMAIN));\n\nThus results in an empty CPU mask which triggers the warning and then the\nsubsequent crash:\n\nWARNING: CPU: 4 PID: 80 at kernel/sched/topology.c:2366 build_sched_domains+0x120c/0x1408\nCall trace:\n build_sched_domains+0x120c/0x1408\n partition_sched_domains_locked+0x234/0x880\n rebuild_sched_domains_locked+0x37c/0x798\n rebuild_sched_domains+0x30/0x58\n cpuset_hotplug_workfn+0x2a8/0x930\n\nUnable to handle kernel paging request at virtual address fffe80027ab37080\n partition_sched_domains_locked+0x318/0x880\n rebuild_sched_domains_locked+0x37c/0x798\n\nAside of the resulting crash, it does not make any sense to offline the last\nlast housekeeping CPU.\n\nPrevent this by masking out the non-housekeeping CPUs when selecting a\ntarget CPU for initiating the CPU unplug operation via the work queue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48a5e206-65a5-4865-aed0-3cbcfca0eb1f",  "id": "CVE-2016-7097",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7097"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    285  ],  "analysis": {    "state": "in_triage"  },  "description": "The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bb11e2ae-d314-4599-901c-c3d88fcb35a5",  "id": "CVE-2013-5634",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5634"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:H/Au:S/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/arm/kvm/arm.c in the Linux kernel before 3.10 on the ARM platform, when KVM is used, allows host OS users to cause a denial of service (NULL pointer dereference, OOPS, and host OS crash) or possibly have unspecified other impact by omitting vCPU initialization before a KVM_GET_REG_LIST ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b6c9377-ee1a-421b-8485-1441d289d336",  "id": "openSUSE-SU-2019:2669-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf9fb6ca-9eff-464f-a5cd-3053a299517f",  "id": "CVE-2024-42073",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems\n\nThe following two shared buffer operations make use of the Shared Buffer\nStatus Register (SBSR):\n\n # devlink sb occupancy snapshot pci/0000:01:00.0\n # devlink sb occupancy clearmax pci/0000:01:00.0\n\nThe register has two masks of 256 bits to denote on which ingress /\negress ports the register should operate on. Spectrum-4 has more than\n256 ports, so the register was extended by cited commit with a new\n'port_page' field.\n\nHowever, when filling the register's payload, the driver specifies the\nports as absolute numbers and not relative to the first port of the port\npage, resulting in memory corruptions [1].\n\nFix by specifying the ports relative to the first port of the port page.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0\nRead of size 1 at addr ffff8881068cb00f by task devlink/1566\n[...]\nCall Trace:\n <TASK>\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0\n mlxsw_devlink_sb_occ_snapshot+0x75/0xb0\n devlink_nl_sb_occ_snapshot_doit+0x1f9/0x2a0\n genl_family_rcv_msg_doit+0x20c/0x300\n genl_rcv_msg+0x567/0x800\n netlink_rcv_skb+0x170/0x450\n genl_rcv+0x2d/0x40\n netlink_unicast+0x547/0x830\n netlink_sendmsg+0x8d4/0xdb0\n __sys_sendto+0x49b/0x510\n __x64_sys_sendto+0xe5/0x1c0\n do_syscall_64+0xc1/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[...]\nAllocated by task 1:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n copy_verifier_state+0xbc2/0xfb0\n do_check_common+0x2c51/0xc7e0\n bpf_check+0x5107/0x9960\n bpf_prog_load+0xf0e/0x2690\n __sys_bpf+0x1a61/0x49d0\n __x64_sys_bpf+0x7d/0xc0\n do_syscall_64+0xc1/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 1:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x109/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xca/0x2b0\n free_verifier_state+0xce/0x270\n do_check_common+0x4828/0xc7e0\n bpf_check+0x5107/0x9960\n bpf_prog_load+0xf0e/0x2690\n __sys_bpf+0x1a61/0x49d0\n __x64_sys_bpf+0x7d/0xc0\n do_syscall_64+0xc1/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fb1059ae-ca00-4a0d-beb5-f86db3a270bf",  "id": "CVE-2024-40970",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nAvoid hw_desc array overrun in dw-axi-dmac\n\nI have a use case where nr_buffers = 3 and in which each descriptor is composed by 3\nsegments, resulting in the DMA channel descs_allocated to be 9. Since axi_desc_put()\nhandles the hw_desc considering the descs_allocated, this scenario would result in a\nkernel panic (hw_desc array will be overrun).\n\nTo fix this, the proposal is to add a new member to the axi_dma_desc structure,\nwhere we keep the number of allocated hw_descs (axi_desc_alloc()) and use it in\naxi_desc_put() to handle the hw_desc array correctly.\n\nAdditionally I propose to remove the axi_chan_start_first_queued() call after completing\nthe transfer, since it was identified that unbalance can occur (started descriptors can\nbe interrupted and transfer ignored due to DMA channel not being enabled).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "19971688-c238-4f80-85bc-14fbe5d70d9c",  "id": "OESA-2024-1905",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "713ec0bb-44ef-4f97-9e64-7d8b8fa12cb0",  "id": "CVE-2011-1023",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1023"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The Reliable Datagram Sockets (RDS) subsystem in the Linux kernel before 2.6.38 does not properly handle congestion map updates, which allows local users to cause a denial of service (BUG_ON and system crash) via vectors involving (1) a loopback (aka loop) transmit operation or (2) an InfiniBand (aka ib) transmit operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c39315f-42de-4957-b769-a77133bb9656",  "id": "AZL-82067",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2194ee27-04e6-4010-ba0c-57c746692c5d",  "id": "CVE-2021-32078",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32078"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a check for a value that shouldn't be negative, e.g., access to element -2 of an array, aka CID-298a58e165e4.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1adfe0fc-0e66-41cd-9fe4-bcd7b01f8618",  "id": "CVE-2010-2495",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2495"  },  "ratings": [    {      "score": 10,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The pppol2tp_xmit function in drivers/net/pppol2tp.c in the L2TP implementation in the Linux kernel before 2.6.34 does not properly validate certain values associated with an interface, which allows attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via vectors related to a routing change.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fefd92a7-9f8c-4efd-9250-76217667f375",  "id": "CVE-2022-49122",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: prevent potential spectre v1 gadget\n\nIt appears like cmd could be a Spectre v1 gadget as it's supplied by a\nuser and used as an array index. Prevent the contents of kernel memory\nfrom being leaked to userspace via speculative execution by using\narray_index_nospec.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5c72ec3e-66b9-4d83-b68c-8be0a908990b",  "id": "CVE-2020-13974",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13974"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_ascii is called several times in a row, aka CID-b86dab054059. NOTE: Members in the community argue that the integer overflow does not lead to a security issue in this case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f80112c-f790-4893-8247-f6d608364452",  "id": "CVE-2023-0459",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0459"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    763  ],  "analysis": {    "state": "in_triage"  },  "description": "Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the \"access_ok\" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff542094-c1cc-463d-9274-78afd397d143",  "id": "SUSE-SU-2021:3144-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31a6ca95-1ca9-48bb-bf05-8a827a19c767",  "id": "CVE-2022-48739",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: hdmi-codec: Fix OOB memory accesses\n\nCorrect size of iec_status array by changing it to the size of status\narray of the struct snd_aes_iec958. This fixes out-of-bounds slab\nread accesses made by memcpy() of the hdmi-codec driver. This problem\nis reported by KASAN.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2514b11-fd37-4ba4-a5fc-9481bcf180df",  "id": "CVE-2023-52749",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: Fix null dereference on suspend\n\nA race condition exists where a synchronous (noqueue) transfer can be\nactive during a system suspend. This can cause a null pointer\ndereference exception to occur when the system resumes.\n\nExample order of events leading to the exception:\n1. spi_sync() calls __spi_transfer_message_noqueue() which sets\n   ctlr->cur_msg\n2. Spi transfer begins via spi_transfer_one_message()\n3. System is suspended interrupting the transfer context\n4. System is resumed\n6. spi_controller_resume() calls spi_start_queue() which resets cur_msg\n   to NULL\n7. Spi transfer context resumes and spi_finalize_current_message() is\n   called which dereferences cur_msg (which is now NULL)\n\nWait for synchronous transfers to complete before suspending by\nacquiring the bus mutex and setting/checking a suspend flag.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "026c61f5-83e5-4f77-8d06-2e1880e1cf2c",  "id": "CVE-2026-31676",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: only handle RESPONSE during service challenge\n\nOnly process RESPONSE packets while the service connection is still in\nRXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before\nrunning response verification and security initialization, then use a local\nsecured flag to decide whether to queue the secured-connection work after\nthe state transition. This keeps duplicate or late RESPONSE packets from\nre-running the setup path and removes the unlocked post-transition state\ntest.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "601f0c2d-933a-483b-a72d-e55d84d720c8",  "id": "CVE-2022-1353",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1353"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "555c7c06-7cc3-49a7-9b67-b33aa453d9b5",  "id": "CVE-2026-31751",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: dt2815: add hardware detection to prevent crash\n\nThe dt2815 driver crashes when attached to I/O ports without actual\nhardware present. This occurs because syzkaller or users can attach\nthe driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.\n\nWhen no hardware exists at the specified port, inb() operations return\n0xff (floating bus), but outb() operations can trigger page faults due\nto undefined behavior, especially under race conditions:\n\n  BUG: unable to handle page fault for address: 000000007fffff90\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  RIP: 0010:dt2815_attach+0x6e0/0x1110\n\nAdd hardware detection by reading the status register before attempting\nany write operations. If the read returns 0xff, assume no hardware is\npresent and fail the attach with -ENODEV. This prevents crashes from\noutb() operations on non-existent hardware.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "366ebae2-2281-4184-aa77-535f415f02ca",  "id": "CVE-2024-42225",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.300000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: replace skb_put with skb_put_zero\n\nAvoid potentially reusing uninitialized data",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf7289ba-304a-4399-acc5-aecfeca05a91",  "id": "CVE-2017-15265",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15265"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17cff229-aec1-4731-95b1-40eef3775e5f",  "id": "CVE-2022-50341",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix oops during encryption\n\nWhen running xfstests against Azure the following oops occurred on an\narm64 system\n\n  Unable to handle kernel write to read-only memory at virtual address\n  ffff0001221cf000\n  Mem abort info:\n    ESR = 0x9600004f\n    EC = 0x25: DABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n    FSC = 0x0f: level 3 permission fault\n  Data abort info:\n    ISV = 0, ISS = 0x0000004f\n    CM = 0, WnR = 1\n  swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000\n  [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003,\n  pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787\n  Internal error: Oops: 9600004f [#1] PREEMPT SMP\n  ...\n  pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)\n  pc : __memcpy+0x40/0x230\n  lr : scatterwalk_copychunks+0xe0/0x200\n  sp : ffff800014e92de0\n  x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008\n  x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008\n  x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000\n  x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014\n  x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058\n  x14: 0000000000000001 x13: 0000000000000008 x12: ffff000114f2e590\n  x11: ffffffffffffffff x10: 0000040000000000 x9 : ffff8000105c3580\n  x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005\n  x5 : ffff0001221cf008 x4 : ffff0001037c4490 x3 : 0000000000000001\n  x2 : 0000000000000008 x1 : ffff0001037c4488 x0 : ffff0001221cf000\n  Call trace:\n   __memcpy+0x40/0x230\n   scatterwalk_map_and_copy+0x98/0x100\n   crypto_ccm_encrypt+0x150/0x180\n   crypto_aead_encrypt+0x2c/0x40\n   crypt_message+0x750/0x880\n   smb3_init_transform_rq+0x298/0x340\n   smb_send_rqst.part.11+0xd8/0x180\n   smb_send_rqst+0x3c/0x100\n   compound_send_recv+0x534/0xbc0\n   smb2_query_info_compound+0x32c/0x440\n   smb2_set_ea+0x438/0x4c0\n   cifs_xattr_set+0x5d4/0x7c0\n\nThis is because in scatterwalk_copychunks(), we attempted to write to\na buffer (@sign) that was allocated in the stack (vmalloc area) by\ncrypt_message() and thus accessing its remaining 8 (x2) bytes ended up\ncrossing a page boundary.\n\nTo simply fix it, we could just pass @sign kmalloc'd from\ncrypt_message() and then we're done.  Luckily, we don't seem to pass\nany other vmalloc'd buffers in smb_rqst::rq_iov...\n\nInstead, let's map the correct pages and offsets from vmalloc buffers\nas well in cifs_sg_set_buf() and then avoiding such oopses.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "928be159-99ff-43a3-8462-96c69092665a",  "id": "openSUSE-SU-2021:0519-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c48f73a4-2148-40d6-9637-929ec540af2d",  "id": "CVE-2023-52915",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer\n\nIn af9035_i2c_master_xfer, msg is controlled by user. When msg[i].buf\nis null and msg[i].len is zero, former checks on msg[i].buf would be\npassed. Malicious data finally reach af9035_i2c_master_xfer. If accessing\nmsg[i].buf[0] without sanity check, null ptr deref would happen.\nWe add check on msg[i].len to prevent crash.\n\nSimilar commit:\ncommit 0ed554fd769a\n(\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d9b962a-091e-4f00-a9c2-b54463ffe15d",  "id": "CLSA-2024-1730801437",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8fea1c26-828d-4ce7-bd3d-39ff35d42a70",  "id": "CVE-2011-2700",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2700"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple buffer overflows in the si4713_write_econtrol_string function in drivers/media/radio/si4713-i2c.c in the Linux kernel before 2.6.39.4 on the N900 platform might allow local users to cause a denial of service or have unspecified other impact via a crafted s_ext_ctrls operation with a (1) V4L2_CID_RDS_TX_PS_NAME or (2) V4L2_CID_RDS_TX_RADIO_TEXT control ID.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "938f543e-c386-4a4c-be81-00b24b65c7da",  "id": "DSA-2390-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d566f9d9-11c9-4dbb-a854-050df8c86780",  "id": "CVE-2020-12654",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12654"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "74fe13e9-a6ff-4464-a9fb-dca5df054904",  "id": "CVE-2018-11508",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11508"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitive information from kernel memory via adjtimex.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:46208'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:151241/Linux-Kernel-4.13-compat_get_timex-Kernel-Pointer-Leak.html'"    }  ]},{  "bom-ref": "8b9421cb-10f9-4cc6-a477-8be7427b9543",  "id": "SUSE-SU-2024:0842-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "62e921e0-e92f-44c1-b87e-e6d474f4d30e",  "id": "CVE-2024-43882",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    367  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: Fix ToCToU between perm check and set-uid/gid usage\n\nWhen opening a file for exec via do_filp_open(), permission checking is\ndone against the file's metadata at that moment, and on success, a file\npointer is passed back. Much later in the execve() code path, the file\nmetadata (specifically mode, uid, and gid) is used to determine if/how\nto set the uid and gid. However, those values may have changed since the\npermissions check, meaning the execution may gain unintended privileges.\n\nFor example, if a file could change permissions from executable and not\nset-id:\n\n---------x 1 root root 16048 Aug  7 13:16 target\n\nto set-id and non-executable:\n\n---S------ 1 root root 16048 Aug  7 13:16 target\n\nit is possible to gain root privileges when execution should have been\ndisallowed.\n\nWhile this race condition is rare in real-world scenarios, it has been\nobserved (and proven exploitable) when package managers are updating\nthe setuid bits of installed programs. Such files start with being\nworld-executable but then are adjusted to be group-exec with a set-uid\nbit. For example, \"chmod o-x,u+s target\" makes \"target\" executable only\nby uid \"root\" and gid \"cdrom\", while also becoming setuid-root:\n\n-rwxr-xr-x 1 root cdrom 16048 Aug  7 13:16 target\n\nbecomes:\n\n-rwsr-xr-- 1 root cdrom 16048 Aug  7 13:16 target\n\nBut racing the chmod means users without group \"cdrom\" membership can\nget the permission to execute \"target\" just before the chmod, and when\nthe chmod finishes, the exec reaches brpm_fill_uid(), and performs the\nsetuid to root, violating the expressed authorization of \"only cdrom\ngroup members can setuid to root\".\n\nRe-check that we still have execute permissions in case the metadata\nhas changed. It would be better to keep a copy from the perm-check time,\nbut until we can do that refactoring, the least-bad option is to do a\nfull inode_permission() call (under inode lock). It is understood that\nthis is safe against dead-locks, but hardly optimal.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb5d114a-9885-4fb3-b68f-95bd914c1090",  "id": "CVE-2022-49465",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-throttle: Set BIO_THROTTLED when bio has been throttled\n\n1.In current process, all bio will set the BIO_THROTTLED flag\nafter __blk_throtl_bio().\n\n2.If bio needs to be throttled, it will start the timer and\nstop submit bio directly. Bio will submit in\nblk_throtl_dispatch_work_fn() when the timer expires.But in\nthe current process, if bio is throttled. The BIO_THROTTLED\nwill be set to bio after timer start. If the bio has been\ncompleted, it may cause use-after-free blow.\n\nBUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70\nRead of size 2 at addr ffff88801b8902d4 by task fio/26380\n\n dump_stack+0x9b/0xce\n print_address_description.constprop.6+0x3e/0x60\n kasan_report.cold.9+0x22/0x3a\n blk_throtl_bio+0x12f0/0x2c70\n submit_bio_checks+0x701/0x1550\n submit_bio_noacct+0x83/0xc80\n submit_bio+0xa7/0x330\n mpage_readahead+0x380/0x500\n read_pages+0x1c1/0xbf0\n page_cache_ra_unbounded+0x471/0x6f0\n do_page_cache_ra+0xda/0x110\n ondemand_readahead+0x442/0xae0\n page_cache_async_ra+0x210/0x300\n generic_file_buffered_read+0x4d9/0x2130\n generic_file_read_iter+0x315/0x490\n blkdev_read_iter+0x113/0x1b0\n aio_read+0x2ad/0x450\n io_submit_one+0xc8e/0x1d60\n __se_sys_io_submit+0x125/0x350\n do_syscall_64+0x2d/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nAllocated by task 26380:\n kasan_save_stack+0x19/0x40\n __kasan_kmalloc.constprop.2+0xc1/0xd0\n kmem_cache_alloc+0x146/0x440\n mempool_alloc+0x125/0x2f0\n bio_alloc_bioset+0x353/0x590\n mpage_alloc+0x3b/0x240\n do_mpage_readpage+0xddf/0x1ef0\n mpage_readahead+0x264/0x500\n read_pages+0x1c1/0xbf0\n page_cache_ra_unbounded+0x471/0x6f0\n do_page_cache_ra+0xda/0x110\n ondemand_readahead+0x442/0xae0\n page_cache_async_ra+0x210/0x300\n generic_file_buffered_read+0x4d9/0x2130\n generic_file_read_iter+0x315/0x490\n blkdev_read_iter+0x113/0x1b0\n aio_read+0x2ad/0x450\n io_submit_one+0xc8e/0x1d60\n __se_sys_io_submit+0x125/0x350\n do_syscall_64+0x2d/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFreed by task 0:\n kasan_save_stack+0x19/0x40\n kasan_set_track+0x1c/0x30\n kasan_set_free_info+0x1b/0x30\n __kasan_slab_free+0x111/0x160\n kmem_cache_free+0x94/0x460\n mempool_free+0xd6/0x320\n bio_free+0xe0/0x130\n bio_put+0xab/0xe0\n bio_endio+0x3a6/0x5d0\n blk_update_request+0x590/0x1370\n scsi_end_request+0x7d/0x400\n scsi_io_completion+0x1aa/0xe50\n scsi_softirq_done+0x11b/0x240\n blk_mq_complete_request+0xd4/0x120\n scsi_mq_done+0xf0/0x200\n virtscsi_vq_done+0xbc/0x150\n vring_interrupt+0x179/0x390\n __handle_irq_event_percpu+0xf7/0x490\n handle_irq_event_percpu+0x7b/0x160\n handle_irq_event+0xcc/0x170\n handle_edge_irq+0x215/0xb20\n common_interrupt+0x60/0x120\n asm_common_interrupt+0x1e/0x40\n\nFix this by move BIO_THROTTLED set into the queue_lock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bba89a7a-4e51-4073-9fe8-b8b287db4345",  "id": "CVE-2024-57975",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    459  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do proper folio cleanup when run_delalloc_nocow() failed\n\n[BUG]\nWith CONFIG_DEBUG_VM set, test case generic/476 has some chance to crash\nwith the following VM_BUG_ON_FOLIO():\n\n  BTRFS error (device dm-3): cow_file_range failed, start 1146880 end 1253375 len 106496 ret -28\n  BTRFS error (device dm-3): run_delalloc_nocow failed, start 1146880 end 1253375 len 106496 ret -28\n  page: refcount:4 mapcount:0 mapping:00000000592787cc index:0x12 pfn:0x10664\n  aops:btrfs_aops [btrfs] ino:101 dentry name(?):\"f1774\"\n  flags: 0x2fffff80004028(uptodate|lru|private|node=0|zone=2|lastcpupid=0xfffff)\n  page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio))\n  ------------[ cut here ]------------\n  kernel BUG at mm/page-writeback.c:2992!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n  CPU: 2 UID: 0 PID: 3943513 Comm: kworker/u24:15 Tainted: G           OE      6.12.0-rc7-custom+ #87\n  Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n  Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022\n  Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]\n  pc : folio_clear_dirty_for_io+0x128/0x258\n  lr : folio_clear_dirty_for_io+0x128/0x258\n  Call trace:\n   folio_clear_dirty_for_io+0x128/0x258\n   btrfs_folio_clamp_clear_dirty+0x80/0xd0 [btrfs]\n   __process_folios_contig+0x154/0x268 [btrfs]\n   extent_clear_unlock_delalloc+0x5c/0x80 [btrfs]\n   run_delalloc_nocow+0x5f8/0x760 [btrfs]\n   btrfs_run_delalloc_range+0xa8/0x220 [btrfs]\n   writepage_delalloc+0x230/0x4c8 [btrfs]\n   extent_writepage+0xb8/0x358 [btrfs]\n   extent_write_cache_pages+0x21c/0x4e8 [btrfs]\n   btrfs_writepages+0x94/0x150 [btrfs]\n   do_writepages+0x74/0x190\n   filemap_fdatawrite_wbc+0x88/0xc8\n   start_delalloc_inodes+0x178/0x3a8 [btrfs]\n   btrfs_start_delalloc_roots+0x174/0x280 [btrfs]\n   shrink_delalloc+0x114/0x280 [btrfs]\n   flush_space+0x250/0x2f8 [btrfs]\n   btrfs_async_reclaim_data_space+0x180/0x228 [btrfs]\n   process_one_work+0x164/0x408\n   worker_thread+0x25c/0x388\n   kthread+0x100/0x118\n   ret_from_fork+0x10/0x20\n  Code: 910a8021 a90363f7 a9046bf9 94012379 (d4210000)\n  ---[ end trace 0000000000000000 ]---\n\n[CAUSE]\nThe first two lines of extra debug messages show the problem is caused\nby the error handling of run_delalloc_nocow().\n\nE.g. we have the following dirtied range (4K blocksize 4K page size):\n\n    0                 16K                  32K\n    |//////////////////////////////////////|\n    |  Pre-allocated  |\n\nAnd the range [0, 16K) has a preallocated extent.\n\n- Enter run_delalloc_nocow() for range [0, 16K)\n  Which found range [0, 16K) is preallocated, can do the proper NOCOW\n  write.\n\n- Enter fallback_to_fow() for range [16K, 32K)\n  Since the range [16K, 32K) is not backed by preallocated extent, we\n  have to go COW.\n\n- cow_file_range() failed for range [16K, 32K)\n  So cow_file_range() will do the clean up by clearing folio dirty,\n  unlock the folios.\n\n  Now the folios in range [16K, 32K) is unlocked.\n\n- Enter extent_clear_unlock_delalloc() from run_delalloc_nocow()\n  Which is called with PAGE_START_WRITEBACK to start page writeback.\n  But folios can only be marked writeback when it's properly locked,\n  thus this triggered the VM_BUG_ON_FOLIO().\n\nFurthermore there is another hidden but common bug that\nrun_delalloc_nocow() is not clearing the folio dirty flags in its error\nhandling path.\nThis is the common bug shared between run_delalloc_nocow() and\ncow_file_range().\n\n[FIX]\n- Clear folio dirty for range [@start, @cur_offset)\n  Introduce a helper, cleanup_dirty_folios(), which\n  will find and lock the folio in the range, clear the dirty flag and\n  start/end the writeback, with the extra handling for the\n  @locked_folio.\n\n- Introduce a helper to clear folio dirty, start and end writeback\n\n- Introduce a helper to record the last failed COW range end\n  This is to trace which range we should skip, to avoid double\n  unlocking.\n\n- Skip the failed COW range for the e\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6a0a4772-08e6-4c54-866e-87a553f8a209",  "id": "CVE-2026-43118",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix zero size inode with non-zero size after log replay\n\nWhen logging that an inode exists, as part of logging a new name or\nlogging new dir entries for a directory, we always set the generation of\nthe logged inode item to 0. This is to signal during log replay (in\noverwrite_item()), that we should not set the i_size since we only logged\nthat an inode exists, so the i_size of the inode in the subvolume tree\nmust be preserved (as when we log new names or that an inode exists, we\ndon't log extents).\n\nThis works fine except when we have already logged an inode in full mode\nor it's the first time we are logging an inode created in a past\ntransaction, that inode has a new i_size of 0 and then we log a new name\nfor the inode (due to a new hardlink or a rename), in which case we log\nan i_size of 0 for the inode and a generation of 0, which causes the log\nreplay code to not update the inode's i_size to 0 (in overwrite_item()).\n\nAn example scenario:\n\n  mkdir /mnt/dir\n  xfs_io -f -c \"pwrite 0 64K\" /mnt/dir/foo\n\n  sync\n\n  xfs_io -c \"truncate 0\" -c \"fsync\" /mnt/dir/foo\n\n  ln /mnt/dir/foo /mnt/dir/bar\n\n  xfs_io -c \"fsync\" /mnt/dir\n\n  <power fail>\n\nAfter log replay the file remains with a size of 64K. This is because when\nwe first log the inode, when we fsync file foo, we log its current i_size\nof 0, and then when we create a hard link we log again the inode in exists\nmode (LOG_INODE_EXISTS) but we set a generation of 0 for the inode item we\nadd to the log tree, so during log replay overwrite_item() sees that the\ngeneration is 0 and i_size is 0 so we skip updating the inode's i_size\nfrom 64K to 0.\n\nFix this by making sure at fill_inode_item() we always log the real\ngeneration of the inode if it was logged in the current transaction with\nthe i_size we logged before. Also if an inode created in a previous\ntransaction is logged in exists mode only, make sure we log the i_size\nstored in the inode item located from the commit root, so that if we log\nmultiple times that the inode exists we get the correct i_size.\n\nA test case for fstests will follow soon.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ea628ad4-a3f3-40d5-9366-5cc0ed410e4b",  "id": "CVE-2022-3635",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3635"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119,    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the identifier assigned to this vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4fe4c25d-0dc9-44b9-b733-e7788056e5c3",  "id": "CVE-2019-15211",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15211"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c does not properly allocate memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d14fc3a7-6fbc-4f7e-a4d2-e25e538d49b1",  "id": "CVE-2023-3357",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3357"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local user to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "360e0f2a-47db-42ba-9222-4342bdf6b47e",  "id": "CVE-2021-47237",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47237"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hamradio: fix memory leak in mkiss_close\n\nMy local syzbot instance hit memory leak in\nmkiss_open()[1]. The problem was in missing\nfree_netdev() in mkiss_close().\n\nIn mkiss_open() netdevice is allocated and then\nregistered, but in mkiss_close() netdevice was\nonly unregistered, but not freed.\n\nFail log:\n\nBUG: memory leak\nunreferenced object 0xffff8880281ba000 (size 4096):\n  comm \"syz-executor.1\", pid 11443, jiffies 4295046091 (age 17.660s)\n  hex dump (first 32 bytes):\n    61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00  ax0.............\n    00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00  .'.*............\n  backtrace:\n    [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0\n    [<ffffffff8706e7e8>] alloc_netdev_mqs+0x98/0xe80\n    [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1]\n    [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110\n    [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670\n    [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440\n    [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200\n    [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0\n    [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nBUG: memory leak\nunreferenced object 0xffff8880141a9a00 (size 96):\n  comm \"syz-executor.1\", pid 11443, jiffies 4295046091 (age 17.660s)\n  hex dump (first 32 bytes):\n    e8 a2 1b 28 80 88 ff ff e8 a2 1b 28 80 88 ff ff  ...(.......(....\n    98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00  .....@..........\n  backtrace:\n    [<ffffffff8709f68b>] __hw_addr_create_ex+0x5b/0x310\n    [<ffffffff8709fb38>] __hw_addr_add_ex+0x1f8/0x2b0\n    [<ffffffff870a0c7b>] dev_addr_init+0x10b/0x1f0\n    [<ffffffff8706e88b>] alloc_netdev_mqs+0x13b/0xe80\n    [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1]\n    [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110\n    [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670\n    [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440\n    [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200\n    [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0\n    [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nBUG: memory leak\nunreferenced object 0xffff8880219bfc00 (size 512):\n  comm \"syz-executor.1\", pid 11443, jiffies 4295046091 (age 17.660s)\n  hex dump (first 32 bytes):\n    00 a0 1b 28 80 88 ff ff 80 8f b1 8d ff ff ff ff  ...(............\n    80 8f b1 8d ff ff ff ff 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0\n    [<ffffffff8706eec7>] alloc_netdev_mqs+0x777/0xe80\n    [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1]\n    [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110\n    [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670\n    [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440\n    [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200\n    [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0\n    [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nBUG: memory leak\nunreferenced object 0xffff888029b2b200 (size 256):\n  comm \"syz-executor.1\", pid 11443, jiffies 4295046091 (age 17.660s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0\n    [<ffffffff8706f062>] alloc_netdev_mqs+0x912/0xe80\n    [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1]\n    [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110\n    [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670\n    [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440\n    [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200\n    [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0\n    [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7322577f-f3cd-495e-bdee-aecdb84446fc",  "id": "AZL-9649",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1500ed24-0b54-443a-ba22-a0da2985a689",  "id": "CVE-2010-3850",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3850"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2 does not require the CAP_NET_ADMIN capability, which allows local users to bypass intended access restrictions and configure econet addresses via an SIOCSIFADDR ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:15704'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:96484/Linux-Kernel-2.6.37-Local-Privilege-Escalation.html'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'PSS:104820/Linux-Kernel-Econet-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "76b4d4b3-1c0d-4fa8-b309-aa62adc88fd3",  "id": "CVE-2010-3881",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3881"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via read operations on the /dev/kvm device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f6bf97d-acb4-4171-8286-3a59c8447fdb",  "id": "CVE-2021-47549",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47549"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl\n\nWhen the `rmmod sata_fsl.ko` command is executed in the PPC64 GNU/Linux,\na bug is reported:\n ==================================================================\n BUG: Unable to handle kernel data access on read at 0x80000800805b502c\n Oops: Kernel access of bad area, sig: 11 [#1]\n NIP [c0000000000388a4] .ioread32+0x4/0x20\n LR [80000000000c6034] .sata_fsl_port_stop+0x44/0xe0 [sata_fsl]\n Call Trace:\n  .free_irq+0x1c/0x4e0 (unreliable)\n  .ata_host_stop+0x74/0xd0 [libata]\n  .release_nodes+0x330/0x3f0\n  .device_release_driver_internal+0x178/0x2c0\n  .driver_detach+0x64/0xd0\n  .bus_remove_driver+0x70/0xf0\n  .driver_unregister+0x38/0x80\n  .platform_driver_unregister+0x14/0x30\n  .fsl_sata_driver_exit+0x18/0xa20 [sata_fsl]\n  .__se_sys_delete_module+0x1ec/0x2d0\n  .system_call_exception+0xfc/0x1f0\n  system_call_common+0xf8/0x200\n ==================================================================\n\nThe triggering of the BUG is shown in the following stack:\n\ndriver_detach\n  device_release_driver_internal\n    __device_release_driver\n      drv->remove(dev) --> platform_drv_remove/platform_remove\n        drv->remove(dev) --> sata_fsl_remove\n          iounmap(host_priv->hcr_base);\t\t\t<---- unmap\n          kfree(host_priv);                             <---- free\n      devres_release_all\n        release_nodes\n          dr->node.release(dev, dr->data) --> ata_host_stop\n            ap->ops->port_stop(ap) --> sata_fsl_port_stop\n                ioread32(hcr_base + HCONTROL)           <---- UAF\n            host->ops->host_stop(host)\n\nThe iounmap(host_priv->hcr_base) and kfree(host_priv) functions should\nnot be executed in drv->remove. These functions should be executed in\nhost_stop after port_stop. Therefore, we move these functions to the\nnew function sata_fsl_host_stop and bind the new function to host_stop.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f4590eec-38a1-45d4-bb22-23c87b3048c9",  "id": "CVE-2023-52477",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: hub: Guard against accesses to uninitialized BOS descriptors\n\nMany functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h\naccess fields inside udev->bos without checking if it was allocated and\ninitialized. If usb_get_bos_descriptor() fails for whatever\nreason, udev->bos will be NULL and those accesses will result in a\ncrash:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000018\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1>\nHardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021\nWorkqueue: usb_hub_wq hub_event\nRIP: 0010:hub_port_reset+0x193/0x788\nCode: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9\nRSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310\nRDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840\nRBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060\nR10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000\nR13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0\nCall Trace:\nhub_event+0x73f/0x156e\n? hub_activate+0x5b7/0x68f\nprocess_one_work+0x1a2/0x487\nworker_thread+0x11a/0x288\nkthread+0x13a/0x152\n? process_one_work+0x487/0x487\n? kthread_associate_blkcg+0x70/0x70\nret_from_fork+0x1f/0x30\n\nFall back to a default behavior if the BOS descriptor isn't accessible\nand skip all the functionalities that depend on it: LPM support checks,\nSuper Speed capabilitiy checks, U1/U2 states setup.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "21dafd62-b354-4986-9b64-fd69bf5c5d06",  "id": "CVE-2023-53159",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53159"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    126  ],  "analysis": {    "state": "in_triage"  },  "description": "The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "876ca88d-7d5e-4b0e-8c1d-c03ae5ceb852",  "id": "OESA-2024-2438",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a7b3bc6f-f710-41cc-9f37-776a5692260d",  "id": "CVE-2024-44931",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: prevent potential speculation leaks in gpio_device_get_desc()\n\nUserspace may trigger a speculative read of an address outside the gpio\ndescriptor array.\nUsers can do that by calling gpio_ioctl() with an offset out of range.\nOffset is copied from user and then used as an array index to get\nthe gpio descriptor without sanitization in gpio_device_get_desc().\n\nThis change ensures that the offset is sanitized by using\narray_index_nospec() to mitigate any possibility of speculative\ninformation leaks.\n\nThis bug was discovered and resolved using Coverity Static Analysis\nSecurity Testing (SAST) by Synopsys, Inc.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc26e1c9-d6ec-493f-a600-bcab65977459",  "id": "ALSA-2026:25239",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c5a078ed-d759-4c69-af84-c17019c8ec7a",  "id": "CVE-2023-53404",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: fotg210: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd1e7e61-4e78-4237-a2b9-28f067c84eba",  "id": "AZL-67977",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "64efb227-f84f-4ff8-b01d-84c1c3584ad0",  "id": "CVE-2014-9584",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9584"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "780517b7-12e7-4188-b705-4c9757a9b928",  "id": "OESA-2026-1416",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e30682a-2fd4-44de-807d-3143e4b1a9ef",  "id": "AZL-34576",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e49bf3b5-1898-4823-b892-fe4adf7156ea",  "id": "CVE-2024-42144",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data\n\nVerify that lvts_data is not NULL before using it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9cfb3d4b-78e2-4f7e-a60b-7f317d9aa7a0",  "id": "RHSA-2020:5422",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0e29c869-a454-4710-9a47-0b5b5549a17e",  "id": "CVE-2016-2384",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2384"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:41999'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:142488/Linux-Kernel-3.x-usb-midi-Local-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "672f499c-d5b5-4058-b92e-075912e52190",  "id": "CLSA-2024-1730801286",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "65d7fc52-61fe-4cf3-9528-828ab672cb27",  "id": "CVE-2024-50177",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix a UBSAN warning in DML2.1\n\nWhen programming phantom pipe, since cursor_width is explicity set to 0,\nthis causes calculation logic to trigger overflow for an unsigned int\ntriggering the kernel's UBSAN check as below:\n\n[   40.962845] UBSAN: shift-out-of-bounds in /tmp/amd.EfpumTkO/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:3312:34\n[   40.962849] shift exponent 4294967170 is too large for 32-bit type 'unsigned int'\n[   40.962852] CPU: 1 PID: 1670 Comm: gnome-shell Tainted: G        W  OE      6.5.0-41-generic #41~22.04.2-Ubuntu\n[   40.962854] Hardware name: Gigabyte Technology Co., Ltd. X670E AORUS PRO X/X670E AORUS PRO X, BIOS F21 01/10/2024\n[   40.962856] Call Trace:\n[   40.962857]  <TASK>\n[   40.962860]  dump_stack_lvl+0x48/0x70\n[   40.962870]  dump_stack+0x10/0x20\n[   40.962872]  __ubsan_handle_shift_out_of_bounds+0x1ac/0x360\n[   40.962878]  calculate_cursor_req_attributes.cold+0x1b/0x28 [amdgpu]\n[   40.963099]  dml_core_mode_support+0x6b91/0x16bc0 [amdgpu]\n[   40.963327]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.963331]  ? CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport+0x18b8/0x2790 [amdgpu]\n[   40.963534]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.963536]  ? dml_core_mode_support+0xb3db/0x16bc0 [amdgpu]\n[   40.963730]  dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu]\n[   40.963906]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.963909]  ? dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu]\n[   40.964078]  core_dcn4_mode_support+0x72/0xbf0 [amdgpu]\n[   40.964247]  dml2_top_optimization_perform_optimization_phase+0x1d3/0x2a0 [amdgpu]\n[   40.964420]  dml2_build_mode_programming+0x23d/0x750 [amdgpu]\n[   40.964587]  dml21_validate+0x274/0x770 [amdgpu]\n[   40.964761]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.964763]  ? resource_append_dpp_pipes_for_plane_composition+0x27c/0x3b0 [amdgpu]\n[   40.964942]  dml2_validate+0x504/0x750 [amdgpu]\n[   40.965117]  ? dml21_copy+0x95/0xb0 [amdgpu]\n[   40.965291]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.965295]  dcn401_validate_bandwidth+0x4e/0x70 [amdgpu]\n[   40.965491]  update_planes_and_stream_state+0x38d/0x5c0 [amdgpu]\n[   40.965672]  update_planes_and_stream_v3+0x52/0x1e0 [amdgpu]\n[   40.965845]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.965849]  dc_update_planes_and_stream+0x71/0xb0 [amdgpu]\n\nFix this by adding a guard for checking cursor width before triggering\nthe size calculation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "86f79a89-78eb-415f-99c9-9c752d4ac248",  "id": "RHSA-2024:7846",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1e254576-fde8-4f8f-9ac7-0b38c87b8ffd",  "id": "CVE-2017-14491",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14491"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:42941'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:144480/Dnsmasq-2-Byte-Heap-Based-Overflow.html'"    }  ]},{  "bom-ref": "19dd80bf-6d8f-4dfe-a073-efb74a97f5c0",  "id": "CVE-2019-19037",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19037"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can be zero.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d8c7c76f-bbf9-4c81-8c73-d10a3b5ca466",  "id": "CVE-2012-4467",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4467"  },  "ratings": [    {      "score": 6.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The (1) do_siocgstamp and (2) do_siocgstampns functions in net/socket.c in the Linux kernel before 3.5.4 use an incorrect argument order, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a crafted ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "90d0ee33-3140-49f1-bee3-043b17909001",  "id": "CVE-2021-3753",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3753"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125,    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from this vulnerability is to data confidentiality.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48ba3398-9d1c-4c58-8288-955c79ae3970",  "id": "CVE-2016-10905",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10905"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e77c068-06ba-4c3d-96dc-e69b0cd3bab2",  "id": "OESA-2026-2810",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3a8669d1-32cc-4c66-b446-3d7c58208768",      "versions": [        {          "component": "radvd",          "version": "1.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf3643ad-a032-4652-8b52-5f29dd61f64e",  "id": "CVE-2011-4915",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4915"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/proc/base.c in the Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /proc/interrupts.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d27e2f11-8a56-4f97-9d1a-2ad580a10426",  "id": "CVE-2022-49598",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_mtu_probing.\n\nWhile reading sysctl_tcp_mtu_probing, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its readers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d0379dc-ab9d-4232-9234-8374cb863d4e",  "id": "CVE-2025-39826",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rose: convert 'use' field to refcount_t\n\nThe 'use' field in struct rose_neigh is used as a reference counter but\nlacks atomicity. This can lead to race conditions where a rose_neigh\nstructure is freed while still being referenced by other code paths.\n\nFor example, when rose_neigh->use becomes zero during an ioctl operation\nvia rose_rt_ioctl(), the structure may be removed while its timer is\nstill active, potentially causing use-after-free issues.\n\nThis patch changes the type of 'use' from unsigned short to refcount_t and\nupdates all code paths to use rose_neigh_hold() and rose_neigh_put() which\noperate reference counts atomically.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "55f96a3f-7c5d-4144-8143-702ca64bb160",  "id": "CVE-2012-4444",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4444"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9e2f56ed-e912-44dd-a2f7-574a8c4370eb",  "id": "CVE-2025-21776",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: hub: Ignore non-compliant devices with too many configs or interfaces\n\nRobert Morris created a test program which can cause\nusb_hub_to_struct_hub() to dereference a NULL or inappropriate\npointer:\n\nOops: general protection fault, probably for non-canonical address\n0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI\nCPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14\nHardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021\nWorkqueue: usb_hub_wq hub_event\nRIP: 0010:usb_hub_adjust_deviceremovable+0x78/0x110\n...\nCall Trace:\n <TASK>\n ? die_addr+0x31/0x80\n ? exc_general_protection+0x1b4/0x3c0\n ? asm_exc_general_protection+0x26/0x30\n ? usb_hub_adjust_deviceremovable+0x78/0x110\n hub_probe+0x7c7/0xab0\n usb_probe_interface+0x14b/0x350\n really_probe+0xd0/0x2d0\n ? __pfx___device_attach_driver+0x10/0x10\n __driver_probe_device+0x6e/0x110\n driver_probe_device+0x1a/0x90\n __device_attach_driver+0x7e/0xc0\n bus_for_each_drv+0x7f/0xd0\n __device_attach+0xaa/0x1a0\n bus_probe_device+0x8b/0xa0\n device_add+0x62e/0x810\n usb_set_configuration+0x65d/0x990\n usb_generic_driver_probe+0x4b/0x70\n usb_probe_device+0x36/0xd0\n\nThe cause of this error is that the device has two interfaces, and the\nhub driver binds to interface 1 instead of interface 0, which is where\nusb_hub_to_struct_hub() looks.\n\nWe can prevent the problem from occurring by refusing to accept hub\ndevices that violate the USB spec by having more than one\nconfiguration or interface.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6047afd7-190e-4c83-88b3-302ef8aaa26c",  "id": "MGASA-2018-0470",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "26b0a763-cb9a-464b-9286-32b900d6d74a",  "id": "CVE-2025-22018",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: Fix NULL pointer dereference\n\nWhen MPOA_cache_impos_rcvd() receives the msg, it can trigger\nNull Pointer Dereference Vulnerability if both entry and\nholding_time are NULL. Because there is only for the situation\nwhere entry is NULL and holding_time exists, it can be passed\nwhen both entry and holding_time are NULL. If these are NULL,\nthe entry will be passd to eg_cache_put() as parameter and\nit is referenced by entry->use code in it.\n\nkasan log:\n\n[    3.316691] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006:I\n[    3.317568] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\n[    3.318188] CPU: 3 UID: 0 PID: 79 Comm: ex Not tainted 6.14.0-rc2 #102\n[    3.318601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n[    3.319298] RIP: 0010:eg_cache_remove_entry+0xa5/0x470\n[    3.319677] Code: c1 f7 6e fd 48 c7 c7 00 7e 38 b2 e8 95 64 54 fd 48 c7 c7 40 7e 38 b2 48 89 ee e80\n[    3.321220] RSP: 0018:ffff88800583f8a8 EFLAGS: 00010006\n[    3.321596] RAX: 0000000000000006 RBX: ffff888005989000 RCX: ffffffffaecc2d8e\n[    3.322112] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000030\n[    3.322643] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff6558b88\n[    3.323181] R10: 0000000000000003 R11: 203a207972746e65 R12: 1ffff11000b07f15\n[    3.323707] R13: dffffc0000000000 R14: ffff888005989000 R15: ffff888005989068\n[    3.324185] FS:  000000001b6313c0(0000) GS:ffff88806d380000(0000) knlGS:0000000000000000\n[    3.325042] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    3.325545] CR2: 00000000004b4b40 CR3: 000000000248e000 CR4: 00000000000006f0\n[    3.326430] Call Trace:\n[    3.326725]  <TASK>\n[    3.326927]  ? die_addr+0x3c/0xa0\n[    3.327330]  ? exc_general_protection+0x161/0x2a0\n[    3.327662]  ? asm_exc_general_protection+0x26/0x30\n[    3.328214]  ? vprintk_emit+0x15e/0x420\n[    3.328543]  ? eg_cache_remove_entry+0xa5/0x470\n[    3.328910]  ? eg_cache_remove_entry+0x9a/0x470\n[    3.329294]  ? __pfx_eg_cache_remove_entry+0x10/0x10\n[    3.329664]  ? console_unlock+0x107/0x1d0\n[    3.329946]  ? __pfx_console_unlock+0x10/0x10\n[    3.330283]  ? do_syscall_64+0xa6/0x1a0\n[    3.330584]  ? entry_SYSCALL_64_after_hwframe+0x47/0x7f\n[    3.331090]  ? __pfx_prb_read_valid+0x10/0x10\n[    3.331395]  ? down_trylock+0x52/0x80\n[    3.331703]  ? vprintk_emit+0x15e/0x420\n[    3.331986]  ? __pfx_vprintk_emit+0x10/0x10\n[    3.332279]  ? down_trylock+0x52/0x80\n[    3.332527]  ? _printk+0xbf/0x100\n[    3.332762]  ? __pfx__printk+0x10/0x10\n[    3.333007]  ? _raw_write_lock_irq+0x81/0xe0\n[    3.333284]  ? __pfx__raw_write_lock_irq+0x10/0x10\n[    3.333614]  msg_from_mpoad+0x1185/0x2750\n[    3.333893]  ? __build_skb_around+0x27b/0x3a0\n[    3.334183]  ? __pfx_msg_from_mpoad+0x10/0x10\n[    3.334501]  ? __alloc_skb+0x1c0/0x310\n[    3.334809]  ? __pfx___alloc_skb+0x10/0x10\n[    3.335283]  ? _raw_spin_lock+0xe0/0xe0\n[    3.335632]  ? finish_wait+0x8d/0x1e0\n[    3.335975]  vcc_sendmsg+0x684/0xba0\n[    3.336250]  ? __pfx_vcc_sendmsg+0x10/0x10\n[    3.336587]  ? __pfx_autoremove_wake_function+0x10/0x10\n[    3.337056]  ? fdget+0x176/0x3e0\n[    3.337348]  __sys_sendto+0x4a2/0x510\n[    3.337663]  ? __pfx___sys_sendto+0x10/0x10\n[    3.337969]  ? ioctl_has_perm.constprop.0.isra.0+0x284/0x400\n[    3.338364]  ? sock_ioctl+0x1bb/0x5a0\n[    3.338653]  ? __rseq_handle_notify_resume+0x825/0xd20\n[    3.339017]  ? __pfx_sock_ioctl+0x10/0x10\n[    3.339316]  ? __pfx___rseq_handle_notify_resume+0x10/0x10\n[    3.339727]  ? selinux_file_ioctl+0xa4/0x260\n[    3.340166]  __x64_sys_sendto+0xe0/0x1c0\n[    3.340526]  ? syscall_exit_to_user_mode+0x123/0x140\n[    3.340898]  do_syscall_64+0xa6/0x1a0\n[    3.341170]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[    3.341533] RIP: 0033:0x44a380\n[    3.341757] Code: 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c00\n[    \n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3baf5c3e-de0a-46c2-a632-93e1dc7a7c69",  "id": "RHSA-2023:2523",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb430b8e-be79-4f35-9855-43309c40042f",  "id": "CVE-2020-10767",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10767"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    440  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b35c4527-0305-4b3d-b911-dc640dd9b28f",  "id": "CVE-2024-46732",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Assign linear_pitch_alignment even for VM\n\n[Description]\nAssign linear_pitch_alignment so we don't cause a divide by 0\nerror in VM environments",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a4efb61-d772-40b5-a1de-5bdcc12e741e",  "id": "CVE-2019-20812",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20812"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3, aka CID-b43d1f9f7067.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9111e925-f116-4aac-9f19-a77e751817fe",  "id": "CVE-2012-5517",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5517"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The online_pages function in mm/memory_hotplug.c in the Linux kernel before 3.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact in opportunistic circumstances by using memory that was hot-added by an administrator.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "03e46b62-9507-41ff-b284-8a2e2f90f82a",  "id": "CVE-2023-52601",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds in dbAdjTree\n\nCurrently there is a bound check missing in the dbAdjTree while\naccessing the dmt_stree. To add the required check added the bool is_ctl\nwhich is required to determine the size as suggest in the following\ncommit.\nhttps://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e75f4fa@oracle.com/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "527f3c00-562a-4ebb-bd9a-f3ef846636c9",  "id": "CVE-2022-49710",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm mirror log: round up region bitmap size to BITS_PER_LONG\n\nThe code in dm-log rounds up bitset_size to 32 bits. It then uses\nfind_next_zero_bit_le on the allocated region. find_next_zero_bit_le\naccesses the bitmap using unsigned long pointers. So, on 64-bit\narchitectures, it may access 4 bytes beyond the allocated size.\n\nFix this bug by rounding up bitset_size to BITS_PER_LONG.\n\nThis bug was found by running the lvm2 testsuite with kasan.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ee09f7a-943b-4767-a1eb-d2e0af12e277",  "id": "CVE-2021-37159",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37159"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "29f5e216-3603-41f6-a4c8-77788e18bda9",  "id": "CVE-2015-8839",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8839"  },  "ratings": [    {      "score": 5.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9222ea8-966b-4052-8662-418a77549867",  "id": "OESA-2026-1414",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a776054-7c21-4780-8990-e696698d53cc",  "id": "CVE-2017-13081",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13081"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    323,    330  ],  "analysis": {    "state": "in_triage"  },  "description": "Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ae9b76c-622a-425a-bb9e-1fbba6ece516",  "id": "CVE-2012-2372",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2372"  },  "ratings": [    {      "score": 4.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:S/C:N/I:N/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The rds_ib_xmit function in net/rds/ib_send.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel 3.7.4 and earlier allows local users to cause a denial of service (BUG_ON and kernel panic) by establishing an RDS connection with the source IP address equal to the IPoIB interface's own IP address, as demonstrated by rds-ping.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c5389ef-800f-4fc9-a3ab-dfe41db16d9b",  "id": "CVE-2023-1990",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1990"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow an attacker to crash the system due to a race problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5065cb75-f8d6-4ffa-b637-47fd7588aace",  "id": "CVE-2021-47281",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47281"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix race of snd_seq_timer_open()\n\nThe timer instance per queue is exclusive, and snd_seq_timer_open()\nshould have managed the concurrent accesses.  It looks as if it's\nchecking the already existing timer instance at the beginning, but\nit's not right, because there is no protection, hence any later\nconcurrent call of snd_seq_timer_open() may override the timer\ninstance easily.  This may result in UAF, as the leftover timer\ninstance can keep running while the queue itself gets closed, as\nspotted by syzkaller recently.\n\nFor avoiding the race, add a proper check at the assignment of\ntmr->timeri again, and return -EBUSY if it's been already registered.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5720c726-a161-4c99-85ca-a66a9d8839ba",  "id": "RHSA-2022:1066",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ba96ccd7-2584-4ad5-a9b7-c2823f26f3e1",  "id": "RHSA-2014:1052",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b7be228a-4c98-44ac-97ba-390deed61930",  "id": "CVE-2010-4668",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4668"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 2.6.37-rc7 allows local users to cause a denial of service (panic) via a zero-length I/O request in a device ioctl to a SCSI device, related to an unaligned map.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4163.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a31695b3-db27-4828-93c0-e6c3cfc87d34",  "id": "CVE-2016-2547",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2547"  },  "ratings": [    {      "score": 5.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "sound/core/timer.c in the Linux kernel before 4.4.1 employs a locking approach that does not consider slave timer instances, which allows local users to cause a denial of service (race condition, use-after-free, and system crash) via a crafted ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed83fd38-8420-4500-9156-eb1b84f29ab1",  "id": "CVE-2024-43886",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check in resource_log_pipe_topology_update\n\n[WHY]\nWhen switching from \"Extend\" to \"Second Display Only\" we sometimes\ncall resource_get_otg_master_for_stream on a stream for the eDP,\nwhich is disconnected. This leads to a null pointer dereference.\n\n[HOW]\nAdded a null check in dc_resource.c/resource_log_pipe_topology_update.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8fe7b3b8-071c-4cd5-b335-f24ba7f2d2b4",  "id": "CVE-2021-47170",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47170"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: usbfs: Don't WARN about excessively large memory allocations\n\nSyzbot found that the kernel generates a WARNing if the user tries to\nsubmit a bulk transfer through usbfs with a buffer that is way too\nlarge.  This isn't a bug in the kernel; it's merely an invalid request\nfrom the user and the usbfs code does handle it correctly.\n\nIn theory the same thing can happen with async transfers, or with the\npacket descriptor table for isochronous transfers.\n\nTo prevent the MM subsystem from complaining about these bad\nallocation requests, add the __GFP_NOWARN flag to the kmalloc calls\nfor these buffers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4e098006-5a99-4ced-a5d9-cb667dd13ee0",  "id": "ALSA-2024:0310",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "efac4fc4-e63b-4b20-8978-0942135b0d4e",  "id": "CVE-2024-57893",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: oss: Fix races at processing SysEx messages\n\nOSS sequencer handles the SysEx messages split in 6 bytes packets, and\nALSA sequencer OSS layer tries to combine those.  It stores the data\nin the internal buffer and this access is racy as of now, which may\nlead to the out-of-bounds access.\n\nAs a temporary band-aid fix, introduce a mutex for serializing the\nprocess of the SysEx message packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2f36456c-1933-44a0-add7-9109d76d63eb",  "id": "CVE-2023-52593",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()\n\nSince 'ieee80211_beacon_get()' can return NULL, 'wfx_set_mfp_ap()'\nshould check the return value before examining skb data. So convert\nthe latter to return an appropriate error code and propagate it to\nreturn from 'wfx_start_ap()' as well. Compile tested only.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3fbe2207-9fd0-411b-9d92-448a9742aa0b",  "id": "CVE-2026-53254",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: validate skb length in MCC handlers\n\nThe RFCOMM MCC handlers cast skb->data to protocol-specific structs\nwithout validating skb->len first. A malicious remote device can send\ntruncated MCC frames and trigger out-of-bounds reads in these handlers.\n\nFix this by using skb_pull_data() to validate and access the required\ndata before dereferencing it.\n\nrfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows\n1-byte RPN requests. Handle this by validating only the DLCI byte first,\nand validating the full struct only when len > 1.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c0692708-0ae2-4559-bc67-93d46e8b5000",  "id": "CVE-2021-47327",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47327"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    911  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get fails\n\narm_smmu_rpm_get() invokes pm_runtime_get_sync(), which increases the\nrefcount of the \"smmu\" even though the return value is less than 0.\n\nThe reference counting issue happens in some error handling paths of\narm_smmu_rpm_get() in its caller functions. When arm_smmu_rpm_get()\nfails, the caller functions forget to decrease the refcount of \"smmu\"\nincreased by arm_smmu_rpm_get(), causing a refcount leak.\n\nFix this issue by calling pm_runtime_resume_and_get() instead of\npm_runtime_get_sync() in arm_smmu_rpm_get(), which can keep the refcount\nbalanced in case of failure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48ba5fe8-a358-4b03-bcfc-0e7bc8fe461c",  "id": "CVE-2022-40768",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40768"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8da2cccd-1192-47f8-b733-4af2dca9e557",  "id": "CVE-2016-8645",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8645"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    284  ],  "analysis": {    "state": "in_triage"  },  "description": "The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial of service (system crash) via a crafted application that makes sendto system calls, related to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2bc9b4a2-7712-44ff-9b74-c341c6e7e2bb",  "id": "CVE-2024-26646",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: intel: hfi: Add syscore callbacks for system-wide PM\n\nThe kernel allocates a memory buffer and provides its location to the\nhardware, which uses it to update the HFI table. This allocation occurs\nduring boot and remains constant throughout runtime.\n\nWhen resuming from hibernation, the restore kernel allocates a second\nmemory buffer and reprograms the HFI hardware with the new location as\npart of a normal boot. The location of the second memory buffer may\ndiffer from the one allocated by the image kernel.\n\nWhen the restore kernel transfers control to the image kernel, its HFI\nbuffer becomes invalid, potentially leading to memory corruption if the\nhardware writes to it (the hardware continues to use the buffer from the\nrestore kernel).\n\nIt is also possible that the hardware \"forgets\" the address of the memory\nbuffer when resuming from \"deep\" suspend. Memory corruption may also occur\nin such a scenario.\n\nTo prevent the described memory corruption, disable HFI when preparing to\nsuspend or hibernate. Enable it when resuming.\n\nAdd syscore callbacks to handle the package of the boot CPU (packages of\nnon-boot CPUs are handled via CPU offline). Syscore ops always run on the\nboot CPU. Additionally, HFI only needs to be disabled during \"deep\" suspend\nand hibernation. Syscore ops only run in these cases.\n\n[ rjw: Comment adjustment, subject and changelog edits ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45b2dd54-cb28-43cd-a7fe-336fc14c5356",  "id": "CVE-2024-56643",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndccp: Fix memory leak in dccp_feat_change_recv\n\nIf dccp_feat_push_confirm() fails after new value for SP feature was accepted\nwithout reconciliation ('entry == NULL' branch), memory allocated for that value\nwith dccp_feat_clone_sp_val() is never freed.\n\nHere is the kmemleak stack for this:\n\nunreferenced object 0xffff88801d4ab488 (size 8):\n  comm \"syz-executor310\", pid 1127, jiffies 4295085598 (age 41.666s)\n  hex dump (first 8 bytes):\n    01 b4 4a 1d 80 88 ff ff                          ..J.....\n  backtrace:\n    [<00000000db7cabfe>] kmemdup+0x23/0x50 mm/util.c:128\n    [<0000000019b38405>] kmemdup include/linux/string.h:465 [inline]\n    [<0000000019b38405>] dccp_feat_clone_sp_val net/dccp/feat.c:371 [inline]\n    [<0000000019b38405>] dccp_feat_clone_sp_val net/dccp/feat.c:367 [inline]\n    [<0000000019b38405>] dccp_feat_change_recv net/dccp/feat.c:1145 [inline]\n    [<0000000019b38405>] dccp_feat_parse_options+0x1196/0x2180 net/dccp/feat.c:1416\n    [<00000000b1f6d94a>] dccp_parse_options+0xa2a/0x1260 net/dccp/options.c:125\n    [<0000000030d7b621>] dccp_rcv_state_process+0x197/0x13d0 net/dccp/input.c:650\n    [<000000001f74c72e>] dccp_v4_do_rcv+0xf9/0x1a0 net/dccp/ipv4.c:688\n    [<00000000a6c24128>] sk_backlog_rcv include/net/sock.h:1041 [inline]\n    [<00000000a6c24128>] __release_sock+0x139/0x3b0 net/core/sock.c:2570\n    [<00000000cf1f3a53>] release_sock+0x54/0x1b0 net/core/sock.c:3111\n    [<000000008422fa23>] inet_wait_for_connect net/ipv4/af_inet.c:603 [inline]\n    [<000000008422fa23>] __inet_stream_connect+0x5d0/0xf70 net/ipv4/af_inet.c:696\n    [<0000000015b6f64d>] inet_stream_connect+0x53/0xa0 net/ipv4/af_inet.c:735\n    [<0000000010122488>] __sys_connect_file+0x15c/0x1a0 net/socket.c:1865\n    [<00000000b4b70023>] __sys_connect+0x165/0x1a0 net/socket.c:1882\n    [<00000000f4cb3815>] __do_sys_connect net/socket.c:1892 [inline]\n    [<00000000f4cb3815>] __se_sys_connect net/socket.c:1889 [inline]\n    [<00000000f4cb3815>] __x64_sys_connect+0x6e/0xb0 net/socket.c:1889\n    [<00000000e7b1e839>] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n    [<0000000055e91434>] entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nClean up the allocated memory in case of dccp_feat_push_confirm() failure\nand bail out with an error reset code.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8856a925-4885-4559-8355-98fd2a7b192e",  "id": "SUSE-SU-2022:4372-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d015d348-ef21-42bb-b190-37ab34f752b5",  "id": "AZL-82070",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e33941e0-40ff-4037-9fee-71966a289283",  "id": "CVE-2026-31448",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.4,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid infinite loops caused by residual data\n\nOn the mkdir/mknod path, when mapping logical blocks to physical blocks,\nif inserting a new extent into the extent tree fails (in this example,\nbecause the file system disabled the huge file feature when marking the\ninode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to\nreclaim the physical block without deleting the corresponding data in\nthe extent tree. This causes subsequent mkdir operations to reference\nthe previously reclaimed physical block number again, even though this\nphysical block is already being used by the xattr block. Therefore, a\nsituation arises where both the directory and xattr are using the same\nbuffer head block in memory simultaneously.\n\nThe above causes ext4_xattr_block_set() to enter an infinite loop about\n\"inserted\" and cannot release the inode lock, ultimately leading to the\n143s blocking problem mentioned in [1].\n\nIf the metadata is corrupted, then trying to remove some extent space\ncan do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE\nwas passed, remove space wrongly update quota information.\nJan Kara suggests distinguishing between two cases:\n\n1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully\nconsistent and we must maintain its consistency including all the\naccounting. However these errors can happen only early before we've\ninserted the extent into the extent tree. So current code works correctly\nfor this case.\n\n2) Some other error - this means metadata is corrupted. We should strive to\ndo as few modifications as possible to limit damage. So I'd just skip\nfreeing of allocated blocks.\n\n[1]\nINFO: task syz.0.17:5995 blocked for more than 143 seconds.\nCall Trace:\n inode_lock_nested include/linux/fs.h:1073 [inline]\n __start_dirop fs/namei.c:2923 [inline]\n start_dirop fs/namei.c:2934 [inline]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b4dfdff-4f4a-4193-ad55-493e4f4a4143",  "id": "CVE-2024-43902",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null checker before passing variables\n\nChecks null pointer before passing variables to functions.\n\nThis fixes 3 NULL_RETURNS issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d861ba95-4ef4-41ba-afeb-d55ef7f7c1d3",  "id": "openSUSE-SU-2026:10821-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d4ed28f7-fb9b-4986-bc38-c6e24977fc2f",  "id": "CVE-2021-47624",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47624"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change\n\nThe refcount leak issues take place in an error handling path. When the\n3rd argument buf doesn't match with \"offline\", \"online\" or \"remove\", the\nfunction simply returns -EINVAL and forgets to decrease the reference\ncount of a rpc_xprt object and a rpc_xprt_switch object increased by\nrpc_sysfs_xprt_kobj_get_xprt() and\nrpc_sysfs_xprt_kobj_get_xprt_switch(), causing reference count leaks of\nboth unused objects.\n\nFix this issue by jumping to the error handling path labelled with\nout_put when buf matches none of \"offline\", \"online\" or \"remove\".",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b57b7c2c-aea3-425e-8e1f-bb648a586bf6",  "id": "CVE-2024-56763",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Prevent bad count for tracing_cpumask_write\n\nIf a large count is provided, it will trigger a warning in bitmap_parse_user.\nAlso check zero for it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "abf57af9-c50f-4df7-b738-404840ce99e8",  "id": "CVE-2019-18808",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18808"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-128c66429247.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a3233a3-d6c2-46d8-8931-9f78239c0b20",  "id": "RLSA-2022:1065",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "76b77848-4a03-4c0d-9202-a3db9ece9814",  "id": "CVE-2022-49114",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libfc: Fix use after free in fc_exch_abts_resp()\n\nfc_exch_release(ep) will decrease the ep's reference count. When the\nreference count reaches zero, it is freed. But ep is still used in the\nfollowing code, which will lead to a use after free.\n\nReturn after the fc_exch_release() call to avoid use after free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "637feddd-672b-4967-92ce-d2991ca1a691",  "id": "CVE-2026-53403",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var\n\ninfo->var, a framebuffer's current mode, is expected to have a matching\nentry in info->modelist. var_to_display() relies on this and treats a\nfailed fb_match_mode() as \"This should not happen\". fb_set_var() keeps it\ntrue by adding the mode to the list on every change, and\ndo_register_framebuffer() does the same at registration.\n\nstore_modes() replaces the modelist from userspace. fb_new_modelist()\nvalidates the new modes but does not check that info->var still has a\nmatch. It relies on fbcon_new_modelist() to re-point consoles, but that\nonly handles consoles mapped to the framebuffer. With fbcon unbound there\nare none, so info->var is left describing a mode that is no longer in the\nlist.\n\nA later console takeover runs var_to_display(), where fb_match_mode()\nreturns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it\nto display_to_var(), and fb_videomode_to_var() dereferences the NULL mode.\n\nKeep the current mode in the list in fb_new_modelist(), the same way\nfb_set_var() does.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "13de6a78-9764-422d-b651-ea6889bf64d6",  "id": "CVE-2022-50253",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: make sure skb->len != 0 when redirecting to a tunneling device\n\nsyzkaller managed to trigger another case where skb->len == 0\nwhen we enter __dev_queue_xmit:\n\nWARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 skb_assert_len include/linux/skbuff.h:2576 [inline]\nWARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 __dev_queue_xmit+0x2069/0x35e0 net/core/dev.c:4295\n\nCall Trace:\n dev_queue_xmit+0x17/0x20 net/core/dev.c:4406\n __bpf_tx_skb net/core/filter.c:2115 [inline]\n __bpf_redirect_no_mac net/core/filter.c:2140 [inline]\n __bpf_redirect+0x5fb/0xda0 net/core/filter.c:2163\n ____bpf_clone_redirect net/core/filter.c:2447 [inline]\n bpf_clone_redirect+0x247/0x390 net/core/filter.c:2419\n bpf_prog_48159a89cb4a9a16+0x59/0x5e\n bpf_dispatcher_nop_func include/linux/bpf.h:897 [inline]\n __bpf_prog_run include/linux/filter.h:596 [inline]\n bpf_prog_run include/linux/filter.h:603 [inline]\n bpf_test_run+0x46c/0x890 net/bpf/test_run.c:402\n bpf_prog_test_run_skb+0xbdc/0x14c0 net/bpf/test_run.c:1170\n bpf_prog_test_run+0x345/0x3c0 kernel/bpf/syscall.c:3648\n __sys_bpf+0x43a/0x6c0 kernel/bpf/syscall.c:5005\n __do_sys_bpf kernel/bpf/syscall.c:5091 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5089 [inline]\n __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5089\n do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48\n entry_SYSCALL_64_after_hwframe+0x61/0xc6\n\nThe reproducer doesn't really reproduce outside of syzkaller\nenvironment, so I'm taking a guess here. It looks like we\ndo generate correct ETH_HLEN-sized packet, but we redirect\nthe packet to the tunneling device. Before we do so, we\n__skb_pull l2 header and arrive again at skb->len == 0.\nDoesn't seem like we can do anything better than having\nan explicit check after __skb_pull?",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "634d7df4-93ff-40e3-8c82-2650cdf014e7",  "id": "CVE-2024-57838",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    668  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/entry: Mark IRQ entries to fix stack depot warnings\n\nThe stack depot filters out everything outside of the top interrupt\ncontext as an uninteresting or irrelevant part of the stack traces. This\nhelps with stack trace de-duplication, avoiding an explosion of saved\nstack traces that share the same IRQ context code path but originate\nfrom different randomly interrupted points, eventually exhausting the\nstack depot.\n\nFiltering uses in_irqentry_text() to identify functions within the\n.irqentry.text and .softirqentry.text sections, which then become the\nlast stack trace entries being saved.\n\nWhile __do_softirq() is placed into the .softirqentry.text section by\ncommon code, populating .irqentry.text is architecture-specific.\n\nCurrently, the .irqentry.text section on s390 is empty, which prevents\nstack depot filtering and de-duplication and could result in warnings\nlike:\n\nStack depot reached limit capacity\nWARNING: CPU: 0 PID: 286113 at lib/stackdepot.c:252 depot_alloc_stack+0x39a/0x3c8\n\nwith PREEMPT and KASAN enabled.\n\nFix this by moving the IO/EXT interrupt handlers from .kprobes.text into\nthe .irqentry.text section and updating the kprobes blacklist to include\nthe .irqentry.text section.\n\nThis is done only for asynchronous interrupts and explicitly not for\nprogram checks, which are synchronous and where the context beyond the\nprogram check is important to preserve. Despite machine checks being\nsomewhat in between, they are extremely rare, and preserving context\nwhen possible is also of value.\n\nSVCs and Restart Interrupts are not relevant, one being always at the\nboundary to user space and the other being a one-time thing.\n\nIRQ entries filtering is also optionally used in ftrace function graph,\nwhere the same logic applies.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8e777adc-09e1-4448-ae99-efd771dc3c3d",  "id": "CVE-2024-43855",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix deadlock between mddev_suspend and flush bio\n\nDeadlock occurs when mddev is being suspended while some flush bio is in\nprogress. It is a complex issue.\n\nT1. the first flush is at the ending stage, it clears 'mddev->flush_bio'\n    and tries to submit data, but is blocked because mddev is suspended\n    by T4.\nT2. the second flush sets 'mddev->flush_bio', and attempts to queue\n    md_submit_flush_data(), which is already running (T1) and won't\n    execute again if on the same CPU as T1.\nT3. the third flush inc active_io and tries to flush, but is blocked because\n    'mddev->flush_bio' is not NULL (set by T2).\nT4. mddev_suspend() is called and waits for active_io dec to 0 which is inc\n    by T3.\n\n  T1\t\tT2\t\tT3\t\tT4\n  (flush 1)\t(flush 2)\t(third 3)\t(suspend)\n  md_submit_flush_data\n   mddev->flush_bio = NULL;\n   .\n   .\t \tmd_flush_request\n   .\t  \t mddev->flush_bio = bio\n   .\t  \t queue submit_flushes\n   .\t\t .\n   .\t\t .\t\tmd_handle_request\n   .\t\t .\t\t active_io + 1\n   .\t\t .\t\t md_flush_request\n   .\t\t .\t\t  wait !mddev->flush_bio\n   .\t\t .\n   .\t\t .\t\t\t\tmddev_suspend\n   .\t\t .\t\t\t\t wait !active_io\n   .\t\t .\n   .\t\t submit_flushes\n   .\t\t queue_work md_submit_flush_data\n   .\t\t //md_submit_flush_data is already running (T1)\n   .\n   md_handle_request\n    wait resume\n\nThe root issue is non-atomic inc/dec of active_io during flush process.\nactive_io is dec before md_submit_flush_data is queued, and inc soon\nafter md_submit_flush_data() run.\n  md_flush_request\n    active_io + 1\n    submit_flushes\n      active_io - 1\n      md_submit_flush_data\n        md_handle_request\n        active_io + 1\n          make_request\n        active_io - 1\n\nIf active_io is dec after md_handle_request() instead of within\nsubmit_flushes(), make_request() can be called directly intead of\nmd_handle_request() in md_submit_flush_data(), and active_io will\nonly inc and dec once in the whole flush process. Deadlock will be\nfixed.\n\nAdditionally, the only difference between fixing the issue and before is\nthat there is no return error handling of make_request(). But after\nprevious patch cleaned md_write_start(), make_requst() only return error\nin raid5_make_request() by dm-raid, see commit 41425f96d7aa (\"dm-raid456,\nmd/raid456: fix a deadlock for dm-raid456 while io concurrent with\nreshape)\". Since dm always splits data and flush operation into two\nseparate io, io size of flush submitted by dm always is 0, make_request()\nwill not be called in md_submit_flush_data(). To prevent future\nmodifications from introducing issues, add WARN_ON to ensure\nmake_request() no error is returned in this context.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1f26903d-8384-49ca-83ff-41f7d4fb0ec4",  "id": "CVE-2025-39744",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu: Fix rcu_read_unlock() deadloop due to IRQ work\n\nDuring rcu_read_unlock_special(), if this happens during irq_exit(), we\ncan lockup if an IPI is issued. This is because the IPI itself triggers\nthe irq_exit() path causing a recursive lock up.\n\nThis is precisely what Xiongfeng found when invoking a BPF program on\nthe trace_tick_stop() tracepoint As shown in the trace below. Fix by\nmanaging the irq_work state correctly.\n\nirq_exit()\n  __irq_exit_rcu()\n    /* in_hardirq() returns false after this */\n    preempt_count_sub(HARDIRQ_OFFSET)\n    tick_irq_exit()\n      tick_nohz_irq_exit()\n\t    tick_nohz_stop_sched_tick()\n\t      trace_tick_stop()  /* a bpf prog is hooked on this trace point */\n\t\t   __bpf_trace_tick_stop()\n\t\t      bpf_trace_run2()\n\t\t\t    rcu_read_unlock_special()\n                              /* will send a IPI to itself */\n\t\t\t      irq_work_queue_on(&rdp->defer_qs_iw, rdp->cpu);\n\nA simple reproducer can also be obtained by doing the following in\ntick_irq_exit(). It will hang on boot without the patch:\n\n  static inline void tick_irq_exit(void)\n  {\n +\trcu_read_lock();\n +\tWRITE_ONCE(current->rcu_read_unlock_special.b.need_qs, true);\n +\trcu_read_unlock();\n +\n\n[neeraj: Apply Frederic's suggested fix for PREEMPT_RT]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7678bda1-2f4e-4f04-ac66-2aab21356943",  "id": "CVE-2021-47344",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47344"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: zr364xx: fix memory leak in zr364xx_start_readpipe\n\nsyzbot reported memory leak in zr364xx driver.\nThe problem was in non-freed urb in case of\nusb_submit_urb() fail.\n\nbacktrace:\n  [<ffffffff82baedf6>] kmalloc include/linux/slab.h:561 [inline]\n  [<ffffffff82baedf6>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74\n  [<ffffffff82f7cce8>] zr364xx_start_readpipe+0x78/0x130 drivers/media/usb/zr364xx/zr364xx.c:1022\n  [<ffffffff84251dfc>] zr364xx_board_init drivers/media/usb/zr364xx/zr364xx.c:1383 [inline]\n  [<ffffffff84251dfc>] zr364xx_probe+0x6a3/0x851 drivers/media/usb/zr364xx/zr364xx.c:1516\n  [<ffffffff82bb6507>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n  [<ffffffff826018a9>] really_probe+0x159/0x500 drivers/base/dd.c:576",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d6b00612-4df6-4e15-9908-f716bb91a959",  "id": "CVE-2014-9892",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9892"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The snd_compr_tstamp function in sound/core/compress_offload.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not properly initialize a timestamp data structure, which allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 28770164 and Qualcomm internal bug CR568717.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "26197ebc-b9cd-4e10-816c-35f8cb024076",  "id": "SUSE-SU-2018:3864-2",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2b93117a-6a10-4a96-8743-05dc28b06da6",  "id": "DLA-337-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e4fb8360-991d-46e0-b3ef-3095e64ef432",  "id": "CVE-2020-11608",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11608"  },  "ratings": [    {      "score": 4.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6abf17d5-5a50-4b3e-834a-18b5acb06d9d",  "id": "CVE-2014-7970",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7970"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "20344d83-fb5b-4d85-ba7b-15507d759016",  "id": "RHSA-2026:1475",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3d62cd3-edc4-47fe-acab-d1f1c07fb0f0",  "id": "CVE-2021-47362",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47362"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Update intermediate power state for SI\n\nUpdate the current state as boot state during dpm initialization.\nDuring the subsequent initialization, set_power_state gets called to\ntransition to the final power state. set_power_state refers to values\nfrom the current state and without current state populated, it could\nresult in NULL pointer dereference.\n\nFor ex: on platforms where PCI speed change is supported through ACPI\nATCS method, the link speed of current state needs to be queried before\ndeciding on changing to final power state's link speed. The logic to query\nATCS-support was broken on certain platforms. The issue became visible\nwhen broken ATCS-support logic got fixed with commit\nf9b7f3703ff9 (\"drm/amdgpu/acpi: make ATPX/ATCS structures global (v2)\").\n\nBug: https://gitlab.freedesktop.org/drm/amd/-/issues/1698",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b145323b-3ac2-4f02-be75-445762ea0793",  "id": "ALSA-2023:6524",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9ba0fd99-02eb-4755-9dff-0e02ff891419",  "id": "CVE-2022-49618",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux()\n\npdesc could be null but still dereference pdesc->name and it will lead to\na null pointer access. So we move a null check before dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f81809a-513b-4d80-a58d-b66b636faf7c",  "id": "CVE-2014-3673",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3673"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b34ffc27-b1ef-4680-a10c-3b49408d3606",  "id": "CVE-2024-35865",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in smb2_is_valid_oplock_break()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "046bc2af-3da9-412d-885d-7278749fcd1a",  "id": "CVE-2025-21999",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nproc: fix UAF in proc_get_inode()\n\nFix race between rmmod and /proc/XXX's inode instantiation.\n\nThe bug is that pde->proc_ops don't belong to /proc, it belongs to a\nmodule, therefore dereferencing it after /proc entry has been registered\nis a bug unless use_pde/unuse_pde() pair has been used.\n\nuse_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops\nnever changes so information necessary for inode instantiation can be\nsaved _before_ proc_register() in PDE itself and used later, avoiding\npde->proc_ops->...  dereference.\n\n      rmmod                         lookup\nsys_delete_module\n                         proc_lookup_de\n\t\t\t   pde_get(de);\n\t\t\t   proc_get_inode(dir->i_sb, de);\n  mod->exit()\n    proc_remove\n      remove_proc_subtree\n       proc_entry_rundown(de);\n  free_module(mod);\n\n                               if (S_ISREG(inode->i_mode))\n\t                         if (de->proc_ops->proc_read_iter)\n                           --> As module is already freed, will trigger UAF\n\nBUG: unable to handle page fault for address: fffffbfff80a702b\nPGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0\nOops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996)\nRIP: 0010:proc_get_inode+0x302/0x6e0\nRSP: 0018:ffff88811c837998 EFLAGS: 00010a06\nRAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007\nRDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158\nRBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20\nR10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0\nR13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001\nFS:  00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n proc_lookup_de+0x11f/0x2e0\n __lookup_slow+0x188/0x350\n walk_component+0x2ab/0x4f0\n path_lookupat+0x120/0x660\n filename_lookup+0x1ce/0x560\n vfs_statx+0xac/0x150\n __do_sys_newstat+0x96/0x110\n do_syscall_64+0x5f/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n[adobriyan@gmail.com: don't do 2 atomic ops on the common path]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ace6408e-f690-430c-8413-45c9744f7971",  "id": "CVE-2026-46023",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm mirror: fix integer overflow in create_dirty_log()\n\nThe argument count calculation in create_dirty_log() performs\n`*args_used = 2 + param_count` before validating against argc. When a\nuser provides a param_count close to UINT_MAX via the device mapper\ntable string, this unsigned addition wraps around to a small value,\ncausing the subsequent `argc < *args_used` check to be bypassed.\n\nThe overflowed param_count is then passed as argc to dm_dirty_log_create(),\nwhere it can cause out-of-bounds reads on the argv array.\n\nFix by comparing param_count against argc - 2 before performing the\naddition, following the same pattern used by parse_features() in the\nsame file. Since argc >= 2 is already guaranteed, the subtraction is\nsafe.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "47aa4325-0c08-45bc-9bb7-c687fef2ebaf",  "id": "ROOT-OS-ALPINE-315-CVE-2026-9076",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e736f303-b452-4ca9-a6e6-15bbc976a596",  "id": "CVE-2021-47386",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47386"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field\n\nIf driver read val value sufficient for\n(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7))\nfrom device then Null pointer dereference occurs.\n(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)\nAlso lm75[] does not serve a purpose anymore after switching to\ndevm_i2c_new_dummy_device() in w83791d_detect_subclients().\n\nThe patch fixes possible NULL pointer dereference by removing lm75[].\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[groeck: Dropped unnecessary continuation lines, fixed multi-line alignment]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ca1f9497-bab3-4176-a57b-fb3ee7d221dd",  "id": "CLSA-2023-1680210075",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b9f36051-8840-456f-b4c3-36bb98fafde4",  "id": "DLA-3008-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "14ac708c-a097-48aa-b8a4-67af095f28ee",  "id": "CLSA-2026-1779437548",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a896f05a-0412-4c6b-adb3-3dca2234cacb",  "id": "CVE-2023-0240",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "There is a logic error in io_uring's implementation which can be used to trigger a use-after-free vulnerability leading to privilege escalation.\n\nIn the io_prep_async_work function the assumption that the last io_grab_identity call cannot return false is not true, and in this case the function will use the init_cred or the previous linked requests identity to do operations instead of using the current identity. This can lead to reference counting issues causing use-after-free. We recommend upgrading past version 5.10.161.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f992b3b-a77b-4db0-b5dd-fca23b22213c",  "id": "DLA-358-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "847b63d3-dc4f-4178-b4fc-78b3ceafd811",  "id": "CVE-2022-49742",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: initialize locks earlier in f2fs_fill_super()\n\nsyzbot is reporting lockdep warning at f2fs_handle_error() [1], for\nspin_lock(&sbi->error_lock) is called before spin_lock_init() is called.\nFor safe locking in error handling, move initialization of locks (and\nobvious structures) in f2fs_fill_super() to immediately after memory\nallocation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "176bec01-b94c-4cab-862b-86dce6073c86",  "id": "CVE-2022-1652",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1652"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ece01969-cd49-4438-915e-a8e33e0803b6",  "id": "ROOT-OS-ALPINE-315-CVE-2025-69420",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f745083d-b201-4646-8110-49132772ecb9",  "id": "CVE-2025-38185",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: atmtcp: Free invalid length skb in atmtcp_c_send().\n\nsyzbot reported the splat below. [0]\n\nvcc_sendmsg() copies data passed from userspace to skb and passes\nit to vcc->dev->ops->send().\n\natmtcp_c_send() accesses skb->data as struct atmtcp_hdr after\nchecking if skb->len is 0, but it's not enough.\n\nAlso, when skb->len == 0, skb and sk (vcc) were leaked because\ndev_kfree_skb() is not called and sk_wmem_alloc adjustment is missing\nto revert atm_account_tx() in vcc_sendmsg(), which is expected\nto be done in atm_pop_raw().\n\nLet's properly free skb with an invalid length in atmtcp_c_send().\n\n[0]:\nBUG: KMSAN: uninit-value in atmtcp_c_send+0x255/0xed0 drivers/atm/atmtcp.c:294\n atmtcp_c_send+0x255/0xed0 drivers/atm/atmtcp.c:294\n vcc_sendmsg+0xd7c/0xff0 net/atm/common.c:644\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg+0x330/0x3d0 net/socket.c:727\n ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2566\n ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620\n __sys_sendmsg net/socket.c:2652 [inline]\n __do_sys_sendmsg net/socket.c:2657 [inline]\n __se_sys_sendmsg net/socket.c:2655 [inline]\n __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2655\n x64_sys_call+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4154 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n kmem_cache_alloc_node_noprof+0x818/0xf00 mm/slub.c:4249\n kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:579\n __alloc_skb+0x347/0x7d0 net/core/skbuff.c:670\n alloc_skb include/linux/skbuff.h:1336 [inline]\n vcc_sendmsg+0xb40/0xff0 net/atm/common.c:628\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg+0x330/0x3d0 net/socket.c:727\n ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2566\n ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620\n __sys_sendmsg net/socket.c:2652 [inline]\n __do_sys_sendmsg net/socket.c:2657 [inline]\n __se_sys_sendmsg net/socket.c:2655 [inline]\n __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2655\n x64_sys_call+0x32fb/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 1 UID: 0 PID: 5798 Comm: syz-executor192 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(undef)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c993ca22-e0ac-4089-b746-80567ab8000a",  "id": "CVE-2026-42327",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a &str that violates the UTF-8 invariant — resulting in undefined behavior. This vulnerability is fixed in 0.10.79.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "550ab5be-2768-465c-9e88-cad3c080442e",  "id": "CVE-2023-6039",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6039"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-component, net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker to crash the system when the LAN78XX USB device detaches.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a7df7081-14f8-4308-8366-5f6ceb6f7f1b",  "id": "CVE-2022-2961",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2961"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind while simultaneously triggering the rose_bind() function. This flaw allows a local user to crash or potentially escalate their privileges on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "00e9c790-0991-4e3f-a3b8-2a7e83d0006b",  "id": "CVE-2025-21758",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: add RCU protection to mld_newpack()\n\nmld_newpack() can be called without RTNL or RCU being held.\n\nNote that we no longer can use sock_alloc_send_skb() because\nipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.\n\nInstead use alloc_skb() and charge the net->ipv6.igmp_sk\nsocket under RCU protection.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee693ecc-8a1d-43bd-8d9b-36dd14347efa",  "id": "CVE-2015-8746",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8746"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not properly initialize memory for migration recovery operations, which allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) via crafted network traffic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dcf8db7f-e687-4423-ac8f-57c39a1c3723",  "id": "CVE-2020-12888",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12888"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    755  ],  "analysis": {    "state": "in_triage"  },  "description": "The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "268e0a10-4303-4c20-b4cf-edf3dfff7132",  "id": "CVE-2021-47641",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47641"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: cirrusfb: check pixclock to avoid divide by zero\n\nDo a sanity check on pixclock value to avoid divide by zero.\n\nIf the pixclock value is zero, the cirrusfb driver will round up\npixclock to get the derived frequency as close to maxclock as\npossible.\n\nSyzkaller reported a divide error in cirrusfb_check_pixclock.\n\ndivide error: 0000 [#1] SMP KASAN PTI\nCPU: 0 PID: 14938 Comm: cirrusfb_test Not tainted 5.15.0-rc6 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2\nRIP: 0010:cirrusfb_check_var+0x6f1/0x1260\n\nCall Trace:\n fb_set_var+0x398/0xf90\n do_fb_ioctl+0x4b8/0x6f0\n fb_ioctl+0xeb/0x130\n __x64_sys_ioctl+0x19d/0x220\n do_syscall_64+0x3a/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5b1a9502-7c4c-4c76-a07b-c2d0b71cdfec",  "id": "MGASA-2024-0247",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9e4e4c82-ee3b-4413-a8c5-7316f72acfab",  "id": "CVE-2025-38232",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: fix race between nfsd registration and exports_proc\n\nAs of now nfsd calls create_proc_exports_entry() at start of init_nfsd\nand cleanup by remove_proc_entry() at last of exit_nfsd.\n\nWhich causes kernel OOPs if there is race between below 2 operations:\n(i) exportfs -r\n(ii) mount -t nfsd none /proc/fs/nfsd\n\nfor 5.4 kernel ARM64:\n\nCPU 1:\nel1_irq+0xbc/0x180\narch_counter_get_cntvct+0x14/0x18\nrunning_clock+0xc/0x18\npreempt_count_add+0x88/0x110\nprep_new_page+0xb0/0x220\nget_page_from_freelist+0x2d8/0x1778\n__alloc_pages_nodemask+0x15c/0xef0\n__vmalloc_node_range+0x28c/0x478\n__vmalloc_node_flags_caller+0x8c/0xb0\nkvmalloc_node+0x88/0xe0\nnfsd_init_net+0x6c/0x108 [nfsd]\nops_init+0x44/0x170\nregister_pernet_operations+0x114/0x270\nregister_pernet_subsys+0x34/0x50\ninit_nfsd+0xa8/0x718 [nfsd]\ndo_one_initcall+0x54/0x2e0\n\nCPU 2 :\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000010\n\nPC is at : exports_net_open+0x50/0x68 [nfsd]\n\nCall trace:\nexports_net_open+0x50/0x68 [nfsd]\nexports_proc_open+0x2c/0x38 [nfsd]\nproc_reg_open+0xb8/0x198\ndo_dentry_open+0x1c4/0x418\nvfs_open+0x38/0x48\npath_openat+0x28c/0xf18\ndo_filp_open+0x70/0xe8\ndo_sys_open+0x154/0x248\n\nSometimes it crashes at exports_net_open() and sometimes cache_seq_next_rcu().\n\nand same is happening on latest 6.14 kernel as well:\n\n[    0.000000] Linux version 6.14.0-rc5-next-20250304-dirty\n...\n[  285.455918] Unable to handle kernel paging request at virtual address 00001f4800001f48\n...\n[  285.464902] pc : cache_seq_next_rcu+0x78/0xa4\n...\n[  285.469695] Call trace:\n[  285.470083]  cache_seq_next_rcu+0x78/0xa4 (P)\n[  285.470488]  seq_read+0xe0/0x11c\n[  285.470675]  proc_reg_read+0x9c/0xf0\n[  285.470874]  vfs_read+0xc4/0x2fc\n[  285.471057]  ksys_read+0x6c/0xf4\n[  285.471231]  __arm64_sys_read+0x1c/0x28\n[  285.471428]  invoke_syscall+0x44/0x100\n[  285.471633]  el0_svc_common.constprop.0+0x40/0xe0\n[  285.471870]  do_el0_svc_compat+0x1c/0x34\n[  285.472073]  el0_svc_compat+0x2c/0x80\n[  285.472265]  el0t_32_sync_handler+0x90/0x140\n[  285.472473]  el0t_32_sync+0x19c/0x1a0\n[  285.472887] Code: f9400885 93407c23 937d7c27 11000421 (f86378a3)\n[  285.473422] ---[ end trace 0000000000000000 ]---\n\nIt reproduced simply with below script:\nwhile [ 1 ]\ndo\n/exportfs -r\ndone &\n\nwhile [ 1 ]\ndo\ninsmod /nfsd.ko\nmount -t nfsd none /proc/fs/nfsd\numount /proc/fs/nfsd\nrmmod nfsd\ndone &\n\nSo exporting interfaces to user space shall be done at last and\ncleanup at first place.\n\nWith change there is no Kernel OOPs.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3962582d-3b14-4c6f-bbb5-8176a8892f41",  "id": "ALBA-2022:1996",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "e52e445b-24d0-4150-822b-d76563b46e68",      "versions": [        {          "component": "sed",          "version": "4.0"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "44c2218e-03c3-4551-8960-9d18d5f90a24",  "id": "CVE-2022-49120",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix task leak in pm8001_send_abort_all()\n\nIn pm8001_send_abort_all(), make sure to free the allocated sas task\nif pm8001_tag_alloc() or pm8001_mpi_build_cmd() fail.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d7e3cf22-73de-49a9-b76b-1aab4e6758e3",  "id": "CVE-2011-1044",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1044"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 does not initialize a certain response buffer, which allows local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially filled, a different vulnerability than CVE-2010-4649.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "30d7ea55-ed1d-4243-95f3-596ab4575cf5",  "id": "CVE-2026-52995",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: zero per-item info buffer before handing it to visitors\n\nrds_for_each_conn_info() and rds_walk_conn_path_info() both hand a\ncaller-allocated on-stack u64 buffer to a per-connection visitor and\nthen copy the full item_len bytes back to user space via\nrds_info_copy() regardless of how much of the buffer the visitor\nactually wrote.\n\nrds_ib_conn_info_visitor() and rds6_ib_conn_info_visitor() only\nwrite a subset of their output struct when the underlying\nrds_connection is not in state RDS_CONN_UP (src/dst addr, tos, sl\nand the two GIDs via explicit memsets). Several u32 fields\n(max_send_wr, max_recv_wr, max_send_sge, rdma_mr_max, rdma_mr_size,\ncache_allocs) and the 2-byte alignment hole between sl and\ncache_allocs remain as whatever stack contents preceded the visitor\ncall and are then memcpy_to_user()'d out to user space.\n\nstruct rds_info_rdma_connection and struct rds6_info_rdma_connection\nare the only rds_info_* structs in include/uapi/linux/rds.h that are\nnot marked __attribute__((packed)), so they have a real alignment\nhole. The other info visitors (rds_conn_info_visitor,\nrds6_conn_info_visitor, rds_tcp_tc_info, ...) write all fields of\ntheir packed output struct today and are not known to be vulnerable,\nbut a future visitor that adds a conditional write-path would have\nthe same bug.\n\nReproduction on a kernel built without CONFIG_INIT_STACK_ALL_ZERO=y:\na local unprivileged user opens AF_RDS, sets SO_RDS_TRANSPORT=IB,\nbinds to a local address on an RDMA-capable netdev (rxe soft-RoCE on\nany netdev is sufficient), sendto()'s any peer on the same subnet\n(fails cleanly but installs an rds_connection in the global hash in\nRDS_CONN_CONNECTING), then calls getsockopt(SOL_RDS,\nRDS_INFO_IB_CONNECTIONS). The returned 68-byte item contains 26\nbytes of stack garbage including kernel text/data pointers:\n\n    0..7   0a 63 00 01 0a 63 00 02     src=10.99.0.1 dst=10.99.0.2\n    8..39  00 ...                      gids (memset-zeroed)\n    40..47 e0 92 a3 81 ff ff ff ff     kernel pointer (max_send_wr)\n    48..55 7f 37 b5 81 ff ff ff ff     kernel pointer (rdma_mr_max)\n    56..59 01 00 08 00                 rdma_mr_size (garbage)\n    60..61 00 00                       tos, sl\n    62..63 00 00                       alignment padding\n    64..67 18 00 00 00                 cache_allocs (garbage)\n\nFix by zeroing the per-item buffer in both rds_for_each_conn_info()\nand rds_walk_conn_path_info() before invoking the visitor. This\ncovers the IPv4/IPv6 IB visitors and hardens all current and future\nvisitors against the same class of bug.\n\nNo functional change for visitors that fully populate their output.\n\nChanges in v2:\n- retarget at the net tree (subject prefix \"[PATCH net v2]\",\n  net/rds: prefix in the title)\n- pick up Reviewed-by tags from Sharath Srinivasan and\n  Allison Henderson",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4da34675-18fd-4288-945d-93d86f39fc47",  "id": "CVE-2023-52591",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nreiserfs: Avoid touching renamed directory if parent does not change\n\nThe VFS will not be locking moved directory if its parent does not\nchange. Change reiserfs rename code to avoid touching renamed directory\nif its parent does not change as without locking that can corrupt the\nfilesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "70e148d9-143f-430a-905b-998e4a57cf14",  "id": "CVE-2020-25686",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25686"  },  "ratings": [    {      "score": 3.7,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    290,    358  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the \"Birthday Attacks\" section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cdcdca2e-7acf-416b-894a-1229798d415d",  "id": "CVE-2022-49743",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: Use \"buf\" flexible array for memcpy() destination\n\nThe \"buf\" flexible array needs to be the memcpy() destination to avoid\nfalse positive run-time warning from the recent FORTIFY_SOURCE\nhardening:\n\n  memcpy: detected field-spanning write (size 93) of single field \"&fh->fb\"\n  at fs/overlayfs/export.c:799 (size 21)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04ab91e1-aaba-4796-a60a-6290b12399ca",  "id": "CVE-2025-39813",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix potential warning in trace_printk_seq during ftrace_dump\n\nWhen calling ftrace_dump_one() concurrently with reading trace_pipe,\na WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race\ncondition.\n\nThe issue occurs because:\n\nCPU0 (ftrace_dump)                              CPU1 (reader)\necho z > /proc/sysrq-trigger\n\n!trace_empty(&iter)\ntrace_iterator_reset(&iter) <- len = size = 0\n                                                cat /sys/kernel/tracing/trace_pipe\ntrace_find_next_entry_inc(&iter)\n  __find_next_entry\n    ring_buffer_empty_cpu <- all empty\n  return NULL\n\ntrace_printk_seq(&iter.seq)\n  WARN_ON_ONCE(s->seq.len >= s->seq.size)\n\nIn the context between trace_empty() and trace_find_next_entry_inc()\nduring ftrace_dump, the ring buffer data was consumed by other readers.\nThis caused trace_find_next_entry_inc to return NULL, failing to populate\n`iter.seq`. At this point, due to the prior trace_iterator_reset, both\n`iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal,\nthe WARN_ON_ONCE condition is triggered.\n\nMove the trace_printk_seq() into the if block that checks to make sure the\nreturn value of trace_find_next_entry_inc() is non-NULL in\nftrace_dump_one(), ensuring the 'iter.seq' is properly populated before\nsubsequent operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "940e2d74-0386-4261-b00d-872fed55fd13",  "id": "CVE-2025-38051",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix use-after-free in cifs_fill_dirent\n\nThere is a race condition in the readdir concurrency process, which may\naccess the rsp buffer after it has been released, triggering the\nfollowing KASAN warning.\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs]\n Read of size 4 at addr ffff8880099b819c by task a.out/342975\n\n CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0x53/0x70\n  print_report+0xce/0x640\n  kasan_report+0xb8/0xf0\n  cifs_fill_dirent+0xb03/0xb60 [cifs]\n  cifs_readdir+0x12cb/0x3190 [cifs]\n  iterate_dir+0x1a1/0x520\n  __x64_sys_getdents+0x134/0x220\n  do_syscall_64+0x4b/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f996f64b9f9\n Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89\n f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01\n f0 ff ff  0d f7 c3 0c 00 f7 d8 64 89 8\n RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e\n RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\n RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88\n R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000\n  </TASK>\n\n Allocated by task 408:\n  kasan_save_stack+0x20/0x40\n  kasan_save_track+0x14/0x30\n  __kasan_slab_alloc+0x6e/0x70\n  kmem_cache_alloc_noprof+0x117/0x3d0\n  mempool_alloc_noprof+0xf2/0x2c0\n  cifs_buf_get+0x36/0x80 [cifs]\n  allocate_buffers+0x1d2/0x330 [cifs]\n  cifs_demultiplex_thread+0x22b/0x2690 [cifs]\n  kthread+0x394/0x720\n  ret_from_fork+0x34/0x70\n  ret_from_fork_asm+0x1a/0x30\n\n Freed by task 342979:\n  kasan_save_stack+0x20/0x40\n  kasan_save_track+0x14/0x30\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x37/0x50\n  kmem_cache_free+0x2b8/0x500\n  cifs_buf_release+0x3c/0x70 [cifs]\n  cifs_readdir+0x1c97/0x3190 [cifs]\n  iterate_dir+0x1a1/0x520\n  __x64_sys_getdents64+0x134/0x220\n  do_syscall_64+0x4b/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n The buggy address belongs to the object at ffff8880099b8000\n  which belongs to the cache cifs_request of size 16588\n The buggy address is located 412 bytes inside of\n  freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc)\n\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n anon flags: 0x80000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\n raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\n head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\n head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\n head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff\n head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n >ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                             ^\n  ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ==================================================================\n\nPOC is available in the link [1].\n\nThe problem triggering process is as follows:\n\nProcess 1                       Process 2\n-----------------------------------\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb44a9b0-7566-4c23-8a07-5b05b5055bee",  "id": "CVE-2012-1179",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1179"  },  "ratings": [    {      "score": 5.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:S/C:N/I:N/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 3.3.1, when KVM is used, allows guest OS users to cause a denial of service (host OS crash) by leveraging administrative access to the guest OS, related to the pmd_none_or_clear_bad function and page faults for huge pages.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3bb663c0-d6c7-452c-b73d-ed5cdb2be3d6",  "id": "CVE-2016-6213",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6213"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0fad44e1-3232-4ea2-9dee-dbc5c48afe2a",  "id": "CVE-2021-47599",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47599"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: use latest_dev in btrfs_show_devname\n\nThe test case btrfs/238 reports the warning below:\n\n WARNING: CPU: 3 PID: 481 at fs/btrfs/super.c:2509 btrfs_show_devname+0x104/0x1e8 [btrfs]\n CPU: 2 PID: 1 Comm: systemd Tainted: G        W  O 5.14.0-rc1-custom #72\n Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015\n Call trace:\n   btrfs_show_devname+0x108/0x1b4 [btrfs]\n   show_mountinfo+0x234/0x2c4\n   m_show+0x28/0x34\n   seq_read_iter+0x12c/0x3c4\n   vfs_read+0x29c/0x2c8\n   ksys_read+0x80/0xec\n   __arm64_sys_read+0x28/0x34\n   invoke_syscall+0x50/0xf8\n   do_el0_svc+0x88/0x138\n   el0_svc+0x2c/0x8c\n   el0t_64_sync_handler+0x84/0xe4\n   el0t_64_sync+0x198/0x19c\n\nReason:\nWhile btrfs_prepare_sprout() moves the fs_devices::devices into\nfs_devices::seed_list, the btrfs_show_devname() searches for the devices\nand found none, leading to the warning as in above.\n\nFix:\nlatest_dev is updated according to the changes to the device list.\nThat means we could use the latest_dev->name to show the device name in\n/proc/self/mounts, the pointer will be always valid as it's assigned\nbefore the device is deleted from the list in remove or replace.\nThe RCU protection is sufficient as the device structure is freed after\nsynchronization.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d4edde27-8895-438c-a32f-cc9dc438ff63",  "id": "CVE-2011-3188",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3188"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a190c71-5df5-4901-93af-f37a7e5a86aa",  "id": "CVE-2012-6712",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6712"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 3.4, a buffer overflow occurs in drivers/net/wireless/iwlwifi/iwl-agn-sta.c, which will cause at least memory corruption.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c7f72208-8753-44d5-9628-28c756ce1f34",  "id": "OESA-2022-1737",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d54c612a-b5e9-41b1-a894-d14fa4f22edc",  "id": "CVE-2011-3363",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3363"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to cause a denial of service (system crash) by placing a referral at the root of a share.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0fd5115f-2216-4797-89f6-06a8743723f9",  "id": "CVE-2021-38202",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38202"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e6283e44-b2d3-45a1-b509-329b2ac14bde",  "id": "CVE-2022-49162",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: sm712fb: Fix crash in smtcfb_write()\n\nWhen the sm712fb driver writes three bytes to the framebuffer, the\ndriver will crash:\n\n    BUG: unable to handle page fault for address: ffffc90001ffffff\n    RIP: 0010:smtcfb_write+0x454/0x5b0\n    Call Trace:\n     vfs_write+0x291/0xd60\n     ? do_sys_openat2+0x27d/0x350\n     ? __fget_light+0x54/0x340\n     ksys_write+0xce/0x190\n     do_syscall_64+0x43/0x90\n     entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFix it by removing the open-coded endianness fixup-code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9893693f-e46f-4939-8fa1-290760adcd8b",  "id": "CVE-2017-7482",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7482"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17954c4c-fb1d-4109-bb0d-144cd97ddabc",  "id": "CVE-2015-3294",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3294"  },  "ratings": [    {      "score": 6.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"    }  ],  "cwes": [    19  ],  "analysis": {    "state": "in_triage"  },  "description": "The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "adea17d8-b085-4dba-bd3a-468e2f5e0d51",  "id": "CVE-2021-47324",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47324"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: Fix possible use-after-free in wdt_startup()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7be681a5-cefc-446d-8e23-5f4eff36fff8",  "id": "CVE-2020-36775",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36775"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid potential deadlock\n\nUsing f2fs_trylock_op() in f2fs_write_compressed_pages() to avoid potential\ndeadlock like we did in f2fs_write_single_data_page().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "09a5f0e4-c08e-47d5-bc5c-84b5c1b6ac57",  "id": "ALSA-2026:38503",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48d0f723-0580-4cee-8ea6-8fb040655811",  "id": "CVE-2024-58058",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: skip dumping tnc tree when zroot is null\n\nClearing slab cache will free all znode in memory and make\nc->zroot.znode = NULL, then dumping tnc tree will access\nc->zroot.znode which cause null pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b2d6a3d-f9a4-4063-bf14-78c182727e26",  "id": "CVE-2011-2525",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2525"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The qdisc_notify function in net/sched/sch_api.c in the Linux kernel before 2.6.35 does not prevent tc_fill_qdisc function calls referencing builtin (aka CQ_F_BUILTIN) Qdisc structures, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a crafted call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "56d1527d-8a98-48b5-85b2-a60bfb406471",  "id": "CVE-2022-48853",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nswiotlb: fix info leak with DMA_FROM_DEVICE\n\nThe problem I'm addressing was discovered by the LTP test covering\ncve-2018-1000204.\n\nA short description of what happens follows:\n1) The test case issues a command code 00 (TEST UNIT READY) via the SG_IO\n   interface with: dxfer_len == 524288, dxdfer_dir == SG_DXFER_FROM_DEV\n   and a corresponding dxferp. The peculiar thing about this is that TUR\n   is not reading from the device.\n2) In sg_start_req() the invocation of blk_rq_map_user() effectively\n   bounces the user-space buffer. As if the device was to transfer into\n   it. Since commit a45b599ad808 (\"scsi: sg: allocate with __GFP_ZERO in\n   sg_build_indirect()\") we make sure this first bounce buffer is\n   allocated with GFP_ZERO.\n3) For the rest of the story we keep ignoring that we have a TUR, so the\n   device won't touch the buffer we prepare as if the we had a\n   DMA_FROM_DEVICE type of situation. My setup uses a virtio-scsi device\n   and the  buffer allocated by SG is mapped by the function\n   virtqueue_add_split() which uses DMA_FROM_DEVICE for the \"in\" sgs (here\n   scatter-gather and not scsi generics). This mapping involves bouncing\n   via the swiotlb (we need swiotlb to do virtio in protected guest like\n   s390 Secure Execution, or AMD SEV).\n4) When the SCSI TUR is done, we first copy back the content of the second\n   (that is swiotlb) bounce buffer (which most likely contains some\n   previous IO data), to the first bounce buffer, which contains all\n   zeros.  Then we copy back the content of the first bounce buffer to\n   the user-space buffer.\n5) The test case detects that the buffer, which it zero-initialized,\n  ain't all zeros and fails.\n\nOne can argue that this is an swiotlb problem, because without swiotlb\nwe leak all zeros, and the swiotlb should be transparent in a sense that\nit does not affect the outcome (if all other participants are well\nbehaved).\n\nCopying the content of the original buffer into the swiotlb buffer is\nthe only way I can think of to make swiotlb transparent in such\nscenarios. So let's do just that if in doubt, but allow the driver\nto tell us that the whole mapped buffer is going to be overwritten,\nin which case we can preserve the old behavior and avoid the performance\nimpact of the extra bounce.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4acab7ce-b8d0-46dd-b3bc-a95b228cb336",  "id": "CVE-2024-50044",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change\n\nrfcomm_sk_state_change attempts to use sock_lock so it must never be\ncalled with it locked but rfcomm_sock_ioctl always attempt to lock it\ncausing the following trace:\n\n======================================================\nWARNING: possible circular locking dependency detected\n6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted\n------------------------------------------------------\nsyz-executor386/5093 is trying to acquire lock:\nffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline]\nffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73\n\nbut task is already holding lock:\nffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "311fa72f-cfe4-4bff-8c01-9552a2b4127a",  "id": "CVE-2026-46082",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0\n\nINVLPGA should cause a #UD when EFER.SVME is not set. Add a check to\nproperly inject #UD when EFER.SVME=0.\n\n[sean: tag for stable@]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "36e3ef28-b6a6-44a2-9a2a-61b25325b8a5",  "id": "CVE-2026-23388",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check metadata block offset is within range\n\nSyzkaller reports a \"general protection fault in squashfs_copy_data\"\n\nThis is ultimately caused by a corrupted index look-up table, which\nproduces a negative metadata block offset.\n\nThis is subsequently passed to squashfs_copy_data (via\nsquashfs_read_metadata) where the negative offset causes an out of bounds\naccess.\n\nThe fix is to check that the offset is within range in\nsquashfs_read_metadata.  This will trap this and other cases.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bae0728d-795f-4ec8-a973-9fa2f147b0dc",  "id": "CVE-2012-6540",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6540"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_ip_vs_get_ctl function in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 3.6 does not initialize a certain structure for IP_VS_SO_GET_TIMEOUT commands, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "57701eca-5211-4a6f-94e6-2224f63809c4",  "id": "RHSA-2026:25239",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c8832e7-b0bc-4f92-8019-7afc0c75911a",  "id": "SUSE-SU-2018:0906-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "001a7e18-5f69-4485-97e5-32b5fe8d84f4",  "id": "CVE-2024-40980",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: replace spin_lock by raw_spin_lock\n\ntrace_drop_common() is called with preemption disabled, and it acquires\na spin_lock. This is problematic for RT kernels because spin_locks are\nsleeping locks in this configuration, which causes the following splat:\n\nBUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\nin_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 449, name: rcuc/47\npreempt_count: 1, expected: 0\nRCU nest depth: 2, expected: 2\n5 locks held by rcuc/47/449:\n #0: ff1100086ec30a60 ((softirq_ctrl.lock)){+.+.}-{2:2}, at: __local_bh_disable_ip+0x105/0x210\n #1: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: rt_spin_lock+0xbf/0x130\n #2: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: __local_bh_disable_ip+0x11c/0x210\n #3: ffffffffb394a160 (rcu_callback){....}-{0:0}, at: rcu_do_batch+0x360/0xc70\n #4: ff1100086ee07520 (&data->lock){+.+.}-{2:2}, at: trace_drop_common.constprop.0+0xb5/0x290\nirq event stamp: 139909\nhardirqs last  enabled at (139908): [<ffffffffb1df2b33>] _raw_spin_unlock_irqrestore+0x63/0x80\nhardirqs last disabled at (139909): [<ffffffffb19bd03d>] trace_drop_common.constprop.0+0x26d/0x290\nsoftirqs last  enabled at (139892): [<ffffffffb07a1083>] __local_bh_enable_ip+0x103/0x170\nsoftirqs last disabled at (139898): [<ffffffffb0909b33>] rcu_cpu_kthread+0x93/0x1f0\nPreemption disabled at:\n[<ffffffffb1de786b>] rt_mutex_slowunlock+0xab/0x2e0\nCPU: 47 PID: 449 Comm: rcuc/47 Not tainted 6.9.0-rc2-rt1+ #7\nHardware name: Dell Inc. PowerEdge R650/0Y2G81, BIOS 1.6.5 04/15/2022\nCall Trace:\n <TASK>\n dump_stack_lvl+0x8c/0xd0\n dump_stack+0x14/0x20\n __might_resched+0x21e/0x2f0\n rt_spin_lock+0x5e/0x130\n ? trace_drop_common.constprop.0+0xb5/0x290\n ? skb_queue_purge_reason.part.0+0x1bf/0x230\n trace_drop_common.constprop.0+0xb5/0x290\n ? preempt_count_sub+0x1c/0xd0\n ? _raw_spin_unlock_irqrestore+0x4a/0x80\n ? __pfx_trace_drop_common.constprop.0+0x10/0x10\n ? rt_mutex_slowunlock+0x26a/0x2e0\n ? skb_queue_purge_reason.part.0+0x1bf/0x230\n ? __pfx_rt_mutex_slowunlock+0x10/0x10\n ? skb_queue_purge_reason.part.0+0x1bf/0x230\n trace_kfree_skb_hit+0x15/0x20\n trace_kfree_skb+0xe9/0x150\n kfree_skb_reason+0x7b/0x110\n skb_queue_purge_reason.part.0+0x1bf/0x230\n ? __pfx_skb_queue_purge_reason.part.0+0x10/0x10\n ? mark_lock.part.0+0x8a/0x520\n...\n\ntrace_drop_common() also disables interrupts, but this is a minor issue\nbecause we could easily replace it with a local_lock.\n\nReplace the spin_lock with raw_spin_lock to avoid sleeping in atomic\ncontext.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5f11d252-78eb-4f3c-809e-7ee3741f85ff",  "id": "CVE-2024-49913",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream\n\nThis commit addresses a null pointer dereference issue in the\n`commit_planes_for_stream` function at line 4140. The issue could occur\nwhen `top_pipe_to_program` is null.\n\nThe fix adds a check to ensure `top_pipe_to_program` is not null before\naccessing its stream_res. This prevents a null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4140 commit_planes_for_stream() error: we previously assumed 'top_pipe_to_program' could be null (see line 3906)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e8b72d4-7613-4e2b-abec-44316f02753b",  "id": "CVE-2023-23004",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23004"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eb7f1357-4f49-40de-9d89-a455d77d8425",  "id": "CVE-2023-52993",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL\n\nBaoquan reported that after triggering a crash the subsequent crash-kernel\nfails to boot about half of the time. It triggers a NULL pointer\ndereference in the periodic tick code.\n\nThis happens because the legacy timer interrupt (IRQ0) is resent in\nsoftware which happens in soft interrupt (tasklet) context. In this context\nget_irq_regs() returns NULL which leads to the NULL pointer dereference.\n\nThe reason for the resend is a spurious APIC interrupt on the IRQ0 vector\nwhich is captured and leads to a resend when the legacy timer interrupt is\nenabled. This is wrong because the legacy PIC interrupts are level\ntriggered and therefore should never be resent in software, but nothing\never sets the IRQ_LEVEL flag on those interrupts, so the core code does not\nknow about their trigger type.\n\nEnsure that IRQ_LEVEL is set when the legacy PCI interrupts are set up.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "419a9865-6f90-41e8-8171-25f8f5f24cb0",  "id": "CVE-2024-26898",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naoe: fix the potential use-after-free problem in aoecmd_cfg_pkts\n\nThis patch is against CVE-2023-6270. The description of cve is:\n\n  A flaw was found in the ATA over Ethernet (AoE) driver in the Linux\n  kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on\n  `struct net_device`, and a use-after-free can be triggered by racing\n  between the free on the struct and the access through the `skbtxq`\n  global queue. This could lead to a denial of service condition or\n  potential code execution.\n\nIn aoecmd_cfg_pkts(), it always calls dev_put(ifp) when skb initial\ncode is finished. But the net_device ifp will still be used in\nlater tx()->dev_queue_xmit() in kthread. Which means that the\ndev_put(ifp) should NOT be called in the success path of skb\ninitial code in aoecmd_cfg_pkts(). Otherwise tx() may run into\nuse-after-free because the net_device is freed.\n\nThis patch removed the dev_put(ifp) in the success path in\naoecmd_cfg_pkts(), and added dev_put() after skb xmit in tx().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f922c210-41e1-4fe2-937b-fe158655897a",  "id": "CVE-2024-36952",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    459  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Move NPIV's transport unregistration to after resource clean up\n\nThere are cases after NPIV deletion where the fabric switch still believes\nthe NPIV is logged into the fabric.  This occurs when a vport is\nunregistered before the Remove All DA_ID CT and LOGO ELS are sent to the\nfabric.\n\nCurrently fc_remove_host(), which calls dev_loss_tmo for all D_IDs including\nthe fabric D_ID, removes the last ndlp reference and frees the ndlp rport\nobject.  This sometimes causes the race condition where the final DA_ID and\nLOGO are skipped from being sent to the fabric switch.\n\nFix by moving the fc_remove_host() and scsi_remove_host() calls after DA_ID\nand LOGO are sent.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18c7ff9a-1fa5-44c0-b494-daeb6aaa8044",  "id": "CVE-2025-68211",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksm: use range-walk function to jump over holes in scan_get_next_rmap_item\n\nCurrently, scan_get_next_rmap_item() walks every page address in a VMA to\nlocate mergeable pages.  This becomes highly inefficient when scanning\nlarge virtual memory areas that contain mostly unmapped regions, causing\nksmd to use large amount of cpu without deduplicating much pages.\n\nThis patch replaces the per-address lookup with a range walk using\nwalk_page_range().  The range walker allows KSM to skip over entire\nunmapped holes in a VMA, avoiding unnecessary lookups.  This problem was\npreviously discussed in [1].\n\nConsider the following test program which creates a 32 TiB mapping in the\nvirtual address space but only populates a single page:\n\n#include <unistd.h>\n#include <stdio.h>\n#include <sys/mman.h>\n\n/* 32 TiB */\nconst size_t size = 32ul * 1024 * 1024 * 1024 * 1024;\n\nint main() {\n        char *area = mmap(NULL, size, PROT_READ | PROT_WRITE,\n                          MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);\n\n        if (area == MAP_FAILED) {\n                perror(\"mmap() failed\\n\");\n                return -1;\n        }\n\n        /* Populate a single page such that we get an anon_vma. */\n        *area = 0;\n\n        /* Enable KSM. */\n        madvise(area, size, MADV_MERGEABLE);\n        pause();\n        return 0;\n}\n\n$ ./ksm-sparse  &\n$ echo 1 > /sys/kernel/mm/ksm/run \n\nWithout this patch ksmd uses 100% of the cpu for a long time (more then 1\nhour in my test machine) scanning all the 32 TiB virtual address space\nthat contain only one mapped page.  This makes ksmd essentially deadlocked\nnot able to deduplicate anything of value.  With this patch ksmd walks\nonly the one mapped page and skips the rest of the 32 TiB virtual address\nspace, making the scan fast using little cpu.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "41910c5f-3ebc-4c01-b561-a4ca353fc009",  "id": "CVE-2022-49534",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT\n\nThere is a potential memory leak in lpfc_ignore_els_cmpl() and\nlpfc_els_rsp_reject() that was allocated from NPIV PLOGI_RJT\n(lpfc_rcv_plogi()'s login_mbox).\n\nCheck if cmdiocb->context_un.mbox was allocated in lpfc_ignore_els_cmpl(),\nand then free it back to phba->mbox_mem_pool along with mbox->ctx_buf for\nservice parameters.\n\nFor lpfc_els_rsp_reject() failure, free both the ctx_buf for service\nparameters and the login_mbox.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "83ae4906-af52-4007-9b49-ce9985449fb9",  "id": "ROOT-OS-DEBIAN-12-CVE-2026-42767",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f3be30d0-6cff-4f20-9dbd-11173fddc6d2",  "id": "CVE-2010-5329",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5329"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The video_usercopy function in drivers/media/video/v4l2-ioctl.c in the Linux kernel before 2.6.39 relies on the count value of a v4l2_ext_controls data structure to determine a kmalloc size, which might allow local users to cause a denial of service (memory consumption) via a large value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a701202f-8282-4bfa-8210-6599a1c340bc",  "id": "CVE-2024-42297",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to don't dirty inode for readonly filesystem\n\nsyzbot reports f2fs bug as below:\n\nkernel BUG at fs/f2fs/inode.c:933!\nRIP: 0010:f2fs_evict_inode+0x1576/0x1590 fs/f2fs/inode.c:933\nCall Trace:\n evict+0x2a4/0x620 fs/inode.c:664\n dispose_list fs/inode.c:697 [inline]\n evict_inodes+0x5f8/0x690 fs/inode.c:747\n generic_shutdown_super+0x9d/0x2c0 fs/super.c:675\n kill_block_super+0x44/0x90 fs/super.c:1667\n kill_f2fs_super+0x303/0x3b0 fs/f2fs/super.c:4894\n deactivate_locked_super+0xc1/0x130 fs/super.c:484\n cleanup_mnt+0x426/0x4c0 fs/namespace.c:1256\n task_work_run+0x24a/0x300 kernel/task_work.c:180\n ptrace_notify+0x2cd/0x380 kernel/signal.c:2399\n ptrace_report_syscall include/linux/ptrace.h:411 [inline]\n ptrace_report_syscall_exit include/linux/ptrace.h:473 [inline]\n syscall_exit_work kernel/entry/common.c:251 [inline]\n syscall_exit_to_user_mode_prepare kernel/entry/common.c:278 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]\n syscall_exit_to_user_mode+0x15c/0x280 kernel/entry/common.c:296\n do_syscall_64+0x50/0x110 arch/x86/entry/common.c:88\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nThe root cause is:\n- do_sys_open\n - f2fs_lookup\n  - __f2fs_find_entry\n   - f2fs_i_depth_write\n    - f2fs_mark_inode_dirty_sync\n     - f2fs_dirty_inode\n      - set_inode_flag(inode, FI_DIRTY_INODE)\n\n- umount\n - kill_f2fs_super\n  - kill_block_super\n   - generic_shutdown_super\n    - sync_filesystem\n    : sb is readonly, skip sync_filesystem()\n    - evict_inodes\n     - iput\n      - f2fs_evict_inode\n       - f2fs_bug_on(sbi, is_inode_flag_set(inode, FI_DIRTY_INODE))\n       : trigger kernel panic\n\nWhen we try to repair i_current_depth in readonly filesystem, let's\nskip dirty inode to avoid panic in later f2fs_evict_inode().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'SNYK:SNYK-UNMANAGED-TORVALDSLINUX-20696791'"    }  ]},{  "bom-ref": "87011232-4294-4ace-97ff-88ae5ee596ed",  "id": "CVE-2022-50462",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: vpe-mt: fix possible memory leak while module exiting\n\nAfer commit 1fa5ae857bb1 (\"driver core: get rid of struct device's\nbus_id string array\"), the name of device is allocated dynamically,\nit need be freed when module exiting, call put_device() to give up\nreference, so that it can be freed in kobject_cleanup() when the\nrefcount hit to 0. The vpe_device is static, so remove kfree() from\nvpe_device_release().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c0aeeaca-a09d-478d-ae9b-536213211533",  "id": "CVE-2021-47114",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47114"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix data corruption by fallocate\n\nWhen fallocate punches holes out of inode size, if original isize is in\nthe middle of last cluster, then the part from isize to the end of the\ncluster will be zeroed with buffer write, at that time isize is not yet\nupdated to match the new size, if writeback is kicked in, it will invoke\nocfs2_writepage()->block_write_full_page() where the pages out of inode\nsize will be dropped.  That will cause file corruption.  Fix this by\nzero out eof blocks when extending the inode size.\n\nRunning the following command with qemu-image 4.2.1 can get a corrupted\ncoverted image file easily.\n\n    qemu-img convert -p -t none -T none -f qcow2 $qcow_image \\\n             -O qcow2 -o compat=1.1 $qcow_image.conv\n\nThe usage of fallocate in qemu is like this, it first punches holes out\nof inode size, then extend the inode size.\n\n    fallocate(11, FALLOC_FL_KEEP_SIZE|FALLOC_FL_PUNCH_HOLE, 2276196352, 65536) = 0\n    fallocate(11, 0, 2276196352, 65536) = 0\n\nv1: https://www.spinics.net/lists/linux-fsdevel/msg193999.html\nv2: https://lore.kernel.org/linux-fsdevel/20210525093034.GB4112@quack2.suse.cz/T/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52d837b2-ae91-479c-8df4-bde1440ad242",  "id": "CVE-2014-2673",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2673"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The arch_dup_task_struct function in the Transactional Memory (TM) implementation in arch/powerpc/kernel/process.c in the Linux kernel before 3.13.7 on the powerpc platform does not properly interact with the clone and fork system calls, which allows local users to cause a denial of service (Program Check and system crash) via certain instructions that are executed with the processor in the Transactional state.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e7811e10-831f-4bfc-9c0c-27534a06c806",  "id": "CVE-2023-53409",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: base: component: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc1c5c82-8fa4-4795-931d-0e89f9ca754a",  "id": "RHSA-2026:19218",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3bbeea78-f261-473b-b181-b05fe7e473cd",  "id": "CVE-2024-47745",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    670  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\n\nThe remap_file_pages syscall handler calls do_mmap() directly, which\ndoesn't contain the LSM security check. And if the process has called\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\nRW pages, this will actually result in remapping the pages to RWX,\nbypassing a W^X policy enforced by SELinux.\n\nSo we should check prot by security_mmap_file LSM hook in the\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\npotentially permits an attacker to bypass a W^X policy enforced by\nSELinux.\n\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\nAIO and can be found in [1].\n\nThe PoC:\n\n$ cat > test.c\n\nint main(void) {\n\tsize_t pagesz = sysconf(_SC_PAGE_SIZE);\n\tint mfd = syscall(SYS_memfd_create, \"test\", 0);\n\tconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\n\t\tMAP_SHARED, mfd, 0);\n\tunsigned int old = syscall(SYS_personality, 0xffffffff);\n\tsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\n\tsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\n\tsyscall(SYS_personality, old);\n\t// show the RWX page exists even if W^X policy is enforced\n\tint fd = open(\"/proc/self/maps\", O_RDONLY);\n\tunsigned char buf2[1024];\n\twhile (1) {\n\t\tint ret = read(fd, buf2, 1024);\n\t\tif (ret <= 0) break;\n\t\twrite(1, buf2, ret);\n\t}\n\tclose(fd);\n}\n\n$ gcc test.c -o test\n$ ./test | grep rwx\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\n\n[PM: subject line tweaks]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'SNYK:SNYK-SLES155-KERNELSYMSAZURE-8534436'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'SNYK:SNYK-SLES155-KERNELSOURCEAZURE-8534467'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'SNYK:SNYK-SLES155-KERNELDEVELAZURE-8534475'"    },    {      "name": "EMBA:sbom:4:exploit",      "value": "'SNYK:SNYK-SLES155-KERNELAZUREDEVEL-8534461'"    },    {      "name": "EMBA:sbom:5:exploit",      "value": "'SNYK:SNYK-SLES155-KERNELAZURE-8534443'"    },    {      "name": "EMBA:sbom:6:exploit",      "value": "'SNYK:SNYK-AMZN2023-PYTHON3PERFDEBUGINFO-8662132'"    },    {      "name": "EMBA:sbom:7:exploit",      "value": "'SNYK:SNYK-AMZN2023-PYTHON3PERF-8662141'"    },    {      "name": "EMBA:sbom:8:exploit",      "value": "'SNYK:SNYK-AMZN2023-PERF-8662475'"    },    {      "name": "EMBA:sbom:9:exploit",      "value": "'SNYK:SNYK-AMZN2023-KERNELTOOLSDEVEL-8662454'"    },    {      "name": "EMBA:sbom:10:exploit",      "value": "'SNYK:SNYK-AMZN2023-KERNELTOOLSDEBUGINFO-8662468'"    },    {      "name": "EMBA:sbom:11:exploit",      "value": "'SNYK:SNYK-AMZN2023-KERNELTOOLS-8662153'"    },    {      "name": "EMBA:sbom:12:exploit",      "value": "'SNYK:SNYK-AMZN2023-KERNELMODULESEXTRACOMMON-8662469'"    },    {      "name": "EMBA:sbom:13:exploit",      "value": "'SNYK:SNYK-AMZN2023-KERNELMODULESEXTRA-8662142'"    },    {      "name": "EMBA:sbom:14:exploit",      "value": "'SNYK:SNYK-AMZN2023-KERNELLIVEPATCH61124134200-8662457'"    },    {      "name": "EMBA:sbom:15:exploit",      "value": "'SNYK:SNYK-AMZN2023-KERNELLIBBPFSTATIC-8662140'"    },    {      "name": "EMBA:sbom:16:exploit",      "value": "'SNYK:SNYK-AMZN2023-KERNELLIBBPFDEVEL-8662461'"    },    {      "name": "EMBA:sbom:17:exploit",      "value": "'SNYK:SNYK-AMZN2023-KERNELLIBBPF-8662465'"    },    {      "name": "EMBA:sbom:18:exploit",      "value": "'SNYK:SNYK-AMZN2023-KERNELHEADERS-8662491'"    },    {      "name": "EMBA:sbom:19:exploit",      "value": "'SNYK:SNYK-AMZN2023-KERNELDEBUGINFOCOMMONAARCH64-8662477'"    },    {      "name": "EMBA:sbom:20:exploit",      "value": "'SNYK:SNYK-AMZN2023-KERNELDEBUGINFO-8662484'"    },    {      "name": "EMBA:sbom:21:exploit",      "value": "'SNYK:SNYK-AMZN2-PYTHONPERF-10079604'"    },    {      "name": "EMBA:sbom:22:exploit",      "value": "'SNYK:SNYK-AMZN2-PERF-10079599'"    },    {      "name": "EMBA:sbom:23:exploit",      "value": "'SNYK:SNYK-AMZN2-KERNELTOOLSDEVEL-10079630'"    },    {      "name": "EMBA:sbom:24:exploit",      "value": "'SNYK:SNYK-AMZN2-KERNELDEBUGINFOCOMMONX8664-10079638'"    }  ]},{  "bom-ref": "14507a2c-3b11-4b22-a1cf-343fea3affe1",  "id": "AZL-42952",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f81d9793-142f-4247-95f7-b1e4b55772fe",  "id": "CVE-2024-45008",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: MT - limit max slots\n\nsyzbot is reporting too large allocation at input_mt_init_slots(), for\nnum_slots is supplied from userspace using ioctl(UI_DEV_CREATE).\n\nSince nobody knows possible max slots, this patch chose 1024.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed4900a7-a3f8-46b1-bf8a-988012964e39",  "id": "CVE-2023-52922",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: Fix UAF in bcm_proc_show()\n\nBUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80\nRead of size 8 at addr ffff888155846230 by task cat/7862\n\nCPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nCall Trace:\n <TASK>\n dump_stack_lvl+0xd5/0x150\n print_report+0xc1/0x5e0\n kasan_report+0xba/0xf0\n bcm_proc_show+0x969/0xa80\n seq_read_iter+0x4f6/0x1260\n seq_read+0x165/0x210\n proc_reg_read+0x227/0x300\n vfs_read+0x1d5/0x8d0\n ksys_read+0x11e/0x240\n do_syscall_64+0x35/0xb0\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nAllocated by task 7846:\n kasan_save_stack+0x1e/0x40\n kasan_set_track+0x21/0x30\n __kasan_kmalloc+0x9e/0xa0\n bcm_sendmsg+0x264b/0x44e0\n sock_sendmsg+0xda/0x180\n ____sys_sendmsg+0x735/0x920\n ___sys_sendmsg+0x11d/0x1b0\n __sys_sendmsg+0xfa/0x1d0\n do_syscall_64+0x35/0xb0\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nFreed by task 7846:\n kasan_save_stack+0x1e/0x40\n kasan_set_track+0x21/0x30\n kasan_save_free_info+0x27/0x40\n ____kasan_slab_free+0x161/0x1c0\n slab_free_freelist_hook+0x119/0x220\n __kmem_cache_free+0xb4/0x2e0\n rcu_core+0x809/0x1bd0\n\nbcm_op is freed before procfs entry be removed in bcm_release(),\nthis lead to bcm_proc_show() may read the freed bcm_op.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0dc32ccc-8756-4ee3-bd3f-7804178a2aa0",  "id": "CVE-2010-4656",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4656"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "The iowarrior_write function in drivers/usb/misc/iowarrior.c in the Linux kernel before 2.6.37 does not properly allocate memory, which might allow local users to trigger a heap-based buffer overflow, and consequently cause a denial of service or gain privileges, via a long report.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff6645d7-641e-4d49-b0e3-becddaf42da2",  "id": "CVE-2017-16532",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16532"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8d4f9357-3836-4bca-b385-d6f88e656e9f",  "id": "CVE-2010-3877",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3877"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "The get_name function in net/tipc/socket.c in the Linux kernel before 2.6.37-rc2 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "40221466-8cf1-43c8-9572-e1f5104ec68d",  "id": "CVE-2024-36893",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: Check for port partner validity before consuming it\n\ntypec_register_partner() does not guarantee partner registration\nto always succeed. In the event of failure, port->partner is set\nto the error value or NULL. Given that port->partner validity is\nnot checked, this results in the following crash:\n\nUnable to handle kernel NULL pointer dereference at virtual address xx\n pc : run_state_machine+0x1bc8/0x1c08\n lr : run_state_machine+0x1b90/0x1c08\n..\n Call trace:\n   run_state_machine+0x1bc8/0x1c08\n   tcpm_state_machine_work+0x94/0xe4\n   kthread_worker_fn+0x118/0x328\n   kthread+0x1d0/0x23c\n   ret_from_fork+0x10/0x20\n\nTo prevent the crash, check for port->partner validity before\nderefencing it in all the call sites.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "228f30c6-a155-4211-818b-ef9486d27203",  "id": "RHSA-2026:1503",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "61a07eab-617c-4b87-b832-787f3ec56375",  "id": "CVE-2026-31400",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix cache_request leak in cache_release\n\nWhen a reader's file descriptor is closed while in the middle of reading\na cache_request (rp->offset != 0), cache_release() decrements the\nrequest's readers count but never checks whether it should free the\nrequest.\n\nIn cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the\ncache_request is removed from the queue and freed along with its buffer\nand cache_head reference. cache_release() lacks this cleanup.\n\nThe only other path that frees requests with readers == 0 is\ncache_dequeue(), but it runs only when CACHE_PENDING transitions from\nset to clear. If that transition already happened while readers was\nstill non-zero, cache_dequeue() will have skipped the request, and no\nsubsequent call will clean it up.\n\nAdd the same cleanup logic from cache_read() to cache_release(): after\ndecrementing readers, check if it reached 0 with CACHE_PENDING clear,\nand if so, dequeue and free the cache_request.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cbf1b84e-741b-4b11-89fd-27421707f6e7",  "id": "AZL-6347",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.2,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4db336ca-f69c-40d0-9609-d2184dc2bc61",  "id": "CVE-2017-5986",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5986"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    617  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "68e84073-593e-4666-905d-d1dd64bde663",  "id": "CVE-2010-5298",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5298"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2c55d8f2-e0df-498c-9151-3590bac9ba54",  "id": "CVE-2012-3400",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3400"  },  "ratings": [    {      "score": 7.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "147954c4-cfd0-4cec-9431-e9a4601070dc",  "id": "CVE-2024-38578",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: Fix buffer size for tag 66 packet\n\nThe 'TAG 66 Packet Format' description is missing the cipher code and\nchecksum fields that are packed into the message packet. As a result,\nthe buffer allocated for the packet is 3 bytes too small and\nwrite_tag_66_packet() will write up to 3 bytes past the end of the\nbuffer.\n\nFix this by increasing the size of the allocation so the whole packet\nwill always fit in the buffer.\n\nThis fixes the below kasan slab-out-of-bounds bug:\n\n  BUG: KASAN: slab-out-of-bounds in ecryptfs_generate_key_packet_set+0x7d6/0xde0\n  Write of size 1 at addr ffff88800afbb2a5 by task touch/181\n\n  CPU: 0 PID: 181 Comm: touch Not tainted 6.6.13-gnu #1 4c9534092be820851bb687b82d1f92a426598dc6\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2/GNU Guix 04/01/2014\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x4c/0x70\n   print_report+0xc5/0x610\n   ? ecryptfs_generate_key_packet_set+0x7d6/0xde0\n   ? kasan_complete_mode_report_info+0x44/0x210\n   ? ecryptfs_generate_key_packet_set+0x7d6/0xde0\n   kasan_report+0xc2/0x110\n   ? ecryptfs_generate_key_packet_set+0x7d6/0xde0\n   __asan_store1+0x62/0x80\n   ecryptfs_generate_key_packet_set+0x7d6/0xde0\n   ? __pfx_ecryptfs_generate_key_packet_set+0x10/0x10\n   ? __alloc_pages+0x2e2/0x540\n   ? __pfx_ovl_open+0x10/0x10 [overlay 30837f11141636a8e1793533a02e6e2e885dad1d]\n   ? dentry_open+0x8f/0xd0\n   ecryptfs_write_metadata+0x30a/0x550\n   ? __pfx_ecryptfs_write_metadata+0x10/0x10\n   ? ecryptfs_get_lower_file+0x6b/0x190\n   ecryptfs_initialize_file+0x77/0x150\n   ecryptfs_create+0x1c2/0x2f0\n   path_openat+0x17cf/0x1ba0\n   ? __pfx_path_openat+0x10/0x10\n   do_filp_open+0x15e/0x290\n   ? __pfx_do_filp_open+0x10/0x10\n   ? __kasan_check_write+0x18/0x30\n   ? _raw_spin_lock+0x86/0xf0\n   ? __pfx__raw_spin_lock+0x10/0x10\n   ? __kasan_check_write+0x18/0x30\n   ? alloc_fd+0xf4/0x330\n   do_sys_openat2+0x122/0x160\n   ? __pfx_do_sys_openat2+0x10/0x10\n   __x64_sys_openat+0xef/0x170\n   ? __pfx___x64_sys_openat+0x10/0x10\n   do_syscall_64+0x60/0xd0\n   entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n  RIP: 0033:0x7f00a703fd67\n  Code: 25 00 00 41 00 3d 00 00 41 00 74 37 64 8b 04 25 18 00 00 00 85 c0 75 5b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 85 00 00 00 48 83 c4 68 5d 41 5c c3 0f 1f\n  RSP: 002b:00007ffc088e30b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101\n  RAX: ffffffffffffffda RBX: 00007ffc088e3368 RCX: 00007f00a703fd67\n  RDX: 0000000000000941 RSI: 00007ffc088e48d7 RDI: 00000000ffffff9c\n  RBP: 00007ffc088e48d7 R08: 0000000000000001 R09: 0000000000000000\n  R10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000000941\n  R13: 0000000000000000 R14: 00007ffc088e48d7 R15: 00007f00a7180040\n   </TASK>\n\n  Allocated by task 181:\n   kasan_save_stack+0x2f/0x60\n   kasan_set_track+0x29/0x40\n   kasan_save_alloc_info+0x25/0x40\n   __kasan_kmalloc+0xc5/0xd0\n   __kmalloc+0x66/0x160\n   ecryptfs_generate_key_packet_set+0x6d2/0xde0\n   ecryptfs_write_metadata+0x30a/0x550\n   ecryptfs_initialize_file+0x77/0x150\n   ecryptfs_create+0x1c2/0x2f0\n   path_openat+0x17cf/0x1ba0\n   do_filp_open+0x15e/0x290\n   do_sys_openat2+0x122/0x160\n   __x64_sys_openat+0xef/0x170\n   do_syscall_64+0x60/0xd0\n   entry_SYSCALL_64_after_hwframe+0x6e/0xd8",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e833f57d-4f78-4aa5-840a-03808edd7411",  "id": "CVE-2024-41077",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: fix validation of block size\n\nBlock size should be between 512 and PAGE_SIZE and be a power of 2. The current\ncheck does not validate this, so update the check.\n\nWithout this patch, null_blk would Oops due to a null pointer deref when\nloaded with bs=1536 [1].\n\n\n[axboe: remove unnecessary braces and != 0 check]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a0568307-063b-4817-8564-3b9ac5df7f17",  "id": "CVE-2010-4342",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4342"  },  "ratings": [    {      "score": 7.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The aun_incoming function in net/econet/af_econet.c in the Linux kernel before 2.6.37-rc6, when Econet is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending an Acorn Universal Networking (AUN) packet over UDP.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48cddfb5-bc6f-4f3f-bc22-020354b65ff2",  "id": "SUSE-SU-2018:0112-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d6da7ded-46f3-4c78-be9a-98d741b85c4c",  "id": "CVE-2024-56608",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'\n\nAn issue was identified in the dcn21_link_encoder_create function where\nan out-of-bounds access could occur when the hpd_source index was used\nto reference the link_enc_hpd_regs array. This array has a fixed size\nand the index was not being checked against the array's bounds before\naccessing it.\n\nThis fix adds a conditional check to ensure that the hpd_source index is\nwithin the valid range of the link_enc_hpd_regs array. If the index is\nout of bounds, the function now returns NULL to prevent undefined\nbehavior.\n\nReferences:\n\n[   65.920507] ------------[ cut here ]------------\n[   65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29\n[   65.920519] index 7 is out of range for type 'dcn10_link_enc_hpd_registers [5]'\n[   65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G           OE      6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13\n[   65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020\n[   65.920527] Call Trace:\n[   65.920529]  <TASK>\n[   65.920532]  dump_stack_lvl+0x48/0x70\n[   65.920541]  dump_stack+0x10/0x20\n[   65.920543]  __ubsan_handle_out_of_bounds+0xa2/0xe0\n[   65.920549]  dcn21_link_encoder_create+0xd9/0x140 [amdgpu]\n[   65.921009]  link_create+0x6d3/0xed0 [amdgpu]\n[   65.921355]  create_links+0x18a/0x4e0 [amdgpu]\n[   65.921679]  dc_create+0x360/0x720 [amdgpu]\n[   65.921999]  ? dmi_matches+0xa0/0x220\n[   65.922004]  amdgpu_dm_init+0x2b6/0x2c90 [amdgpu]\n[   65.922342]  ? console_unlock+0x77/0x120\n[   65.922348]  ? dev_printk_emit+0x86/0xb0\n[   65.922354]  dm_hw_init+0x15/0x40 [amdgpu]\n[   65.922686]  amdgpu_device_init+0x26a8/0x33a0 [amdgpu]\n[   65.922921]  amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu]\n[   65.923087]  amdgpu_pci_probe+0x1b7/0x630 [amdgpu]\n[   65.923087]  local_pci_probe+0x4b/0xb0\n[   65.923087]  pci_device_probe+0xc8/0x280\n[   65.923087]  really_probe+0x187/0x300\n[   65.923087]  __driver_probe_device+0x85/0x130\n[   65.923087]  driver_probe_device+0x24/0x110\n[   65.923087]  __driver_attach+0xac/0x1d0\n[   65.923087]  ? __pfx___driver_attach+0x10/0x10\n[   65.923087]  bus_for_each_dev+0x7d/0xd0\n[   65.923087]  driver_attach+0x1e/0x30\n[   65.923087]  bus_add_driver+0xf2/0x200\n[   65.923087]  driver_register+0x64/0x130\n[   65.923087]  ? __pfx_amdgpu_init+0x10/0x10 [amdgpu]\n[   65.923087]  __pci_register_driver+0x61/0x70\n[   65.923087]  amdgpu_init+0x7d/0xff0 [amdgpu]\n[   65.923087]  do_one_initcall+0x49/0x310\n[   65.923087]  ? kmalloc_trace+0x136/0x360\n[   65.923087]  do_init_module+0x6a/0x270\n[   65.923087]  load_module+0x1fce/0x23a0\n[   65.923087]  init_module_from_file+0x9c/0xe0\n[   65.923087]  ? init_module_from_file+0x9c/0xe0\n[   65.923087]  idempotent_init_module+0x179/0x230\n[   65.923087]  __x64_sys_finit_module+0x5d/0xa0\n[   65.923087]  do_syscall_64+0x76/0x120\n[   65.923087]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[   65.923087] RIP: 0033:0x7f2d80f1e88d\n[   65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48\n[   65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139\n[   65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d\n[   65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f\n[   65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002\n[   65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480\n[   65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0\n[   65.923087]  </TASK>\n[   65.923927] ---[ end trace ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9429d551-d853-43cb-9b5c-5087a6839339",  "id": "OESA-2021-1147",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6244547a-db3f-4278-af68-296133b9a1a5",  "id": "CLSA-2025-1760371564",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b8fb397-f9ec-4c63-bc38-4e0232600cc8",  "id": "CVE-2014-4608",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4608"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run.  NOTE: the author of the LZO algorithms says \"the Linux kernel is *not* affected; media hype.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d1256af-bcf7-44aa-9a5b-21506d664793",  "id": "CVE-2011-1768",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1768"  },  "ratings": [    {      "score": 5.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The tunnels implementation in the Linux kernel before 2.6.34, when tunnel functionality is configured as a module, allows remote attackers to cause a denial of service (OOPS) by sending a packet during module loading.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d322eb64-e322-4c04-82ab-c8edf07486b2",  "id": "CVE-2022-49395",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: Fix out-of-bounds read in LDT setup\n\nsyscall_stub_data() expects the data_count parameter to be the number of\nlongs, not bytes.\n\n ==================================================================\n BUG: KASAN: stack-out-of-bounds in syscall_stub_data+0x70/0xe0\n Read of size 128 at addr 000000006411f6f0 by task swapper/1\n\n CPU: 0 PID: 1 Comm: swapper Not tainted 5.18.0+ #18\n Call Trace:\n  show_stack.cold+0x166/0x2a7\n  __dump_stack+0x3a/0x43\n  dump_stack_lvl+0x1f/0x27\n  print_report.cold+0xdb/0xf81\n  kasan_report+0x119/0x1f0\n  kasan_check_range+0x3a3/0x440\n  memcpy+0x52/0x140\n  syscall_stub_data+0x70/0xe0\n  write_ldt_entry+0xac/0x190\n  init_new_ldt+0x515/0x960\n  init_new_context+0x2c4/0x4d0\n  mm_init.constprop.0+0x5ed/0x760\n  mm_alloc+0x118/0x170\n  0x60033f48\n  do_one_initcall+0x1d7/0x860\n  0x60003e7b\n  kernel_init+0x6e/0x3d4\n  new_thread_handler+0x1e7/0x2c0\n\n The buggy address belongs to stack of task swapper/1\n  and is located at offset 64 in frame:\n  init_new_ldt+0x0/0x960\n\n This frame has 2 objects:\n  [32, 40) 'addr'\n  [64, 80) 'desc'\n ==================================================================",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f6f5958b-015d-4a49-8a57-e6546f618197",  "id": "AZL-56774",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd93e235-bc14-47bb-b38d-3aed59d9de56",  "id": "CVE-2021-47345",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47345"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Fix rdma_resolve_route() memory leak\n\nFix a memory leak when \"mda_resolve_route() is called more than once on\nthe same \"rdma_cm_id\".\n\nThis is possible if cma_query_handler() triggers the\nRDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and\nallows rdma_resolve_route() to be called again.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "568f43f5-38ac-42c2-ac97-9db6d5a6eb90",  "id": "CVE-2026-46022",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()\n\nibmasm_handle_mouse_interrupt() performs an out-of-bounds MMIO read\nwhen the queue reader or writer index from hardware exceeds\nREMOTE_QUEUE_SIZE (60).\n\nA compromised service processor can trigger this by writing an\nout-of-range value to the reader or writer MMIO register before\nasserting an interrupt. Since writer is re-read from hardware on\nevery loop iteration, it can also be set to an out-of-range value\nafter the loop has already started.\n\nThe root cause is that get_queue_reader() and get_queue_writer() return\nraw readl() values that are passed directly into get_queue_entry(),\nwhich computes:\n\n  queue_begin + reader * sizeof(struct remote_input)\n\nwith no bounds check. This unchecked MMIO address is then passed to\nmemcpy_fromio(), reading 8 bytes from unintended device registers.\nFor sufficiently large values the address falls outside the PCI BAR\nmapping entirely, triggering a machine check exception.\n\nFix by checking both indices against REMOTE_QUEUE_SIZE at the top of\nthe loop body, before any call to get_queue_entry(). On an out-of-range\nvalue, reset the reader register to 0 via set_queue_reader() before\nbreaking, so that normal queue operation can resume if the corrupted\nhardware state is transient.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db6f7eeb-4d52-40e5-a731-5dfe50b454ea",  "id": "CVE-2024-46721",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix possible NULL pointer dereference\n\nprofile->parent->dents[AAFS_PROF_DIR] could be NULL only if its parent is made\nfrom __create_missing_ancestors(..) and 'ent->old' is NULL in\naa_replace_profiles(..).\nIn that case, it must return an error code and the code, -ENOENT represents\nits state that the path of its parent is not existed yet.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000030\nPGD 0 P4D 0\nPREEMPT SMP PTI\nCPU: 4 PID: 3362 Comm: apparmor_parser Not tainted 6.8.0-24-generic #24\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:aafs_create.constprop.0+0x7f/0x130\nCode: 4c 63 e0 48 83 c4 18 4c 89 e0 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 45 31 d2 c3 cc cc cc cc <4d> 8b 55 30 4d 8d ba a0 00 00 00 4c 89 55 c0 4c 89 ff e8 7a 6a ae\nRSP: 0018:ffffc9000b2c7c98 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 00000000000041ed RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffc9000b2c7cd8 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffffffff82baac10\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\nFS:  00007be9f22cf740(0000) GS:ffff88817bc00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000030 CR3: 0000000134b08000 CR4: 00000000000006f0\nCall Trace:\n <TASK>\n ? show_regs+0x6d/0x80\n ? __die+0x24/0x80\n ? page_fault_oops+0x99/0x1b0\n ? kernelmode_fixup_or_oops+0xb2/0x140\n ? __bad_area_nosemaphore+0x1a5/0x2c0\n ? find_vma+0x34/0x60\n ? bad_area_nosemaphore+0x16/0x30\n ? do_user_addr_fault+0x2a2/0x6b0\n ? exc_page_fault+0x83/0x1b0\n ? asm_exc_page_fault+0x27/0x30\n ? aafs_create.constprop.0+0x7f/0x130\n ? aafs_create.constprop.0+0x51/0x130\n __aafs_profile_mkdir+0x3d6/0x480\n aa_replace_profiles+0x83f/0x1270\n policy_update+0xe3/0x180\n profile_load+0xbc/0x150\n ? rw_verify_area+0x47/0x140\n vfs_write+0x100/0x480\n ? __x64_sys_openat+0x55/0xa0\n ? syscall_exit_to_user_mode+0x86/0x260\n ksys_write+0x73/0x100\n __x64_sys_write+0x19/0x30\n x64_sys_call+0x7e/0x25c0\n do_syscall_64+0x7f/0x180\n entry_SYSCALL_64_after_hwframe+0x78/0x80\nRIP: 0033:0x7be9f211c574\nCode: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89\nRSP: 002b:00007ffd26f2b8c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 00005d504415e200 RCX: 00007be9f211c574\nRDX: 0000000000001fc1 RSI: 00005d504418bc80 RDI: 0000000000000004\nRBP: 0000000000001fc1 R08: 0000000000001fc1 R09: 0000000080000000\nR10: 0000000000000000 R11: 0000000000000202 R12: 00005d504418bc80\nR13: 0000000000000004 R14: 00007ffd26f2b9b0 R15: 00007ffd26f2ba30\n </TASK>\nModules linked in: snd_seq_dummy snd_hrtimer qrtr snd_hda_codec_generic snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device i2c_i801 snd_timer i2c_smbus qxl snd soundcore drm_ttm_helper lpc_ich ttm joydev input_leds serio_raw mac_hid binfmt_misc msr parport_pc ppdev lp parport efi_pstore nfnetlink dmi_sysfs qemu_fw_cfg ip_tables x_tables autofs4 hid_generic usbhid hid ahci libahci psmouse virtio_rng xhci_pci xhci_pci_renesas\nCR2: 0000000000000030\n---[ end trace 0000000000000000 ]---\nRIP: 0010:aafs_create.constprop.0+0x7f/0x130\nCode: 4c 63 e0 48 83 c4 18 4c 89 e0 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 45 31 d2 c3 cc cc cc cc <4d> 8b 55 30 4d 8d ba a0 00 00 00 4c 89 55 c0 4c 89 ff e8 7a 6a ae\nRSP: 0018:ffffc9000b2c7c98 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 00000000000041ed RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffc9000b2c7cd8 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b9b24814-aae4-49fc-a160-41dbd40de71b",  "id": "CVE-2022-45885",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45885"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition that can cause a use-after-free when a device is disconnected.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0eec4657-1200-4e57-a51f-c5ec0fb8a739",  "id": "CVE-2011-2906",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2906"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer signedness error in the pmcraid_ioctl_passthrough function in drivers/scsi/pmcraid.c in the Linux kernel before 3.1 might allow local users to cause a denial of service (memory consumption or memory corruption) via a negative size value in an ioctl call. NOTE: this may be a vulnerability only in unusual environments that provide a privileged program for obtaining the required file descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "090517cf-4e54-4c16-8ea6-053984e01cc3",  "id": "CVE-2024-43904",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing\n\nThis commit adds null checks for the 'stream' and 'plane' variables in\nthe dcn30_apply_idle_power_optimizations function. These variables were\npreviously assumed to be null at line 922, but they were used later in\nthe code without checking if they were null. This could potentially lead\nto a null pointer dereference, which would cause a crash.\n\nThe null checks ensure that 'stream' and 'plane' are not null before\nthey are used, preventing potential crashes.\n\nFixes the below static smatch checker:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:938 dcn30_apply_idle_power_optimizations() error: we previously assumed 'stream' could be null (see line 922)\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:940 dcn30_apply_idle_power_optimizations() error: we previously assumed 'plane' could be null (see line 922)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8aac2560-1597-4fae-9c88-cd8a3e2f90bf",  "id": "RHSA-2021:1024",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d4f6825f-a561-4733-b334-b5a5fe0ea0c8",  "id": "CVE-2024-41079",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: always initialize cqe.result\n\nThe spec doesn't mandate that the first two double words (aka results)\nfor the command queue entry need to be set to 0 when they are not\nused (not specified). Though, the target implemention returns 0 for TCP\nand FC but not for RDMA.\n\nLet's make RDMA behave the same and thus explicitly initializing the\nresult field. This prevents leaking any data from the stack.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e84dfc90-b9e2-4d8b-bde6-3deb85d0c641",  "id": "CVE-2022-24958",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24958"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    763  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c11b5394-9f26-413b-96ad-e37fc0c1858e",  "id": "CVE-2023-52828",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Detect IP == ksym.end as part of BPF program\n\nNow that bpf_throw kfunc is the first such call instruction that has\nnoreturn semantics within the verifier, this also kicks in dead code\nelimination in unprecedented ways. For one, any instruction following\na bpf_throw call will never be marked as seen. Moreover, if a callchain\nends up throwing, any instructions after the call instruction to the\neventually throwing subprog in callers will also never be marked as\nseen.\n\nThe tempting way to fix this would be to emit extra 'int3' instructions\nwhich bump the jited_len of a program, and ensure that during runtime\nwhen a program throws, we can discover its boundaries even if the call\ninstruction to bpf_throw (or to subprogs that always throw) is emitted\nas the final instruction in the program.\n\nAn example of such a program would be this:\n\ndo_something():\n\t...\n\tr0 = 0\n\texit\n\nfoo():\n\tr1 = 0\n\tcall bpf_throw\n\tr0 = 0\n\texit\n\nbar(cond):\n\tif r1 != 0 goto pc+2\n\tcall do_something\n\texit\n\tcall foo\n\tr0 = 0  // Never seen by verifier\n\texit\t//\n\nmain(ctx):\n\tr1 = ...\n\tcall bar\n\tr0 = 0\n\texit\n\nHere, if we do end up throwing, the stacktrace would be the following:\n\nbpf_throw\nfoo\nbar\nmain\n\nIn bar, the final instruction emitted will be the call to foo, as such,\nthe return address will be the subsequent instruction (which the JIT\nemits as int3 on x86). This will end up lying outside the jited_len of\nthe program, thus, when unwinding, we will fail to discover the return\naddress as belonging to any program and end up in a panic due to the\nunreliable stack unwinding of BPF programs that we never expect.\n\nTo remedy this case, make bpf_prog_ksym_find treat IP == ksym.end as\npart of the BPF program, so that is_bpf_text_address returns true when\nsuch a case occurs, and we are able to unwind reliably when the final\ninstruction ends up being a call instruction.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2ef9b162-d58b-4fd3-b913-d5c8d7a8fab9",  "id": "CVE-2021-47366",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47366"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server\n\nAFS-3 has two data fetch RPC variants, FS.FetchData and FS.FetchData64, and\nLinux's afs client switches between them when talking to a non-YFS server\nif the read size, the file position or the sum of the two have the upper 32\nbits set of the 64-bit value.\n\nThis is a problem, however, since the file position and length fields of\nFS.FetchData are *signed* 32-bit values.\n\nFix this by capturing the capability bits obtained from the fileserver when\nit's sent an FS.GetCapabilities RPC, rather than just discarding them, and\nthen picking out the VICED_CAPABILITY_64BITFILES flag.  This can then be\nused to decide whether to use FS.FetchData or FS.FetchData64 - and also\nFS.StoreData or FS.StoreData64 - rather than using upper_32_bits() to\nswitch on the parameter values.\n\nThis capabilities flag could also be used to limit the maximum size of the\nfile, but all servers must be checked for that.\n\nNote that the issue does not exist with FS.StoreData - that uses *unsigned*\n32-bit values.  It's also not a problem with Auristor servers as its\nYFS.FetchData64 op uses unsigned 64-bit values.\n\nThis can be tested by cloning a git repo through an OpenAFS client to an\nOpenAFS server and then doing \"git status\" on it from a Linux afs\nclient[1].  Provided the clone has a pack file that's in the 2G-4G range,\nthe git status will show errors like:\n\n\terror: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index\n\terror: packfile .git/objects/pack/pack-5e813c51d12b6847bbc0fcd97c2bca66da50079c.pack does not match index\n\nThis can be observed in the server's FileLog with something like the\nfollowing appearing:\n\nSun Aug 29 19:31:39 2021 SRXAFS_FetchData, Fid = 2303380852.491776.3263114, Host 192.168.11.201:7001, Id 1001\nSun Aug 29 19:31:39 2021 CheckRights: len=0, for host=192.168.11.201:7001\nSun Aug 29 19:31:39 2021 FetchData_RXStyle: Pos 18446744071815340032, Len 3154\nSun Aug 29 19:31:39 2021 FetchData_RXStyle: file size 2400758866\n...\nSun Aug 29 19:31:40 2021 SRXAFS_FetchData returns 5\n\nNote the file position of 18446744071815340032.  This is the requested file\nposition sign-extended.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "75beb428-ea3d-445b-8389-96d3d0f95993",  "id": "CVE-2018-13100",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13100"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3, which does not properly validate secs_per_zone in a corrupted f2fs image, as demonstrated by a divide-by-zero error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4824ecbd-3386-4731-80b5-f0cf0c427aaa",  "id": "CVE-2022-48634",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: Fix BUG: sleeping function called from invalid context errors\n\ngma_crtc_page_flip() was holding the event_lock spinlock while calling\ncrtc_funcs->mode_set_base() which takes ww_mutex.\n\nThe only reason to hold event_lock is to clear gma_crtc->page_flip_event\non mode_set_base() errors.\n\nInstead unlock it after setting gma_crtc->page_flip_event and on\nerrors re-take the lock and clear gma_crtc->page_flip_event it\nit is still set.\n\nThis fixes the following WARN/stacktrace:\n\n[  512.122953] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:870\n[  512.123004] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1253, name: gnome-shell\n[  512.123031] preempt_count: 1, expected: 0\n[  512.123048] RCU nest depth: 0, expected: 0\n[  512.123066] INFO: lockdep is turned off.\n[  512.123080] irq event stamp: 0\n[  512.123094] hardirqs last  enabled at (0): [<0000000000000000>] 0x0\n[  512.123134] hardirqs last disabled at (0): [<ffffffff8d0ec28c>] copy_process+0x9fc/0x1de0\n[  512.123176] softirqs last  enabled at (0): [<ffffffff8d0ec28c>] copy_process+0x9fc/0x1de0\n[  512.123207] softirqs last disabled at (0): [<0000000000000000>] 0x0\n[  512.123233] Preemption disabled at:\n[  512.123241] [<0000000000000000>] 0x0\n[  512.123275] CPU: 3 PID: 1253 Comm: gnome-shell Tainted: G        W         5.19.0+ #1\n[  512.123304] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[  512.123323] Call Trace:\n[  512.123346]  <TASK>\n[  512.123370]  dump_stack_lvl+0x5b/0x77\n[  512.123412]  __might_resched.cold+0xff/0x13a\n[  512.123458]  ww_mutex_lock+0x1e/0xa0\n[  512.123495]  psb_gem_pin+0x2c/0x150 [gma500_gfx]\n[  512.123601]  gma_pipe_set_base+0x76/0x240 [gma500_gfx]\n[  512.123708]  gma_crtc_page_flip+0x95/0x130 [gma500_gfx]\n[  512.123808]  drm_mode_page_flip_ioctl+0x57d/0x5d0\n[  512.123897]  ? drm_mode_cursor2_ioctl+0x10/0x10\n[  512.123936]  drm_ioctl_kernel+0xa1/0x150\n[  512.123984]  drm_ioctl+0x21f/0x420\n[  512.124025]  ? drm_mode_cursor2_ioctl+0x10/0x10\n[  512.124070]  ? rcu_read_lock_bh_held+0xb/0x60\n[  512.124104]  ? lock_release+0x1ef/0x2d0\n[  512.124161]  __x64_sys_ioctl+0x8d/0xd0\n[  512.124203]  do_syscall_64+0x58/0x80\n[  512.124239]  ? do_syscall_64+0x67/0x80\n[  512.124267]  ? trace_hardirqs_on_prepare+0x55/0xe0\n[  512.124300]  ? do_syscall_64+0x67/0x80\n[  512.124340]  ? rcu_read_lock_sched_held+0x10/0x80\n[  512.124377]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[  512.124411] RIP: 0033:0x7fcc4a70740f\n[  512.124442] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00\n[  512.124470] RSP: 002b:00007ffda73f5390 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n[  512.124503] RAX: ffffffffffffffda RBX: 000055cc9e474500 RCX: 00007fcc4a70740f\n[  512.124524] RDX: 00007ffda73f5420 RSI: 00000000c01864b0 RDI: 0000000000000009\n[  512.124544] RBP: 00007ffda73f5420 R08: 000055cc9c0b0cb0 R09: 0000000000000034\n[  512.124564] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000c01864b0\n[  512.124584] R13: 0000000000000009 R14: 000055cc9df484d0 R15: 000055cc9af5d0c0\n[  512.124647]  </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7bf203f6-268d-41c6-957c-396cc8ce33bb",  "id": "CVE-2022-3594",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3594"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    404  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211363.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6c8859ed-a196-4fb9-8b8c-67e690af0aac",  "id": "CVE-2018-1094",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1094"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "19bc36fc-4dc3-496a-a1c4-d899b178231e",  "id": "DLA-1445-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f2382dba-b147-4511-bf91-33501acd5968",  "id": "CVE-2024-46730",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Ensure array index tg_inst won't be -1\n\n[WHY & HOW]\ntg_inst will be a negative if timing_generator_count equals 0, which\nshould be checked before used.\n\nThis fixes 2 OVERRUN issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c37e159-2ff0-4e03-ab0f-e7204b0be4ba",  "id": "CVE-2021-47635",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47635"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix to add refcount once page is set private\n\nMM defined the rule [1] very clearly that once page was set with PG_private\nflag, we should increment the refcount in that page, also main flows like\npageout(), migrate_page() will assume there is one additional page\nreference count if page_has_private() returns true. Otherwise, we may\nget a BUG in page migration:\n\n  page:0000000080d05b9d refcount:-1 mapcount:0 mapping:000000005f4d82a8\n  index:0xe2 pfn:0x14c12\n  aops:ubifs_file_address_operations [ubifs] ino:8f1 dentry name:\"f30e\"\n  flags: 0x1fffff80002405(locked|uptodate|owner_priv_1|private|node=0|\n  zone=1|lastcpupid=0x1fffff)\n  page dumped because: VM_BUG_ON_PAGE(page_count(page) != 0)\n  ------------[ cut here ]------------\n  kernel BUG at include/linux/page_ref.h:184!\n  invalid opcode: 0000 [#1] SMP\n  CPU: 3 PID: 38 Comm: kcompactd0 Not tainted 5.15.0-rc5\n  RIP: 0010:migrate_page_move_mapping+0xac3/0xe70\n  Call Trace:\n    ubifs_migrate_page+0x22/0xc0 [ubifs]\n    move_to_new_page+0xb4/0x600\n    migrate_pages+0x1523/0x1cc0\n    compact_zone+0x8c5/0x14b0\n    kcompactd+0x2bc/0x560\n    kthread+0x18c/0x1e0\n    ret_from_fork+0x1f/0x30\n\nBefore the time, we should make clean a concept, what does refcount means\nin page gotten from grab_cache_page_write_begin(). There are 2 situations:\nSituation 1: refcount is 3, page is created by __page_cache_alloc.\n  TYPE_A - the write process is using this page\n  TYPE_B - page is assigned to one certain mapping by calling\n\t   __add_to_page_cache_locked()\n  TYPE_C - page is added into pagevec list corresponding current cpu by\n\t   calling lru_cache_add()\nSituation 2: refcount is 2, page is gotten from the mapping's tree\n  TYPE_B - page has been assigned to one certain mapping\n  TYPE_A - the write process is using this page (by calling\n\t   page_cache_get_speculative())\nFilesystem releases one refcount by calling put_page() in xxx_write_end(),\nthe released refcount corresponds to TYPE_A (write task is using it). If\nthere are any processes using a page, page migration process will skip the\npage by judging whether expected_page_refs() equals to page refcount.\n\nThe BUG is caused by following process:\n    PA(cpu 0)                           kcompactd(cpu 1)\n\t\t\t\tcompact_zone\nubifs_write_begin\n  page_a = grab_cache_page_write_begin\n    add_to_page_cache_lru\n      lru_cache_add\n        pagevec_add // put page into cpu 0's pagevec\n  (refcnf = 3, for page creation process)\nubifs_write_end\n  SetPagePrivate(page_a) // doesn't increase page count !\n  unlock_page(page_a)\n  put_page(page_a)  // refcnt = 2\n\t\t\t\t[...]\n\n    PB(cpu 0)\nfilemap_read\n  filemap_get_pages\n    add_to_page_cache_lru\n      lru_cache_add\n        __pagevec_lru_add // traverse all pages in cpu 0's pagevec\n\t  __pagevec_lru_add_fn\n\t    SetPageLRU(page_a)\n\t\t\t\tisolate_migratepages\n                                  isolate_migratepages_block\n\t\t\t\t    get_page_unless_zero(page_a)\n\t\t\t\t    // refcnt = 3\n                                      list_add(page_a, from_list)\n\t\t\t\tmigrate_pages(from_list)\n\t\t\t\t  __unmap_and_move\n\t\t\t\t    move_to_new_page\n\t\t\t\t      ubifs_migrate_page(page_a)\n\t\t\t\t        migrate_page_move_mapping\n\t\t\t\t\t  expected_page_refs get 3\n                                  (migration[1] + mapping[1] + private[1])\n\t release_pages\n\t   put_page_testzero(page_a) // refcnt = 3\n                                          page_ref_freeze  // refcnt = 0\n\t     page_ref_dec_and_test(0 - 1 = -1)\n                                          page_ref_unfreeze\n                                            VM_BUG_ON_PAGE(-1 != 0, page)\n\nUBIFS doesn't increase the page refcount after setting private flag, which\nleads to page migration task believes the page is not used by any other\nprocesses, so the page is migrated. This causes concurrent accessing on\npage refcount between put_page() called by other process(eg. read process\ncalls lru_cache_add) and page_ref_unfreeze() called by mi\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2c02c919-2913-4b8e-bd03-f18605b141c1",  "id": "CVE-2025-38704",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access\n\nIn the preparation stage of CPU online, if the corresponding\nthe rdp's->nocb_cb_kthread does not exist, will be created,\nthere is a situation where the rdp's rcuop kthreads creation fails,\nand then de-offload this CPU's rdp, does not assign this CPU's\nrdp->nocb_cb_kthread pointer, but this rdp's->nocb_gp_rdp and\nrdp's->rdp_gp->nocb_gp_kthread is still valid.\n\nThis will cause the subsequent re-offload operation of this offline\nCPU, which will pass the conditional check and the kthread_unpark()\nwill access invalid rdp's->nocb_cb_kthread pointer.\n\nThis commit therefore use rdp's->nocb_gp_kthread instead of\nrdp_gp's->nocb_gp_kthread for safety check.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4fac3d6a-f0c6-4c46-8c06-f9f039f1b510",  "id": "CVE-2026-43456",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: fix type confusion in bond_setup_by_slave()\n\nkernel BUG at net/core/skbuff.c:2306!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306\nRSP: 0018:ffffc90004aff760 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e\nRDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900\nRBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000\nR10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780\nR13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0\nCall Trace:\n <TASK>\n ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900\n dev_hard_header include/linux/netdevice.h:3439 [inline]\n packet_snd net/packet/af_packet.c:3028 [inline]\n packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592\n ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646\n __sys_sendmsg+0x170/0x220 net/socket.c:2678\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fe1a0e6c1a9\n\nWhen a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,\nbond_setup_by_slave() directly copies the slave's header_ops to the\nbond device:\n\n    bond_dev->header_ops = slave_dev->header_ops;\n\nThis causes a type confusion when dev_hard_header() is later called\non the bond device. Functions like ipgre_header(), ip6gre_header(),all use\nnetdev_priv(dev) to access their device-specific private data. When\ncalled with the bond device, netdev_priv() returns the bond's private\ndata (struct bonding) instead of the expected type (e.g. struct\nip_tunnel), leading to garbage values being read and kernel crashes.\n\nFix this by introducing bond_header_ops with wrapper functions that\ndelegate to the active slave's header_ops using the slave's own\ndevice. This ensures netdev_priv() in the slave's header functions\nalways receives the correct device.\n\nThe fix is placed in the bonding driver rather than individual device\ndrivers, as the root cause is bond blindly inheriting header_ops from\nthe slave without considering that these callbacks expect a specific\nnetdev_priv() layout.\n\nThe type confusion can be observed by adding a printk in\nipgre_header() and running the following commands:\n\n    ip link add dummy0 type dummy\n    ip addr add 10.0.0.1/24 dev dummy0\n    ip link set dummy0 up\n    ip link add gre1 type gre local 10.0.0.1\n    ip link add bond1 type bond mode active-backup\n    ip link set gre1 master bond1\n    ip link set gre1 up\n    ip link set bond1 up\n    ip addr add fe80::1/64 dev bond1",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2ab47aed-ddc1-4e5a-93a7-5bb30ce80fe2",  "id": "CVE-2012-0027",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0027"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fedd5e9b-5ce1-4aa7-8920-efb5cf91b13a",  "id": "AZL-90090",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3fd0ec43-c4fc-4212-8d95-ed853b82d1a4",  "id": "CVE-2011-1945",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1945"  },  "ratings": [    {      "score": 2.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9fb52ec9-89f3-4e33-b70c-5c912e012751",  "id": "CVE-2023-53285",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: add bounds checking in get_max_inline_xattr_value_size()\n\nNormally the extended attributes in the inode body would have been\nchecked when the inode is first opened, but if someone is writing to\nthe block device while the file system is mounted, it's possible for\nthe inode table to get corrupted.  Add bounds checking to avoid\nreading beyond the end of allocated memory if this happens.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9bdbd2e7-c4a4-47ea-9d26-1c7efd1a8a23",  "id": "CVE-2024-46747",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup\n\nreport_fixup for the Cougar 500k Gaming Keyboard was not verifying\nthat the report descriptor size was correct before accessing it",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fa4d1052-8574-4ae3-be62-42fb40f3cdf5",  "id": "ROOT-OS-DEBIAN-13-CVE-2026-14456",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0a38bc6b-f6a3-444e-90c3-eba7bd5a6bf9",  "id": "CVE-2025-38096",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: don't warn when if there is a FW error\n\niwl_trans_reclaim is warning if it is called when the FW is not alive.\nBut if it is called when there is a pending restart, i.e. after a FW\nerror, there is no need to warn, instead - return silently.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "890fb088-6b5a-48b8-81b1-7140e5312f09",  "id": "CVE-2026-43075",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix out-of-bounds write in ocfs2_write_end_inline\n\nKASAN reports a use-after-free write of 4086 bytes in\nocfs2_write_end_inline, called from ocfs2_write_end_nolock during a\ncopy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on\na loop device.  The actual bug is an out-of-bounds write past the inode\nblock buffer, not a true use-after-free.  The write overflows into an\nadjacent freed page, which KASAN reports as UAF.\n\nThe root cause is that ocfs2_try_to_write_inline_data trusts the on-disk\nid_count field to determine whether a write fits in inline data.  On a\ncorrupted filesystem, id_count can exceed the physical maximum inline data\ncapacity, causing writes to overflow the inode block buffer.\n\nCall trace (crash path):\n\n   vfs_copy_file_range (fs/read_write.c:1634)\n     do_splice_direct\n       splice_direct_to_actor\n         iter_file_splice_write\n           ocfs2_file_write_iter\n             generic_perform_write\n               ocfs2_write_end\n                 ocfs2_write_end_nolock (fs/ocfs2/aops.c:1949)\n                   ocfs2_write_end_inline (fs/ocfs2/aops.c:1915)\n                     memcpy_from_folio     <-- KASAN: write OOB\n\nSo add id_count upper bound check in ocfs2_validate_inode_block() to\nalongside the existing i_size check to fix it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7711f84c-4388-44c8-9a0f-85026a6665a9",  "id": "CVE-2024-46752",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    404  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: replace BUG_ON() with error handling at update_ref_for_cow()\n\nInstead of a BUG_ON() just return an error, log an error message and\nabort the transaction in case we find an extent buffer belonging to the\nrelocation tree that doesn't have the full backref flag set. This is\nunexpected and should never happen (save for bugs or a potential bad\nmemory).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7624a301-78e4-4b9f-adfd-2a26a90d2684",  "id": "CVE-2025-37954",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Avoid race in open_cached_dir with lease breaks\n\nA pre-existing valid cfid returned from find_or_create_cached_dir might\nrace with a lease break, meaning open_cached_dir doesn't consider it\nvalid, and thinks it's newly-constructed. This leaks a dentry reference\nif the allocation occurs before the queued lease break work runs.\n\nAvoid the race by extending holding the cfid_list_lock across\nfind_or_create_cached_dir and when the result is checked.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f4ebeb8d-c677-44cc-9427-5ef21502a866",  "id": "CVE-2025-24912",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24912"  },  "ratings": [    {      "score": 3.7,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    826  ],  "analysis": {    "state": "in_triage"  },  "description": "hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "16b16765-bc3c-4f86-90b1-7559282bcab4",  "id": "CVE-2021-38198",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38198"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "713e9257-932f-473f-b4a2-55162473f4ce",  "id": "CVE-2011-1759",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1759"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the sys_oabi_semtimedop function in arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 2.6.39 on the ARM platform, when CONFIG_OABI_COMPAT is enabled, allows local users to gain privileges or cause a denial of service (heap memory corruption) by providing a crafted argument and leveraging a race condition.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cff19a05-a88d-4aeb-9042-97479428aa8a",  "id": "CVE-2018-19407",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19407"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "81b3a84c-2c97-49af-959c-0392ae7d539f",  "id": "CVE-2024-57924",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: relax assertions on failure to encode file handles\n\nEncoding file handles is usually performed by a filesystem >encode_fh()\nmethod that may fail for various reasons.\n\nThe legacy users of exportfs_encode_fh(), namely, nfsd and\nname_to_handle_at(2) syscall are ready to cope with the possibility\nof failure to encode a file handle.\n\nThere are a few other users of exportfs_encode_{fh,fid}() that\ncurrently have a WARN_ON() assertion when ->encode_fh() fails.\nRelax those assertions because they are wrong.\n\nThe second linked bug report states commit 16aac5ad1fa9 (\"ovl: support\nencoding non-decodable file handles\") in v6.6 as the regressing commit,\nbut this is not accurate.\n\nThe aforementioned commit only increases the chances of the assertion\nand allows triggering the assertion with the reproducer using overlayfs,\ninotify and drop_caches.\n\nTriggering this assertion was always possible with other filesystems and\nother reasons of ->encode_fh() failures and more particularly, it was\nalso possible with the exact same reproducer using overlayfs that is\nmounted with options index=on,nfs_export=on also on kernels < v6.6.\nTherefore, I am not listing the aforementioned commit as a Fixes commit.\n\nBackport hint: this patch will have a trivial conflict applying to\nv6.6.y, and other trivial conflicts applying to stable kernels < v6.6.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aa169a76-1017-496c-8d3b-726037389202",  "id": "CVE-2021-29650",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29650"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ccc80d70-4170-40ad-aa78-cf76f0e17791",  "id": "DSA-5343-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b74ab4b2-1645-423d-830d-adca7875d024",  "id": "CVE-2026-43183",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx25821: Fix a resource leak in cx25821_dev_setup()\n\nAdd release_mem_region() if ioremap() fails to release the memory\nregion obtained by cx25821_get_resources().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84e1da43-c13f-4ab2-bbd2-6480da6ac021",  "id": "CVE-2022-48702",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()\n\nThe voice allocator sometimes begins allocating from near the end of the\narray and then wraps around, however snd_emu10k1_pcm_channel_alloc()\naccesses the newly allocated voices as if it never wrapped around.\n\nThis results in out of bounds access if the first voice has a high enough\nindex so that first_voice + requested_voice_count > NUM_G (64).\nThe more voices are requested, the more likely it is for this to occur.\n\nThis was initially discovered using PipeWire, however it can be reproduced\nby calling aplay multiple times with 16 channels:\naplay -r 48000 -D plughw:CARD=Live,DEV=3 -c 16 /dev/zero\n\nUBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40\nindex 65 is out of range for type 'snd_emu10k1_voice [64]'\nCPU: 1 PID: 31977 Comm: aplay Tainted: G        W IOE      6.0.0-rc2-emu10k1+ #7\nHardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002    07/22/2010\nCall Trace:\n<TASK>\ndump_stack_lvl+0x49/0x63\ndump_stack+0x10/0x16\nubsan_epilogue+0x9/0x3f\n__ubsan_handle_out_of_bounds.cold+0x44/0x49\nsnd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1]\nsnd_pcm_hw_params+0x29f/0x600 [snd_pcm]\nsnd_pcm_common_ioctl+0x188/0x1410 [snd_pcm]\n? exit_to_user_mode_prepare+0x35/0x170\n? do_syscall_64+0x69/0x90\n? syscall_exit_to_user_mode+0x26/0x50\n? do_syscall_64+0x69/0x90\n? exit_to_user_mode_prepare+0x35/0x170\nsnd_pcm_ioctl+0x27/0x40 [snd_pcm]\n__x64_sys_ioctl+0x95/0xd0\ndo_syscall_64+0x5c/0x90\n? do_syscall_64+0x69/0x90\n? do_syscall_64+0x69/0x90\nentry_SYSCALL_64_after_hwframe+0x63/0xcd",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51b3a690-6415-4241-bb6c-6b80e276de8d",  "id": "CVE-2019-20095",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20095"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This will cause a memory leak and denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e46b4007-7710-4ccd-a750-a0c4ffd71169",  "id": "CVE-2024-46726",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Ensure index calculation will not overflow\n\n[WHY & HOW]\nMake sure vmid0p72_idx, vnom0p8_idx and vmax0p9_idx calculation will\nnever overflow and exceess array size.\n\nThis fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2a1ccc1b-de66-40d4-8f26-5450191bf4f9",  "id": "CVE-2022-49309",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback()\n\nThere is a deadlock in rtw_surveydone_event_callback(),\nwhich is shown below:\n\n   (Thread 1)                  |      (Thread 2)\n                               | _set_timer()\nrtw_surveydone_event_callback()|  mod_timer()\n spin_lock_bh() //(1)          |  (wait a time)\n ...                           | rtw_scan_timeout_handler()\n del_timer_sync()              |  spin_lock_bh() //(2)\n (wait timer to stop)          |  ...\n\nWe hold pmlmepriv->lock in position (1) of thread 1 and use\ndel_timer_sync() to wait timer to stop, but timer handler\nalso need pmlmepriv->lock in position (2) of thread 2.\nAs a result, rtw_surveydone_event_callback() will block forever.\n\nThis patch extracts del_timer_sync() from the protection of\nspin_lock_bh(), which could let timer handler to obtain\nthe needed lock. What`s more, we change spin_lock_bh() in\nrtw_scan_timeout_handler() to spin_lock_irq(). Otherwise,\nspin_lock_bh() will also cause deadlock() in timer handler.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c26813e-9024-4456-a58a-884e2614effd",  "id": "CVE-2024-49968",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: filesystems without casefold feature cannot be mounted with siphash\n\nWhen mounting the ext4 filesystem, if the default hash version is set to\nDX_HASH_SIPHASH but the casefold feature is not set, exit the mounting.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1ae584b9-996c-4196-b871-ba7760c458da",  "id": "CVE-2024-53148",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Flush partial mappings in error case\n\nIf some remap_pfn_range() calls succeeded before one failed, we still have\nbuffer pages mapped into the userspace page tables when we drop the buffer\nreference with comedi_buf_map_put(bm). The userspace mappings are only\ncleaned up later in the mmap error path.\n\nFix it by explicitly flushing all mappings in our VMA on the error path.\n\nSee commit 79a61cc3fc04 (\"mm: avoid leaving partial pfn mappings around in\nerror case\").",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9de5bead-8d47-4353-ae3b-08c3001f1d51",  "id": "CVE-2024-53181",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: vector: Do not use drvdata in release\n\nThe drvdata is not available in release. Let's just use container_of()\nto get the vector_device instance. Otherwise, removing a vector device\nwill result in a crash:\n\nRIP: 0033:vector_device_release+0xf/0x50\nRSP: 00000000e187bc40  EFLAGS: 00010202\nRAX: 0000000060028f61 RBX: 00000000600f1baf RCX: 00000000620074e0\nRDX: 000000006220b9c0 RSI: 0000000060551c80 RDI: 0000000000000000\nRBP: 00000000e187bc50 R08: 00000000603ad594 R09: 00000000e187bb70\nR10: 000000000000135a R11: 00000000603ad422 R12: 00000000623ae028\nR13: 000000006287a200 R14: 0000000062006d30 R15: 00000000623700b6\nKernel panic - not syncing: Segfault with no mm\nCPU: 0 UID: 0 PID: 16 Comm: kworker/0:1 Not tainted 6.12.0-rc6-g59b723cd2adb #1\nWorkqueue: events mc_work_proc\nStack:\n 60028f61 623ae028 e187bc80 60276fcd\n 6220b9c0 603f5820 623ae028 00000000\n e187bcb0 603a2bcd 623ae000 62370010\nCall Trace:\n [<60028f61>] ? vector_device_release+0x0/0x50\n [<60276fcd>] device_release+0x70/0xba\n [<603a2bcd>] kobject_put+0xba/0xe7\n [<60277265>] put_device+0x19/0x1c\n [<60281266>] platform_device_put+0x26/0x29\n [<60281e5f>] platform_device_unregister+0x2c/0x2e\n [<60029422>] vector_remove+0x52/0x58\n [<60031316>] ? mconsole_reply+0x0/0x50\n [<600310c8>] mconsole_remove+0x160/0x1cc\n [<603b19f4>] ? strlen+0x0/0x15\n [<60066611>] ? __dequeue_entity+0x1a9/0x206\n [<600666a7>] ? set_next_entity+0x39/0x63\n [<6006666e>] ? set_next_entity+0x0/0x63\n [<60038fa6>] ? um_set_signals+0x0/0x43\n [<6003070c>] mc_work_proc+0x77/0x91\n [<60057664>] process_scheduled_works+0x1b3/0x2dd\n [<60055f32>] ? assign_work+0x0/0x58\n [<60057f0a>] worker_thread+0x1e9/0x293\n [<6005406f>] ? set_pf_worker+0x0/0x64\n [<6005d65d>] ? arch_local_irq_save+0x0/0x2d\n [<6005d748>] ? kthread_exit+0x0/0x3a\n [<60057d21>] ? worker_thread+0x0/0x293\n [<6005dbf1>] kthread+0x126/0x12b\n [<600219c5>] new_thread_handler+0x85/0xb6",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1e52cc5c-2f41-4d5f-9128-746b5d0c9f9f",  "id": "CVE-2026-31580",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix cached_dev.sb_bio use-after-free and crash\n\nIn our production environment, we have received multiple crash reports\nregarding libceph, which have caught our attention:\n\n```\n[6888366.280350] Call Trace:\n[6888366.280452]  blk_update_request+0x14e/0x370\n[6888366.280561]  blk_mq_end_request+0x1a/0x130\n[6888366.280671]  rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792]  rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903]  __complete_request+0x22/0x70 [libceph]\n[6888366.281032]  osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164]  ? inet_recvmsg+0x5b/0xd0\n[6888366.281272]  ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405]  ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534]  ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661]  ceph_con_workfn+0x329/0x680 [libceph]\n```\n\nAfter analyzing the coredump file, we found that the address of\ndc->sb_bio has been freed. We know that cached_dev is only freed when it\nis stopped.\n\nSince sb_bio is a part of struct cached_dev, rather than an alloc every\ntime.  If the device is stopped while writing to the superblock, the\nreleased address will be accessed at endio.\n\nThis patch hopes to wait for sb_write to complete in cached_dev_free.\n\nIt should be noted that we analyzed the cause of the problem, then tell\nall details to the QWEN and adopted the modifications it made.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8ab6aead-3a2e-495f-b440-00979cae6366",  "id": "CVE-2022-50011",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvenus: pm_helpers: Fix warning in OPP during probe\n\nFix the following WARN triggered during Venus driver probe on\n5.19.0-rc8-next-20220728:\n\n WARNING: CPU: 7 PID: 339 at drivers/opp/core.c:2471 dev_pm_opp_set_config+0x49c/0x610\n Modules linked in: qcom_spmi_adc5 rtc_pm8xxx qcom_spmi_adc_tm5 leds_qcom_lpg led_class_multicolor\n  qcom_pon qcom_vadc_common venus_core(+) qcom_spmi_temp_alarm v4l2_mem2mem videobuf2_v4l2 msm(+)\n  videobuf2_common crct10dif_ce spi_geni_qcom snd_soc_sm8250 i2c_qcom_geni gpu_sched\n  snd_soc_qcom_common videodev qcom_q6v5_pas soundwire_qcom drm_dp_aux_bus qcom_stats\n  drm_display_helper qcom_pil_info soundwire_bus snd_soc_lpass_va_macro mc qcom_q6v5\n  phy_qcom_snps_femto_v2 qcom_rng snd_soc_lpass_macro_common snd_soc_lpass_wsa_macro\n  lpass_gfm_sm8250 slimbus qcom_sysmon qcom_common qcom_glink_smem qmi_helpers\n  qcom_wdt mdt_loader socinfo icc_osm_l3 display_connector\n  drm_kms_helper qnoc_sm8250 drm fuse ip_tables x_tables ipv6\n CPU: 7 PID: 339 Comm: systemd-udevd Not tainted 5.19.0-rc8-next-20220728 #4\n Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)\n pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : dev_pm_opp_set_config+0x49c/0x610\n lr : dev_pm_opp_set_config+0x58/0x610\n sp : ffff8000093c3710\n x29: ffff8000093c3710 x28: ffffbca3959d82b8 x27: ffff8000093c3d00\n x26: ffffbca3959d8e08 x25: ffff4396cac98118 x24: ffff4396c0e24810\n x23: ffff4396c4272c40 x22: ffff4396c0e24810 x21: ffff8000093c3810\n x20: ffff4396cac36800 x19: ffff4396cac96800 x18: 0000000000000000\n x17: 0000000000000003 x16: ffffbca3f4edf198 x15: 0000001cba64a858\n x14: 0000000000000180 x13: 000000000000017e x12: 0000000000000000\n x11: 0000000000000002 x10: 0000000000000a60 x9 : ffff8000093c35c0\n x8 : ffff4396c4273700 x7 : ffff43983efca6c0 x6 : ffff43983efca640\n x5 : 00000000410fd0d0 x4 : ffff4396c4272c40 x3 : ffffbca3f5d1e008\n x2 : 0000000000000000 x1 : ffff4396c2421600 x0 : ffff4396cac96860\n Call trace:\n  dev_pm_opp_set_config+0x49c/0x610\n  devm_pm_opp_set_config+0x18/0x70\n  vcodec_domains_get+0xb8/0x1638 [venus_core]\n  core_get_v4+0x1d8/0x218 [venus_core]\n  venus_probe+0xf4/0x468 [venus_core]\n  platform_probe+0x68/0xd8\n  really_probe+0xbc/0x2a8\n  __driver_probe_device+0x78/0xe0\n  driver_probe_device+0x3c/0xf0\n  __driver_attach+0x70/0x120\n  bus_for_each_dev+0x70/0xc0\n  driver_attach+0x24/0x30\n  bus_add_driver+0x150/0x200\n  driver_register+0x64/0x120\n  __platform_driver_register+0x28/0x38\n  qcom_venus_driver_init+0x24/0x1000 [venus_core]\n  do_one_initcall+0x54/0x1c8\n  do_init_module+0x44/0x1d0\n  load_module+0x16c8/0x1aa0\n  __do_sys_finit_module+0xbc/0x110\n  __arm64_sys_finit_module+0x20/0x30\n  invoke_syscall+0x44/0x108\n  el0_svc_common.constprop.0+0xcc/0xf0\n  do_el0_svc+0x2c/0xb8\n  el0_svc+0x2c/0x88\n  el0t_64_sync_handler+0xb8/0xc0\n  el0t_64_sync+0x18c/0x190\n  qcom-venus: probe of aa00000.video-codec failed with error -16\n\nThe fix is re-ordering the code related to OPP core. The OPP core\nexpects all configuration options to be provided before the OPP\ntable is added.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dcf009bd-edc7-47d0-9434-2c50e21e78b1",  "id": "CVE-2022-36123",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36123"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9ceb301e-8210-4605-952e-38f78c6ef100",  "id": "CVE-2024-40998",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()\n\nIn the following concurrency we will access the uninitialized rs->lock:\n\next4_fill_super\n  ext4_register_sysfs\n   // sysfs registered msg_ratelimit_interval_ms\n                             // Other processes modify rs->interval to\n                             // non-zero via msg_ratelimit_interval_ms\n  ext4_orphan_cleanup\n    ext4_msg(sb, KERN_INFO, \"Errors on filesystem, \"\n      __ext4_msg\n        ___ratelimit(&(EXT4_SB(sb)->s_msg_ratelimit_state)\n          if (!rs->interval)  // do nothing if interval is 0\n            return 1;\n          raw_spin_trylock_irqsave(&rs->lock, flags)\n            raw_spin_trylock(lock)\n              _raw_spin_trylock\n                __raw_spin_trylock\n                  spin_acquire(&lock->dep_map, 0, 1, _RET_IP_)\n                    lock_acquire\n                      __lock_acquire\n                        register_lock_class\n                          assign_lock_key\n                            dump_stack();\n  ratelimit_state_init(&sbi->s_msg_ratelimit_state, 5 * HZ, 10);\n    raw_spin_lock_init(&rs->lock);\n    // init rs->lock here\n\nand get the following dump_stack:\n\n=========================================================\nINFO: trying to register non-static key.\nThe code is fine but needs lockdep annotation, or maybe\nyou didn't initialize this object before use?\nturning off the locking correctness validator.\nCPU: 12 PID: 753 Comm: mount Tainted: G E 6.7.0-rc6-next-20231222 #504\n[...]\nCall Trace:\n dump_stack_lvl+0xc5/0x170\n dump_stack+0x18/0x30\n register_lock_class+0x740/0x7c0\n __lock_acquire+0x69/0x13a0\n lock_acquire+0x120/0x450\n _raw_spin_trylock+0x98/0xd0\n ___ratelimit+0xf6/0x220\n __ext4_msg+0x7f/0x160 [ext4]\n ext4_orphan_cleanup+0x665/0x740 [ext4]\n __ext4_fill_super+0x21ea/0x2b10 [ext4]\n ext4_fill_super+0x14d/0x360 [ext4]\n[...]\n=========================================================\n\nNormally interval is 0 until s_msg_ratelimit_state is initialized, so\n___ratelimit() does nothing. But registering sysfs precedes initializing\nrs->lock, so it is possible to change rs->interval to a non-zero value\nvia the msg_ratelimit_interval_ms interface of sysfs while rs->lock is\nuninitialized, and then a call to ext4_msg triggers the problem by\naccessing an uninitialized rs->lock. Therefore register sysfs after all\ninitializations are complete to avoid such problems.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5caa64eb-839a-4d7c-bb36-ac7894d2df23",  "id": "SUSE-SU-2018:3866-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7866c1c9-df63-4b04-b2f4-e8a6db15fd85",  "id": "SUSE-SU-2022:14915-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1fefa7cd-9281-4b9d-9133-6cd301741605",  "id": "CVE-2025-37857",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: st: Fix array overflow in st_setup()\n\nChange the array size to follow parms size instead of a fixed value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "361c469f-7309-4e8d-a452-0283995ddef2",  "id": "CVE-2024-42131",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: avoid overflows in dirty throttling logic\n\nThe dirty throttling logic is interspersed with assumptions that dirty\nlimits in PAGE_SIZE units fit into 32-bit (so that various multiplications\nfit into 64-bits).  If limits end up being larger, we will hit overflows,\npossible divisions by 0 etc.  Fix these problems by never allowing so\nlarge dirty limits as they have dubious practical value anyway.  For\ndirty_bytes / dirty_background_bytes interfaces we can just refuse to set\nso large limits.  For dirty_ratio / dirty_background_ratio it isn't so\nsimple as the dirty limit is computed from the amount of available memory\nwhich can change due to memory hotplug etc.  So when converting dirty\nlimits from ratios to numbers of pages, we just don't allow the result to\nexceed UINT_MAX.\n\nThis is root-only triggerable problem which occurs when the operator\nsets dirty limits to >16 TB.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e7c178f5-0b63-41a2-8edd-58f96b1b85a8",  "id": "CVE-2023-45862",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45862"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6102348e-0389-4543-b7d4-861967542e50",  "id": "CVE-2018-18710",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18710"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "11583e2d-8b50-4791-b085-e81ee1cab3e7",  "id": "AZL-35086",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef4f4300-4504-4cf6-841b-a6174559a7cd",  "id": "CVE-2021-47234",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47234"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: phy-mtk-tphy: Fix some resource leaks in mtk_phy_init()\n\nUse clk_disable_unprepare() in the error path of mtk_phy_init() to fix\nsome resource leaks.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10ef0c72-ba91-45ac-8355-096b706d815f",  "id": "CVE-2024-56619",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()\n\nSyzbot reported that when searching for records in a directory where the\ninode's i_size is corrupted and has a large value, memory access outside\nthe folio/page range may occur, or a use-after-free bug may be detected if\nKASAN is enabled.\n\nThis is because nilfs_last_byte(), which is called by nilfs_find_entry()\nand others to calculate the number of valid bytes of directory data in a\npage from i_size and the page index, loses the upper 32 bits of the 64-bit\nsize information due to an inappropriate type of local variable to which\nthe i_size value is assigned.\n\nThis caused a large byte offset value due to underflow in the end address\ncalculation in the calling nilfs_find_entry(), resulting in memory access\nthat exceeds the folio/page size.\n\nFix this issue by changing the type of the local variable causing the bit\nloss from \"unsigned int\" to \"u64\".  The return value of nilfs_last_byte()\nis also of type \"unsigned int\", but it is truncated so as not to exceed\nPAGE_SIZE and no bit loss occurs, so no change is required.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed893d50-f73f-4592-a1a7-64cf17bbc0f4",  "id": "CVE-2023-53246",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL\n\nWhen compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount\nis NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL attributes to\nS_AUTOMOUNT and corresponding dentry flags is retained regardless of\nCONFIG_CIFS_DFS_UPCALL, leading to a NULL pointer dereference in\nVFS follow_automount() when traversing a DFS referral link:\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  ...\n  Call Trace:\n   <TASK>\n   __traverse_mounts+0xb5/0x220\n   ? cifs_revalidate_mapping+0x65/0xc0 [cifs]\n   step_into+0x195/0x610\n   ? lookup_fast+0xe2/0xf0\n   path_lookupat+0x64/0x140\n   filename_lookup+0xc2/0x140\n   ? __create_object+0x299/0x380\n   ? kmem_cache_alloc+0x119/0x220\n   ? user_path_at_empty+0x31/0x50\n   user_path_at_empty+0x31/0x50\n   __x64_sys_chdir+0x2a/0xd0\n   ? exit_to_user_mode_prepare+0xca/0x100\n   do_syscall_64+0x42/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nThis fix adds an inline cifs_dfs_d_automount() {return -EREMOTE} handler\nwhen CONFIG_CIFS_DFS_UPCALL is disabled. An alternative would be to\navoid flagging S_AUTOMOUNT, etc. without CONFIG_CIFS_DFS_UPCALL. This\napproach was chosen as it provides more control over the error path.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff638d2b-b8a0-49d1-a23a-ceb77959f0e4",  "id": "CVE-2022-3108",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3108"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    252  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c8686bb9-3aff-410c-9371-37074495fb17",  "id": "CVE-2024-26654",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: sh: aica: reorder cleanup operations to avoid UAF bugs\n\nThe dreamcastcard->timer could schedule the spu_dma_work and the\nspu_dma_work could also arm the dreamcastcard->timer.\n\nWhen the snd_pcm_substream is closing, the aica_channel will be\ndeallocated. But it could still be dereferenced in the worker\nthread. The reason is that del_timer() will return directly\nregardless of whether the timer handler is running or not and\nthe worker could be rescheduled in the timer handler. As a result,\nthe UAF bug will happen. The racy situation is shown below:\n\n      (Thread 1)                 |      (Thread 2)\nsnd_aicapcm_pcm_close()          |\n ...                             |  run_spu_dma() //worker\n                                 |    mod_timer()\n  flush_work()                   |\n  del_timer()                    |  aica_period_elapsed() //timer\n  kfree(dreamcastcard->channel)  |    schedule_work()\n                                 |  run_spu_dma() //worker\n  ...                            |    dreamcastcard->channel-> //USE\n\nIn order to mitigate this bug and other possible corner cases,\ncall mod_timer() conditionally in run_spu_dma(), then implement\nPCM sync_stop op to cancel both the timer and worker. The sync_stop\nop will be called from PCM core appropriately when needed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6687a5d8-f756-403e-ac60-34e48cb6cbbb",  "id": "CVE-2024-36481",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    754  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/probes: fix error check in parse_btf_field()\n\nbtf_find_struct_member() might return NULL or an error via the\nERR_PTR() macro. However, its caller in parse_btf_field() only checks\nfor the NULL condition. Fix this by using IS_ERR() and returning the\nerror up the stack.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aaa41a85-dafa-458d-9bcd-51021c5769b9",  "id": "CVE-2025-37839",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: remove wrong sb->s_sequence check\n\nJournal emptiness is not determined by sb->s_sequence == 0 but rather by\nsb->s_start == 0 (which is set a few lines above). Furthermore 0 is a\nvalid transaction ID so the check can spuriously trigger. Remove the\ninvalid WARN_ON.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a7c6689e-7dc7-47b9-b789-bc951fa4c578",  "id": "CVE-2017-16648",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16648"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The dvb_frontend_free function in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device. NOTE: the function was later renamed __dvb_frontend_free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b6a93c9-23f9-431b-b2c4-6f93ff0d2582",  "id": "CVE-2024-49892",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Initialize get_bytes_per_element's default to 1\n\nVariables, used as denominators and maybe not assigned to other values,\nshould not be 0. bytes_per_element_y & bytes_per_element_c are\ninitialized by get_bytes_per_element() which should never return 0.\n\nThis fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a281b17d-8ac2-4a0b-9189-a2035fd2a5b4",  "id": "CVE-2023-53432",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: net: fix use after free in fwnet_finish_incoming_packet()\n\nThe netif_rx() function frees the skb so we can't dereference it to\nsave the skb->len.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2cca67a-3247-4a82-9a91-aaaf719bd454",  "id": "CVE-2021-3653",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3653"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    862  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the \"int_ctl\" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4fe12a16-264d-4119-83e5-7fc4931259d5",  "id": "CVE-2024-56746",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()\n\nWhen information such as info->screen_base is not ready, calling\nsh7760fb_free_mem() does not release memory correctly. Call\ndma_free_coherent() instead.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "97930cdc-6867-4bf7-824d-68265edc2382",  "id": "CVE-2021-47580",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47580"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix type in min_t to avoid stack OOB\n\nChange min_t() to use type \"u32\" instead of type \"int\" to avoid stack out\nof bounds. With min_t() type \"int\" the values get sign extended and the\nlarger value gets used causing stack out of bounds.\n\nBUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:191 [inline]\nBUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x1de/0x240 lib/scatterlist.c:976\nRead of size 127 at addr ffff888072607128 by task syz-executor.7/18707\n\nCPU: 1 PID: 18707 Comm: syz-executor.7 Not tainted 5.15.0-syzk #1\nHardware name: Red Hat KVM, BIOS 1.13.0-2\nCall Trace:\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106\n print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:256\n __kasan_report mm/kasan/report.c:442 [inline]\n kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:459\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0x1a3/0x210 mm/kasan/generic.c:189\n memcpy+0x23/0x60 mm/kasan/shadow.c:65\n memcpy include/linux/fortify-string.h:191 [inline]\n sg_copy_buffer+0x1de/0x240 lib/scatterlist.c:976\n sg_copy_from_buffer+0x33/0x40 lib/scatterlist.c:1000\n fill_from_dev_buffer.part.34+0x82/0x130 drivers/scsi/scsi_debug.c:1162\n fill_from_dev_buffer drivers/scsi/scsi_debug.c:1888 [inline]\n resp_readcap16+0x365/0x3b0 drivers/scsi/scsi_debug.c:1887\n schedule_resp+0x4d8/0x1a70 drivers/scsi/scsi_debug.c:5478\n scsi_debug_queuecommand+0x8c9/0x1ec0 drivers/scsi/scsi_debug.c:7533\n scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1520 [inline]\n scsi_queue_rq+0x16b0/0x2d40 drivers/scsi/scsi_lib.c:1699\n blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1639\n __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325\n blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358\n __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1761\n __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1838\n blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891\n blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474\n blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:62\n sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:836\n sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:774\n sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:939\n sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1165\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:874 [inline]\n __se_sys_ioctl fs/ioctl.c:860 [inline]\n __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52ec915a-b797-4f58-8486-d714a7e17de1",  "id": "SUSE-SU-2026:3055-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3a8669d1-32cc-4c66-b446-3d7c58208768",      "versions": [        {          "component": "radvd",          "version": "1.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1aad21fe-8eb9-4536-8070-1475b1455b54",  "id": "CVE-2024-46818",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check gpio_id before used as array index\n\n[WHY & HOW]\nGPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore\nshould be checked in advance.\n\nThis fixes 5 OVERRUN issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ab41d28e-8642-43e3-a4f4-1c94ea1c4128",  "id": "CVE-2011-2209",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2209"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer signedness error in the osf_sysinfo function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform allows local users to obtain sensitive information from kernel memory via a crafted call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d74f53b6-26d5-4d00-a1b7-1a63bb8d5d06",  "id": "CVE-2025-38702",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: fix potential buffer overflow in do_register_framebuffer()\n\nThe current implementation may lead to buffer overflow when:\n1.  Unregistration creates NULL gaps in registered_fb[]\n2.  All array slots become occupied despite num_registered_fb < FB_MAX\n3.  The registration loop exceeds array bounds\n\nAdd boundary check to prevent registered_fb[FB_MAX] access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f3d3294d-2d4b-41a7-86bc-59f8190e4f62",  "id": "OESA-2026-2782",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17f00676-d687-470e-8431-2633077b3dbb",  "id": "CVE-2024-48875",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't take dev_replace rwsem on task already holding it\n\nRunning fstests btrfs/011 with MKFS_OPTIONS=\"-O rst\" to force the usage of\nthe RAID stripe-tree, we get the following splat from lockdep:\n\n BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started\n\n ============================================\n WARNING: possible recursive locking detected\n 6.11.0-rc3-btrfs-for-next #599 Not tainted\n --------------------------------------------\n btrfs/2326 is trying to acquire lock:\n ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\n\n but task is already holding lock:\n ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\n\n other info that might help us debug this:\n  Possible unsafe locking scenario:\n\n        CPU0\n        ----\n   lock(&fs_info->dev_replace.rwsem);\n   lock(&fs_info->dev_replace.rwsem);\n\n  *** DEADLOCK ***\n\n  May be due to missing lock nesting notation\n\n 1 lock held by btrfs/2326:\n  #0: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\n\n stack backtrace:\n CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0x5b/0x80\n  __lock_acquire+0x2798/0x69d0\n  ? __pfx___lock_acquire+0x10/0x10\n  ? __pfx___lock_acquire+0x10/0x10\n  lock_acquire+0x19d/0x4a0\n  ? btrfs_map_block+0x39f/0x2250\n  ? __pfx_lock_acquire+0x10/0x10\n  ? find_held_lock+0x2d/0x110\n  ? lock_is_held_type+0x8f/0x100\n  down_read+0x8e/0x440\n  ? btrfs_map_block+0x39f/0x2250\n  ? __pfx_down_read+0x10/0x10\n  ? do_raw_read_unlock+0x44/0x70\n  ? _raw_read_unlock+0x23/0x40\n  btrfs_map_block+0x39f/0x2250\n  ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00\n  ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0\n  ? __kasan_slab_alloc+0x6e/0x70\n  ? __pfx_btrfs_map_block+0x10/0x10\n  ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10\n  ? kmem_cache_alloc_noprof+0x1f2/0x300\n  ? mempool_alloc_noprof+0xed/0x2b0\n  btrfs_submit_chunk+0x28d/0x17e0\n  ? __pfx_btrfs_submit_chunk+0x10/0x10\n  ? bvec_alloc+0xd7/0x1b0\n  ? bio_add_folio+0x171/0x270\n  ? __pfx_bio_add_folio+0x10/0x10\n  ? __kasan_check_read+0x20/0x20\n  btrfs_submit_bio+0x37/0x80\n  read_extent_buffer_pages+0x3df/0x6c0\n  btrfs_read_extent_buffer+0x13e/0x5f0\n  read_tree_block+0x81/0xe0\n  read_block_for_search+0x4bd/0x7a0\n  ? __pfx_read_block_for_search+0x10/0x10\n  btrfs_search_slot+0x78d/0x2720\n  ? __pfx_btrfs_search_slot+0x10/0x10\n  ? lock_is_held_type+0x8f/0x100\n  ? kasan_save_track+0x14/0x30\n  ? __kasan_slab_alloc+0x6e/0x70\n  ? kmem_cache_alloc_noprof+0x1f2/0x300\n  btrfs_get_raid_extent_offset+0x181/0x820\n  ? __pfx_lock_acquire+0x10/0x10\n  ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10\n  ? down_read+0x194/0x440\n  ? __pfx_down_read+0x10/0x10\n  ? do_raw_read_unlock+0x44/0x70\n  ? _raw_read_unlock+0x23/0x40\n  btrfs_map_block+0x5b5/0x2250\n  ? __pfx_btrfs_map_block+0x10/0x10\n  scrub_submit_initial_read+0x8fe/0x11b0\n  ? __pfx_scrub_submit_initial_read+0x10/0x10\n  submit_initial_group_read+0x161/0x3a0\n  ? lock_release+0x20e/0x710\n  ? __pfx_submit_initial_group_read+0x10/0x10\n  ? __pfx_lock_release+0x10/0x10\n  scrub_simple_mirror.isra.0+0x3eb/0x580\n  scrub_stripe+0xe4d/0x1440\n  ? lock_release+0x20e/0x710\n  ? __pfx_scrub_stripe+0x10/0x10\n  ? __pfx_lock_release+0x10/0x10\n  ? do_raw_read_unlock+0x44/0x70\n  ? _raw_read_unlock+0x23/0x40\n  scrub_chunk+0x257/0x4a0\n  scrub_enumerate_chunks+0x64c/0xf70\n  ? __mutex_unlock_slowpath+0x147/0x5f0\n  ? __pfx_scrub_enumerate_chunks+0x10/0x10\n  ? bit_wait_timeout+0xb0/0x170\n  ? __up_read+0x189/0x700\n  ? scrub_workers_get+0x231/0x300\n  ? up_write+0x490/0x4f0\n  btrfs_scrub_dev+0x52e/0xcd0\n  ? create_pending_snapshots+0x230/0x250\n  ? __pfx_btrfs_scrub_dev+0x10/0x10\n  btrfs_dev_replace_by_ioctl+0xd69/0x1d00\n  ? lock_acquire+0x19d/0x4a0\n  ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10\n  ?\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2cd41883-3cdf-4ff3-8cb5-8c52eaf2dfea",  "id": "CVE-2019-3460",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3460"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d7451b46-577c-4116-af54-5d0e0a8646c8",  "id": "CVE-2023-52868",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: prevent potential string overflow\n\nThe dev->id value comes from ida_alloc() so it's a number between zero\nand INT_MAX.  If it's too high then these sprintf()s will overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8031800f-5e90-4998-834e-7d0923e8df72",  "id": "CVE-2018-14609",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14609"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in __del_reloc_root() in fs/btrfs/relocation.c when mounting a crafted btrfs image, related to removing reloc rb_trees when reloc control has not been initialized.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0c7f9d74-231a-4af1-b37d-40edfa4d3ba4",  "id": "CVE-2017-1000111",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000111"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "239fea8d-a030-4324-97be-ba181a6ef5c0",  "id": "CVE-2022-50252",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Do not free q_vector unless new one was allocated\n\nAvoid potential use-after-free condition under memory pressure. If the\nkzalloc() fails, q_vector will be freed but left in the original\nadapter->q_vector[v_idx] array position.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a205ee9-273b-4c7f-9605-9d22423a1584",  "id": "CVE-2022-0322",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0322"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    681,    704  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c5ce0089-779c-4a9b-8836-9ef7de7a3a52",  "id": "CVE-2014-3180",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3180"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read. restart_syscall uses uninitialized data when restarting compat_sys_nanosleep. NOTE: this is disputed because the code path is unreachable",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "30d9eb16-63d9-4a12-a09c-acdd8c4a3b0b",  "id": "CVE-2017-14492",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14492"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:42942'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:144479/Dnsmasq-Heap-Based-Overflow.html'"    }  ]},{  "bom-ref": "7c0af1fa-6989-4cc1-ad4d-23583a2999f0",  "id": "CVE-2020-12770",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12770"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.6.11. sg_write lacks an sg_remove_request call in a certain failure case, aka CID-83c6f2390040.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3d0322eb-db90-4328-ae72-d2b96a8e6992",  "id": "CVE-2011-4913",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4913"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The rose_parse_ccitt function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 does not validate the FAC_CCITT_DEST_NSAP and FAC_CCITT_SRC_NSAP fields, which allows remote attackers to (1) cause a denial of service (integer underflow, heap memory corruption, and panic) via a small length value in data sent to a ROSE socket, or (2) conduct stack-based buffer overflow attacks via a large length value in data sent to a ROSE socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6a6c6ab9-b114-462c-9a8e-32ec697d4331",  "id": "CLSA-2023-1680206329",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b15512e3-fd4b-4e4c-bc28-e5c4d966cadb",  "id": "CVE-2024-42077",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix DIO failure due to insufficient transaction credits\n\nThe code in ocfs2_dio_end_io_write() estimates number of necessary\ntransaction credits using ocfs2_calc_extend_credits().  This however does\nnot take into account that the IO could be arbitrarily large and can\ncontain arbitrary number of extents.\n\nExtent tree manipulations do often extend the current transaction but not\nin all of the cases.  For example if we have only single block extents in\nthe tree, ocfs2_mark_extent_written() will end up calling\nocfs2_replace_extent_rec() all the time and we will never extend the\ncurrent transaction and eventually exhaust all the transaction credits if\nthe IO contains many single block extents.  Once that happens a\nWARN_ON(jbd2_handle_buffer_credits(handle) <= 0) is triggered in\njbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to\nthis error.  This was actually triggered by one of our customers on a\nheavily fragmented OCFS2 filesystem.\n\nTo fix the issue make sure the transaction always has enough credits for\none extent insert before each call of ocfs2_mark_extent_written().\n\nHeming Zhao said:\n\n------\nPANIC: \"Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error\"\n\nPID: xxx  TASK: xxxx  CPU: 5  COMMAND: \"SubmitThread-CA\"\n  #0 machine_kexec at ffffffff8c069932\n  #1 __crash_kexec at ffffffff8c1338fa\n  #2 panic at ffffffff8c1d69b9\n  #3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2]\n  #4 __ocfs2_abort at ffffffffc0c88387 [ocfs2]\n  #5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2]\n  #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2]\n  #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2]\n  #8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2]\n  #9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2]\n#10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2]\n#11 dio_complete at ffffffff8c2b9fa7\n#12 do_blockdev_direct_IO at ffffffff8c2bc09f\n#13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2]\n#14 generic_file_direct_write at ffffffff8c1dcf14\n#15 __generic_file_write_iter at ffffffff8c1dd07b\n#16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2]\n#17 aio_write at ffffffff8c2cc72e\n#18 kmem_cache_alloc at ffffffff8c248dde\n#19 do_io_submit at ffffffff8c2ccada\n#20 do_syscall_64 at ffffffff8c004984\n#21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "82f4697c-a4a8-493d-bf06-2d3c38fdd985",  "id": "CVE-2015-0275",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0275"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    17  ],  "analysis": {    "state": "in_triage"  },  "description": "The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service (BUG) via a crafted fallocate zero-range request.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a06d176-6a85-443a-9568-2f69812439ae",  "id": "SUSE-SU-2026:3835-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "85c1e7ba-4314-4567-a06a-796337d28813",  "id": "CVE-2019-20096",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20096"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service, aka CID-1d3ff0950e2b.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6af32a3b-441f-4826-9ce4-6e3149baa18f",  "id": "CVE-2022-34495",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34495"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2b70e11e-3297-4bd0-9679-354988a16c46",  "id": "CVE-2013-2895",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2895"  },  "ratings": [    {      "score": 5.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/hid/hid-logitech-dj.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) or obtain sensitive information from kernel memory via a crafted device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "348f1054-f4b8-49f8-94d7-54417f71d53e",  "id": "CVE-2014-0205",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0205"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The futex_wait function in kernel/futex.c in the Linux kernel before 2.6.37 does not properly maintain a certain reference count during requeue operations, which allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that triggers a zero count.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a22aa838-40ca-4a52-89eb-9d0c72f4f229",  "id": "CVE-2016-8630",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8630"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    284,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M byte in an undefined instruction.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f93a7a7a-d591-44e6-a8fc-472497e0c8c0",  "id": "AZL-77606",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4c13d83f-5fb8-4b1a-a6d2-a74648641efe",  "id": "CVE-2024-46717",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: SHAMPO, Fix incorrect page release\n\nUnder the following conditions:\n1) No skb created yet\n2) header_size == 0 (no SHAMPO header)\n3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the\n   last page fragment of a SHAMPO header page)\n\na new skb is formed with a page that is NOT a SHAMPO header page (it\nis a regular data page). Further down in the same function\n(mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from\nheader_index is released. This is wrong and it leads to SHAMPO header\npages being released more than once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5d964781-6efb-4fb6-adf6-d4fb5d9ab9ed",  "id": "CVE-2022-50320",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address\n\nOn a Packard Bell Dot SC (Intel Atom N2600 model) there is a FPDT table\nwhich contains invalid physical addresses, with high bits set which fall\noutside the range of the CPU-s supported physical address range.\n\nCalling acpi_os_map_memory() on such an invalid phys address leads to\nthe below WARN_ON in ioremap triggering resulting in an oops/stacktrace.\n\nAdd code to verify the physical address before calling acpi_os_map_memory()\nto fix / avoid the oops.\n\n[    1.226900] ioremap: invalid physical address 3001000000000000\n[    1.226949] ------------[ cut here ]------------\n[    1.226962] WARNING: CPU: 1 PID: 1 at arch/x86/mm/ioremap.c:200 __ioremap_caller.cold+0x43/0x5f\n[    1.226996] Modules linked in:\n[    1.227016] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc3+ #490\n[    1.227029] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[    1.227038] RIP: 0010:__ioremap_caller.cold+0x43/0x5f\n[    1.227054] Code: 96 00 00 e9 f8 af 24 ff 89 c6 48 c7 c7 d8 0c 84 99 e8 6a 96 00 00 e9 76 af 24 ff 48 89 fe 48 c7 c7 a8 0c 84 99 e8 56 96 00 00 <0f> 0b e9 60 af 24 ff 48 8b 34 24 48 c7 c7 40 0d 84 99 e8 3f 96 00\n[    1.227067] RSP: 0000:ffffb18c40033d60 EFLAGS: 00010286\n[    1.227084] RAX: 0000000000000032 RBX: 3001000000000000 RCX: 0000000000000000\n[    1.227095] RDX: 0000000000000001 RSI: 00000000ffffdfff RDI: 00000000ffffffff\n[    1.227105] RBP: 3001000000000000 R08: 0000000000000000 R09: ffffb18c40033c18\n[    1.227115] R10: 0000000000000003 R11: ffffffff99d62fe8 R12: 0000000000000008\n[    1.227124] R13: 0003001000000000 R14: 0000000000001000 R15: 3001000000000000\n[    1.227135] FS:  0000000000000000(0000) GS:ffff913a3c080000(0000) knlGS:0000000000000000\n[    1.227146] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    1.227156] CR2: 0000000000000000 CR3: 0000000018c26000 CR4: 00000000000006e0\n[    1.227167] Call Trace:\n[    1.227176]  <TASK>\n[    1.227185]  ? acpi_os_map_iomem+0x1c9/0x1e0\n[    1.227215]  ? kmem_cache_alloc_trace+0x187/0x370\n[    1.227254]  acpi_os_map_iomem+0x1c9/0x1e0\n[    1.227288]  acpi_init_fpdt+0xa8/0x253\n[    1.227308]  ? acpi_debugfs_init+0x1f/0x1f\n[    1.227339]  do_one_initcall+0x5a/0x300\n[    1.227406]  ? rcu_read_lock_sched_held+0x3f/0x80\n[    1.227442]  kernel_init_freeable+0x28b/0x2cc\n[    1.227512]  ? rest_init+0x170/0x170\n[    1.227538]  kernel_init+0x16/0x140\n[    1.227552]  ret_from_fork+0x1f/0x30\n[    1.227639]  </TASK>\n[    1.227647] irq event stamp: 186819\n[    1.227656] hardirqs last  enabled at (186825): [<ffffffff98184a6e>] __up_console_sem+0x5e/0x70\n[    1.227672] hardirqs last disabled at (186830): [<ffffffff98184a53>] __up_console_sem+0x43/0x70\n[    1.227686] softirqs last  enabled at (186576): [<ffffffff980fbc9d>] __irq_exit_rcu+0xed/0x160\n[    1.227701] softirqs last disabled at (186569): [<ffffffff980fbc9d>] __irq_exit_rcu+0xed/0x160\n[    1.227715] ---[ end trace 0000000000000000 ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e8e1b85-4267-4c6d-a79b-10b798631eed",  "id": "CVE-2025-39691",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/buffer: fix use-after-free when call bh_read() helper\n\nThere's issue as follows:\nBUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110\nRead of size 8 at addr ffffc9000168f7f8 by task swapper/3/0\nCPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.16.0-862.14.0.6.x86_64\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996)\nCall Trace:\n <IRQ>\n dump_stack_lvl+0x55/0x70\n print_address_description.constprop.0+0x2c/0x390\n print_report+0xb4/0x270\n kasan_report+0xb8/0xf0\n end_buffer_read_sync+0xe3/0x110\n end_bio_bh_io_sync+0x56/0x80\n blk_update_request+0x30a/0x720\n scsi_end_request+0x51/0x2b0\n scsi_io_completion+0xe3/0x480\n ? scsi_device_unbusy+0x11e/0x160\n blk_complete_reqs+0x7b/0x90\n handle_softirqs+0xef/0x370\n irq_exit_rcu+0xa5/0xd0\n sysvec_apic_timer_interrupt+0x6e/0x90\n </IRQ>\n\n Above issue happens when do ntfs3 filesystem mount, issue may happens\n as follows:\n           mount                            IRQ\nntfs_fill_super\n  read_cache_page\n    do_read_cache_folio\n      filemap_read_folio\n        mpage_read_folio\n\t do_mpage_readpage\n\t  ntfs_get_block_vbo\n\t   bh_read\n\t     submit_bh\n\t     wait_on_buffer(bh);\n\t                            blk_complete_reqs\n\t\t\t\t     scsi_io_completion\n\t\t\t\t      scsi_end_request\n\t\t\t\t       blk_update_request\n\t\t\t\t        end_bio_bh_io_sync\n\t\t\t\t\t end_buffer_read_sync\n\t\t\t\t\t  __end_buffer_read_notouch\n\t\t\t\t\t   unlock_buffer\n\n            wait_on_buffer(bh);--> return will return to caller\n\n\t\t\t\t\t  put_bh\n\t\t\t\t\t    --> trigger stack-out-of-bounds\nIn the mpage_read_folio() function, the stack variable 'map_bh' is\npassed to ntfs_get_block_vbo(). Once unlock_buffer() unlocks and\nwait_on_buffer() returns to continue processing, the stack variable\nis likely to be reclaimed. Consequently, during the end_buffer_read_sync()\nprocess, calling put_bh() may result in stack overrun.\n\nIf the bh is not allocated on the stack, it belongs to a folio.  Freeing\na buffer head which belongs to a folio is done by drop_buffers() which\nwill fail to free buffers which are still locked.  So it is safe to call\nput_bh() before __end_buffer_read_notouch().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d0dfc9d-7582-4a76-99c5-b0c918205710",  "id": "CVE-2024-50091",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm vdo: don't refer to dedupe_context after releasing it\n\nClear the dedupe_context pointer in a data_vio whenever ownership of\nthe context is lost, so that vdo can't examine it accidentally.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c7326a7b-5959-49e8-93c4-475fe98363d6",  "id": "CVE-2015-8844",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8844"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The signal implementation in the Linux kernel before 4.3.5 on powerpc platforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "94f3b9f4-2ec0-4c52-9abf-c796d257e98d",  "id": "CVE-2024-26591",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix re-attachment branch in bpf_tracing_prog_attach\n\nThe following case can cause a crash due to missing attach_btf:\n\n1) load rawtp program\n2) load fentry program with rawtp as target_fd\n3) create tracing link for fentry program with target_fd = 0\n4) repeat 3\n\nIn the end we have:\n\n- prog->aux->dst_trampoline == NULL\n- tgt_prog == NULL (because we did not provide target_fd to link_create)\n- prog->aux->attach_btf == NULL (the program was loaded with attach_prog_fd=X)\n- the program was loaded for tgt_prog but we have no way to find out which one\n\n    BUG: kernel NULL pointer dereference, address: 0000000000000058\n    Call Trace:\n     <TASK>\n     ? __die+0x20/0x70\n     ? page_fault_oops+0x15b/0x430\n     ? fixup_exception+0x22/0x330\n     ? exc_page_fault+0x6f/0x170\n     ? asm_exc_page_fault+0x22/0x30\n     ? bpf_tracing_prog_attach+0x279/0x560\n     ? btf_obj_id+0x5/0x10\n     bpf_tracing_prog_attach+0x439/0x560\n     __sys_bpf+0x1cf4/0x2de0\n     __x64_sys_bpf+0x1c/0x30\n     do_syscall_64+0x41/0xf0\n     entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nReturn -EINVAL in this situation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9ac5b43c-98c4-4e07-9c31-61e8a602bfa2",  "id": "CVE-2022-49324",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmips: cpc: Fix refcount leak in mips_cpc_default_phys_base\n\nAdd the missing of_node_put() to release the refcount incremented\nby of_find_compatible_node().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4295280a-28aa-4a91-b592-ebec525b5463",  "id": "CVE-2013-7339",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7339"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel before 3.12.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd40dfa7-c8fb-4d35-951d-7eb2ce675c0c",  "id": "CVE-2024-44938",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix shift-out-of-bounds in dbDiscardAG\n\nWhen searching for the next smaller log2 block, BLKSTOL2() returned 0,\ncausing shift exponent -1 to be negative.\n\nThis patch fixes the issue by exiting the loop directly when negative\nshift is found.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3cab9426-a99d-4dce-b3cd-5ee339229583",  "id": "CVE-2021-47384",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47384"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field\n\nIf driver read tmp value sufficient for\n(tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7))\nfrom device then Null pointer dereference occurs.\n(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)\nAlso lm75[] does not serve a purpose anymore after switching to\ndevm_i2c_new_dummy_device() in w83791d_detect_subclients().\n\nThe patch fixes possible NULL pointer dereference by removing lm75[].\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[groeck: Dropped unnecessary continuation lines, fixed multi-line alignments]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e207994a-c743-417f-9dba-dd075d87576a",  "id": "CVE-2018-1000500",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000500"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    295  ],  "analysis": {    "state": "in_triage"  },  "description": "Busybox contains a Missing SSL certificate validation vulnerability in The \"busybox wget\" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using \"busybox wget https://compromised-domain.com/important-file\".",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "751668ce-63f3-4007-b0e7-b76f45217493",  "id": "CVE-2023-6560",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6560"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119,    823  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:176405/io_uring-__io_uaddr_map-Dangerous-Multi-Page-Handling.html'"    }  ]},{  "bom-ref": "af43b708-eb88-45d9-87f0-54130198dffd",  "id": "RHSA-2016:1940",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1cd5e80e-f0dc-4665-8ee4-11cc64d80b33",  "id": "CVE-2024-49909",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func\n\nThis commit adds a null check for the set_output_gamma function pointer\nin the dcn32_set_output_transfer_func function. Previously,\nset_output_gamma was being checked for null, but then it was being\ndereferenced without any null check. This could lead to a null pointer\ndereference if set_output_gamma is null.\n\nTo fix this, we now ensure that set_output_gamma is not null before\ndereferencing it. We do this by adding a null check for set_output_gamma\nbefore the call to set_output_gamma.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "234c4e83-b374-4371-a2e4-129eb8f2d4ab",  "id": "CVE-2024-26779",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix race condition on enabling fast-xmit\n\nfast-xmit must only be enabled after the sta has been uploaded to the driver,\notherwise it could end up passing the not-yet-uploaded sta via drv_tx calls\nto the driver, leading to potential crashes because of uninitialized drv_priv\ndata.\nAdd a missing sta->uploaded check and re-check fast xmit after inserting a sta.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "158c65f9-b9d5-4eaf-a472-ebd4a60ac286",  "id": "CVE-2024-56570",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: Filter invalid inodes with missing lookup function\n\nAdd a check to the ovl_dentry_weird() function to prevent the\nprocessing of directory inodes that lack the lookup function.\nThis is important because such inodes can cause errors in overlayfs\nwhen passed to the lowerstack.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "58adc500-08c6-4d0c-8c68-83f6a3b1e812",  "id": "CVE-2023-53548",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb\n\nThe syzbot fuzzer identified a problem in the usbnet driver:\n\nusb 1-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 0 PID: 754 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504\nModules linked in:\nCPU: 0 PID: 754 Comm: kworker/0:2 Not tainted 6.4.0-rc7-syzkaller-00014-g692b7dc87ca6 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023\nWorkqueue: mld mld_ifc_work\nRIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504\nCode: 7c 24 18 e8 2c b4 5b fb 48 8b 7c 24 18 e8 42 07 f0 fe 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 c9 fc 8a e8 5a 6f 23 fb <0f> 0b e9 58 f8 ff ff e8 fe b3 5b fb 48 81 c5 c0 05 00 00 e9 84 f7\nRSP: 0018:ffffc9000463f568 EFLAGS: 00010086\nRAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000\nRDX: ffff88801eb28000 RSI: ffffffff814c03b7 RDI: 0000000000000001\nRBP: ffff8881443b7190 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000003\nR13: ffff88802a77cb18 R14: 0000000000000003 R15: ffff888018262500\nFS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000556a99c15a18 CR3: 0000000028c71000 CR4: 0000000000350ef0\nCall Trace:\n <TASK>\n usbnet_start_xmit+0xfe5/0x2190 drivers/net/usb/usbnet.c:1453\n __netdev_start_xmit include/linux/netdevice.h:4918 [inline]\n netdev_start_xmit include/linux/netdevice.h:4932 [inline]\n xmit_one net/core/dev.c:3578 [inline]\n dev_hard_start_xmit+0x187/0x700 net/core/dev.c:3594\n...\n\nThis bug is caused by the fact that usbnet trusts the bulk endpoint\naddresses its probe routine receives in the driver_info structure, and\nit does not check to see that these endpoints actually exist and have\nthe expected type and directions.\n\nThe fix is simply to add such a check.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "06b73508-15bf-4135-a2e0-0ed8bcaadd66",  "id": "CVE-2020-25639",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25639"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a local user to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc0fba9c-67a3-4aad-accf-5675a9198785",  "id": "RHSA-2022:0064",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45264348-b382-40b5-ba48-471ba99283c3",  "id": "CVE-2023-53309",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: Fix integer overflow in radeon_cs_parser_init\n\nThe type of size is unsigned, if size is 0x40000000, there will be an\ninteger overflow, size will be zero after size *= sizeof(uint32_t),\nwill cause uninitialized memory to be referenced later",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c6f68311-6812-4d49-b7bc-327ba4f25f3a",  "id": "CVE-2024-57896",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: flush delalloc workers queue before stopping cleaner kthread during unmount\n\nDuring the unmount path, at close_ctree(), we first stop the cleaner\nkthread, using kthread_stop() which frees the associated task_struct, and\nthen stop and destroy all the work queues. However after we stopped the\ncleaner we may still have a worker from the delalloc_workers queue running\ninode.c:submit_compressed_extents(), which calls btrfs_add_delayed_iput(),\nwhich in turn tries to wake up the cleaner kthread - which was already\ndestroyed before, resulting in a use-after-free on the task_struct.\n\nSyzbot reported this with the following stack traces:\n\n  BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089\n  Read of size 8 at addr ffff8880259d2818 by task kworker/u8:3/52\n\n  CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n  Workqueue: btrfs-delalloc btrfs_work_helper\n  Call Trace:\n   <TASK>\n   __dump_stack lib/dump_stack.c:94 [inline]\n   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n   print_address_description mm/kasan/report.c:378 [inline]\n   print_report+0x169/0x550 mm/kasan/report.c:489\n   kasan_report+0x143/0x180 mm/kasan/report.c:602\n   __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089\n   lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849\n   __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n   _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162\n   class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline]\n   try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4205\n   submit_compressed_extents+0xdf/0x16e0 fs/btrfs/inode.c:1615\n   run_ordered_work fs/btrfs/async-thread.c:288 [inline]\n   btrfs_work_helper+0x96f/0xc40 fs/btrfs/async-thread.c:324\n   process_one_work kernel/workqueue.c:3229 [inline]\n   process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n   worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n   kthread+0x2f0/0x390 kernel/kthread.c:389\n   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n   </TASK>\n\n  Allocated by task 2:\n   kasan_save_stack mm/kasan/common.c:47 [inline]\n   kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n   unpoison_slab_object mm/kasan/common.c:319 [inline]\n   __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345\n   kasan_slab_alloc include/linux/kasan.h:250 [inline]\n   slab_post_alloc_hook mm/slub.c:4104 [inline]\n   slab_alloc_node mm/slub.c:4153 [inline]\n   kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4205\n   alloc_task_struct_node kernel/fork.c:180 [inline]\n   dup_task_struct+0x57/0x8c0 kernel/fork.c:1113\n   copy_process+0x5d1/0x3d50 kernel/fork.c:2225\n   kernel_clone+0x223/0x870 kernel/fork.c:2807\n   kernel_thread+0x1bc/0x240 kernel/fork.c:2869\n   create_kthread kernel/kthread.c:412 [inline]\n   kthreadd+0x60d/0x810 kernel/kthread.c:767\n   ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\n  Freed by task 24:\n   kasan_save_stack mm/kasan/common.c:47 [inline]\n   kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n   kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582\n   poison_slab_object mm/kasan/common.c:247 [inline]\n   __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n   kasan_slab_free include/linux/kasan.h:233 [inline]\n   slab_free_hook mm/slub.c:2338 [inline]\n   slab_free mm/slub.c:4598 [inline]\n   kmem_cache_free+0x195/0x410 mm/slub.c:4700\n   put_task_struct include/linux/sched/task.h:144 [inline]\n   delayed_put_task_struct+0x125/0x300 kernel/exit.c:227\n   rcu_do_batch kernel/rcu/tree.c:2567 [inline]\n   rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823\n   handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554\n   run_ksoftirqd+0xca/0x130 kernel/softirq.c:943\n  \n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "02227280-af06-4e14-92e3-59cd610e811a",  "id": "CVE-2024-26978",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: max310x: fix NULL pointer dereference in I2C instantiation\n\nWhen trying to instantiate a max14830 device from userspace:\n\n    echo max14830 0x60 > /sys/bus/i2c/devices/i2c-2/new_device\n\nwe get the following error:\n\n    Unable to handle kernel NULL pointer dereference at virtual address...\n    ...\n    Call trace:\n        max310x_i2c_probe+0x48/0x170 [max310x]\n        i2c_device_probe+0x150/0x2a0\n    ...\n\nAdd check for validity of devtype to prevent the error, and abort probe\nwith a meaningful error message.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "af821029-eac7-4792-9504-e2d5b369245f",  "id": "CVE-2023-53000",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: prevent potential spectre v1 gadgets\n\nMost netlink attributes are parsed and validated from\n__nla_validate_parse() or validate_nla()\n\n    u16 type = nla_type(nla);\n\n    if (type == 0 || type > maxtype) {\n        /* error or continue */\n    }\n\n@type is then used as an array index and can be used\nas a Spectre v1 gadget.\n\narray_index_nospec() can be used to prevent leaking\ncontent of kernel memory to malicious users.\n\nThis should take care of vast majority of netlink uses,\nbut an audit is needed to take care of others where\nvalidation is not yet centralized in core netlink functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a284948-6ef4-45c3-a7b2-3f53e2057191",  "id": "CVE-2017-16646",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16646"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "83d044aa-2b3b-4292-b863-e76fbc79262f",  "id": "CVE-2024-56566",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: Avoid list corruption when removing a slab from the full list\n\nBoot with slub_debug=UFPZ.\n\nIf allocated object failed in alloc_consistency_checks, all objects of\nthe slab will be marked as used, and then the slab will be removed from\nthe partial list.\n\nWhen an object belonging to the slab got freed later, the remove_full()\nfunction is called. Because the slab is neither on the partial list nor\non the full list, it eventually lead to a list corruption (actually a\nlist poison being detected).\n\nSo we need to mark and isolate the slab page with metadata corruption,\ndo not put it back in circulation.\n\nBecause the debug caches avoid all the fastpaths, reusing the frozen bit\nto mark slab page with metadata corruption seems to be fine.\n\n[ 4277.385669] list_del corruption, ffffea00044b3e50->next is LIST_POISON1 (dead000000000100)\n[ 4277.387023] ------------[ cut here ]------------\n[ 4277.387880] kernel BUG at lib/list_debug.c:56!\n[ 4277.388680] invalid opcode: 0000 [#1] PREEMPT SMP PTI\n[ 4277.389562] CPU: 5 PID: 90 Comm: kworker/5:1 Kdump: loaded Tainted: G           OE      6.6.1-1 #1\n[ 4277.392113] Workqueue: xfs-inodegc/vda1 xfs_inodegc_worker [xfs]\n[ 4277.393551] RIP: 0010:__list_del_entry_valid_or_report+0x7b/0xc0\n[ 4277.394518] Code: 48 91 82 e8 37 f9 9a ff 0f 0b 48 89 fe 48 c7 c7 28 49 91 82 e8 26 f9 9a ff 0f 0b 48 89 fe 48 c7 c7 58 49 91\n[ 4277.397292] RSP: 0018:ffffc90000333b38 EFLAGS: 00010082\n[ 4277.398202] RAX: 000000000000004e RBX: ffffea00044b3e50 RCX: 0000000000000000\n[ 4277.399340] RDX: 0000000000000002 RSI: ffffffff828f8715 RDI: 00000000ffffffff\n[ 4277.400545] RBP: ffffea00044b3e40 R08: 0000000000000000 R09: ffffc900003339f0\n[ 4277.401710] R10: 0000000000000003 R11: ffffffff82d44088 R12: ffff888112cf9910\n[ 4277.402887] R13: 0000000000000001 R14: 0000000000000001 R15: ffff8881000424c0\n[ 4277.404049] FS:  0000000000000000(0000) GS:ffff88842fd40000(0000) knlGS:0000000000000000\n[ 4277.405357] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 4277.406389] CR2: 00007f2ad0b24000 CR3: 0000000102a3a006 CR4: 00000000007706e0\n[ 4277.407589] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 4277.408780] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 4277.410000] PKRU: 55555554\n[ 4277.410645] Call Trace:\n[ 4277.411234]  <TASK>\n[ 4277.411777]  ? die+0x32/0x80\n[ 4277.412439]  ? do_trap+0xd6/0x100\n[ 4277.413150]  ? __list_del_entry_valid_or_report+0x7b/0xc0\n[ 4277.414158]  ? do_error_trap+0x6a/0x90\n[ 4277.414948]  ? __list_del_entry_valid_or_report+0x7b/0xc0\n[ 4277.415915]  ? exc_invalid_op+0x4c/0x60\n[ 4277.416710]  ? __list_del_entry_valid_or_report+0x7b/0xc0\n[ 4277.417675]  ? asm_exc_invalid_op+0x16/0x20\n[ 4277.418482]  ? __list_del_entry_valid_or_report+0x7b/0xc0\n[ 4277.419466]  ? __list_del_entry_valid_or_report+0x7b/0xc0\n[ 4277.420410]  free_to_partial_list+0x515/0x5e0\n[ 4277.421242]  ? xfs_iext_remove+0x41a/0xa10 [xfs]\n[ 4277.422298]  xfs_iext_remove+0x41a/0xa10 [xfs]\n[ 4277.423316]  ? xfs_inodegc_worker+0xb4/0x1a0 [xfs]\n[ 4277.424383]  xfs_bmap_del_extent_delay+0x4fe/0x7d0 [xfs]\n[ 4277.425490]  __xfs_bunmapi+0x50d/0x840 [xfs]\n[ 4277.426445]  xfs_itruncate_extents_flags+0x13a/0x490 [xfs]\n[ 4277.427553]  xfs_inactive_truncate+0xa3/0x120 [xfs]\n[ 4277.428567]  xfs_inactive+0x22d/0x290 [xfs]\n[ 4277.429500]  xfs_inodegc_worker+0xb4/0x1a0 [xfs]\n[ 4277.430479]  process_one_work+0x171/0x340\n[ 4277.431227]  worker_thread+0x277/0x390\n[ 4277.431962]  ? __pfx_worker_thread+0x10/0x10\n[ 4277.432752]  kthread+0xf0/0x120\n[ 4277.433382]  ? __pfx_kthread+0x10/0x10\n[ 4277.434134]  ret_from_fork+0x2d/0x50\n[ 4277.434837]  ? __pfx_kthread+0x10/0x10\n[ 4277.435566]  ret_from_fork_asm+0x1b/0x30\n[ 4277.436280]  </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2204f0f2-5807-4ab8-ade4-1819e87c1fb2",  "id": "CVE-2025-38539",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Add down_write(trace_event_sem) when adding trace event\n\nWhen a module is loaded, it adds trace events defined by the module. It\nmay also need to modify the modules trace printk formats to replace enum\nnames with their values.\n\nIf two modules are loaded at the same time, the adding of the event to the\nftrace_events list can corrupt the walking of the list in the code that is\nmodifying the printk format strings and crash the kernel.\n\nThe addition of the event should take the trace_event_sem for write while\nit adds the new event.\n\nAlso add a lockdep_assert_held() on that semaphore in\n__trace_add_event_dirs() as it iterates the list.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9cac2c12-e018-4c9e-a2bc-0bec3233f002",  "id": "AZL-26984",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6d1d6b96-2386-49f0-b6cf-10a9900023f4",  "id": "CVE-2016-3138",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3138"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:136138/Linux-cdc_acm-Null-Pointer-Dereference.html'"    }  ]},{  "bom-ref": "f015e6a1-9fda-48cd-9192-38ee3530d918",  "id": "CVE-2024-42252",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclosures: Change BUG_ON() to WARN_ON()\n\nIf a BUG_ON() can be hit in the wild, it shouldn't be a BUG_ON()\n\nFor reference, this has popped up once in the CI, and we'll need more\ninfo to debug it:\n\n03240 ------------[ cut here ]------------\n03240 kernel BUG at lib/closure.c:21!\n03240 kernel BUG at lib/closure.c:21!\n03240 Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n03240 Modules linked in:\n03240 CPU: 15 PID: 40534 Comm: kworker/u80:1 Not tainted 6.10.0-rc4-ktest-ga56da69799bd #25570\n03240 Hardware name: linux,dummy-virt (DT)\n03240 Workqueue: btree_update btree_interior_update_work\n03240 pstate: 00001005 (nzcv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--)\n03240 pc : closure_put+0x224/0x2a0\n03240 lr : closure_put+0x24/0x2a0\n03240 sp : ffff0000d12071c0\n03240 x29: ffff0000d12071c0 x28: dfff800000000000 x27: ffff0000d1207360\n03240 x26: 0000000000000040 x25: 0000000000000040 x24: 0000000000000040\n03240 x23: ffff0000c1f20180 x22: 0000000000000000 x21: ffff0000c1f20168\n03240 x20: 0000000040000000 x19: ffff0000c1f20140 x18: 0000000000000001\n03240 x17: 0000000000003aa0 x16: 0000000000003ad0 x15: 1fffe0001c326974\n03240 x14: 0000000000000a1e x13: 0000000000000000 x12: 1fffe000183e402d\n03240 x11: ffff6000183e402d x10: dfff800000000000 x9 : ffff6000183e402e\n03240 x8 : 0000000000000001 x7 : 00009fffe7c1bfd3 x6 : ffff0000c1f2016b\n03240 x5 : ffff0000c1f20168 x4 : ffff6000183e402e x3 : ffff800081391954\n03240 x2 : 0000000000000001 x1 : 0000000000000000 x0 : 00000000a8000000\n03240 Call trace:\n03240  closure_put+0x224/0x2a0\n03240  bch2_check_for_deadlock+0x910/0x1028\n03240  bch2_six_check_for_deadlock+0x1c/0x30\n03240  six_lock_slowpath.isra.0+0x29c/0xed0\n03240  six_lock_ip_waiter+0xa8/0xf8\n03240  __bch2_btree_node_lock_write+0x14c/0x298\n03240  bch2_trans_lock_write+0x6d4/0xb10\n03240  __bch2_trans_commit+0x135c/0x5520\n03240  btree_interior_update_work+0x1248/0x1c10\n03240  process_scheduled_works+0x53c/0xd90\n03240  worker_thread+0x370/0x8c8\n03240  kthread+0x258/0x2e8\n03240  ret_from_fork+0x10/0x20\n03240 Code: aa1303e0 d63f0020 a94363f7 17ffff8c (d4210000)\n03240 ---[ end trace 0000000000000000 ]---\n03240 Kernel panic - not syncing: Oops - BUG: Fatal exception\n03240 SMP: stopping secondary CPUs\n03241 SMP: failed to stop secondary CPUs 13,15\n03241 Kernel Offset: disabled\n03241 CPU features: 0x00,00000003,80000008,4240500b\n03241 Memory Limit: none\n03241 ---[ end Kernel panic - not syncing: Oops - BUG: Fatal exception ]---\n03246 ========= FAILED TIMEOUT copygc_torture_no_checksum in 7200s",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e7e13d3e-fabe-4908-9de2-985aa9aa7e8d",  "id": "CVE-2022-49937",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mceusb: Use new usb_control_msg_*() routines\n\nAutomatic kernel fuzzing led to a WARN about invalid pipe direction in\nthe mceusb driver:\n\n------------[ cut here ]------------\nusb 6-1: BOGUS control dir, pipe 80000380 doesn't match bRequestType 40\nWARNING: CPU: 0 PID: 2465 at drivers/usb/core/urb.c:410\nusb_submit_urb+0x1326/0x1820 drivers/usb/core/urb.c:410\nModules linked in:\nCPU: 0 PID: 2465 Comm: kworker/0:2 Not tainted 5.19.0-rc4-00208-g69cb6c6556ad #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.13.0-1ubuntu1.1 04/01/2014\nWorkqueue: usb_hub_wq hub_event\nRIP: 0010:usb_submit_urb+0x1326/0x1820 drivers/usb/core/urb.c:410\nCode: 7c 24 40 e8 ac 23 91 fd 48 8b 7c 24 40 e8 b2 70 1b ff 45 89 e8\n44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 a0 30 a9 86 e8 48 07 11 02 <0f> 0b\ne9 1c f0 ff ff e8 7e 23 91 fd 0f b6 1d 63 22 83 05 31 ff 41\nRSP: 0018:ffffc900032becf0 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: ffff8881100f3058 RCX: 0000000000000000\nRDX: ffffc90004961000 RSI: ffff888114c6d580 RDI: fffff52000657d90\nRBP: ffff888105ad90f0 R08: ffffffff812c3638 R09: 0000000000000000\nR10: 0000000000000005 R11: ffffed1023504ef1 R12: ffff888105ad9000\nR13: 0000000000000040 R14: 0000000080000380 R15: ffff88810ba96500\nFS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffe810bda58 CR3: 000000010b720000 CR4: 0000000000350ef0\nCall Trace:\n<TASK>\nusb_start_wait_urb+0x101/0x4c0 drivers/usb/core/message.c:58\nusb_internal_control_msg drivers/usb/core/message.c:102 [inline]\nusb_control_msg+0x31c/0x4a0 drivers/usb/core/message.c:153\nmceusb_gen1_init drivers/media/rc/mceusb.c:1431 [inline]\nmceusb_dev_probe+0x258e/0x33f0 drivers/media/rc/mceusb.c:1807\n\nThe reason for the warning is clear enough; the driver sends an\nunusual read request on endpoint 0 but does not set the USB_DIR_IN bit\nin the bRequestType field.\n\nMore importantly, the whole situation can be avoided and the driver\nsimplified by converting it over to the relatively new\nusb_control_msg_recv() and usb_control_msg_send() routines.  That's\nwhat this fix does.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9224f4e-cb22-4dd2-9fd2-323c80196163",  "id": "CVE-2025-38465",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: Fix wraparounds of sk->sk_rmem_alloc.\n\nNetlink has this pattern in some places\n\n  if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)\n  \tatomic_add(skb->truesize, &sk->sk_rmem_alloc);\n\n, which has the same problem fixed by commit 5a465a0da13e (\"udp:\nFix multiple wraparounds of sk->sk_rmem_alloc.\").\n\nFor example, if we set INT_MAX to SO_RCVBUFFORCE, the condition\nis always false as the two operands are of int.\n\nThen, a single socket can eat as many skb as possible until OOM\nhappens, and we can see multiple wraparounds of sk->sk_rmem_alloc.\n\nLet's fix it by using atomic_add_return() and comparing the two\nvariables as unsigned int.\n\nBefore:\n  [root@fedora ~]# ss -f netlink\n  Recv-Q      Send-Q Local Address:Port                Peer Address:Port\n  -1668710080 0               rtnl:nl_wraparound/293               *\n\nAfter:\n  [root@fedora ~]# ss -f netlink\n  Recv-Q     Send-Q Local Address:Port                Peer Address:Port\n  2147483072 0               rtnl:nl_wraparound/290               *\n  ^\n  `--- INT_MAX - 576",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b9ebaff9-c81c-4a5a-a280-27e65c83d44d",  "id": "CVE-2021-47379",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47379"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd\n\nKASAN reports a use-after-free report when doing fuzz test:\n\n[693354.104835] ==================================================================\n[693354.105094] BUG: KASAN: use-after-free in bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105336] Read of size 4 at addr ffff888be0a35664 by task sh/1453338\n\n[693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147\n[693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018\n[693354.105612] Call Trace:\n[693354.105621]  dump_stack+0xf1/0x19b\n[693354.105626]  ? show_regs_print_info+0x5/0x5\n[693354.105634]  ? printk+0x9c/0xc3\n[693354.105638]  ? cpumask_weight+0x1f/0x1f\n[693354.105648]  print_address_description+0x70/0x360\n[693354.105654]  kasan_report+0x1b2/0x330\n[693354.105659]  ? bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105665]  ? bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105670]  bfq_io_set_weight_legacy+0xd3/0x160\n[693354.105675]  ? bfq_cpd_init+0x20/0x20\n[693354.105683]  cgroup_file_write+0x3aa/0x510\n[693354.105693]  ? ___slab_alloc+0x507/0x540\n[693354.105698]  ? cgroup_file_poll+0x60/0x60\n[693354.105702]  ? 0xffffffff89600000\n[693354.105708]  ? usercopy_abort+0x90/0x90\n[693354.105716]  ? mutex_lock+0xef/0x180\n[693354.105726]  kernfs_fop_write+0x1ab/0x280\n[693354.105732]  ? cgroup_file_poll+0x60/0x60\n[693354.105738]  vfs_write+0xe7/0x230\n[693354.105744]  ksys_write+0xb0/0x140\n[693354.105749]  ? __ia32_sys_read+0x50/0x50\n[693354.105760]  do_syscall_64+0x112/0x370\n[693354.105766]  ? syscall_return_slowpath+0x260/0x260\n[693354.105772]  ? do_page_fault+0x9b/0x270\n[693354.105779]  ? prepare_exit_to_usermode+0xf9/0x1a0\n[693354.105784]  ? enter_from_user_mode+0x30/0x30\n[693354.105793]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n[693354.105875] Allocated by task 1453337:\n[693354.106001]  kasan_kmalloc+0xa0/0xd0\n[693354.106006]  kmem_cache_alloc_node_trace+0x108/0x220\n[693354.106010]  bfq_pd_alloc+0x96/0x120\n[693354.106015]  blkcg_activate_policy+0x1b7/0x2b0\n[693354.106020]  bfq_create_group_hierarchy+0x1e/0x80\n[693354.106026]  bfq_init_queue+0x678/0x8c0\n[693354.106031]  blk_mq_init_sched+0x1f8/0x460\n[693354.106037]  elevator_switch_mq+0xe1/0x240\n[693354.106041]  elevator_switch+0x25/0x40\n[693354.106045]  elv_iosched_store+0x1a1/0x230\n[693354.106049]  queue_attr_store+0x78/0xb0\n[693354.106053]  kernfs_fop_write+0x1ab/0x280\n[693354.106056]  vfs_write+0xe7/0x230\n[693354.106060]  ksys_write+0xb0/0x140\n[693354.106064]  do_syscall_64+0x112/0x370\n[693354.106069]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n[693354.106114] Freed by task 1453336:\n[693354.106225]  __kasan_slab_free+0x130/0x180\n[693354.106229]  kfree+0x90/0x1b0\n[693354.106233]  blkcg_deactivate_policy+0x12c/0x220\n[693354.106238]  bfq_exit_queue+0xf5/0x110\n[693354.106241]  blk_mq_exit_sched+0x104/0x130\n[693354.106245]  __elevator_exit+0x45/0x60\n[693354.106249]  elevator_switch_mq+0xd6/0x240\n[693354.106253]  elevator_switch+0x25/0x40\n[693354.106257]  elv_iosched_store+0x1a1/0x230\n[693354.106261]  queue_attr_store+0x78/0xb0\n[693354.106264]  kernfs_fop_write+0x1ab/0x280\n[693354.106268]  vfs_write+0xe7/0x230\n[693354.106271]  ksys_write+0xb0/0x140\n[693354.106275]  do_syscall_64+0x112/0x370\n[693354.106280]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n[693354.106329] The buggy address belongs to the object at ffff888be0a35580\n                 which belongs to the cache kmalloc-1k of size 1024\n[693354.106736] The buggy address is located 228 bytes inside of\n                 1024-byte region [ffff888be0a35580, ffff888be0a35980)\n[693354.107114] The buggy address belongs to the page:\n[693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0 compound_mapcount: 0\n[693354.107606] flags: 0x17ffffc0008100(slab|head)\n[693354.107760] raw: 0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080\n[693354.108020] r\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "909fbc28-2d2a-4bfd-9249-bed55a2b43cf",  "id": "CVE-2024-26907",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix fortify source warning while accessing Eth segment\n\n ------------[ cut here ]------------\n memcpy: detected field-spanning write (size 56) of single field \"eseg->inline_hdr.start\" at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2)\n WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n Modules linked in: 8021q garp mrp stp llc rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) ib_uverbs(OE) ib_core(OE) mlx5_core(OE) pci_hyperv_intf mlxdevm(OE) mlx_compat(OE) tls mlxfw(OE) psample nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink mst_pciconf(OE) knem(OE) vfio_pci vfio_pci_core vfio_iommu_type1 vfio iommufd irqbypass cuse nfsv3 nfs fscache netfs xfrm_user xfrm_algo ipmi_devintf ipmi_msghandler binfmt_misc crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel sha512_ssse3 snd_pcsp aesni_intel crypto_simd cryptd snd_pcm snd_timer joydev snd soundcore input_leds serio_raw evbug nfsd auth_rpcgss nfs_acl lockd grace sch_fq_codel sunrpc drm efi_pstore ip_tables x_tables autofs4 psmouse virtio_net net_failover failover floppy\n  [last unloaded: mlx_compat(OE)]\n CPU: 0 PID: 293779 Comm: ssh Tainted: G           OE      6.2.0-32-generic #32~22.04.1-Ubuntu\n Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n RIP: 0010:mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n Code: 0c 01 00 a8 01 75 25 48 8b 75 a0 b9 02 00 00 00 48 c7 c2 10 5b fd c0 48 c7 c7 80 5b fd c0 c6 05 57 0c 03 00 01 e8 95 4d 93 da <0f> 0b 44 8b 4d b0 4c 8b 45 c8 48 8b 4d c0 e9 49 fb ff ff 41 0f b7\n RSP: 0018:ffffb5b48478b570 EFLAGS: 00010046\n RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffffb5b48478b628 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffffb5b48478b5e8\n R13: ffff963a3c609b5e R14: ffff9639c3fbd800 R15: ffffb5b480475a80\n FS:  00007fc03b444c80(0000) GS:ffff963a3dc00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000556f46bdf000 CR3: 0000000006ac6003 CR4: 00000000003706f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  <TASK>\n  ? show_regs+0x72/0x90\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  ? __warn+0x8d/0x160\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  ? report_bug+0x1bb/0x1d0\n  ? handle_bug+0x46/0x90\n  ? exc_invalid_op+0x19/0x80\n  ? asm_exc_invalid_op+0x1b/0x20\n  ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib]\n  mlx5_ib_post_send_nodrain+0xb/0x20 [mlx5_ib]\n  ipoib_send+0x2ec/0x770 [ib_ipoib]\n  ipoib_start_xmit+0x5a0/0x770 [ib_ipoib]\n  dev_hard_start_xmit+0x8e/0x1e0\n  ? validate_xmit_skb_list+0x4d/0x80\n  sch_direct_xmit+0x116/0x3a0\n  __dev_xmit_skb+0x1fd/0x580\n  __dev_queue_xmit+0x284/0x6b0\n  ? _raw_spin_unlock_irq+0xe/0x50\n  ? __flush_work.isra.0+0x20d/0x370\n  ? push_pseudo_header+0x17/0x40 [ib_ipoib]\n  neigh_connected_output+0xcd/0x110\n  ip_finish_output2+0x179/0x480\n  ? __smp_call_single_queue+0x61/0xa0\n  __ip_finish_output+0xc3/0x190\n  ip_finish_output+0x2e/0xf0\n  ip_output+0x78/0x110\n  ? __pfx_ip_finish_output+0x10/0x10\n  ip_local_out+0x64/0x70\n  __ip_queue_xmit+0x18a/0x460\n  ip_queue_xmit+0x15/0x30\n  __tcp_transmit_skb+0x914/0x9c0\n  tcp_write_xmit+0x334/0x8d0\n  tcp_push_one+0x3c/0x60\n  tcp_sendmsg_locked+0x2e1/0xac0\n  tcp_sendmsg+0x2d/0x50\n  inet_sendmsg+0x43/0x90\n  sock_sendmsg+0x68/0x80\n  sock_write_iter+0x93/0x100\n  vfs_write+0x326/0x3c0\n  ksys_write+0xbd/0xf0\n  ? do_syscall_64+0x69/0x90\n  __x64_sys_write+0x19/0x30\n  do_syscall_\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ec5a623f-e385-43cd-bd8d-921cca9cbe2c",  "id": "CVE-2022-48842",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362,    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix race condition during interface enslave\n\nCommit 5dbbbd01cbba83 (\"ice: Avoid RTNL lock when re-creating\nauxiliary device\") changes a process of re-creation of aux device\nso ice_plug_aux_dev() is called from ice_service_task() context.\nThis unfortunately opens a race window that can result in dead-lock\nwhen interface has left LAG and immediately enters LAG again.\n\nReproducer:\n```\n#!/bin/sh\n\nip link add lag0 type bond mode 1 miimon 100\nip link set lag0\n\nfor n in {1..10}; do\n        echo Cycle: $n\n        ip link set ens7f0 master lag0\n        sleep 1\n        ip link set ens7f0 nomaster\ndone\n```\n\nThis results in:\n[20976.208697] Workqueue: ice ice_service_task [ice]\n[20976.213422] Call Trace:\n[20976.215871]  __schedule+0x2d1/0x830\n[20976.219364]  schedule+0x35/0xa0\n[20976.222510]  schedule_preempt_disabled+0xa/0x10\n[20976.227043]  __mutex_lock.isra.7+0x310/0x420\n[20976.235071]  enum_all_gids_of_dev_cb+0x1c/0x100 [ib_core]\n[20976.251215]  ib_enum_roce_netdev+0xa4/0xe0 [ib_core]\n[20976.256192]  ib_cache_setup_one+0x33/0xa0 [ib_core]\n[20976.261079]  ib_register_device+0x40d/0x580 [ib_core]\n[20976.266139]  irdma_ib_register_device+0x129/0x250 [irdma]\n[20976.281409]  irdma_probe+0x2c1/0x360 [irdma]\n[20976.285691]  auxiliary_bus_probe+0x45/0x70\n[20976.289790]  really_probe+0x1f2/0x480\n[20976.298509]  driver_probe_device+0x49/0xc0\n[20976.302609]  bus_for_each_drv+0x79/0xc0\n[20976.306448]  __device_attach+0xdc/0x160\n[20976.310286]  bus_probe_device+0x9d/0xb0\n[20976.314128]  device_add+0x43c/0x890\n[20976.321287]  __auxiliary_device_add+0x43/0x60\n[20976.325644]  ice_plug_aux_dev+0xb2/0x100 [ice]\n[20976.330109]  ice_service_task+0xd0c/0xed0 [ice]\n[20976.342591]  process_one_work+0x1a7/0x360\n[20976.350536]  worker_thread+0x30/0x390\n[20976.358128]  kthread+0x10a/0x120\n[20976.365547]  ret_from_fork+0x1f/0x40\n...\n[20976.438030] task:ip              state:D stack:    0 pid:213658 ppid:213627 flags:0x00004084\n[20976.446469] Call Trace:\n[20976.448921]  __schedule+0x2d1/0x830\n[20976.452414]  schedule+0x35/0xa0\n[20976.455559]  schedule_preempt_disabled+0xa/0x10\n[20976.460090]  __mutex_lock.isra.7+0x310/0x420\n[20976.464364]  device_del+0x36/0x3c0\n[20976.467772]  ice_unplug_aux_dev+0x1a/0x40 [ice]\n[20976.472313]  ice_lag_event_handler+0x2a2/0x520 [ice]\n[20976.477288]  notifier_call_chain+0x47/0x70\n[20976.481386]  __netdev_upper_dev_link+0x18b/0x280\n[20976.489845]  bond_enslave+0xe05/0x1790 [bonding]\n[20976.494475]  do_setlink+0x336/0xf50\n[20976.502517]  __rtnl_newlink+0x529/0x8b0\n[20976.543441]  rtnl_newlink+0x43/0x60\n[20976.546934]  rtnetlink_rcv_msg+0x2b1/0x360\n[20976.559238]  netlink_rcv_skb+0x4c/0x120\n[20976.563079]  netlink_unicast+0x196/0x230\n[20976.567005]  netlink_sendmsg+0x204/0x3d0\n[20976.570930]  sock_sendmsg+0x4c/0x50\n[20976.574423]  ____sys_sendmsg+0x1eb/0x250\n[20976.586807]  ___sys_sendmsg+0x7c/0xc0\n[20976.606353]  __sys_sendmsg+0x57/0xa0\n[20976.609930]  do_syscall_64+0x5b/0x1a0\n[20976.613598]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\n1. Command 'ip link ... set nomaster' causes that ice_plug_aux_dev()\n   is called from ice_service_task() context, aux device is created\n   and associated device->lock is taken.\n2. Command 'ip link ... set master...' calls ice's notifier under\n   RTNL lock and that notifier calls ice_unplug_aux_dev(). That\n   function tries to take aux device->lock but this is already taken\n   by ice_plug_aux_dev() in step 1\n3. Later ice_plug_aux_dev() tries to take RTNL lock but this is already\n   taken in step 2\n4. Dead-lock\n\nThe patch fixes this issue by following changes:\n- Bit ICE_FLAG_PLUG_AUX_DEV is kept to be set during ice_plug_aux_dev()\n  call in ice_service_task()\n- The bit is checked in ice_clear_rdma_cap() and only if it is not set\n  then ice_unplug_aux_dev() is called. If it is set (in other words\n  plugging of aux device was requested and ice_plug_aux_dev() is\n  potentially running) then the function only clears the\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48b355ac-e4e1-4a96-9ee3-e691831aa895",  "id": "MGASA-2022-0255",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3acb943d-9634-41e1-b073-efd0cabd4d81",  "id": "CVE-2014-8369",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8369"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ca7b15e5-b420-4e63-9cd9-a5f8eb341854",  "id": "CVE-2019-7221",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7221"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:151713/KVM-VMX-Preemption-Timer-Use-After-Free.html'"    }  ]},{  "bom-ref": "447cb7ab-a54d-4e32-9b27-25990f28be00",  "id": "CVE-2022-0433",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0433"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476,    908  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash the system. This flaw affects Linux kernel versions prior to 5.17-rc1.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "33bcb860-3e4d-470b-ad58-a4ce49c13c60",  "id": "MGASA-2018-0190",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "36b90f3b-c5fd-4468-9da5-56ca99b40848",  "id": "CVE-2018-20856",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20856"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b94a42be-e7a7-4913-b040-e0028d2a76e4",  "id": "ALBA-2022:2002",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "1859ca2a-489d-4c53-8b85-a35fa8ab1d1b",      "versions": [        {          "component": "iptables",          "version": "1.4.7"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "53d1309c-46ca-4616-94c2-3ab65cff10cd",  "id": "CVE-2026-64212",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: don't dereference a pointer before NULL checking it\n\nIn iwl_mld_remove_link, the link->fw_id is saved at the beginning of the\nfunction so we have it after we freed the link.\n\nBut the link pointer can be NULL, and is not checked when the fw_id is\nstored.\n\nFix it by simply freeing the link at the end of the function.\n\nfFixes: 0e66a39f4f0e (\"wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()\")",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f1fb14f2-be58-4f92-8bd4-bc3cec1c82ae",  "id": "CVE-2014-3940",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3940"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel through 3.14.5 does not properly consider the presence of hugetlb entries, which allows local users to cause a denial of service (memory corruption or system crash) by accessing certain memory locations, as demonstrated by triggering a race condition via numa_maps read operations during hugepage migration, related to fs/proc/task_mmu.c and mm/mempolicy.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0886aab2-7fe4-4bfc-9913-d3cd42922a1e",  "id": "CVE-2014-6417",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6417"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a long unencrypted auth ticket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2103e2d-13f7-43e2-b86e-f6b1b2b8d186",  "id": "CVE-2024-43911",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix NULL dereference at band check in starting tx ba session\n\nIn MLD connection, link_data/link_conf are dynamically allocated. They\ndon't point to vif->bss_conf. So, there will be no chanreq assigned to\nvif->bss_conf and then the chan will be NULL. Tweak the code to check\nht_supported/vht_supported/has_he/has_eht on sta deflink.\n\nCrash log (with rtw89 version under MLO development):\n[ 9890.526087] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 9890.526102] #PF: supervisor read access in kernel mode\n[ 9890.526105] #PF: error_code(0x0000) - not-present page\n[ 9890.526109] PGD 0 P4D 0\n[ 9890.526114] Oops: 0000 [#1] PREEMPT SMP PTI\n[ 9890.526119] CPU: 2 PID: 6367 Comm: kworker/u16:2 Kdump: loaded Tainted: G           OE      6.9.0 #1\n[ 9890.526123] Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB3WW (2.73 ) 11/28/2018\n[ 9890.526126] Workqueue: phy2 rtw89_core_ba_work [rtw89_core]\n[ 9890.526203] RIP: 0010:ieee80211_start_tx_ba_session (net/mac80211/agg-tx.c:618 (discriminator 1)) mac80211\n[ 9890.526279] Code: f7 e8 d5 93 3e ea 48 83 c4 28 89 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 49 8b 84 24 e0 f1 ff ff 48 8b 80 90 1b 00 00 <83> 38 03 0f 84 37 fe ff ff bb ea ff ff ff eb cc 49 8b 84 24 10 f3\nAll code\n========\n   0:\tf7 e8                \timul   %eax\n   2:\td5                   \t(bad)\n   3:\t93                   \txchg   %eax,%ebx\n   4:\t3e ea                \tds (bad)\n   6:\t48 83 c4 28          \tadd    $0x28,%rsp\n   a:\t89 d8                \tmov    %ebx,%eax\n   c:\t5b                   \tpop    %rbx\n   d:\t41 5c                \tpop    %r12\n   f:\t41 5d                \tpop    %r13\n  11:\t41 5e                \tpop    %r14\n  13:\t41 5f                \tpop    %r15\n  15:\t5d                   \tpop    %rbp\n  16:\tc3                   \tretq\n  17:\tcc                   \tint3\n  18:\tcc                   \tint3\n  19:\tcc                   \tint3\n  1a:\tcc                   \tint3\n  1b:\t49 8b 84 24 e0 f1 ff \tmov    -0xe20(%r12),%rax\n  22:\tff\n  23:\t48 8b 80 90 1b 00 00 \tmov    0x1b90(%rax),%rax\n  2a:*\t83 38 03             \tcmpl   $0x3,(%rax)\t\t<-- trapping instruction\n  2d:\t0f 84 37 fe ff ff    \tje     0xfffffffffffffe6a\n  33:\tbb ea ff ff ff       \tmov    $0xffffffea,%ebx\n  38:\teb cc                \tjmp    0x6\n  3a:\t49                   \trex.WB\n  3b:\t8b                   \t.byte 0x8b\n  3c:\t84 24 10             \ttest   %ah,(%rax,%rdx,1)\n  3f:\tf3                   \trepz\n\nCode starting with the faulting instruction\n===========================================\n   0:\t83 38 03             \tcmpl   $0x3,(%rax)\n   3:\t0f 84 37 fe ff ff    \tje     0xfffffffffffffe40\n   9:\tbb ea ff ff ff       \tmov    $0xffffffea,%ebx\n   e:\teb cc                \tjmp    0xffffffffffffffdc\n  10:\t49                   \trex.WB\n  11:\t8b                   \t.byte 0x8b\n  12:\t84 24 10             \ttest   %ah,(%rax,%rdx,1)\n  15:\tf3                   \trepz\n[ 9890.526285] RSP: 0018:ffffb8db09013d68 EFLAGS: 00010246\n[ 9890.526291] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9308e0d656c8\n[ 9890.526295] RDX: 0000000000000000 RSI: ffffffffab99460b RDI: ffffffffab9a7685\n[ 9890.526300] RBP: ffffb8db09013db8 R08: 0000000000000000 R09: 0000000000000873\n[ 9890.526304] R10: ffff9308e0d64800 R11: 0000000000000002 R12: ffff9308e5ff6e70\n[ 9890.526308] R13: ffff930952500e20 R14: ffff9309192a8c00 R15: 0000000000000000\n[ 9890.526313] FS:  0000000000000000(0000) GS:ffff930b4e700000(0000) knlGS:0000000000000000\n[ 9890.526316] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 9890.526318] CR2: 0000000000000000 CR3: 0000000391c58005 CR4: 00000000001706f0\n[ 9890.526321] Call Trace:\n[ 9890.526324]  <TASK>\n[ 9890.526327] ? show_regs (arch/x86/kernel/dumpstack.c:479)\n[ 9890.526335] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434)\n[ 9890.526340] ? page_fault_oops (arch/x86/mm/fault.c:713)\n[ 9890.526347] ? search_module_extables (kernel/module/main.c:3256 (discriminator\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8604513-e35b-4113-9742-2264a4c37ad7",  "id": "CVE-2024-40932",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/exynos/vidi: fix memory leak in .get_modes()\n\nThe duplicated EDID is never freed. Fix it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "081c77ae-b173-4c75-83bf-6e6ab139ea88",  "id": "CVE-2023-22996",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22996"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    772  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c64526b1-37cf-4320-9c4c-f363962968c2",  "id": "CVE-2015-4176",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4176"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/namespace.c in the Linux kernel before 4.0.2 does not properly support mount connectivity, which allows local users to read arbitrary files by leveraging user-namespace root access for deletion of a file or directory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ce2442ab-e4d4-494c-8d04-8ee2bcd8985d",  "id": "CVE-2025-21718",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rose: fix timer races against user threads\n\nRose timers only acquire the socket spinlock, without\nchecking if the socket is owned by one user thread.\n\nAdd a check and rearm the timers if needed.\n\nBUG: KASAN: slab-use-after-free in rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174\nRead of size 2 at addr ffff88802f09b82a by task swapper/0/0\n\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nCall Trace:\n <IRQ>\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n  print_address_description mm/kasan/report.c:378 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:489\n  kasan_report+0x143/0x180 mm/kasan/report.c:602\n  rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174\n  call_timer_fn+0x187/0x650 kernel/time/timer.c:1793\n  expire_timers kernel/time/timer.c:1844 [inline]\n  __run_timers kernel/time/timer.c:2418 [inline]\n  __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430\n  run_timer_base kernel/time/timer.c:2439 [inline]\n  run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449\n  handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561\n  __do_softirq kernel/softirq.c:595 [inline]\n  invoke_softirq kernel/softirq.c:435 [inline]\n  __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662\n  irq_exit_rcu+0x9/0x30 kernel/softirq.c:678\n  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]\n  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049\n </IRQ>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1e030aaf-2381-4eeb-bfec-bb2058c55e9b",  "id": "CVE-2013-3234",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3234"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The rose_recvmsg function in net/rose/af_rose.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "98e71f31-198e-4bd0-a2e3-845840210100",  "id": "AZL-42049",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c421b465-a140-4422-8d4d-907be06a19fc",  "id": "CVE-2010-4078",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4078"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "The sisfb_ioctl function in drivers/video/sis/sis_main.c in the Linux kernel before 2.6.36-rc6 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FBIOGET_VBLANK ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "23b50523-d6b9-4ff1-bdce-0620d9da6ce0",  "id": "CVE-2023-52814",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix potential null pointer derefernce\n\nThe amdgpu_ras_get_context may return NULL if device\nnot support ras feature, so add check before using.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d2c1829-5cd3-4cf6-871f-62742752bf51",  "id": "AZL-75284",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fabe9032-88d6-492d-b7c4-8e0d0d0e973e",  "id": "OESA-2026-3684",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0c72a4be-7f4c-4095-aece-34f3966ebb69",  "id": "CVE-2014-8160",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8160"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols, which allows remote attackers to bypass intended access restrictions via packets with disallowed port numbers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c94b29fe-e862-4fc0-8af8-59db555fa38a",  "id": "CVE-2024-41002",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/sec - Fix memory leak for sec resource release\n\nThe AIV is one of the SEC resources. When releasing resources,\nit need to release the AIV resources at the same time.\nOtherwise, memory leakage occurs.\n\nThe aiv resource release is added to the sec resource release\nfunction.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a717d3e-1bbe-4096-b596-8bdebdb60d9c",  "id": "CVE-2024-53165",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsh: intc: Fix use-after-free bug in register_intc_controller()\n\nIn the error handling for this function, d is freed without ever\nremoving it from intc_list which would lead to a use after free.\nTo fix this, let's only add it to the list after everything has\nsucceeded.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee34614f-5de7-4750-9629-e4203f5bdd53",  "id": "CVE-2011-2909",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2909"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_devinfo_ioctl function in drivers/staging/comedi/comedi_fops.c in the Linux kernel before 3.1 allows local users to obtain sensitive information from kernel memory via a copy of a short string.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9cbe22b-5914-4b85-bc04-540ef8c24e37",  "id": "ROOT-OS-DEBIAN-12-CVE-2026-63076",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f42408e-2b84-4588-ba88-55f30b9bac36",  "id": "AZL-56010",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ea8669dd-611e-4b64-821e-238272d22582",  "id": "CVE-2024-26938",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()\n\nIf we have no VBT, or the VBT didn't declare the encoder\nin question, we won't have the 'devdata' for the encoder.\nInstead of oopsing just bail early.\n\nWe won't be able to tell whether the port is DP++ or not,\nbut so be it.\n\n(cherry picked from commit 26410896206342c8a80d2b027923e9ee7d33b733)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b385720-da30-48b9-a2d4-5ba7419c8abe",  "id": "CVE-2018-1065",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1065"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "843d8649-f944-425b-8437-5a60a807aecf",  "id": "DSA-4018-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7829e50d-eabf-452b-b46c-6ac552380171",  "id": "MGASA-2024-0291",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b82b6b6-2828-47f0-bf1c-2cc1362697d9",  "id": "CVE-2019-14513",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14513"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buffer allocated for the packet, a different vulnerability than CVE-2017-14491.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e6c0fc4-3656-49aa-8a68-f79b1ce94e87",  "id": "CVE-2026-31464",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()\n\nA malicious or compromised VIO server can return a num_written value in the\ndiscover targets MAD response that exceeds max_targets. This value is\nstored directly in vhost->num_targets without validation, and is then used\nas the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which\nis only allocated for max_targets entries. Indices at or beyond max_targets\naccess kernel memory outside the DMA-coherent allocation.  The\nout-of-bounds data is subsequently embedded in Implicit Logout and PLOGI\nMADs that are sent back to the VIO server, leaking kernel memory.\n\nFix by clamping num_written to max_targets before storing it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "358cd3e3-a07e-4cbc-9f5e-e66314f1d8bd",  "id": "CVE-2014-3601",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3601"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:H/Au:S/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb244c8b-0f97-45e1-9345-73c40f7b3afb",  "id": "CVE-2025-71222",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: ensure skb headroom before skb_push\n\nThis avoids occasional skb_under_panic Oops from wl1271_tx_work. In this case, headroom is\nless than needed (typically 110 - 94 = 16 bytes).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9faf02c8-5ab9-47c8-b41a-b92fe2e9f2a9",  "id": "CVE-2022-50379",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race between quota enable and quota rescan ioctl\n\nWhen enabling quotas, at btrfs_quota_enable(), after committing the\ntransaction, we change fs_info->quota_root to point to the quota root we\ncreated and set BTRFS_FS_QUOTA_ENABLED at fs_info->flags. Then we try\nto start the qgroup rescan worker, first by initializing it with a call\nto qgroup_rescan_init() - however if that fails we end up freeing the\nquota root but we leave fs_info->quota_root still pointing to it, this\ncan later result in a use-after-free somewhere else.\n\nWe have previously set the flags BTRFS_FS_QUOTA_ENABLED and\nBTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at\nbtrfs_quota_enable(), which is possible if someone already called the\nquota rescan ioctl, and therefore started the rescan worker.\n\nSo fix this by ignoring an -EINPROGRESS and asserting we can't get any\nother error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cee19f54-4ea9-450e-b703-b8066b896747",  "id": "CVE-2020-14416",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14416"  },  "ratings": [    {      "score": 4.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.4.16, a race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free, aka CID-0ace17d56824. This affects drivers/net/slip/slip.c and drivers/net/can/slcan.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31aa56e4-0ab4-4ce6-aeab-7c268314bc0a",  "id": "CVE-2024-40997",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: amd-pstate: fix memory leak on CPU EPP exit\n\nThe cpudata memory from kzalloc() in amd_pstate_epp_cpu_init() is\nnot freed in the analogous exit function, so fix that.\n\n[ rjw: Subject and changelog edits ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c4951f37-dc52-4b62-8423-309f3c643156",  "id": "CVE-2024-46742",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()\n\nnull-ptr-deref will occur when (req_op_level == SMB2_OPLOCK_LEVEL_LEASE)\nand parse_lease_state() return NULL.\n\nFix this by check if 'lease_ctx_info' is NULL.\n\nAdditionally, remove the redundant parentheses in\nparse_durable_handle_context().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f5e15d68-9294-45ae-b204-12868929b8e2",  "id": "CVE-2022-49610",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Prevent RSB underflow before vmenter\n\nOn VMX, there are some balanced returns between the time the guest's\nSPEC_CTRL value is written, and the vmenter.\n\nBalanced returns (matched by a preceding call) are usually ok, but it's\nat least theoretically possible an NMI with a deep call stack could\nempty the RSB before one of the returns.\n\nFor maximum paranoia, don't allow *any* returns (balanced or otherwise)\nbetween the SPEC_CTRL write and the vmenter.\n\n  [ bp: Fix 32-bit build. ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "464036b0-49e5-45e2-b9b0-98be557a992a",  "id": "CVE-2022-49191",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmxser: fix xmit_buf leak in activate when LSR == 0xff\n\nWhen LSR is 0xff in ->activate() (rather unlike), we return an error.\nProvided ->shutdown() is not called when ->activate() fails, nothing\nactually frees the buffer in this case.\n\nFix this by properly freeing the buffer in a designated label. We jump\nthere also from the \"!info->type\" if now too.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "49e67d9d-83b1-4ea5-9e20-cf98f94adc94",  "id": "CVE-2025-38542",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: appletalk: Fix device refcount leak in atrtr_create()\n\nWhen updating an existing route entry in atrtr_create(), the old device\nreference was not being released before assigning the new device,\nleading to a device refcount leak. Fix this by calling dev_put() to\nrelease the old device reference before holding the new one.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "619e9982-417c-4932-bf33-d6a49451101f",  "id": "CVE-2026-43452",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.199999999999999,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: guard option walkers against 1-byte tail reads\n\nWhen the last byte of options is a non-single-byte option kind, walkers\nthat advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end\nof the option area.\n\nAdd an explicit i == optlen - 1 check before dereferencing op[i + 1]\nin xt_tcpudp and xt_dccp option walkers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b105f0d0-3734-493c-b0f0-ccd9c4edef36",  "id": "CVE-2024-43906",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/admgpu: fix dereferencing null pointer context\n\nWhen user space sets an invalid ta type, the pointer context will be empty.\nSo it need to check the pointer context before using it",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "29184ff1-ac3c-46dd-9555-9359153fd872",  "id": "CVE-2022-41218",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41218"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "77bc48f2-5891-4a56-aba1-b63495df6a14",  "id": "CVE-2010-4655",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4655"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    665  ],  "analysis": {    "state": "in_triage"  },  "description": "net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability for an ethtool ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "caa06e04-7dd2-43ec-9c86-f75855cbc9ba",  "id": "CVE-2024-50218",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: pass u64 to ocfs2_truncate_inline maybe overflow\n\nSyzbot reported a kernel BUG in ocfs2_truncate_inline.  There are two\nreasons for this: first, the parameter value passed is greater than\nocfs2_max_inline_data_with_xattr, second, the start and end parameters of\nocfs2_truncate_inline are \"unsigned int\".\n\nSo, we need to add a sanity check for byte_start and byte_len right before\nocfs2_truncate_inline() in ocfs2_remove_inode_range(), if they are greater\nthan ocfs2_max_inline_data_with_xattr return -EINVAL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2c50331c-afbe-4b96-87d1-30e9c85c66b8",  "id": "DSA-4157-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "772fb3ba-de04-49b7-b22e-6e3fbd317d7b",  "id": "CVE-2018-17972",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17972"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a local attacker to exploit racy stack unwinding and leak kernel task stack contents.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5483eaea-8542-4e70-a518-90a146252c64",  "id": "CVE-2022-3111",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3111"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in drivers/power/supply/wm8350_power.c lacks free of WM8350_IRQ_CHG_FAST_RDY, which is registered in wm8350_init_charger().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d61bf042-f403-4550-b990-d488c58544e6",  "id": "CVE-2024-42087",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep\n\nThe ilitek-ili9881c controls the reset GPIO using the non-sleeping\ngpiod_set_value() function. This complains loudly when the GPIO\ncontroller needs to sleep. As the caller can sleep, use\ngpiod_set_value_cansleep() to fix the issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7cae5e98-6678-49df-b038-2c1305cde1ee",  "id": "CVE-2025-37991",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Fix double SIGFPE crash\n\nCamm noticed that on parisc a SIGFPE exception will crash an application with\na second SIGFPE in the signal handler.  Dave analyzed it, and it happens\nbecause glibc uses a double-word floating-point store to atomically update\nfunction descriptors. As a result of lazy binding, we hit a floating-point\nstore in fpe_func almost immediately.\n\nWhen the T bit is set, an assist exception trap occurs when when the\nco-processor encounters *any* floating-point instruction except for a double\nstore of register %fr0.  The latter cancels all pending traps.  Let's fix this\nby clearing the Trap (T) bit in the FP status register before returning to the\nsignal handler in userspace.\n\nThe issue can be reproduced with this test program:\n\nroot@parisc:~# cat fpe.c\n\nstatic void fpe_func(int sig, siginfo_t *i, void *v) {\n        sigset_t set;\n        sigemptyset(&set);\n        sigaddset(&set, SIGFPE);\n        sigprocmask(SIG_UNBLOCK, &set, NULL);\n        printf(\"GOT signal %d with si_code %ld\\n\", sig, i->si_code);\n}\n\nint main() {\n        struct sigaction action = {\n                .sa_sigaction = fpe_func,\n                .sa_flags = SA_RESTART|SA_SIGINFO };\n        sigaction(SIGFPE, &action, 0);\n        feenableexcept(FE_OVERFLOW);\n        return printf(\"%lf\\n\",1.7976931348623158E308*1.7976931348623158E308);\n}\n\nroot@parisc:~# gcc fpe.c -lm\nroot@parisc:~# ./a.out\n Floating point exception\n\nroot@parisc:~# strace -f ./a.out\n execve(\"./a.out\", [\"./a.out\"], 0xf9ac7034 /* 20 vars */) = 0\n getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0\n ...\n rt_sigaction(SIGFPE, {sa_handler=0x1110a, sa_mask=[], sa_flags=SA_RESTART|SA_SIGINFO}, NULL, 8) = 0\n --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0x1078f} ---\n --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0xf8f21237} ---\n +++ killed by SIGFPE +++\n Floating point exception",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "76e5cba5-eb5c-423b-96b5-a3994c3333ee",  "id": "CVE-2025-38546",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: Fix memory leak of struct clip_vcc.\n\nioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to\nvcc->user_back.\n\nThe code assumes that vcc_destroy_socket() passes NULL skb\nto vcc->push() when the socket is close()d, and then clip_push()\nfrees clip_vcc.\n\nHowever, ioctl(ATMARPD_CTRL) sets NULL to vcc->push() in\natm_init_atmarp(), resulting in memory leak.\n\nLet's serialise two ioctl() by lock_sock() and check vcc->push()\nin atm_init_atmarp() to prevent memleak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3950574e-cab6-4c6f-a764-a1551e8bf2f5",  "id": "CVE-2022-49440",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/rtas: Keep MSR[RI] set when calling RTAS\n\nRTAS runs in real mode (MSR[DR] and MSR[IR] unset) and in 32-bit big\nendian mode (MSR[SF,LE] unset).\n\nThe change in MSR is done in enter_rtas() in a relatively complex way,\nsince the MSR value could be hardcoded.\n\nFurthermore, a panic has been reported when hitting the watchdog interrupt\nwhile running in RTAS, this leads to the following stack trace:\n\n  watchdog: CPU 24 Hard LOCKUP\n  watchdog: CPU 24 TB:997512652051031, last heartbeat TB:997504470175378 (15980ms ago)\n  ...\n  Supported: No, Unreleased kernel\n  CPU: 24 PID: 87504 Comm: drmgr Kdump: loaded Tainted: G            E  X    5.14.21-150400.71.1.bz196362_2-default #1 SLE15-SP4 (unreleased) 0d821077ef4faa8dfaf370efb5fdca1fa35f4e2c\n  NIP:  000000001fb41050 LR: 000000001fb4104c CTR: 0000000000000000\n  REGS: c00000000fc33d60 TRAP: 0100   Tainted: G            E  X     (5.14.21-150400.71.1.bz196362_2-default)\n  MSR:  8000000002981000 <SF,VEC,VSX,ME>  CR: 48800002  XER: 20040020\n  CFAR: 000000000000011c IRQMASK: 1\n  GPR00: 0000000000000003 ffffffffffffffff 0000000000000001 00000000000050dc\n  GPR04: 000000001ffb6100 0000000000000020 0000000000000001 000000001fb09010\n  GPR08: 0000000020000000 0000000000000000 0000000000000000 0000000000000000\n  GPR12: 80040000072a40a8 c00000000ff8b680 0000000000000007 0000000000000034\n  GPR16: 000000001fbf6e94 000000001fbf6d84 000000001fbd1db0 000000001fb3f008\n  GPR20: 000000001fb41018 ffffffffffffffff 000000000000017f fffffffffffff68f\n  GPR24: 000000001fb18fe8 000000001fb3e000 000000001fb1adc0 000000001fb1cf40\n  GPR28: 000000001fb26000 000000001fb460f0 000000001fb17f18 000000001fb17000\n  NIP [000000001fb41050] 0x1fb41050\n  LR [000000001fb4104c] 0x1fb4104c\n  Call Trace:\n  Instruction dump:\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  Oops: Unrecoverable System Reset, sig: 6 [#1]\n  LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries\n  ...\n  Supported: No, Unreleased kernel\n  CPU: 24 PID: 87504 Comm: drmgr Kdump: loaded Tainted: G            E  X    5.14.21-150400.71.1.bz196362_2-default #1 SLE15-SP4 (unreleased) 0d821077ef4faa8dfaf370efb5fdca1fa35f4e2c\n  NIP:  000000001fb41050 LR: 000000001fb4104c CTR: 0000000000000000\n  REGS: c00000000fc33d60 TRAP: 0100   Tainted: G            E  X     (5.14.21-150400.71.1.bz196362_2-default)\n  MSR:  8000000002981000 <SF,VEC,VSX,ME>  CR: 48800002  XER: 20040020\n  CFAR: 000000000000011c IRQMASK: 1\n  GPR00: 0000000000000003 ffffffffffffffff 0000000000000001 00000000000050dc\n  GPR04: 000000001ffb6100 0000000000000020 0000000000000001 000000001fb09010\n  GPR08: 0000000020000000 0000000000000000 0000000000000000 0000000000000000\n  GPR12: 80040000072a40a8 c00000000ff8b680 0000000000000007 0000000000000034\n  GPR16: 000000001fbf6e94 000000001fbf6d84 000000001fbd1db0 000000001fb3f008\n  GPR20: 000000001fb41018 ffffffffffffffff 000000000000017f fffffffffffff68f\n  GPR24: 000000001fb18fe8 000000001fb3e000 000000001fb1adc0 000000001fb1cf40\n  GPR28: 000000001fb26000 000000001fb460f0 000000001fb17f18 000000001fb17000\n  NIP [000000001fb41050] 0x1fb41050\n  LR [000000001fb4104c] 0x1fb4104c\n  Call Trace:\n  Instruction dump:\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  ---[ end trace 3ddec07f638c34a2 ]---\n\nThis happens because MSR[RI] is unset when entering RTAS but there is no\nvalid reason to not set it here.\n\nRTAS is expected to be called with MSR[RI] as specified in PAPR+ section\n\"7.2.1 Machine State\":\n\n  R1–7.2.1–9. If called with MSR[RI] equal to 1, then RTAS must protect\n  its own critical regions from recursion by setting the MSR[RI] bit to\n  0 when in the critical regions.\n\nFixing this by reviewing the way MSR is compute before calling RTAS. Now a\nhardcoded value meaning real \n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "590071aa-9dec-44ef-8694-da8071f98f57",  "id": "CVE-2024-43901",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix NULL pointer dereference for DTN log in DCN401\n\nWhen users run the command:\n\ncat /sys/kernel/debug/dri/0/amdgpu_dm_dtn_log\n\nThe following NULL pointer dereference happens:\n\n[  +0.000003] BUG: kernel NULL pointer dereference, address: NULL\n[  +0.000005] #PF: supervisor instruction fetch in kernel mode\n[  +0.000002] #PF: error_code(0x0010) - not-present page\n[  +0.000002] PGD 0 P4D 0\n[  +0.000004] Oops: 0010 [#1] PREEMPT SMP NOPTI\n[  +0.000003] RIP: 0010:0x0\n[  +0.000008] Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n[...]\n[  +0.000002] PKRU: 55555554\n[  +0.000002] Call Trace:\n[  +0.000002]  <TASK>\n[  +0.000003]  ? show_regs+0x65/0x70\n[  +0.000006]  ? __die+0x24/0x70\n[  +0.000004]  ? page_fault_oops+0x160/0x470\n[  +0.000006]  ? do_user_addr_fault+0x2b5/0x690\n[  +0.000003]  ? prb_read_valid+0x1c/0x30\n[  +0.000005]  ? exc_page_fault+0x8c/0x1a0\n[  +0.000005]  ? asm_exc_page_fault+0x27/0x30\n[  +0.000012]  dcn10_log_color_state+0xf9/0x510 [amdgpu]\n[  +0.000306]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000003]  ? vsnprintf+0x2fb/0x600\n[  +0.000009]  dcn10_log_hw_state+0xfd0/0xfe0 [amdgpu]\n[  +0.000218]  ? __mod_memcg_lruvec_state+0xe8/0x170\n[  +0.000008]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000002]  ? debug_smp_processor_id+0x17/0x20\n[  +0.000003]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000002]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000002]  ? set_ptes.isra.0+0x2b/0x90\n[  +0.000004]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000002]  ? _raw_spin_unlock+0x19/0x40\n[  +0.000004]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000002]  ? do_anonymous_page+0x337/0x700\n[  +0.000004]  dtn_log_read+0x82/0x120 [amdgpu]\n[  +0.000207]  full_proxy_read+0x66/0x90\n[  +0.000007]  vfs_read+0xb0/0x340\n[  +0.000005]  ? __count_memcg_events+0x79/0xe0\n[  +0.000002]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  +0.000003]  ? count_memcg_events.constprop.0+0x1e/0x40\n[  +0.000003]  ? handle_mm_fault+0xb2/0x370\n[  +0.000003]  ksys_read+0x6b/0xf0\n[  +0.000004]  __x64_sys_read+0x19/0x20\n[  +0.000003]  do_syscall_64+0x60/0x130\n[  +0.000004]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[  +0.000003] RIP: 0033:0x7fdf32f147e2\n[...]\n\nThis error happens when the color log tries to read the gamut remap\ninformation from DCN401 which is not initialized in the dcn401_dpp_funcs\nwhich leads to a null pointer dereference. This commit addresses this\nissue by adding a proper guard to access the gamut_remap callback in\ncase the specific ASIC did not implement this function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3140762a-72d4-48fb-b36a-afa58251d1a5",  "id": "CVE-2019-19767",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19767"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9191d919-ad87-45e4-81ea-0c3a4bad52f4",  "id": "CVE-2023-53297",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: fix \"bad unlock balance\" in l2cap_disconnect_rsp\n\nconn->chan_lock isn't acquired before l2cap_get_chan_by_scid,\nif l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance'\nis triggered.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d26db488-8daf-40fa-91a2-ae111349ad06",  "id": "CVE-2016-9756",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9756"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2a94eb82-1dac-4c19-877f-3dd5f78412eb",  "id": "CVE-2022-3107",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3107"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "25654e72-1f30-4ce6-be1a-165e70a29ed9",  "id": "CVE-2024-42069",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix possible double free in error handling path\n\nWhen auxiliary_device_add() returns error and then calls\nauxiliary_device_uninit(), callback function adev_release\ncalls kfree(madev). We shouldn't call kfree(madev) again\nin the error handling path. Set 'madev' to NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "604e0dab-cc14-4d43-8eb0-0736b2652653",  "id": "CVE-2014-3507",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3507"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d40885a4-5f92-429b-bfbd-94668b116944",  "id": "CVE-2024-57834",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread\n\nsyzbot report a null-ptr-deref in vidtv_mux_stop_thread. [1]\n\nIf dvb->mux is not initialized successfully by vidtv_mux_init() in the\nvidtv_start_streaming(), it will trigger null pointer dereference about mux\nin vidtv_mux_stop_thread().\n\nAdjust the timing of streaming initialization and check it before\nstopping it.\n\n[1]\nKASAN: null-ptr-deref in range [0x0000000000000128-0x000000000000012f]\nCPU: 0 UID: 0 PID: 5842 Comm: syz-executor248 Not tainted 6.13.0-rc4-syzkaller-00012-g9b2ffa6148b1 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nRIP: 0010:vidtv_mux_stop_thread+0x26/0x80 drivers/media/test-drivers/vidtv/vidtv_mux.c:471\nCode: 90 90 90 90 66 0f 1f 00 55 53 48 89 fb e8 82 2e c8 f9 48 8d bb 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 02 7e 3b 0f b6 ab 28 01 00 00 31 ff 89 ee e8\nRSP: 0018:ffffc90003f2faa8 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff87cfb125\nRDX: 0000000000000025 RSI: ffffffff87d120ce RDI: 0000000000000128\nRBP: ffff888029b8d220 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000003 R12: ffff888029b8d188\nR13: ffffffff8f590aa0 R14: ffffc9000581c5c8 R15: ffff888029a17710\nFS:  00007f7eef5156c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f7eef5e635c CR3: 0000000076ca6000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n vidtv_stop_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:209 [inline]\n vidtv_stop_feed+0x151/0x250 drivers/media/test-drivers/vidtv/vidtv_bridge.c:252\n dmx_section_feed_stop_filtering+0x90/0x160 drivers/media/dvb-core/dvb_demux.c:1000\n dvb_dmxdev_feed_stop.isra.0+0x1ee/0x270 drivers/media/dvb-core/dmxdev.c:486\n dvb_dmxdev_filter_stop+0x22a/0x3a0 drivers/media/dvb-core/dmxdev.c:559\n dvb_dmxdev_filter_free drivers/media/dvb-core/dmxdev.c:840 [inline]\n dvb_demux_release+0x92/0x550 drivers/media/dvb-core/dmxdev.c:1246\n __fput+0x3f8/0xb60 fs/file_table.c:450\n task_work_run+0x14e/0x250 kernel/task_work.c:239\n get_signal+0x1d3/0x2610 kernel/signal.c:2790\n arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337\n exit_to_user_mode_loop kernel/entry/common.c:111 [inline]\n exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\n syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218\n do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c49be408-1797-4a1d-a54a-5d4497a01001",  "id": "CVE-2024-25741",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25741"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    703  ],  "analysis": {    "state": "in_triage"  },  "description": "printer_write in drivers/usb/gadget/function/f_printer.c in the Linux kernel through 6.7.4 does not properly call usb_ep_queue, which might allow attackers to cause a denial of service or have unspecified other impact.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e0ba192-e523-460d-91fb-680283a96d12",  "id": "SUSE-SU-2019:3188-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b9bab69-40cd-4662-a93e-dcbc05b78bec",  "id": "CVE-2022-45887",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45887"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    772  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2a56b404-4cc0-4dd4-a8c0-5a2bba178d41",  "id": "CVE-2017-5551",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5551"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7097.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b4b07d39-b61d-40b7-9fc9-0df7039b5056",  "id": "CVE-2011-2534",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2534"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the clusterip_proc_write function in net/ipv4/netfilter/ipt_CLUSTERIP.c in the Linux kernel before 2.6.39 might allow local users to cause a denial of service or have unspecified other impact via a crafted write operation, related to string data that lacks a terminating '\\0' character.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a4a269f-cd48-4ab5-9f28-e3750cee6091",  "id": "CVE-2023-51780",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51780"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2db36649-59d7-4f0f-9f31-e40adcdaf113",  "id": "CVE-2026-53225",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix uninit-value in __sctp_rcv_asconf_lookup()\n\n__sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF\nchunk can hold the ADDIP header and a parameter header, then calls\naf->from_addr_param(), which reads the full address (16 bytes for IPv6)\ntrusting the parameter's declared length.\n\nAn unauthenticated peer can send a truncated trailing ASCONF chunk that\ndeclares an IPv6 address parameter but stops after the 4-byte parameter\nheader; reached from the no-association lookup path, from_addr_param() then\nreads uninitialized bytes past the parameter.\n\nImpact: an unauthenticated SCTP peer makes the receive path read up to 16\nbytes of uninitialized memory past a truncated ASCONF address parameter.\n\nThe sibling __sctp_rcv_init_lookup() bounds parameters with\nsctp_walk_params(); this path open-codes the fetch and omits the bound.\nVerify the whole address parameter lies within the chunk before\nfrom_addr_param() reads it, the same class of fix as commit 51e5ad549c43\n(\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\").",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0a213611-e477-4fa8-bed3-928b69c338ac",  "id": "AZL-92484",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2abb2c04-3c04-4cb6-bb0c-83b2e0000724",  "id": "ALSA-2023:7877",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "65de1096-1d6d-4337-9071-069f4bd7d1db",  "id": "CVE-2022-49740",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads\n\nThis patch fixes slab-out-of-bounds reads in brcmfmac that occur in\nbrcmf_construct_chaninfo() and brcmf_enable_bw40_2g() when the count\nvalue of channel specifications provided by the device is greater than\nthe length of 'list->element[]', decided by the size of the 'list'\nallocated with kzalloc(). The patch adds checks that make the functions\nfree the buffer and return -EINVAL if that is the case. Note that the\nnegative return is handled by the caller, brcmf_setup_wiphybands() or\nbrcmf_cfg80211_attach().\n\nFound by a modified version of syzkaller.\n\nCrash Report from brcmf_construct_chaninfo():\n==================================================================\nBUG: KASAN: slab-out-of-bounds in brcmf_setup_wiphybands+0x1238/0x1430\nRead of size 4 at addr ffff888115f24600 by task kworker/0:2/1896\n\nCPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G        W  O      5.14.0+ #132\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014\nWorkqueue: usb_hub_wq hub_event\nCall Trace:\n dump_stack_lvl+0x57/0x7d\n print_address_description.constprop.0.cold+0x93/0x334\n kasan_report.cold+0x83/0xdf\n brcmf_setup_wiphybands+0x1238/0x1430\n brcmf_cfg80211_attach+0x2118/0x3fd0\n brcmf_attach+0x389/0xd40\n brcmf_usb_probe+0x12de/0x1690\n usb_probe_interface+0x25f/0x710\n really_probe+0x1be/0xa90\n __driver_probe_device+0x2ab/0x460\n driver_probe_device+0x49/0x120\n __device_attach_driver+0x18a/0x250\n bus_for_each_drv+0x123/0x1a0\n __device_attach+0x207/0x330\n bus_probe_device+0x1a2/0x260\n device_add+0xa61/0x1ce0\n usb_set_configuration+0x984/0x1770\n usb_generic_driver_probe+0x69/0x90\n usb_probe_device+0x9c/0x220\n really_probe+0x1be/0xa90\n __driver_probe_device+0x2ab/0x460\n driver_probe_device+0x49/0x120\n __device_attach_driver+0x18a/0x250\n bus_for_each_drv+0x123/0x1a0\n __device_attach+0x207/0x330\n bus_probe_device+0x1a2/0x260\n device_add+0xa61/0x1ce0\n usb_new_device.cold+0x463/0xf66\n hub_event+0x10d5/0x3330\n process_one_work+0x873/0x13e0\n worker_thread+0x8b/0xd10\n kthread+0x379/0x450\n ret_from_fork+0x1f/0x30\n\nAllocated by task 1896:\n kasan_save_stack+0x1b/0x40\n __kasan_kmalloc+0x7c/0x90\n kmem_cache_alloc_trace+0x19e/0x330\n brcmf_setup_wiphybands+0x290/0x1430\n brcmf_cfg80211_attach+0x2118/0x3fd0\n brcmf_attach+0x389/0xd40\n brcmf_usb_probe+0x12de/0x1690\n usb_probe_interface+0x25f/0x710\n really_probe+0x1be/0xa90\n __driver_probe_device+0x2ab/0x460\n driver_probe_device+0x49/0x120\n __device_attach_driver+0x18a/0x250\n bus_for_each_drv+0x123/0x1a0\n __device_attach+0x207/0x330\n bus_probe_device+0x1a2/0x260\n device_add+0xa61/0x1ce0\n usb_set_configuration+0x984/0x1770\n usb_generic_driver_probe+0x69/0x90\n usb_probe_device+0x9c/0x220\n really_probe+0x1be/0xa90\n __driver_probe_device+0x2ab/0x460\n driver_probe_device+0x49/0x120\n __device_attach_driver+0x18a/0x250\n bus_for_each_drv+0x123/0x1a0\n __device_attach+0x207/0x330\n bus_probe_device+0x1a2/0x260\n device_add+0xa61/0x1ce0\n usb_new_device.cold+0x463/0xf66\n hub_event+0x10d5/0x3330\n process_one_work+0x873/0x13e0\n worker_thread+0x8b/0xd10\n kthread+0x379/0x450\n ret_from_fork+0x1f/0x30\n\nThe buggy address belongs to the object at ffff888115f24000\n which belongs to the cache kmalloc-2k of size 2048\nThe buggy address is located 1536 bytes inside of\n 2048-byte region [ffff888115f24000, ffff888115f24800)\n\nMemory state around the buggy address:\n ffff888115f24500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff888115f24580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n>ffff888115f24600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n                   ^\n ffff888115f24680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff888115f24700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n==================================================================\n\nCrash Report from brcmf_enable_bw40_2g():\n==========\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ff2bbf2-6d08-4729-ab8d-c54f714739b4",  "id": "CVE-2014-0221",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0221"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "89809bcd-60da-4614-86a1-7d38132ecccf",  "id": "CVE-2024-35935",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    209  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: send: handle path ref underflow in header iterate_inode_ref()\n\nChange BUG_ON to proper error handling if building the path buffer\nfails. The pointers are not printed so we don't accidentally leak kernel\naddresses.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "228552b1-104c-462e-8567-c782f70ccaf1",  "id": "MGASA-2022-0173",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cecfc91e-a80f-425b-9b7b-f1af40c1700d",  "id": "CVE-2024-46810",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ\n\nMake sure the connector is fully initialized before signalling any\nHPD events via drm_kms_helper_hotplug_event(), otherwise this may\nlead to NULL pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2f35c7a6-fa8e-41e8-9d1a-de1882a4eec8",  "id": "CVE-2021-47550",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47550"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/amdgpu: fix potential memleak\n\nIn function amdgpu_get_xgmi_hive, when kobject_init_and_add failed\nThere is a potential memleak if not call kobject_put.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f98decf6-3cd0-45e0-923e-6ad1a483519a",  "id": "CVE-2020-27830",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27830"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "295833c6-1816-45a9-b6f2-be9900feeef9",  "id": "CVE-2019-19065",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19065"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering rhashtable_init() failures, aka CID-34b3be18a04e. NOTE: This has been disputed as not a vulnerability because \"rhashtable_init() can only fail if it is passed invalid values in the second parameter's struct, but when invoked from sdma_init() that is a pointer to a static const struct, so an attacker could only trigger failure if they could corrupt kernel memory (in which case a small memory leak is not a significant problem).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a7a4ce4e-c3c2-41c3-988e-22b830a7e816",  "id": "DLA-0008-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e3a5371-deae-4f66-9353-d71d14b99752",  "id": "RHSA-2026:38805",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6685f8aa-e301-4abf-bc83-532f7ee4a0b5",  "id": "CVE-2011-1017",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1017"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "Heap-based buffer overflow in the ldm_frag_add function in fs/partitions/ldm.c in the Linux kernel 2.6.37.2 and earlier might allow local users to gain privileges or obtain sensitive information via a crafted LDM partition table.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "213d5cf8-b9be-4a33-ad0b-993396f819a6",  "id": "CVE-2022-49521",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()\n\nIf no handler is found in lpfc_complete_unsol_iocb() to match the rctl of a\nreceived frame, the frame is dropped and resources are leaked.\n\nFix by returning resources when discarding an unhandled frame type.  Update\nlpfc_fc_frame_check() handling of NOP basic link service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9fe6bf5c-d57f-4eb8-b875-6a02c3bf85a4",  "id": "CVE-2012-0045",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0045"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The em_syscall function in arch/x86/kvm/emulate.c in the KVM implementation in the Linux kernel before 3.2.14 does not properly handle the 0f05 (aka syscall) opcode, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application, as demonstrated by an NASM file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:36545'"    }  ]},{  "bom-ref": "8b0effbd-214c-428c-8227-f2e89c74f833",  "id": "CVE-2019-15219",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15219"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/sisusbvga/sisusb.c driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2c32b82b-354d-46e2-ba9b-5cfea2e194dd",  "id": "CVE-2023-2430",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2430"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    413,    667  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found due to missing lock for IOPOLL flaw in io_cqring_event_overflow() in io_uring.c in Linux Kernel. This flaw allows a local attacker with user privilege to trigger a Denial of Service threat.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4498cae1-66b6-424c-b9b2-7ed84250ae50",  "id": "CVE-2015-1792",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1792"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "08de528d-5025-482e-9993-726c606984a1",  "id": "CVE-2023-53318",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrecordmcount: Fix memory leaks in the uwrite function\n\nCommon realloc mistake: 'file_append' nulled but not freed upon failure",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2aeedb9d-c8be-4bb4-8ca2-51fdf2c5389f",  "id": "CVE-2025-22090",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()\n\nIf track_pfn_copy() fails, we already added the dst VMA to the maple\ntree. As fork() fails, we'll cleanup the maple tree, and stumble over\nthe dst VMA for which we neither performed any reservation nor copied\nany page tables.\n\nConsequently untrack_pfn() will see VM_PAT and try obtaining the\nPAT information from the page table -- which fails because the page\ntable was not copied.\n\nThe easiest fix would be to simply clear the VM_PAT flag of the dst VMA\nif track_pfn_copy() fails. However, the whole thing is about \"simply\"\nclearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy()\nand performed a reservation, but copying the page tables fails, we'll\nsimply clear the VM_PAT flag, not properly undoing the reservation ...\nwhich is also wrong.\n\nSo let's fix it properly: set the VM_PAT flag only if the reservation\nsucceeded (leaving it clear initially), and undo the reservation if\nanything goes wrong while copying the page tables: clearing the VM_PAT\nflag after undoing the reservation.\n\nNote that any copied page table entries will get zapped when the VMA will\nget removed later, after copy_page_range() succeeded; as VM_PAT is not set\nthen, we won't try cleaning VM_PAT up once more and untrack_pfn() will be\nhappy. Note that leaving these page tables in place without a reservation\nis not a problem, as we are aborting fork(); this process will never run.\n\nA reproducer can trigger this usually at the first try:\n\n  https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c\n\n  WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110\n  Modules linked in: ...\n  CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\n  RIP: 0010:get_pat_info+0xf6/0x110\n  ...\n  Call Trace:\n   <TASK>\n   ...\n   untrack_pfn+0x52/0x110\n   unmap_single_vma+0xa6/0xe0\n   unmap_vmas+0x105/0x1f0\n   exit_mmap+0xf6/0x460\n   __mmput+0x4b/0x120\n   copy_process+0x1bf6/0x2aa0\n   kernel_clone+0xab/0x440\n   __do_sys_clone+0x66/0x90\n   do_syscall_64+0x95/0x180\n\nLikely this case was missed in:\n\n  d155df53f310 (\"x86/mm/pat: clear VM_PAT if copy_p4d_range failed\")\n\n... and instead of undoing the reservation we simply cleared the VM_PAT flag.\n\nKeep the documentation of these functions in include/linux/pgtable.h,\none place is more than sufficient -- we should clean that up for the other\nfunctions like track_pfn_remap/untrack_pfn separately.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a27cfb3d-4562-4aa3-aff9-9f441e1a04f3",  "id": "CVE-2024-23849",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23849"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    193  ],  "analysis": {    "state": "in_triage"  },  "description": "In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "afb74232-b1c1-46a1-be8a-53397328dafe",  "id": "CVE-2020-16166",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16166"  },  "ratings": [    {      "score": 3.7,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    330  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3fa3b472-f6d4-4d69-a087-81d7002945ac",  "id": "RHSA-2016:0301",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "862329d1-a083-4a4d-a03a-0cd909c9de26",  "id": "MGASA-2024-0200",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e69e847-0927-4f30-a891-c602343b5a8e",  "id": "CVE-2014-0195",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0195"  },  "ratings": [    {      "score": 6.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'MSF:dtls_fragment_overflow'"    }  ]},{  "bom-ref": "96d6f14e-78d7-4d26-862f-3cb432575b19",  "id": "CVE-2013-0169",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0169"  },  "ratings": [    {      "score": 2.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the \"Lucky Thirteen\" issue.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5d4cb188-c394-42b3-a542-5e2651709f6f",  "id": "RHSA-2020:5476",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b4d579c-73dd-445f-a64d-a77134861a8b",  "id": "CVE-2017-18174",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18174"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a0fadc5-5be9-4c0f-b0c3-d806e4a712ea",  "id": "CVE-2022-49544",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipw2x00: Fix potential NULL dereference in libipw_xmit()\n\ncrypt and crypt->ops could be null, so we need to checking null\nbefore dereference",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9be168fc-09bf-48c1-9a0b-21b19ab46a53",  "id": "CVE-2025-38004",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: add locking for bcm_op runtime updates\n\nThe CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via\nhrtimer. The content and also the length of the sequence can be changed\nresp reduced at runtime where the 'currframe' counter is then set to zero.\n\nAlthough this appeared to be a safe operation the updates of 'currframe'\ncan be triggered from user space and hrtimer context in bcm_can_tx().\nAnderson Nascimento created a proof of concept that triggered a KASAN\nslab-out-of-bounds read access which can be prevented with a spin_lock_bh.\n\nAt the rework of bcm_can_tx() the 'count' variable has been moved into\nthe protected section as this variable can be modified from both contexts\ntoo.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1ebbd093-72f9-4c60-8cde-ecf3928e23bf",  "id": "CVE-2025-21711",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rose: prevent integer overflows in rose_setsockopt()\n\nIn case of possible unpredictably large arguments passed to\nrose_setsockopt() and multiplied by extra values on top of that,\ninteger overflows may occur.\n\nDo the safest minimum and fix these issues by checking the\ncontents of 'opt' and returning -EINVAL if they are too large. Also,\nswitch to unsigned int and remove useless check for negative 'opt'\nin ROSE_IDLE case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c42228fd-5e5c-42f2-9d7f-a5319b5dcb8e",  "id": "CVE-2014-7825",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7825"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7b9b24e0-3394-426b-8b7b-e157b4b81a57",  "id": "ROOT-OS-DEBIAN-12-CVE-2026-54874",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "007ab009-3844-4110-a800-e7617ee91248",  "id": "CVE-2024-47668",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()\n\nIf we need to increase the tree depth, allocate a new node, and then\nrace with another thread that increased the tree depth before us, we'll\nstill have a preallocated node that might be used later.\n\nIf we then use that node for a new non-root node, it'll still have a\npointer to the old root instead of being zeroed - fix this by zeroing it\nin the cmpxchg failure path.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2835960-0d77-49bd-a6a0-046fd89a4f34",  "id": "CVE-2024-56369",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/modes: Avoid divide by zero harder in drm_mode_vrefresh()\n\ndrm_mode_vrefresh() is trying to avoid divide by zero\nby checking whether htotal or vtotal are zero. But we may\nstill end up with a div-by-zero of vtotal*htotal*...",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e861a97e-11b9-4ea3-8d2a-0524411e4a47",  "id": "CVE-2024-0607",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    229  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a236df2f-671a-4596-bb00-61e23ea18fce",  "id": "CVE-2024-46808",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range\n\n[Why & How]\nASSERT if return NULL from kcalloc.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "36e75f7c-b858-4cd7-a76d-00472cd9e3c7",  "id": "CVE-2022-0516",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0516"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2de37c55-da34-4583-8d52-b3dc015df438",  "id": "CVE-2016-8650",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8650"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20,    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users to cause a denial of service (stack memory corruption and panic) via an add_key system call for an RSA key with a zero exponent.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c5cf3996-e69e-4794-bedd-18ca22a59d82",  "id": "CVE-2023-52975",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress\n\nBug report and analysis from Ding Hui.\n\nDuring iSCSI session logout, if another task accesses the shost ipaddress\nattr, we can get a KASAN UAF report like this:\n\n[  276.942144] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x78/0xe0\n[  276.942535] Write of size 4 at addr ffff8881053b45b8 by task cat/4088\n[  276.943511] CPU: 2 PID: 4088 Comm: cat Tainted: G            E      6.1.0-rc8+ #3\n[  276.943997] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\n[  276.944470] Call Trace:\n[  276.944943]  <TASK>\n[  276.945397]  dump_stack_lvl+0x34/0x48\n[  276.945887]  print_address_description.constprop.0+0x86/0x1e7\n[  276.946421]  print_report+0x36/0x4f\n[  276.947358]  kasan_report+0xad/0x130\n[  276.948234]  kasan_check_range+0x35/0x1c0\n[  276.948674]  _raw_spin_lock_bh+0x78/0xe0\n[  276.949989]  iscsi_sw_tcp_host_get_param+0xad/0x2e0 [iscsi_tcp]\n[  276.951765]  show_host_param_ISCSI_HOST_PARAM_IPADDRESS+0xe9/0x130 [scsi_transport_iscsi]\n[  276.952185]  dev_attr_show+0x3f/0x80\n[  276.953005]  sysfs_kf_seq_show+0x1fb/0x3e0\n[  276.953401]  seq_read_iter+0x402/0x1020\n[  276.954260]  vfs_read+0x532/0x7b0\n[  276.955113]  ksys_read+0xed/0x1c0\n[  276.955952]  do_syscall_64+0x38/0x90\n[  276.956347]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[  276.956769] RIP: 0033:0x7f5d3a679222\n[  276.957161] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 32 c0 0b 00 e8 a5 fe 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24\n[  276.958009] RSP: 002b:00007ffc864d16a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\n[  276.958431] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5d3a679222\n[  276.958857] RDX: 0000000000020000 RSI: 00007f5d3a4fe000 RDI: 0000000000000003\n[  276.959281] RBP: 00007f5d3a4fe000 R08: 00000000ffffffff R09: 0000000000000000\n[  276.959682] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000020000\n[  276.960126] R13: 0000000000000003 R14: 0000000000000000 R15: 0000557a26dada58\n[  276.960536]  </TASK>\n[  276.961357] Allocated by task 2209:\n[  276.961756]  kasan_save_stack+0x1e/0x40\n[  276.962170]  kasan_set_track+0x21/0x30\n[  276.962557]  __kasan_kmalloc+0x7e/0x90\n[  276.962923]  __kmalloc+0x5b/0x140\n[  276.963308]  iscsi_alloc_session+0x28/0x840 [scsi_transport_iscsi]\n[  276.963712]  iscsi_session_setup+0xda/0xba0 [libiscsi]\n[  276.964078]  iscsi_sw_tcp_session_create+0x1fd/0x330 [iscsi_tcp]\n[  276.964431]  iscsi_if_create_session.isra.0+0x50/0x260 [scsi_transport_iscsi]\n[  276.964793]  iscsi_if_recv_msg+0xc5a/0x2660 [scsi_transport_iscsi]\n[  276.965153]  iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi]\n[  276.965546]  netlink_unicast+0x4d5/0x7b0\n[  276.965905]  netlink_sendmsg+0x78d/0xc30\n[  276.966236]  sock_sendmsg+0xe5/0x120\n[  276.966576]  ____sys_sendmsg+0x5fe/0x860\n[  276.966923]  ___sys_sendmsg+0xe0/0x170\n[  276.967300]  __sys_sendmsg+0xc8/0x170\n[  276.967666]  do_syscall_64+0x38/0x90\n[  276.968028]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[  276.968773] Freed by task 2209:\n[  276.969111]  kasan_save_stack+0x1e/0x40\n[  276.969449]  kasan_set_track+0x21/0x30\n[  276.969789]  kasan_save_free_info+0x2a/0x50\n[  276.970146]  __kasan_slab_free+0x106/0x190\n[  276.970470]  __kmem_cache_free+0x133/0x270\n[  276.970816]  device_release+0x98/0x210\n[  276.971145]  kobject_cleanup+0x101/0x360\n[  276.971462]  iscsi_session_teardown+0x3fb/0x530 [libiscsi]\n[  276.971775]  iscsi_sw_tcp_session_destroy+0xd8/0x130 [iscsi_tcp]\n[  276.972143]  iscsi_if_recv_msg+0x1bf1/0x2660 [scsi_transport_iscsi]\n[  276.972485]  iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi]\n[  276.972808]  netlink_unicast+0x4d5/0x7b0\n[  276.973201]  netlink_sendmsg+0x78d/0xc30\n[  276.973544]  sock_sendmsg+0xe5/0x120\n[  276.973864]  ____sys_sendmsg+0x5fe/0x860\n[  276.974248]  ___sys_\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0f77811d-a932-4ad7-b05f-9c2f14b82b30",  "id": "CVE-2017-1000365",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000365"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier. It appears that this feature was introduced in the Linux Kernel version 2.6.23.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "66306751-d58f-4831-9e4b-a2a7323f1bf8",  "id": "CVE-2018-10879",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10879"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "75ba426f-5bf2-4d31-bcd8-83a95a975c32",  "id": "CVE-2013-6382",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6382"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for a (1) XFS_IOC_ATTRLIST_BY_HANDLE or (2) XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted length value, related to the xfs_attrlist_by_handle function in fs/xfs/xfs_ioctl.c and the xfs_compat_attrlist_by_handle function in fs/xfs/xfs_ioctl32.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0c8abbb6-b561-4269-98e4-da96dc42cc16",  "id": "CVE-2025-21759",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: extend RCU protection in igmp6_send()\n\nigmp6_send() can be called without RTNL or RCU being held.\n\nExtend RCU protection so that we can safely fetch the net pointer\nand avoid a potential UAF.\n\nNote that we no longer can use sock_alloc_send_skb() because\nipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.\n\nInstead use alloc_skb() and charge the net->ipv6.igmp_sk\nsocket under RCU protection.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3680ce85-9999-4085-bc74-4efffb5a180a",  "id": "OESA-2026-2044",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6dbe4842-5b96-4415-8b08-b1f9daa5d81d",  "id": "RHSA-2026:1720",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "990f6576-58cb-43fc-81a4-9155038762e9",  "id": "CVE-2024-50062",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Avoid null pointer deref during path establishment\n\nFor RTRS path establishment, RTRS client initiates and completes con_num\nof connections. After establishing all its connections, the information\nis exchanged between the client and server through the info_req message.\nDuring this exchange, it is essential that all connections have been\nestablished, and the state of the RTRS srv path is CONNECTED.\n\nSo add these sanity checks, to make sure we detect and abort process in\nerror scenarios to avoid null pointer deref.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "483719b9-9569-4bbc-9457-3d76e1266e4f",  "id": "CVE-2024-50202",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    755  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: propagate directory read errors from nilfs_find_entry()\n\nSyzbot reported that a task hang occurs in vcs_open() during a fuzzing\ntest for nilfs2.\n\nThe root cause of this problem is that in nilfs_find_entry(), which\nsearches for directory entries, ignores errors when loading a directory\npage/folio via nilfs_get_folio() fails.\n\nIf the filesystem images is corrupted, and the i_size of the directory\ninode is large, and the directory page/folio is successfully read but\nfails the sanity check, for example when it is zero-filled,\nnilfs_check_folio() may continue to spit out error messages in bursts.\n\nFix this issue by propagating the error to the callers when loading a\npage/folio fails in nilfs_find_entry().\n\nThe current interface of nilfs_find_entry() and its callers is outdated\nand cannot propagate error codes such as -EIO and -ENOMEM returned via\nnilfs_find_entry(), so fix it together.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b04ede69-e8c3-46e5-8a9c-014574f5cf46",  "id": "CVE-2016-4485",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4485"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aae9cded-1d26-49eb-8719-ada704e92e7e",  "id": "OESA-2026-1412",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "545b44d1-900d-41e1-8286-b3f05dd48e46",  "id": "CVE-2023-52619",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore/ram: Fix crash when setting number of cpus to an odd number\n\nWhen the number of cpu cores is adjusted to 7 or other odd numbers,\nthe zone size will become an odd number.\nThe address of the zone will become:\n    addr of zone0 = BASE\n    addr of zone1 = BASE + zone_size\n    addr of zone2 = BASE + zone_size*2\n    ...\nThe address of zone1/3/5/7 will be mapped to non-alignment va.\nEventually crashes will occur when accessing these va.\n\nSo, use ALIGN_DOWN() to make sure the zone size is even\nto avoid this bug.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "216cb789-e95c-439d-8f1b-af6e78649d96",  "id": "CVE-2010-4565",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4565"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The bcm_connect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel 2.6.36 and earlier creates a publicly accessible file with a filename containing a kernel memory address, which allows local users to obtain potentially sensitive information about kernel memory use by listing this filename.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e60ed9c9-d978-4c30-bc74-aa78c45f94ec",  "id": "CVE-2022-49530",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix double free in si_parse_power_table()\n\nIn function si_parse_power_table(), array adev->pm.dpm.ps and its member\nis allocated. If the allocation of each member fails, the array itself\nis freed and returned with an error code. However, the array is later\nfreed again in si_dpm_fini() function which is called when the function\nreturns an error.\n\nThis leads to potential double free of the array adev->pm.dpm.ps, as\nwell as leak of its array members, since the members are not freed in\nthe allocation function and the array is not nulled when freed.\nIn addition adev->pm.dpm.num_ps, which keeps track of the allocated\narray member, is not updated until the member allocation is\nsuccessfully finished, this could also lead to either use after free,\nor uninitialized variable access in si_dpm_fini().\n\nFix this by postponing the free of the array until si_dpm_fini() and\nincrement adev->pm.dpm.num_ps everytime the array member is allocated.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "67a5c4aa-dc71-46eb-99e8-dc6d25e4ca28",  "id": "CVE-2024-24860",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24860"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "11d09929-de43-4cff-8827-85b680c7d471",  "id": "CVE-2026-53196",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: io_ti: fix heap overflow in get_manuf_info()\n\nget_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the\ndevice I2C EEPROM into a buffer allocated with kmalloc_obj(), which\nis sizeof(struct edge_ti_manuf_descriptor) = 10 bytes.\n\nThe Size field comes from the device and is only validated (in\ncheck_i2c_image()) to make sure the descriptor fits within\nTI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size.\nA malicious USB device can therefore set Size to any value up to 16377,\ncausing a heap overflow of up to 16367 bytes when plugged into a host\nrunning this driver.\n\nvalid_csum() is called after read_rom() and also iterates\nbuffer[0..Size-1], compounding the out-of-bounds access.\n\nFix by rejecting descriptors with unexpected length before calling\nread_rom().\n\n[ johan: amend commit message; also check for short descriptors ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "39abb918-0f44-447a-b2ff-de3375ef6932",  "id": "CVE-2017-18204",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18204"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to cause a denial of service (deadlock) via DIO requests.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "91c69d70-c208-4d6a-9b2b-1dec5c8faf62",  "id": "CVE-2024-46719",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Fix null pointer dereference in trace\n\nucsi_register_altmode checks IS_ERR for the alt pointer and treats\nNULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled,\nucsi_register_displayport returns NULL which causes a NULL pointer\ndereference in trace. Rather than return NULL, call\ntypec_port_register_altmode to register DisplayPort alternate mode\nas a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "191dc34b-bf41-4ad9-b75c-d4519433fb62",  "id": "CVE-2018-6927",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6927"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a negative wake or requeue value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9510f856-f62b-47bf-bd2f-e10e10a17aec",  "id": "CVE-2010-5332",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5332"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 2.6.37, an out of bounds array access happened in drivers/net/mlx4/port.c. When searching for a free entry in either mlx4_register_vlan() or mlx4_register_mac(), and there is no free entry, the loop terminates without updating the local variable free thus causing out of array bounds access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7a81eb6d-c90f-4311-95fe-4d59c5b8cf76",  "id": "CVE-2024-53104",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format\n\nThis can lead to out of bounds writes since frames of this type were not\ntaken into account when calculating the size of the frames buffer in\nuvc_parse_streaming.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "59632267-39df-4ef1-b6ba-a67e57b50c13",  "id": "CVE-2022-26365",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26365"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "730a863b-e8a8-4680-a1aa-d06dcdd616bb",  "id": "CVE-2022-48858",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix a race on command flush flow\n\nFix a refcount use after free warning due to a race on command entry.\nSuch race occurs when one of the commands releases its last refcount and\nfrees its index and entry while another process running command flush\nflow takes refcount to this command entry. The process which handles\ncommands flush may see this command as needed to be flushed if the other\nprocess released its refcount but didn't release the index yet. Fix it\nby adding the needed spin lock.\n\nIt fixes the following warning trace:\n\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 11 PID: 540311 at lib/refcount.c:25 refcount_warn_saturate+0x80/0xe0\n...\nRIP: 0010:refcount_warn_saturate+0x80/0xe0\n...\nCall Trace:\n <TASK>\n mlx5_cmd_trigger_completions+0x293/0x340 [mlx5_core]\n mlx5_cmd_flush+0x3a/0xf0 [mlx5_core]\n enter_error_state+0x44/0x80 [mlx5_core]\n mlx5_fw_fatal_reporter_err_work+0x37/0xe0 [mlx5_core]\n process_one_work+0x1be/0x390\n worker_thread+0x4d/0x3d0\n ? rescuer_thread+0x350/0x350\n kthread+0x141/0x160\n ? set_kthread_struct+0x40/0x40\n ret_from_fork+0x1f/0x30\n </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "365b631c-d7cc-4290-aab9-be5b98edb1ed",  "id": "CVE-2020-14381",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14381"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory or escalate their privileges when creating a futex on a filesystem that is about to be unmounted. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "82c72fa7-74c0-40ca-8159-61e47e478f73",  "id": "CVE-2014-9895",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9895"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/media/media-device.c in the Linux kernel before 3.11, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not properly initialize certain data structures, which allows local users to obtain sensitive information via a crafted application, aka Android internal bug 28750150 and Qualcomm internal bug CR570757, a different vulnerability than CVE-2014-1739.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2a61fa34-c12e-484f-9ff3-2d6e962a7544",  "id": "CVE-2026-31411",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atm: fix crash due to unvalidated vcc pointer in sigd_send()\n\nReproducer available at [1].\n\nThe ATM send path (sendmsg -> vcc_sendmsg -> sigd_send) reads the vcc\npointer from msg->vcc and uses it directly without any validation. This\npointer comes from userspace via sendmsg() and can be arbitrarily forged:\n\n    int fd = socket(AF_ATMSVC, SOCK_DGRAM, 0);\n    ioctl(fd, ATMSIGD_CTRL);  // become ATM signaling daemon\n    struct msghdr msg = { .msg_iov = &iov, ... };\n    *(unsigned long *)(buf + 4) = 0xdeadbeef;  // fake vcc pointer\n    sendmsg(fd, &msg, 0);  // kernel dereferences 0xdeadbeef\n\nIn normal operation, the kernel sends the vcc pointer to the signaling\ndaemon via sigd_enq() when processing operations like connect(), bind(),\nor listen(). The daemon is expected to return the same pointer when\nresponding. However, a malicious daemon can send arbitrary pointer values.\n\nFix this by introducing find_get_vcc() which validates the pointer by\nsearching through vcc_hash (similar to how sigd_close() iterates over\nall VCCs), and acquires a reference via sock_hold() if found.\n\nSince struct atm_vcc embeds struct sock as its first member, they share\nthe same lifetime. Therefore using sock_hold/sock_put is sufficient to\nkeep the vcc alive while it is being used.\n\nNote that there may be a race with sigd_close() which could mark the vcc\nwith various flags (e.g., ATM_VF_RELEASED) after find_get_vcc() returns.\nHowever, sock_hold() guarantees the memory remains valid, so this race\nonly affects the logical state, not memory safety.\n\n[1]: https://gist.github.com/mrpre/1ba5949c45529c511152e2f4c755b0f3",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c318cde6-43d6-4e3f-be65-0ffdde6bd3ed",  "id": "OESA-2024-1879",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9aebb948-8a4f-401c-98d8-eecbec1028f0",  "id": "CVE-2018-10323",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10323"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted xfs image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e4223bef-4be6-4d30-bf38-68a86e3ce69b",  "id": "CVE-2008-7270",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-7270"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a different vulnerability than CVE-2010-4180.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6007361b-5531-4dfb-9bd3-26f459469892",  "id": "CVE-2013-7281",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7281"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The dgram_recvmsg function in net/ieee802154/dgram.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a8175ee-398d-4db0-8d4d-d756aa4f44ef",  "id": "CVE-2024-56598",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: array-index-out-of-bounds fix in dtReadFirst\n\nThe value of stbl can be sometimes out of bounds due\nto a bad filesystem. Added a check with appopriate return\nof error code in that case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cf5404fb-e3ba-452b-ae75-cd0b68a80912",  "id": "CVE-2013-6431",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6431"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The fib6_add function in net/ipv6/ip6_fib.c in the Linux kernel before 3.11.5 does not properly implement error-code encoding, which allows local users to cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for an IPv6 SIOCADDRT ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "063158e6-0cec-4ee1-bbbc-259710b697c2",  "id": "ALSA-2024:1334",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb730f7b-22ab-4611-82f8-ed518c7de6c4",  "id": "CVE-2026-31579",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit\n\nwg_netns_pre_exit() manually acquires rtnl_lock() inside the\npernet .pre_exit callback.  This causes a hung task when another\nthread holds rtnl_mutex - the cleanup_net workqueue (or the\nsetup_net failure rollback path) blocks indefinitely in\nwg_netns_pre_exit() waiting to acquire the lock.\n\nConvert to .exit_rtnl, introduced in commit 7a60d91c690b (\"net:\nAdd ->exit_rtnl() hook to struct pernet_operations.\"), where the\nframework already holds RTNL and batches all callbacks under a\nsingle rtnl_lock()/rtnl_unlock() pair, eliminating the contention\nwindow.\n\nThe rcu_assign_pointer(wg->creating_net, NULL) is safe to move\nfrom .pre_exit to .exit_rtnl (which runs after synchronize_rcu())\nbecause all RCU readers of creating_net either use maybe_get_net()\n- which returns NULL for a dying namespace with zero refcount - or\naccess net->user_ns which remains valid throughout the entire\nops_undo_list sequence.\n\n[ Jason: added __net_exit and __read_mostly annotations that were missing. ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "716119d8-0f32-49a0-b426-f69642ec1d46",  "id": "CVE-2010-2963",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2963"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/media/video/v4l2-compat-ioctl32.c in the Video4Linux (V4L) implementation in the Linux kernel before 2.6.36 on 64-bit platforms does not validate the destination of a memory copy operation, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via a VIDIOCSTUNER ioctl call on a /dev/video device, followed by a VIDIOCSMICROCODE ioctl call on this device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:15344'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:95287/Linux-Kernel-VIDIOCSMICROCODE-IOCTL-Local-Memory-Overwrite.html'"    }  ]},{  "bom-ref": "41fd50dc-7d0c-4b5e-921b-bfb8dd90c245",  "id": "CVE-2023-52595",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rt2x00: restart beacon queue when hardware reset\n\nWhen a hardware reset is triggered, all registers are reset, so all\nqueues are forced to stop in hardware interface. However, mac80211\nwill not automatically stop the queue. If we don't manually stop the\nbeacon queue, the queue will be deadlocked and unable to start again.\nThis patch fixes the issue where Apple devices cannot connect to the\nAP after calling ieee80211_restart_hw().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c82005ac-23a3-4b23-b3a8-7c451416ff15",  "id": "CVE-2023-52741",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix use-after-free in rdata->read_into_pages()\n\nWhen the network status is unstable, use-after-free may occur when\nread data from the server.\n\n  BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0\n\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x38/0x4c\n   print_report+0x16f/0x4a6\n   kasan_report+0xb7/0x130\n   readpages_fill_pages+0x14c/0x7e0\n   cifs_readv_receive+0x46d/0xa40\n   cifs_demultiplex_thread+0x121c/0x1490\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n   </TASK>\n\n  Allocated by task 2535:\n   kasan_save_stack+0x22/0x50\n   kasan_set_track+0x25/0x30\n   __kasan_kmalloc+0x82/0x90\n   cifs_readdata_direct_alloc+0x2c/0x110\n   cifs_readdata_alloc+0x2d/0x60\n   cifs_readahead+0x393/0xfe0\n   read_pages+0x12f/0x470\n   page_cache_ra_unbounded+0x1b1/0x240\n   filemap_get_pages+0x1c8/0x9a0\n   filemap_read+0x1c0/0x540\n   cifs_strict_readv+0x21b/0x240\n   vfs_read+0x395/0x4b0\n   ksys_read+0xb8/0x150\n   do_syscall_64+0x3f/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\n  Freed by task 79:\n   kasan_save_stack+0x22/0x50\n   kasan_set_track+0x25/0x30\n   kasan_save_free_info+0x2e/0x50\n   __kasan_slab_free+0x10e/0x1a0\n   __kmem_cache_free+0x7a/0x1a0\n   cifs_readdata_release+0x49/0x60\n   process_one_work+0x46c/0x760\n   worker_thread+0x2a4/0x6f0\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n\n  Last potentially related work creation:\n   kasan_save_stack+0x22/0x50\n   __kasan_record_aux_stack+0x95/0xb0\n   insert_work+0x2b/0x130\n   __queue_work+0x1fe/0x660\n   queue_work_on+0x4b/0x60\n   smb2_readv_callback+0x396/0x800\n   cifs_abort_connection+0x474/0x6a0\n   cifs_reconnect+0x5cb/0xa50\n   cifs_readv_from_socket.cold+0x22/0x6c\n   cifs_read_page_from_socket+0xc1/0x100\n   readpages_fill_pages.cold+0x2f/0x46\n   cifs_readv_receive+0x46d/0xa40\n   cifs_demultiplex_thread+0x121c/0x1490\n   kthread+0x16b/0x1a0\n   ret_from_fork+0x2c/0x50\n\nThe following function calls will cause UAF of the rdata pointer.\n\nreadpages_fill_pages\n cifs_read_page_from_socket\n  cifs_readv_from_socket\n   cifs_reconnect\n    __cifs_reconnect\n     cifs_abort_connection\n      mid->callback() --> smb2_readv_callback\n       queue_work(&rdata->work)  # if the worker completes first,\n                                 # the rdata is freed\n          cifs_readv_complete\n            kref_put\n              cifs_readdata_release\n                kfree(rdata)\n return rdata->...               # UAF in readpages_fill_pages()\n\nSimilarly, this problem also occurs in the uncache_fill_pages().\n\nFix this by adjusts the order of condition judgment in the return\nstatement.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b6328dd1-880b-48a1-9587-afde27f96eef",  "id": "CVE-2025-38698",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Regular file corruption check\n\nThe reproducer builds a corrupted file on disk with a negative i_size value.\nAdd a check when opening this file to avoid subsequent operation failures.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "031019ae-7ef8-491b-87be-cc8bd00e355c",  "id": "OESA-2024-1901",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84824f50-7d76-4542-9284-f798d2c193b8",  "id": "CLSA-2024-1731344946",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d17c2658-d90a-4e76-9a5e-12dfb6a7c6e9",  "id": "CVE-2012-4565",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4565"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "The tcp_illinois_info function in net/ipv4/tcp_illinois.c in the Linux kernel before 3.4.19, when the net.ipv4.tcp_congestion_control illinois setting is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) by reading TCP stats.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "416d3df2-89b3-4b79-9aac-590a6f45e02c",  "id": "OESA-2023-1207",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b7366f7-5df2-46b7-ac52-daf6ce78f06b",  "id": "CVE-2011-1745",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1745"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the agp_generic_insert_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_BIND agp_ioctl ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0592d32b-a63b-4a4a-b3fa-51ac6cd44e8b",  "id": "MGASA-2014-0325",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2bc9b557-b9f1-4356-bba8-642c3ac6afba",  "id": "CVE-2022-1048",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1048"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a0494864-a831-4d21-872f-2c13a5ff94ab",  "id": "CVE-2014-8133",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8133"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "acec9a04-17a9-47d9-a509-668e88699a85",  "id": "CVE-2023-53648",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer\n\nsmatch error:\nsound/pci/ac97/ac97_codec.c:2354 snd_ac97_mixer() error:\nwe previously assumed 'rac97' could be null (see line 2072)\n\nremove redundant assignment, return error if rac97 is NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "92f76c56-30b3-4cec-81a4-d784bb6e18ce",  "id": "CVE-2015-9261",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9261"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d891b667-8b35-472e-800e-e52e6c741627",  "id": "CVE-2017-15116",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15116"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The rngapi_reset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service (NULL pointer dereference).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "893bf1b9-8cb6-4ee1-8235-a25ae743aa57",  "id": "CVE-2022-48731",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/kmemleak: avoid scanning potential huge holes\n\nWhen using devm_request_free_mem_region() and devm_memremap_pages() to\nadd ZONE_DEVICE memory, if requested free mem region's end pfn were\nhuge(e.g., 0x400000000), the node_end_pfn() will be also huge (see\nmove_pfn_range_to_zone()).  Thus it creates a huge hole between\nnode_start_pfn() and node_end_pfn().\n\nWe found on some AMD APUs, amdkfd requested such a free mem region and\ncreated a huge hole.  In such a case, following code snippet was just\ndoing busy test_bit() looping on the huge hole.\n\n  for (pfn = start_pfn; pfn < end_pfn; pfn++) {\n\tstruct page *page = pfn_to_online_page(pfn);\n\t\tif (!page)\n\t\t\tcontinue;\n\t...\n  }\n\nSo we got a soft lockup:\n\n  watchdog: BUG: soft lockup - CPU#6 stuck for 26s! [bash:1221]\n  CPU: 6 PID: 1221 Comm: bash Not tainted 5.15.0-custom #1\n  RIP: 0010:pfn_to_online_page+0x5/0xd0\n  Call Trace:\n    ? kmemleak_scan+0x16a/0x440\n    kmemleak_write+0x306/0x3a0\n    ? common_file_perm+0x72/0x170\n    full_proxy_write+0x5c/0x90\n    vfs_write+0xb9/0x260\n    ksys_write+0x67/0xe0\n    __x64_sys_write+0x1a/0x20\n    do_syscall_64+0x3b/0xc0\n    entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nI did some tests with the patch.\n\n(1) amdgpu module unloaded\n\nbefore the patch:\n\n  real    0m0.976s\n  user    0m0.000s\n  sys     0m0.968s\n\nafter the patch:\n\n  real    0m0.981s\n  user    0m0.000s\n  sys     0m0.973s\n\n(2) amdgpu module loaded\n\nbefore the patch:\n\n  real    0m35.365s\n  user    0m0.000s\n  sys     0m35.354s\n\nafter the patch:\n\n  real    0m1.049s\n  user    0m0.000s\n  sys     0m1.042s",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eee536f2-8831-42a9-8b81-a05c72815574",  "id": "CVE-2023-53414",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: snic: Fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic at\nonce.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a24502f-f467-436d-8852-f3d7b8724dee",  "id": "CVE-2024-57883",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: hugetlb: independent PMD page table shared count\n\nThe folio refcount may be increased unexpectly through try_get_folio() by\ncaller such as split_huge_pages.  In huge_pmd_unshare(), we use refcount\nto check whether a pmd page table is shared.  The check is incorrect if\nthe refcount is increased by the above caller, and this can cause the page\ntable leaked:\n\n BUG: Bad page state in process sh  pfn:109324\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x66 pfn:0x109324\n flags: 0x17ffff800000000(node=0|zone=2|lastcpupid=0xfffff)\n page_type: f2(table)\n raw: 017ffff800000000 0000000000000000 0000000000000000 0000000000000000\n raw: 0000000000000066 0000000000000000 00000000f2000000 0000000000000000\n page dumped because: nonzero mapcount\n ...\n CPU: 31 UID: 0 PID: 7515 Comm: sh Kdump: loaded Tainted: G    B              6.13.0-rc2master+ #7\n Tainted: [B]=BAD_PAGE\n Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\n Call trace:\n  show_stack+0x20/0x38 (C)\n  dump_stack_lvl+0x80/0xf8\n  dump_stack+0x18/0x28\n  bad_page+0x8c/0x130\n  free_page_is_bad_report+0xa4/0xb0\n  free_unref_page+0x3cc/0x620\n  __folio_put+0xf4/0x158\n  split_huge_pages_all+0x1e0/0x3e8\n  split_huge_pages_write+0x25c/0x2d8\n  full_proxy_write+0x64/0xd8\n  vfs_write+0xcc/0x280\n  ksys_write+0x70/0x110\n  __arm64_sys_write+0x24/0x38\n  invoke_syscall+0x50/0x120\n  el0_svc_common.constprop.0+0xc8/0xf0\n  do_el0_svc+0x24/0x38\n  el0_svc+0x34/0x128\n  el0t_64_sync_handler+0xc8/0xd0\n  el0t_64_sync+0x190/0x198\n\nThe issue may be triggered by damon, offline_page, page_idle, etc, which\nwill increase the refcount of page table.\n\n1. The page table itself will be discarded after reporting the\n   \"nonzero mapcount\".\n\n2. The HugeTLB page mapped by the page table miss freeing since we\n   treat the page table as shared and a shared page table will not be\n   unmapped.\n\nFix it by introducing independent PMD page table shared count.  As\ndescribed by comment, pt_index/pt_mm/pt_frag_refcount are used for s390\ngmap, x86 pgds and powerpc, pt_share_count is used for x86/arm64/riscv\npmds, so we can reuse the field as pt_share_count.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "71570cf0-860f-41bb-bd47-39bcf4b0d1dc",  "id": "CVE-2022-49343",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid cycles in directory h-tree\n\nA maliciously corrupted filesystem can contain cycles in the h-tree\nstored inside a directory. That can easily lead to the kernel corrupting\ntree nodes that were already verified under its hands while doing a node\nsplit and consequently accessing unallocated memory. Fix the problem by\nverifying traversed block numbers are unique.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8cda7d3-04dd-4125-b288-99193873f416",  "id": "MGASA-2019-0229",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bc75a133-caf6-4cab-a7ad-9b28c8654f18",  "id": "CVE-2022-50205",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next2: Add more validity checks for inode counts\n\nAdd checks verifying number of inodes stored in the superblock matches\nthe number computed from number of inodes per group. Also verify we have\nat least one block worth of inodes per group. This prevents crashes on\ncorrupted filesystems.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "03634cb7-3875-4422-a92d-bc081c936d48",  "id": "RHSA-2024:0310",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "81a63e3c-ef04-41bd-a75b-14d72b482af5",  "id": "CVE-2023-52655",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: aqc111: check packet for fixup for true limit\n\nIf a device sends a packet that is inbetween 0\nand sizeof(u64) the value passed to skb_trim()\nas length will wrap around ending up as some very\nlarge value.\n\nThe driver will then proceed to parse the header\nlocated at that position, which will either oops or\nprocess some random value.\n\nThe fix is to check against sizeof(u64) rather than\n0, which the driver currently does. The issue exists\nsince the introduction of the driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d9db2c88-e450-4146-ae9d-51a5249ab1fa",  "id": "CVE-2018-1120",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1120"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119,    122  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:44806'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:147806/Procps-ng-Audit-Report.html'"    }  ]},{  "bom-ref": "4d48458a-87f9-4d5b-ba2a-486d81f579e8",  "id": "CVE-2024-43905",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Fix the null pointer dereference for vega10_hwmgr\n\nCheck return value and conduct null pointer handling to avoid null pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84b90c64-f391-4a68-bd8d-55ddbf9d64d9",  "id": "CVE-2022-44032",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44032"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4000_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cmm_open() and cm4000_detach().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aee03e20-f0e9-4ba5-a9c0-3a84fcfa71cb",  "id": "DLA-2614-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ecf59225-e09f-4107-97d2-0451400d8d5d",  "id": "CVE-2012-6539",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6539"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The dev_ifconf function in net/socket.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a3076284-beeb-4001-804a-bb472a78827a",  "id": "CVE-2024-42096",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86: stop playing stack games in profile_pc()\n\nThe 'profile_pc()' function is used for timer-based profiling, which\nisn't really all that relevant any more to begin with, but it also ends\nup making assumptions based on the stack layout that aren't necessarily\nvalid.\n\nBasically, the code tries to account the time spent in spinlocks to the\ncaller rather than the spinlock, and while I support that as a concept,\nit's not worth the code complexity or the KASAN warnings when no serious\nprofiling is done using timers anyway these days.\n\nAnd the code really does depend on stack layout that is only true in the\nsimplest of cases.  We've lost the comment at some point (I think when\nthe 32-bit and 64-bit code was unified), but it used to say:\n\n\tAssume the lock function has either no stack frame or a copy\n\tof eflags from PUSHF.\n\nwhich explains why it just blindly loads a word or two straight off the\nstack pointer and then takes a minimal look at the values to just check\nif they might be eflags or the return pc:\n\n\tEflags always has bits 22 and up cleared unlike kernel addresses\n\nbut that basic stack layout assumption assumes that there isn't any lock\ndebugging etc going on that would complicate the code and cause a stack\nframe.\n\nIt causes KASAN unhappiness reported for years by syzkaller [1] and\nothers [2].\n\nWith no real practical reason for this any more, just remove the code.\n\nJust for historical interest, here's some background commits relating to\nthis code from 2006:\n\n  0cb91a229364 (\"i386: Account spinlocks to the caller during profiling for !FP kernels\")\n  31679f38d886 (\"Simplify profile_pc on x86-64\")\n\nand a code unification from 2009:\n\n  ef4512882dbe (\"x86: time_32/64.c unify profile_pc\")\n\nbut the basics of this thing actually goes back to before the git tree.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "999808a0-de24-46cb-a907-71145022fc66",  "id": "SUSE-SU-2021:0162-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2d8f9e7e-9781-48c4-b280-79ee773a42a9",  "id": "CVE-2016-10088",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10088"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6c5b8b11-09f6-4827-baf4-fa19bb2169c0",  "id": "CVE-2023-52635",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM / devfreq: Synchronize devfreq_monitor_[start/stop]\n\nThere is a chance if a frequent switch of the governor\ndone in a loop result in timer list corruption where\ntimer cancel being done from two place one from\ncancel_delayed_work_sync() and followed by expire_timers()\ncan be seen from the traces[1].\n\nwhile true\ndo\n        echo \"simple_ondemand\" > /sys/class/devfreq/1d84000.ufshc/governor\n        echo \"performance\" > /sys/class/devfreq/1d84000.ufshc/governor\ndone\n\nIt looks to be issue with devfreq driver where\ndevice_monitor_[start/stop] need to synchronized so that\ndelayed work should get corrupted while it is either\nbeing queued or running or being cancelled.\n\nLet's use polling flag and devfreq lock to synchronize the\nqueueing the timer instance twice and work data being\ncorrupted.\n\n[1]\n...\n..\n<idle>-0    [003]   9436.209662:  timer_cancel   timer=0xffffff80444f0428\n<idle>-0    [003]   9436.209664:  timer_expire_entry   timer=0xffffff80444f0428  now=0x10022da1c  function=__typeid__ZTSFvP10timer_listE_global_addr  baseclk=0x10022da1c\n<idle>-0    [003]   9436.209718:  timer_expire_exit   timer=0xffffff80444f0428\nkworker/u16:6-14217    [003]   9436.209863:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2b  now=0x10022da1c  flags=182452227\nvendor.xxxyyy.ha-1593    [004]   9436.209888:  timer_cancel   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216390:  timer_init   timer=0xffffff80444f0428\nvendor.xxxyyy.ha-1593    [004]   9436.216392:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2c  now=0x10022da1d  flags=186646532\nvendor.xxxyyy.ha-1593    [005]   9436.220992:  timer_cancel   timer=0xffffff80444f0428\nxxxyyyTraceManag-7795    [004]   9436.261641:  timer_cancel   timer=0xffffff80444f0428\n\n[2]\n\n 9436.261653][    C4] Unable to handle kernel paging request at virtual address dead00000000012a\n[ 9436.261664][    C4] Mem abort info:\n[ 9436.261666][    C4]   ESR = 0x96000044\n[ 9436.261669][    C4]   EC = 0x25: DABT (current EL), IL = 32 bits\n[ 9436.261671][    C4]   SET = 0, FnV = 0\n[ 9436.261673][    C4]   EA = 0, S1PTW = 0\n[ 9436.261675][    C4] Data abort info:\n[ 9436.261677][    C4]   ISV = 0, ISS = 0x00000044\n[ 9436.261680][    C4]   CM = 0, WnR = 1\n[ 9436.261682][    C4] [dead00000000012a] address between user and kernel address ranges\n[ 9436.261685][    C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP\n[ 9436.261701][    C4] Skip md ftrace buffer dump for: 0x3a982d0\n...\n\n[ 9436.262138][    C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S      W  O      5.10.149-android12-9-o-g17f915d29d0c #1\n[ 9436.262141][    C4] Hardware name: Qualcomm Technologies, Inc.  (DT)\n[ 9436.262144][    C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--)\n[ 9436.262161][    C4] pc : expire_timers+0x9c/0x438\n[ 9436.262164][    C4] lr : expire_timers+0x2a4/0x438\n[ 9436.262168][    C4] sp : ffffffc010023dd0\n[ 9436.262171][    C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18\n[ 9436.262178][    C4] x27: ffffffd063569dd0 x26: ffffffd063536008\n[ 9436.262182][    C4] x25: 0000000000000001 x24: ffffff88f7c69280\n[ 9436.262185][    C4] x23: 00000000000000e0 x22: dead000000000122\n[ 9436.262188][    C4] x21: 000000010022da29 x20: ffffff8af72b4e80\n[ 9436.262191][    C4] x19: ffffffc010023e50 x18: ffffffc010025038\n[ 9436.262195][    C4] x17: 0000000000000240 x16: 0000000000000201\n[ 9436.262199][    C4] x15: ffffffffffffffff x14: ffffff889f3c3100\n[ 9436.262203][    C4] x13: ffffff889f3c3100 x12: 00000000049f56b8\n[ 9436.262207][    C4] x11: 00000000049f56b8 x10: 00000000ffffffff\n[ 9436.262212][    C4] x9 : ffffffc010023e50 x8 : dead000000000122\n[ 9436.262216][    C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8\n[ 9436.262220][    C4] x5 : 0000000000000000 x4 : 0000000000000101\n[ 9436.262223][    C4] x3 : 0000000000000080 x2 : ffffff8\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e4a9b20-33bd-4da2-9f5d-06e51b1c5fd9",  "id": "SUSE-SU-2021:3531-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "189af41b-7c35-4a45-bcaf-b64d6f5e2eda",  "id": "CLSA-2022-1647550569",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d08b8dce-df63-44d3-8fd8-ed5865e1f7aa",  "id": "CVE-2024-40959",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()\n\nip6_dst_idev() can return NULL, xfrm6_get_saddr() must act accordingly.\n\nsyzbot reported:\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 1 PID: 12 Comm: kworker/u8:1 Not tainted 6.10.0-rc2-syzkaller-00383-gb8481381d4e2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\nWorkqueue: wg-kex-wg1 wg_packet_handshake_send_worker\n RIP: 0010:xfrm6_get_saddr+0x93/0x130 net/ipv6/xfrm6_policy.c:64\nCode: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 97 00 00 00 4c 8b ab d8 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 86 00 00 00 4d 8b 6d 00 e8 ca 13 47 01 48 b8 00\nRSP: 0018:ffffc90000117378 EFLAGS: 00010246\nRAX: dffffc0000000000 RBX: ffff88807b079dc0 RCX: ffffffff89a0d6d7\nRDX: 0000000000000000 RSI: ffffffff89a0d6e9 RDI: ffff88807b079e98\nRBP: ffff88807ad73248 R08: 0000000000000007 R09: fffffffffffff000\nR10: ffff88807b079dc0 R11: 0000000000000007 R12: ffffc90000117480\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\nFS:  0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f4586d00440 CR3: 0000000079042000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n  xfrm_get_saddr net/xfrm/xfrm_policy.c:2452 [inline]\n  xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2481 [inline]\n  xfrm_tmpl_resolve+0xa26/0xf10 net/xfrm/xfrm_policy.c:2541\n  xfrm_resolve_and_create_bundle+0x140/0x2570 net/xfrm/xfrm_policy.c:2835\n  xfrm_bundle_lookup net/xfrm/xfrm_policy.c:3070 [inline]\n  xfrm_lookup_with_ifid+0x4d1/0x1e60 net/xfrm/xfrm_policy.c:3201\n  xfrm_lookup net/xfrm/xfrm_policy.c:3298 [inline]\n  xfrm_lookup_route+0x3b/0x200 net/xfrm/xfrm_policy.c:3309\n  ip6_dst_lookup_flow+0x15c/0x1d0 net/ipv6/ip6_output.c:1256\n  send6+0x611/0xd20 drivers/net/wireguard/socket.c:139\n  wg_socket_send_skb_to_peer+0xf9/0x220 drivers/net/wireguard/socket.c:178\n  wg_socket_send_buffer_to_peer+0x12b/0x190 drivers/net/wireguard/socket.c:200\n  wg_packet_send_handshake_initiation+0x227/0x360 drivers/net/wireguard/send.c:40\n  wg_packet_handshake_send_worker+0x1c/0x30 drivers/net/wireguard/send.c:51\n  process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231\n  process_scheduled_works kernel/workqueue.c:3312 [inline]\n  worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393\n  kthread+0x2c1/0x3a0 kernel/kthread.c:389\n  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7163625a-a482-4c0f-b28f-8aceab757e34",  "id": "CVE-2013-1767",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1767"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Use-after-free vulnerability in the shmem_remount_fs function in mm/shmem.c in the Linux kernel before 3.7.10 allows local users to gain privileges or cause a denial of service (system crash) by remounting a tmpfs filesystem without specifying a required mpol (aka mempolicy) mount option.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee0b357b-9ea3-44b8-a2a1-a614c49fb977",  "id": "RHSA-2022:6224",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99e2b97e-ed4e-455f-927e-7c61da131941",  "id": "CVE-2024-41015",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: add bounds checking to ocfs2_check_dir_entry()\n\nThis adds sanity checks for ocfs2_dir_entry to make sure all members of\nocfs2_dir_entry don't stray beyond valid memory region.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "861dca3c-f36f-4435-932f-18b00646a81c",  "id": "CVE-2022-48824",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: myrs: Fix crash in error case\n\nIn myrs_detect(), cs->disable_intr is NULL when privdata->hw_init() fails\nwith non-zero. In this case, myrs_cleanup(cs) will call a NULL ptr and\ncrash the kernel.\n\n[    1.105606] myrs 0000:00:03.0: Unknown Initialization Error 5A\n[    1.105872] myrs 0000:00:03.0: Failed to initialize Controller\n[    1.106082] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[    1.110774] Call Trace:\n[    1.110950]  myrs_cleanup+0xe4/0x150 [myrs]\n[    1.111135]  myrs_probe.cold+0x91/0x56a [myrs]\n[    1.111302]  ? DAC960_GEM_intr_handler+0x1f0/0x1f0 [myrs]\n[    1.111500]  local_pci_probe+0x48/0x90",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a6bcfa2-897e-4f72-81e7-43c5e1e54655",  "id": "CVE-2023-53176",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: Reinit port->pm on port specific driver unbind\n\nWhen we unbind a serial port hardware specific 8250 driver, the generic\nserial8250 driver takes over the port. After that we see an oops about 10\nseconds later. This can produce the following at least on some TI SoCs:\n\nUnhandled fault: imprecise external abort (0x1406)\nInternal error: : 1406 [#1] SMP ARM\n\nTurns out that we may still have the serial port hardware specific driver\nport->pm in use, and serial8250_pm() tries to call it after the port\nspecific driver is gone:\n\nserial8250_pm [8250_base] from uart_change_pm+0x54/0x8c [serial_base]\nuart_change_pm [serial_base] from uart_hangup+0x154/0x198 [serial_base]\nuart_hangup [serial_base] from __tty_hangup.part.0+0x328/0x37c\n__tty_hangup.part.0 from disassociate_ctty+0x154/0x20c\ndisassociate_ctty from do_exit+0x744/0xaac\ndo_exit from do_group_exit+0x40/0x8c\ndo_group_exit from __wake_up_parent+0x0/0x1c\n\nLet's fix the issue by calling serial8250_set_defaults() in\nserial8250_unregister_port(). This will set the port back to using\nthe serial8250 default functions, and sets the port->pm to point to\nserial8250_pm.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f57da685-06fc-4595-8481-dc918bb84082",  "id": "RHSA-2022:1078",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ce3c8eef-151d-404a-9243-b9b8f28ae922",  "id": "CVE-2023-52561",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved\n\nAdding a reserved memory region for the framebuffer memory\n(the splash memory region set up by the bootloader).\n\nIt fixes a kernel panic (arm-smmu: Unhandled context fault\nat this particular memory region) reported on DB845c running\nv5.10.y.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0f955e5e-2225-4fd1-8ed4-b993fb057fcc",  "id": "ROOT-OS-ALPINE-317-CVE-2026-45447",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f35d3536-bc95-433c-9213-89f322f744aa",  "id": "CVE-2022-37660",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37660"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    323  ],  "analysis": {    "state": "in_triage"  },  "description": "In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17fa088e-abb2-469b-b9a0-2fc387c13010",  "id": "CVE-2022-33981",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33981"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "73d1a18b-b8cd-4ff0-82b6-6a86018dfab0",  "id": "CVE-2010-4077",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4077"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The ntty_ioctl_tiocgicount function in drivers/char/nozomi.c in the Linux kernel 2.6.36.1 and earlier does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:16973'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:99294/Linux-2.6.37-rc1-serial_core-TIOCGICOUNT-Leak.html'"    }  ]},{  "bom-ref": "82562284-704c-47b1-b940-34296bc59aa1",  "id": "CVE-2016-6327",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6327"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel before 4.5.1 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an ABORT_TASK command to abort a device write operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "148f902f-ff76-4507-87ce-9bcc706065d1",  "id": "CVE-2019-18660",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18660"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "001ae7ea-0f1a-40a0-90a5-051b3086f4ee",  "id": "OESA-2022-1821",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "80d7f980-7da3-4744-974c-c73bb603f006",  "id": "CVE-2013-2851",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2851"  },  "ratings": [    {      "score": 6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:S/C:C/I:C/A:C"    }  ],  "cwes": [    134  ],  "analysis": {    "state": "in_triage"  },  "description": "Format string vulnerability in the register_disk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/md_mod/parameters/new_array in order to create a crafted /dev/md device name.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "caefde25-a94a-4ceb-a778-d034fa3b68e5",  "id": "CVE-2012-5375",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5375"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The CRC32C feature in the Btrfs implementation in the Linux kernel before 3.8-rc1 allows local users to cause a denial of service (prevention of file creation) by leveraging the ability to write to a directory important to the victim, and creating a file with a crafted name that is associated with a specific CRC32C hash value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:38132'"    }  ]},{  "bom-ref": "e1d2b8ab-3fd1-4a45-b19a-cd40f1866653",  "id": "CLSA-2024-1709839769",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8e5ea949-ded2-4f04-87d0-a3854ed2868d",  "id": "CVE-2011-2518",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2518"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The tomoyo_mount_acl function in security/tomoyo/mount.c in the Linux kernel before 2.6.39.2 calls the kern_path function with arguments taken directly from a mount system call, which allows local users to cause a denial of service (OOPS) or possibly have unspecified other impact via a NULL value for the device name.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "27db841a-bc7f-44f3-ae77-2a28b9386779",  "id": "CVE-2023-53584",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process\n\nThere are two states for ubifs writing pages:\n1. Dirty, Private\n2. Not Dirty, Not Private\n\nThe normal process cannot go to ubifs_releasepage() which means there\nexists pages being private but not dirty. Reproducer[1] shows that it\ncould occur (which maybe related to [2]) with following process:\n\n     PA                     PB                    PC\nlock(page)[PA]\nubifs_write_end\n  attach_page_private         // set Private\n  __set_page_dirty_nobuffers  // set Dirty\nunlock(page)\n\nwrite_cache_pages[PA]\n  lock(page)\n  clear_page_dirty_for_io(page)\t// clear Dirty\n  ubifs_writepage\n\n                        do_truncation[PB]\n\t\t\t  truncate_setsize\n\t\t\t    i_size_write(inode, newsize) // newsize = 0\n\n    i_size = i_size_read(inode)\t// i_size = 0\n    end_index = i_size >> PAGE_SHIFT\n    if (page->index > end_index)\n      goto out // jump\nout:\nunlock(page)   // Private, Not Dirty\n\n\t\t\t\t\t\tgeneric_fadvise[PC]\n\t\t\t\t\t\t  lock(page)\n\t\t\t\t\t\t  invalidate_inode_page\n\t\t\t\t\t\t    try_to_release_page\n\t\t\t\t\t\t      ubifs_releasepage\n\t\t\t\t\t\t        ubifs_assert(c, 0)\n\t\t                                        // bad assertion!\n\t\t\t\t\t\t  unlock(page)\n\t\t\t  truncate_pagecache[PB]\n\nThen we may get following assertion failed:\n  UBIFS error (ubi0:0 pid 1683): ubifs_assert_failed [ubifs]:\n  UBIFS assert failed: 0, in fs/ubifs/file.c:1513\n  UBIFS warning (ubi0:0 pid 1683): ubifs_ro_mode [ubifs]:\n  switched to read-only mode, error -22\n  CPU: 2 PID: 1683 Comm: aa Not tainted 5.16.0-rc5-00184-g0bca5994cacc-dirty #308\n  Call Trace:\n    dump_stack+0x13/0x1b\n    ubifs_ro_mode+0x54/0x60 [ubifs]\n    ubifs_assert_failed+0x4b/0x80 [ubifs]\n    ubifs_releasepage+0x67/0x1d0 [ubifs]\n    try_to_release_page+0x57/0xe0\n    invalidate_inode_page+0xfb/0x130\n    __invalidate_mapping_pages+0xb9/0x280\n    invalidate_mapping_pagevec+0x12/0x20\n    generic_fadvise+0x303/0x3c0\n    ksys_fadvise64_64+0x4c/0xb0\n\n[1] https://bugzilla.kernel.org/show_bug.cgi?id=215373\n[2] https://linux-mtd.infradead.narkive.com/NQoBeT1u/patch-rfc-ubifs-fix-assert-failed-in-ubifs-set-page-dirty",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fb558de5-dbbd-4914-8538-5fa977b5c3ba",  "id": "CVE-2017-17805",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17805"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd9dd034-376e-4856-8542-cfae181a1bd7",  "id": "CVE-2026-23397",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfnetlink_osf: validate individual option lengths in fingerprints\n\nnfnl_osf_add_callback() validates opt_num bounds and string\nNUL-termination but does not check individual option length fields.\nA zero-length option causes nf_osf_match_one() to enter the option\nmatching loop even when foptsize sums to zero, which matches packets\nwith no TCP options where ctx->optp is NULL:\n\n Oops: general protection fault\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)\n Call Trace:\n  nf_osf_match (net/netfilter/nfnetlink_osf.c:227)\n  xt_osf_match_packet (net/netfilter/xt_osf.c:32)\n  ipt_do_table (net/ipv4/netfilter/ip_tables.c:293)\n  nf_hook_slow (net/netfilter/core.c:623)\n  ip_local_deliver (net/ipv4/ip_input.c:262)\n  ip_rcv (net/ipv4/ip_input.c:573)\n\nAdditionally, an MSS option (kind=2) with length < 4 causes\nout-of-bounds reads when nf_osf_match_one() unconditionally accesses\noptp[2] and optp[3] for MSS value extraction.  While RFC 9293\nsection 3.2 specifies that the MSS option is always exactly 4\nbytes (Kind=2, Length=4), the check uses \"< 4\" rather than\n\"!= 4\" because lengths greater than 4 do not cause memory\nsafety issues -- the buffer is guaranteed to be at least\nfoptsize bytes by the ctx->optsize == foptsize check.\n\nReject fingerprints where any option has zero length, or where an MSS\noption has length less than 4, at add time rather than trusting these\nvalues in the packet matching hot path.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bdf47814-5433-4701-8f27-751d6eac2ac5",  "id": "CVE-2026-53349",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n\nNAT helpers such as nf_nat_h323 store a raw pointer to module text in\nexp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister()\nonly unlinks the callback descriptor and never walks the expectation table,\nso an expectation pending at module removal survives with a dangling\nexp->expectfn into freed module text.\n\nWhen the expected connection arrives, init_conntrack() invokes\nexp->expectfn(), now a stale pointer into the unloaded module. Reproduced\non a KASAN build by loading the H.323 helpers, creating a Q.931\nexpectation, unloading nf_nat_h323, then connecting to the expected port:\n\n Oops: int3: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:0xffffffffa06102d1\n  init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862)\n  nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049)\n  ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223)\n  nf_hook_slow (net/netfilter/core.c:619)\n  __ip_local_out (net/ipv4/ip_output.c:120)\n  __tcp_transmit_skb (net/ipv4/tcp_output.c:1715)\n  tcp_connect (net/ipv4/tcp_output.c:4374)\n  tcp_v4_connect (net/ipv4/tcp_ipv4.c:345)\n  __sys_connect (net/socket.c:2167)\n Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323]\n\nReaching the dangling state requires CAP_SYS_MODULE in the initial user\nnamespace to remove a NAT helper that still has live expectations, so this\nis a robustness fix; leaving an expectation pointing at freed text is wrong\nregardless.\n\nAdd nf_ct_helper_expectfn_destroy(), which walks the expectation table and\ndrops every expectation whose ->expectfn matches the descriptor being torn\ndown. Call it from each NAT helper's exit path after the existing RCU grace\nperiod, so no expectation outlives the code it points at and no extra\nsynchronize_rcu() is introduced. With the fix, the same reproducer runs to\ncompletion without the Oops.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e643608c-98c1-46a3-9ff1-22c6d50b8846",  "id": "CVE-2024-46776",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Run DC_LOG_DC after checking link->link_enc\n\n[WHAT]\nThe DC_LOG_DC should be run after link->link_enc is checked, not before.\n\nThis fixes 1 REVERSE_INULL issue reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "665b4aa8-29c4-488e-8e97-52249e6c7b5d",  "id": "ALSA-2023:7046",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "41bce0f0-95a3-4e60-9218-ef0ceade5cf3",  "id": "CVE-2020-8992",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8992"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400,    834  ],  "analysis": {    "state": "in_triage"  },  "description": "ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8cd85ea3-7f5e-4f11-ba3e-addaf9a4b9b5",  "id": "CVE-2024-50285",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: check outstanding simultaneous SMB operations\n\nIf Client send simultaneous SMB operations to ksmbd, It exhausts too much\nmemory through the \"ksmbd_work_cache”. It will cause OOM issue.\nksmbd has a credit mechanism but it can't handle this problem. This patch\nadd the check if it exceeds max credits to prevent this problem by assuming\nthat one smb request consumes at least one credit.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "82b08635-c9b4-46c3-9609-fd0c287fe3d0",  "id": "CLSA-2026-1777948139",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d199324-c519-41f8-93e5-8a6dcabec873",  "id": "CVE-2024-49936",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/xen-netback: prevent UAF in xenvif_flush_hash()\n\nDuring the list_for_each_entry_rcu iteration call of xenvif_flush_hash,\nkfree_rcu does not exist inside the rcu read critical section, so if\nkfree_rcu is called when the rcu grace period ends during the iteration,\nUAF occurs when accessing head->next after the entry becomes free.\n\nTherefore, to solve this, you need to change it to list_for_each_entry_safe.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b366673e-2037-4092-bf68-e4ce9dd81e88",  "id": "CVE-2018-10021",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10021"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial of service (ata qc leak) by triggering certain failure conditions. NOTE: a third party disputes the relevance of this report because the failure can only occur for physically proximate attackers who unplug SAS Host Bus Adapter cables",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "53ac9caa-e6ad-4503-b33e-b1d99a7e1f29",  "id": "CVE-2025-38105",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Kill timer properly at removal\n\nThe USB-audio MIDI code initializes the timer, but in a rare case, the\ndriver might be freed without the disconnect call.  This leaves the\ntimer in an active state while the assigned object is released via\nsnd_usbmidi_free(), which ends up with a kernel warning when the debug\nconfiguration is enabled, as spotted by fuzzer.\n\nFor avoiding the problem, put timer_shutdown_sync() at\nsnd_usbmidi_free(), so that the timer can be killed properly.\nWhile we're at it, replace the existing timer_delete_sync() at the\ndisconnect callback with timer_shutdown_sync(), too.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a849dc93-ca4e-4521-acd6-fa27401863a1",  "id": "CVE-2013-10048",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10048"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    78  ],  "analysis": {    "state": "in_triage"  },  "description": "An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper input handling in the unauthenticated command.php endpoint. By sending specially crafted POST requests, a remote attacker can execute arbitrary shell commands with root privileges, allowing full takeover of the device. This includes launching services such as Telnet, exfiltrating credentials, modifying system configuration, and disrupting availability. The flaw stems from the lack of authentication and inadequate sanitation of the cmd parameter.",  "affects": [    {      "ref": "0f9017f6-bd13-4064-97b2-6cfc35c2947d",      "versions": [        {          "component": "dir-600_firmware",          "version": "2.14b01"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'MSF:dlink_command_php_exec_noauth'"    }  ]},{  "bom-ref": "63bf5af2-6966-4dde-92f6-7dc742f7eca7",  "id": "CVE-2017-12153",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12153"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel through 4.13.3. This function does not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1b8f4df9-c0ff-45e5-93f7-36c37dd5cf3d",  "id": "CVE-2024-49903",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix uaf in dbFreeBits\n\n[syzbot reported]\n==================================================================\nBUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline]\nBUG: KASAN: slab-use-after-free in __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752\nRead of size 8 at addr ffff8880229254b0 by task syz-executor357/5216\n\nCPU: 0 UID: 0 PID: 5216 Comm: syz-executor357 Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:93 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\n kasan_report+0x143/0x180 mm/kasan/report.c:601\n __mutex_lock_common kernel/locking/mutex.c:587 [inline]\n __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752\n dbFreeBits+0x7ea/0xd90 fs/jfs/jfs_dmap.c:2390\n dbFreeDmap fs/jfs/jfs_dmap.c:2089 [inline]\n dbFree+0x35b/0x680 fs/jfs/jfs_dmap.c:409\n dbDiscardAG+0x8a9/0xa20 fs/jfs/jfs_dmap.c:1650\n jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100\n jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n\nFreed by task 5218:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579\n poison_slab_object+0xe0/0x150 mm/kasan/common.c:240\n __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256\n kasan_slab_free include/linux/kasan.h:184 [inline]\n slab_free_hook mm/slub.c:2252 [inline]\n slab_free mm/slub.c:4473 [inline]\n kfree+0x149/0x360 mm/slub.c:4594\n dbUnmount+0x11d/0x190 fs/jfs/jfs_dmap.c:278\n jfs_mount_rw+0x4ac/0x6a0 fs/jfs/jfs_mount.c:247\n jfs_remount+0x3d1/0x6b0 fs/jfs/super.c:454\n reconfigure_super+0x445/0x880 fs/super.c:1083\n vfs_cmd_reconfigure fs/fsopen.c:263 [inline]\n vfs_fsconfig_locked fs/fsopen.c:292 [inline]\n __do_sys_fsconfig fs/fsopen.c:473 [inline]\n __se_sys_fsconfig+0xb6e/0xf80 fs/fsopen.c:345\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[Analysis]\nThere are two paths (dbUnmount and jfs_ioc_trim) that generate race\ncondition when accessing bmap, which leads to the occurrence of uaf.\n\nUse the lock s_umount to synchronize them, in order to avoid uaf caused\nby race condition.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c6ced4f5-06dd-41d7-936b-4f296e1f9c05",  "id": "CVE-2024-50244",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Additional check in ni_clear()\n\nChecking of NTFS_FLAGS_LOG_REPLAYING added to prevent access to\nuninitialized bitmap during replay process.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "702117b1-88ff-4cfd-9978-257e04c206f8",  "id": "CVE-2023-53153",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: Fix use after free for wext\n\nKey information in wext.connect is not reset on (re)connect and can hold\ndata from a previous connection.\n\nReset key data to avoid that drivers or mac80211 incorrectly detect a\nWEP connection request and access the freed or already reused memory.\n\nAdditionally optimize cfg80211_sme_connect() and avoid an useless\nschedule of conn_work.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "50dbf1da-e3f7-4f95-b19c-e21376027c49",  "id": "OESA-2022-1859",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9364f822-f860-4103-9b2b-7c7a76c7f4ae",  "id": "CVE-2021-47233",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47233"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: rt4801: Fix NULL pointer dereference if priv->enable_gpios is NULL\n\ndevm_gpiod_get_array_optional may return NULL if no GPIO was assigned.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c30aeb73-1330-4769-8962-c8d08b735d95",  "id": "CVE-2022-49029",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails\n\nSmatch report warning as follows:\n\ndrivers/hwmon/ibmpex.c:509 ibmpex_register_bmc() warn:\n  '&data->list' not removed from list\n\nIf ibmpex_find_sensors() fails in ibmpex_register_bmc(), data will\nbe freed, but data->list will not be removed from driver_data.bmc_data,\nthen list traversal may cause UAF.\n\nFix by removeing it from driver_data.bmc_data before free().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ad07c5d0-a1c3-4369-9c2e-c0d1af76d0e2",  "id": "CVE-2022-48990",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix use-after-free during gpu recovery\n\n[Why]\n    [  754.862560] refcount_t: underflow; use-after-free.\n    [  754.862898] Call Trace:\n    [  754.862903]  <TASK>\n    [  754.862913]  amdgpu_job_free_cb+0xc2/0xe1 [amdgpu]\n    [  754.863543]  drm_sched_main.cold+0x34/0x39 [amd_sched]\n\n[How]\n    The fw_fence may be not init, check whether dma_fence_init\n    is performed before job free",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "af6fb0e0-f2de-4d2f-8d32-e691fa09ca28",  "id": "MGASA-2018-0365",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d314a15b-872e-496b-88be-3c149c14b86e",  "id": "CVE-2017-18203",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18203"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e6510d79-67cc-4a4c-a6c5-6e8067f95872",  "id": "GHSA-xmgf-hq76-4vx2",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e076c55-ef58-4b2a-8772-9daff46fb03c",  "id": "CVE-2026-31576",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: hackrf: fix to not free memory after the device is registered in hackrf_probe()\n\nIn hackrf driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nhackrf_probe()\n  kzalloc(); // alloc hackrf_dev\n  ....\n  v4l2_device_register();\n  ....\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open hackrf fd\n\t\t\t\t\t\t....\n  v4l2_device_unregister();\n  ....\n  kfree(); // free hackrf_dev\n  ....\n\t\t\t\t\t\tsys_ioctl(fd, ...);\n\t\t\t\t\t\t  v4l2_ioctl();\n\t\t\t\t\t\t    video_is_registered() // UAF!!\n\t\t\t\t\t\t....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t  v4l2_release() // UAF!!\n\t\t\t\t\t\t    hackrf_video_release()\n\t\t\t\t\t\t      kfree(); // DFB!!\n```\n\nWhen a V4L2 or video device is unregistered, the device node is removed so\nnew open() calls are blocked.\n\nHowever, file descriptors that are already open-and any in-flight I/O-do\nnot terminate immediately; they remain valid until the last reference is\ndropped and the driver's release() is invoked.\n\nTherefore, freeing device memory on the error path after hackrf_probe()\nhas registered dev it will lead to a race to use-after-free vuln, since\nthose already-open handles haven't been released yet.\n\nAnd since release() free memory too, race to use-after-free and\ndouble-free vuln occur.\n\nTo prevent this, if device is registered from probe(), it should be\nmodified to free memory only through release() rather than calling\nkfree() directly.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9787f716-5a54-42fb-bfb7-41a5f6109008",  "id": "CVE-2025-38716",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix general protection fault in hfs_find_init()\n\nThe hfs_find_init() method can trigger the crash\nif tree pointer is NULL:\n\n[   45.746290][ T9787] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KAI\n[   45.747287][ T9787] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]\n[   45.748716][ T9787] CPU: 2 UID: 0 PID: 9787 Comm: repro Not tainted 6.16.0-rc3 #10 PREEMPT(full)\n[   45.750250][ T9787] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   45.751983][ T9787] RIP: 0010:hfs_find_init+0x86/0x230\n[   45.752834][ T9787] Code: c1 ea 03 80 3c 02 00 0f 85 9a 01 00 00 4c 8d 6b 40 48 c7 45 18 00 00 00 00 48 b8 00 00 00 00 00 fc\n[   45.755574][ T9787] RSP: 0018:ffffc90015157668 EFLAGS: 00010202\n[   45.756432][ T9787] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff819a4d09\n[   45.757457][ T9787] RDX: 0000000000000008 RSI: ffffffff819acd3a RDI: ffffc900151576e8\n[   45.758282][ T9787] RBP: ffffc900151576d0 R08: 0000000000000005 R09: 0000000000000000\n[   45.758943][ T9787] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000004\n[   45.759619][ T9787] R13: 0000000000000040 R14: ffff88802c50814a R15: 0000000000000000\n[   45.760293][ T9787] FS:  00007ffb72734540(0000) GS:ffff8880cec64000(0000) knlGS:0000000000000000\n[   45.761050][ T9787] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   45.761606][ T9787] CR2: 00007f9bd8225000 CR3: 000000010979a000 CR4: 00000000000006f0\n[   45.762286][ T9787] Call Trace:\n[   45.762570][ T9787]  <TASK>\n[   45.762824][ T9787]  hfs_ext_read_extent+0x190/0x9d0\n[   45.763269][ T9787]  ? submit_bio_noacct_nocheck+0x2dd/0xce0\n[   45.763766][ T9787]  ? __pfx_hfs_ext_read_extent+0x10/0x10\n[   45.764250][ T9787]  hfs_get_block+0x55f/0x830\n[   45.764646][ T9787]  block_read_full_folio+0x36d/0x850\n[   45.765105][ T9787]  ? __pfx_hfs_get_block+0x10/0x10\n[   45.765541][ T9787]  ? const_folio_flags+0x5b/0x100\n[   45.765972][ T9787]  ? __pfx_hfs_read_folio+0x10/0x10\n[   45.766415][ T9787]  filemap_read_folio+0xbe/0x290\n[   45.766840][ T9787]  ? __pfx_filemap_read_folio+0x10/0x10\n[   45.767325][ T9787]  ? __filemap_get_folio+0x32b/0xbf0\n[   45.767780][ T9787]  do_read_cache_folio+0x263/0x5c0\n[   45.768223][ T9787]  ? __pfx_hfs_read_folio+0x10/0x10\n[   45.768666][ T9787]  read_cache_page+0x5b/0x160\n[   45.769070][ T9787]  hfs_btree_open+0x491/0x1740\n[   45.769481][ T9787]  hfs_mdb_get+0x15e2/0x1fb0\n[   45.769877][ T9787]  ? __pfx_hfs_mdb_get+0x10/0x10\n[   45.770316][ T9787]  ? find_held_lock+0x2b/0x80\n[   45.770731][ T9787]  ? lockdep_init_map_type+0x5c/0x280\n[   45.771200][ T9787]  ? lockdep_init_map_type+0x5c/0x280\n[   45.771674][ T9787]  hfs_fill_super+0x38e/0x720\n[   45.772092][ T9787]  ? __pfx_hfs_fill_super+0x10/0x10\n[   45.772549][ T9787]  ? snprintf+0xbe/0x100\n[   45.772931][ T9787]  ? __pfx_snprintf+0x10/0x10\n[   45.773350][ T9787]  ? do_raw_spin_lock+0x129/0x2b0\n[   45.773796][ T9787]  ? find_held_lock+0x2b/0x80\n[   45.774215][ T9787]  ? set_blocksize+0x40a/0x510\n[   45.774636][ T9787]  ? sb_set_blocksize+0x176/0x1d0\n[   45.775087][ T9787]  ? setup_bdev_super+0x369/0x730\n[   45.775533][ T9787]  get_tree_bdev_flags+0x384/0x620\n[   45.775985][ T9787]  ? __pfx_hfs_fill_super+0x10/0x10\n[   45.776453][ T9787]  ? __pfx_get_tree_bdev_flags+0x10/0x10\n[   45.776950][ T9787]  ? bpf_lsm_capable+0x9/0x10\n[   45.777365][ T9787]  ? security_capable+0x80/0x260\n[   45.777803][ T9787]  vfs_get_tree+0x8e/0x340\n[   45.778203][ T9787]  path_mount+0x13de/0x2010\n[   45.778604][ T9787]  ? kmem_cache_free+0x2b0/0x4c0\n[   45.779052][ T9787]  ? __pfx_path_mount+0x10/0x10\n[   45.779480][ T9787]  ? getname_flags.part.0+0x1c5/0x550\n[   45.779954][ T9787]  ? putname+0x154/0x1a0\n[   45.780335][ T9787]  __x64_sys_mount+0x27b/0x300\n[   45.780758][ T9787]  ? __pfx___x64_sys_mount+0x10/0x10\n[   45.781232][ T9787] \n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb508752-c92b-4834-adf8-87c4946b1184",  "id": "CVE-2021-47182",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47182"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix scsi_mode_sense() buffer length handling\n\nSeveral problems exist with scsi_mode_sense() buffer length handling:\n\n 1) The allocation length field of the MODE SENSE(10) command is 16-bits,\n    occupying bytes 7 and 8 of the CDB. With this command, access to mode\n    pages larger than 255 bytes is thus possible. However, the CDB\n    allocation length field is set by assigning len to byte 8 only, thus\n    truncating buffer length larger than 255.\n\n 2) If scsi_mode_sense() is called with len smaller than 8 with\n    sdev->use_10_for_ms set, or smaller than 4 otherwise, the buffer length\n    is increased to 8 and 4 respectively, and the buffer is zero filled\n    with these increased values, thus corrupting the memory following the\n    buffer.\n\nFix these 2 problems by using put_unaligned_be16() to set the allocation\nlength field of MODE SENSE(10) CDB and by returning an error when len is\ntoo small.\n\nFurthermore, if len is larger than 255B, always try MODE SENSE(10) first,\neven if the device driver did not set sdev->use_10_for_ms. In case of\ninvalid opcode error for MODE SENSE(10), access to mode pages larger than\n255 bytes are not retried using MODE SENSE(6). To avoid buffer length\noverflows for the MODE_SENSE(10) case, check that len is smaller than 65535\nbytes.\n\nWhile at it, also fix the folowing:\n\n * Use get_unaligned_be16() to retrieve the mode data length and block\n   descriptor length fields of the mode sense reply header instead of using\n   an open coded calculation.\n\n * Fix the kdoc dbd argument explanation: the DBD bit stands for Disable\n   Block Descriptor, which is the opposite of what the dbd argument\n   description was.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7f62f094-790f-4e24-8b09-17bcf40938b2",  "id": "CVE-2021-3739",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3739"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the Linux Kernel, where triggering the bug requires ‘CAP_SYS_ADMIN’. This flaw allows a local attacker to crash the system or leak kernel internal information. The highest threat from this vulnerability is to system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e24efc7f-b237-4c77-be5e-5050df3ac615",  "id": "SUSE-SU-2026:22256-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "e52e445b-24d0-4150-822b-d76563b46e68",      "versions": [        {          "component": "sed",          "version": "4.0"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "989b1612-7de1-427d-8cab-df0bd228fc02",  "id": "CVE-2022-45886",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45886"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "39c49165-ad3a-47d3-af61-073bf20ec15e",  "id": "CVE-2019-19537",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19537"  },  "ratings": [    {      "score": 4.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a5f03b7-3abe-4a8c-a43c-3ab47b566446",  "id": "CVE-2024-50183",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance\n\nDeleting an NPIV instance requires all fabric ndlps to be released before\nan NPIV's resources can be torn down.  Failure to release fabric ndlps\nbeforehand opens kref imbalance race conditions.  Fix by forcing the DA_ID\nto complete synchronously with usage of wait_queue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a4293aa-a7c1-4fa3-9c74-19b3b9f4be85",  "id": "CVE-2022-36879",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36879"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18eea727-1f09-4d13-b599-99758b73b2ad",  "id": "SUSE-SU-2023:3820-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d47e6dd-2449-462e-be55-91693f71f7be",  "id": "CVE-2012-3412",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3412"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "The sfc (aka Solarflare Solarstorm) driver in the Linux kernel before 3.2.30 allows remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a86a2f35-5b73-44d9-acb9-0296217f312f",  "id": "CVE-2024-42311",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()\n\nSyzbot reports uninitialized value access issue as below:\n\nloop0: detected capacity change from 0 to 64\n=====================================================\nBUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30\n hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30\n d_revalidate fs/namei.c:862 [inline]\n lookup_fast+0x89e/0x8e0 fs/namei.c:1649\n walk_component fs/namei.c:2001 [inline]\n link_path_walk+0x817/0x1480 fs/namei.c:2332\n path_lookupat+0xd9/0x6f0 fs/namei.c:2485\n filename_lookup+0x22e/0x740 fs/namei.c:2515\n user_path_at_empty+0x8b/0x390 fs/namei.c:2924\n user_path_at include/linux/namei.h:57 [inline]\n do_mount fs/namespace.c:3689 [inline]\n __do_sys_mount fs/namespace.c:3898 [inline]\n __se_sys_mount+0x66b/0x810 fs/namespace.c:3875\n __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nBUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline]\nBUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366\n hfs_ext_read_extent fs/hfs/extent.c:196 [inline]\n hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366\n block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271\n hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39\n filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426\n do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553\n do_read_cache_page mm/filemap.c:3595 [inline]\n read_cache_page+0xfb/0x2f0 mm/filemap.c:3604\n read_mapping_page include/linux/pagemap.h:755 [inline]\n hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78\n hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204\n hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406\n mount_bdev+0x628/0x920 fs/super.c:1359\n hfs_mount+0xcd/0xe0 fs/hfs/super.c:456\n legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610\n vfs_get_tree+0xdc/0x5d0 fs/super.c:1489\n do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145\n path_mount+0xf98/0x26a0 fs/namespace.c:3475\n do_mount fs/namespace.c:3488 [inline]\n __do_sys_mount fs/namespace.c:3697 [inline]\n __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674\n __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674\n do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]\n __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178\n do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203\n do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246\n entry_SYSENTER_compat_after_hwframe+0x70/0x82\n\nUninit was created at:\n __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590\n __alloc_pages_node include/linux/gfp.h:238 [inline]\n alloc_pages_node include/linux/gfp.h:261 [inline]\n alloc_slab_page mm/slub.c:2190 [inline]\n allocate_slab mm/slub.c:2354 [inline]\n new_slab+0x2d7/0x1400 mm/slub.c:2407\n ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540\n __slab_alloc mm/slub.c:3625 [inline]\n __slab_alloc_node mm/slub.c:3678 [inline]\n slab_alloc_node mm/slub.c:3850 [inline]\n kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879\n alloc_inode_sb include/linux/fs.h:3018 [inline]\n hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165\n alloc_inode+0x83/0x440 fs/inode.c:260\n new_inode_pseudo fs/inode.c:1005 [inline]\n new_inode+0x38/0x4f0 fs/inode.c:1031\n hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186\n hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228\n vfs_mkdir+0x49a/0x700 fs/namei.c:4126\n do_mkdirat+0x529/0x810 fs/namei.c:4149\n __do_sys_mkdirat fs/namei.c:4164 [inline]\n __se_sys_mkdirat fs/namei.c:4162 [inline]\n __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nIt missed to initialize .tz_secondswest, .cached_start and .cached_blocks\nfields in struct hfs_inode_info after hfs_alloc_inode(), fix it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6d830022-6e14-454b-93de-ac91612688a3",  "id": "CVE-2016-0704",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0704"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "387a936e-be14-43a5-8fc5-19e8cc62cfa9",  "id": "CVE-2015-4692",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4692"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fea83049-a8d9-468c-8b53-362dc7e7078f",  "id": "CVE-2015-8964",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8964"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel before 4.5 allows local users to obtain sensitive information from kernel memory by reading a tty data structure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "03abeb9c-f2f9-491d-9449-908f5ef18007",  "id": "CVE-2015-3331",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3331"  },  "ratings": [    {      "score": 9.300000000000001,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "82efd166-11f0-46f9-aaf8-e198b307b6fd",  "id": "CVE-2020-25682",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25682"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    122,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in dnsmasq before 2.83. A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in the rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths, it is possible extract_name() gets passed an offset from the base buffer, thus reducing, in practice, the number of available bytes that can be written in the buffer. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "46d9ba7c-2fcb-4143-a622-83f9ae6435d6",  "id": "CVE-2022-49821",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: fix possible memory leak in mISDN_dsp_element_register()\n\nAfer commit 1fa5ae857bb1 (\"driver core: get rid of struct device's\nbus_id string array\"), the name of device is allocated dynamically,\nuse put_device() to give up the reference, so that the name can be\nfreed in kobject_cleanup() when the refcount is 0.\n\nThe 'entry' is going to be freed in mISDN_dsp_dev_release(), so the\nkfree() is removed. list_del() is called in mISDN_dsp_dev_release(),\nso it need be initialized.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "25c70efa-29ce-42b4-914c-4acaaec19290",  "id": "CVE-2024-58005",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Change to kvalloc() in eventlog/acpi.c\n\nThe following failure was reported on HPE ProLiant D320:\n\n[   10.693310][    T1] tpm_tis STM0925:00: 2.0 TPM (device-id 0x3, rev-id 0)\n[   10.848132][    T1] ------------[ cut here ]------------\n[   10.853559][    T1] WARNING: CPU: 59 PID: 1 at mm/page_alloc.c:4727 __alloc_pages_noprof+0x2ca/0x330\n[   10.862827][    T1] Modules linked in:\n[   10.866671][    T1] CPU: 59 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-lp155.2.g52785e2-default #1 openSUSE Tumbleweed (unreleased) 588cd98293a7c9eba9013378d807364c088c9375\n[   10.882741][    T1] Hardware name: HPE ProLiant DL320 Gen12/ProLiant DL320 Gen12, BIOS 1.20 10/28/2024\n[   10.892170][    T1] RIP: 0010:__alloc_pages_noprof+0x2ca/0x330\n[   10.898103][    T1] Code: 24 08 e9 4a fe ff ff e8 34 36 fa ff e9 88 fe ff ff 83 fe 0a 0f 86 b3 fd ff ff 80 3d 01 e7 ce 01 00 75 09 c6 05 f8 e6 ce 01 01 <0f> 0b 45 31 ff e9 e5 fe ff ff f7 c2 00 00 08 00 75 42 89 d9 80 e1\n[   10.917750][    T1] RSP: 0000:ffffb7cf40077980 EFLAGS: 00010246\n[   10.923777][    T1] RAX: 0000000000000000 RBX: 0000000000040cc0 RCX: 0000000000000000\n[   10.931727][    T1] RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000040cc0\n\nThe above transcript shows that ACPI pointed a 16 MiB buffer for the log\nevents because RSI maps to the 'order' parameter of __alloc_pages_noprof().\nAddress the bug by moving from devm_kmalloc() to devm_add_action() and\nkvmalloc() and devm_add_action().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7a74ba7b-2843-4e37-b426-66e5c97c95e5",  "id": "CVE-2013-2147",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2147"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device, related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32 command for a /dev/cciss device, related to the cciss_ioctl32_passthru function in drivers/block/cciss.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eafd64e2-1b1d-4549-b7c0-0a2ddc567f26",  "id": "CVE-2021-3483",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3483"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions before kernel 5.12-rc6 are affected",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9364f1b5-5a45-4e00-bb48-45f8549760e6",  "id": "CVE-2024-49897",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check phantom_stream before it is used\n\ndcn32_enable_phantom_stream can return null, so returned value\nmust be checked before used.\n\nThis fixes 1 NULL_RETURNS issue reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7730c98e-25fb-4e22-a280-cf2214459724",  "id": "CVE-2024-49915",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn32_init_hw` function. The issue could occur when `dc->clk_mgr` is\nnull.\n\nThe fix adds a check to ensure `dc->clk_mgr` is not null before\naccessing its functions. This prevents a potential null pointer\ndereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn32/dcn32_hwseq.c:961 dcn32_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 782)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "71315761-3512-4b49-a254-37a57f6c779c",  "id": "CVE-2025-23163",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: vlan: don't propagate flags on open\n\nWith the device instance lock, there is now a possibility of a deadlock:\n\n[    1.211455] ============================================\n[    1.211571] WARNING: possible recursive locking detected\n[    1.211687] 6.14.0-rc5-01215-g032756b4ca7a-dirty #5 Not tainted\n[    1.211823] --------------------------------------------\n[    1.211936] ip/184 is trying to acquire lock:\n[    1.212032] ffff8881024a4c30 (&dev->lock){+.+.}-{4:4}, at: dev_set_allmulti+0x4e/0xb0\n[    1.212207]\n[    1.212207] but task is already holding lock:\n[    1.212332] ffff8881024a4c30 (&dev->lock){+.+.}-{4:4}, at: dev_open+0x50/0xb0\n[    1.212487]\n[    1.212487] other info that might help us debug this:\n[    1.212626]  Possible unsafe locking scenario:\n[    1.212626]\n[    1.212751]        CPU0\n[    1.212815]        ----\n[    1.212871]   lock(&dev->lock);\n[    1.212944]   lock(&dev->lock);\n[    1.213016]\n[    1.213016]  *** DEADLOCK ***\n[    1.213016]\n[    1.213143]  May be due to missing lock nesting notation\n[    1.213143]\n[    1.213294] 3 locks held by ip/184:\n[    1.213371]  #0: ffffffff838b53e0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock+0x1b/0xa0\n[    1.213543]  #1: ffffffff84e5fc70 (&net->rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock+0x37/0xa0\n[    1.213727]  #2: ffff8881024a4c30 (&dev->lock){+.+.}-{4:4}, at: dev_open+0x50/0xb0\n[    1.213895]\n[    1.213895] stack backtrace:\n[    1.213991] CPU: 0 UID: 0 PID: 184 Comm: ip Not tainted 6.14.0-rc5-01215-g032756b4ca7a-dirty #5\n[    1.213993] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014\n[    1.213994] Call Trace:\n[    1.213995]  <TASK>\n[    1.213996]  dump_stack_lvl+0x8e/0xd0\n[    1.214000]  print_deadlock_bug+0x28b/0x2a0\n[    1.214020]  lock_acquire+0xea/0x2a0\n[    1.214027]  __mutex_lock+0xbf/0xd40\n[    1.214038]  dev_set_allmulti+0x4e/0xb0 # real_dev->flags & IFF_ALLMULTI\n[    1.214040]  vlan_dev_open+0xa5/0x170 # ndo_open on vlandev\n[    1.214042]  __dev_open+0x145/0x270\n[    1.214046]  __dev_change_flags+0xb0/0x1e0\n[    1.214051]  netif_change_flags+0x22/0x60 # IFF_UP vlandev\n[    1.214053]  dev_change_flags+0x61/0xb0 # for each device in group from dev->vlan_info\n[    1.214055]  vlan_device_event+0x766/0x7c0 # on netdevsim0\n[    1.214058]  notifier_call_chain+0x78/0x120\n[    1.214062]  netif_open+0x6d/0x90\n[    1.214064]  dev_open+0x5b/0xb0 # locks netdevsim0\n[    1.214066]  bond_enslave+0x64c/0x1230\n[    1.214075]  do_set_master+0x175/0x1e0 # on netdevsim0\n[    1.214077]  do_setlink+0x516/0x13b0\n[    1.214094]  rtnl_newlink+0xaba/0xb80\n[    1.214132]  rtnetlink_rcv_msg+0x440/0x490\n[    1.214144]  netlink_rcv_skb+0xeb/0x120\n[    1.214150]  netlink_unicast+0x1f9/0x320\n[    1.214153]  netlink_sendmsg+0x346/0x3f0\n[    1.214157]  __sock_sendmsg+0x86/0xb0\n[    1.214160]  ____sys_sendmsg+0x1c8/0x220\n[    1.214164]  ___sys_sendmsg+0x28f/0x2d0\n[    1.214179]  __x64_sys_sendmsg+0xef/0x140\n[    1.214184]  do_syscall_64+0xec/0x1d0\n[    1.214190]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[    1.214191] RIP: 0033:0x7f2d1b4a7e56\n\nDevice setup:\n\n     netdevsim0 (down)\n     ^        ^\n  bond        netdevsim1.100@netdevsim1 allmulticast=on (down)\n\nWhen we enslave the lower device (netdevsim0) which has a vlan, we\npropagate vlan's allmuti/promisc flags during ndo_open. This causes\n(re)locking on of the real_dev.\n\nPropagate allmulti/promisc on flags change, not on the open. There\nis a slight semantics change that vlans that are down now propagate\nthe flags, but this seems unlikely to result in the real issues.\n\nReproducer:\n\n  echo 0 1 > /sys/bus/netdevsim/new_device\n\n  dev_path=$(ls -d /sys/bus/netdevsim/devices/netdevsim0/net/*)\n  dev=$(echo $dev_path | rev | cut -d/ -f1 | rev)\n\n  ip link set dev $dev name netdevsim0\n  ip link set dev netdevsim0 up\n\n  ip link add link netdevsim0 name netdevsim0.100 type vlan id 100\n  ip link set dev netdevsim0.100 allm\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51b18701-59be-4da1-97eb-83e28206dfc1",  "id": "CVE-2023-0458",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0458"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or commit 739790605705ddcf18f21782b9c99ad7d53a8c11",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6f58687b-9666-4203-ace8-f585d768c3a1",  "id": "CVE-2013-3232",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3232"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c17cc9c8-a7e3-47aa-b30a-7f92fa87abda",  "id": "CLSA-2026-1777552800",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "667b1878-e8ff-452d-bdf6-894347577d57",  "id": "CVE-2013-4220",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4220"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The bad_mode function in arch/arm64/kernel/traps.c in the Linux kernel before 3.9.5 on the ARM64 platform allows local users to cause a denial of service (system crash) via vectors involving an attempted register access that triggers an unexpected value in the Exception Syndrome Register (ESR).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee69002c-1849-4b14-9497-297ea0ef1a5c",  "id": "CVE-2024-38582",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential hang in nilfs_detach_log_writer()\n\nSyzbot has reported a potential hang in nilfs_detach_log_writer() called\nduring nilfs2 unmount.\n\nAnalysis revealed that this is because nilfs_segctor_sync(), which\nsynchronizes with the log writer thread, can be called after\nnilfs_segctor_destroy() terminates that thread, as shown in the call trace\nbelow:\n\nnilfs_detach_log_writer\n  nilfs_segctor_destroy\n    nilfs_segctor_kill_thread  --> Shut down log writer thread\n    flush_work\n      nilfs_iput_work_func\n        nilfs_dispose_list\n          iput\n            nilfs_evict_inode\n              nilfs_transaction_commit\n                nilfs_construct_segment (if inode needs sync)\n                  nilfs_segctor_sync  --> Attempt to synchronize with\n                                          log writer thread\n                           *** DEADLOCK ***\n\nFix this issue by changing nilfs_segctor_sync() so that the log writer\nthread returns normally without synchronizing after it terminates, and by\nforcing tasks that are already waiting to complete once after the thread\nterminates.\n\nThe skipped inode metadata flushout will then be processed together in the\nsubsequent cleanup work in nilfs_segctor_destroy().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "86c8076f-d35f-4282-a9b9-debc95f78f67",  "id": "CVE-2024-40960",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent possible NULL dereference in rt6_probe()\n\nsyzbot caught a NULL dereference in rt6_probe() [1]\n\nBail out if  __in6_dev_get() returns NULL.\n\n[1]\nOops: general protection fault, probably for non-canonical address 0xdffffc00000000cb: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000658-0x000000000000065f]\nCPU: 1 PID: 22444 Comm: syz-executor.0 Not tainted 6.10.0-rc2-syzkaller-00383-gb8481381d4e2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\n RIP: 0010:rt6_probe net/ipv6/route.c:656 [inline]\n RIP: 0010:find_match+0x8c4/0xf50 net/ipv6/route.c:758\nCode: 14 fd f7 48 8b 85 38 ff ff ff 48 c7 45 b0 00 00 00 00 48 8d b8 5c 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 19\nRSP: 0018:ffffc900034af070 EFLAGS: 00010203\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90004521000\nRDX: 00000000000000cb RSI: ffffffff8990d0cd RDI: 000000000000065c\nRBP: ffffc900034af150 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000002 R12: 000000000000000a\nR13: 1ffff92000695e18 R14: ffff8880244a1d20 R15: 0000000000000000\nFS:  00007f4844a5a6c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b31b27000 CR3: 000000002d42c000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n  rt6_nh_find_match+0xfa/0x1a0 net/ipv6/route.c:784\n  nexthop_for_each_fib6_nh+0x26d/0x4a0 net/ipv4/nexthop.c:1496\n  __find_rr_leaf+0x6e7/0xe00 net/ipv6/route.c:825\n  find_rr_leaf net/ipv6/route.c:853 [inline]\n  rt6_select net/ipv6/route.c:897 [inline]\n  fib6_table_lookup+0x57e/0xa30 net/ipv6/route.c:2195\n  ip6_pol_route+0x1cd/0x1150 net/ipv6/route.c:2231\n  pol_lookup_func include/net/ip6_fib.h:616 [inline]\n  fib6_rule_lookup+0x386/0x720 net/ipv6/fib6_rules.c:121\n  ip6_route_output_flags_noref net/ipv6/route.c:2639 [inline]\n  ip6_route_output_flags+0x1d0/0x640 net/ipv6/route.c:2651\n  ip6_dst_lookup_tail.constprop.0+0x961/0x1760 net/ipv6/ip6_output.c:1147\n  ip6_dst_lookup_flow+0x99/0x1d0 net/ipv6/ip6_output.c:1250\n  rawv6_sendmsg+0xdab/0x4340 net/ipv6/raw.c:898\n  inet_sendmsg+0x119/0x140 net/ipv4/af_inet.c:853\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  sock_write_iter+0x4b8/0x5c0 net/socket.c:1160\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0x6b6/0x1140 fs/read_write.c:590\n  ksys_write+0x1f8/0x260 fs/read_write.c:643\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "beeef0d0-8aa4-423c-ad6d-ad20513b8628",  "id": "CVE-2020-11669",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11669"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka CID-53a712bae5dd.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cf4c212e-ca5b-4858-8e55-7ff98abdd9c3",  "id": "CVE-2022-49572",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_slow_start_after_idle.\n\nWhile reading sysctl_tcp_slow_start_after_idle, it can be changed\nconcurrently.  Thus, we need to add READ_ONCE() to its readers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "13df89ac-9cb9-49e1-9566-3e4d01dbec70",  "id": "CVE-2011-3638",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3638"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/ext4/extents.c in the Linux kernel before 3.0 does not mark a modified extent as dirty in certain cases of extent splitting, which allows local users to cause a denial of service (system crash) via vectors involving ext4 umount and mount operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "605bc3e9-c82f-41e7-83d1-918cd7c6c292",  "id": "CVE-2018-14616",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14616"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference in fscrypt_do_page_crypto() in fs/crypto/crypto.c when operating on a file in a corrupted f2fs image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3718fa64-7f4f-4935-a153-df055d1ebab8",  "id": "CVE-2023-52640",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix oob in ntfs_listxattr\n\nThe length of name cannot exceed the space occupied by ea.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31471899-89de-441c-bbe4-97eac87b317f",  "id": "CVE-2015-5307",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5307"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b5e6313-671e-46f1-a0f6-111067dc717b",  "id": "CVE-2013-4127",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4127"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Use-after-free vulnerability in the vhost_net_set_backend function in drivers/vhost/net.c in the Linux kernel through 3.10.3 allows local users to cause a denial of service (OOPS and system crash) via vectors involving powering on a virtual machine.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5cece179-2b32-433a-bf7c-dfd57ee557af",  "id": "CVE-2022-24959",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24959"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9848e342-d308-4e78-8691-dd7ea5fbe6a3",  "id": "SUSE-SU-2015:2230-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "09649f27-ee04-4153-8495-b4a693ce2623",  "id": "CVE-2017-10911",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10911"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka XSA-216.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c3f527d-deff-426b-9fb3-ed92faa861d5",  "id": "CVE-2017-1000407",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000407"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    754  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "956bf1fb-03ac-4ccd-845f-a38535cf8cd7",  "id": "CVE-2025-38530",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: pcl812: Fix bit shift out of bounds\n\nWhen checking for a supported IRQ number, the following test is used:\n\n\tif ((1 << it->options[1]) & board->irq_bits) {\n\nHowever, `it->options[i]` is an unchecked `int` value from userspace, so\nthe shift amount could be negative or out of bounds.  Fix the test by\nrequiring `it->options[1]` to be within bounds before proceeding with\nthe original test.  Valid `it->options[1]` values that select the IRQ\nwill be in the range [1,15]. The value 0 explicitly disables the use of\ninterrupts.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0f3ee19e-b6e7-4b01-a78f-a1781809c9f1",  "id": "CVE-2017-2618",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2618"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    193,    682  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a6c120d-24fa-4aee-acc3-4a525d330091",  "id": "CVE-2024-43883",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: vhci-hcd: Do not drop references before new references are gained\n\nAt a few places the driver carries stale pointers\nto references that can still be used. Make sure that does not happen.\nThis strictly speaking closes ZDI-CAN-22273, though there may be\nsimilar races in the driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3999a23c-ffe6-47e2-b2ad-93c2e91a5601",  "id": "CVE-2020-25284",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25284"  },  "ratings": [    {      "score": 4.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    863  ],  "analysis": {    "state": "in_triage"  },  "description": "The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices, aka CID-f44d04e696fe.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5481ec4c-d16f-4f00-a407-e64df9c62ad5",  "id": "CVE-2022-2905",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2905"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "62440e93-9be6-4192-8b99-2aebb49f5dad",  "id": "CVE-2022-49447",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: hisi: Add missing of_node_put after of_find_compatible_node\n\nof_find_compatible_node  will increment the refcount of the returned\ndevice_node. Calling of_node_put() to avoid the refcount leak",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b10c86f0-7870-4121-9422-dedd0a7f7fb7",  "id": "CVE-2021-38209",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38209"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    203  ],  "analysis": {    "state": "in_triage"  },  "description": "net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "937db443-f78a-4d73-a7dd-d62996290d6b",  "id": "CVE-2024-57890",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/uverbs: Prevent integer overflow issue\n\nIn the expression \"cmd.wqe_size * cmd.wr_count\", both variables are u32\nvalues that come from the user so the multiplication can lead to integer\nwrapping.  Then we pass the result to uverbs_request_next_ptr() which also\ncould potentially wrap.  The \"cmd.sge_count * sizeof(struct ib_uverbs_sge)\"\nmultiplication can also overflow on 32bit systems although it's fine on\n64bit systems.\n\nThis patch does two things.  First, I've re-arranged the condition in\nuverbs_request_next_ptr() so that the use controlled variable \"len\" is on\none side of the comparison by itself without any math.  Then I've modified\nall the callers to use size_mul() for the multiplications.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cc332689-a817-48e2-a77d-0824da8c0756",  "id": "CVE-2019-11810",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11810"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This causes a Denial of Service, related to a use-after-free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4ddbe1ce-f6bd-462a-83ac-3ee8598e57ce",  "id": "CVE-2021-47405",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47405"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: usbhid: free raw_report buffers in usbhid_stop\n\nFree the unsent raw_report buffers when the device is removed.\n\nFixes a memory leak reported by syzbot at:\nhttps://syzkaller.appspot.com/bug?id=7b4fa7cb1a7c2d3342a2a8a6c53371c8c418ab47",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ee8dd62-5072-4e42-b6c0-cd15509ab6ba",  "id": "CVE-2019-19947",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19947"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d3fc5b5-1018-45d4-9e83-3c23ca049abc",  "id": "CVE-2025-37877",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: Clear iommu-dma ops on cleanup\n\nIf iommu_device_register() encounters an error, it can end up tearing\ndown already-configured groups and default domains, however this\ncurrently still leaves devices hooked up to iommu-dma (and even\nhistorically the behaviour in this area was at best inconsistent across\narchitectures/drivers...) Although in the case that an IOMMU is present\nwhose driver has failed to probe, users cannot necessarily expect DMA to\nwork anyway, it's still arguable that we should do our best to put\nthings back as if the IOMMU driver was never there at all, and certainly\nthe potential for crashing in iommu-dma itself is undesirable. Make sure\nwe clean up the dev->dma_iommu flag along with everything else.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b0499f4b-b710-4602-aafe-ae089dcd3a25",  "id": "CVE-2024-56616",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp_mst: Fix MST sideband message body length check\n\nFix the MST sideband message body length check, which must be at least 1\nbyte accounting for the message body CRC (aka message data CRC) at the\nend of the message.\n\nThis fixes a case where an MST branch device returns a header with a\ncorrect header CRC (indicating a correctly received body length), with\nthe body length being incorrectly set to 0. This will later lead to a\nmemory corruption in drm_dp_sideband_append_payload() and the following\nerrors in dmesg:\n\n   UBSAN: array-index-out-of-bounds in drivers/gpu/drm/display/drm_dp_mst_topology.c:786:25\n   index -1 is out of range for type 'u8 [48]'\n   Call Trace:\n    drm_dp_sideband_append_payload+0x33d/0x350 [drm_display_helper]\n    drm_dp_get_one_sb_msg+0x3ce/0x5f0 [drm_display_helper]\n    drm_dp_mst_hpd_irq_handle_event+0xc8/0x1580 [drm_display_helper]\n\n   memcpy: detected field-spanning write (size 18446744073709551615) of single field \"&msg->msg[msg->curlen]\" at drivers/gpu/drm/display/drm_dp_mst_topology.c:791 (size 256)\n   Call Trace:\n    drm_dp_sideband_append_payload+0x324/0x350 [drm_display_helper]\n    drm_dp_get_one_sb_msg+0x3ce/0x5f0 [drm_display_helper]\n    drm_dp_mst_hpd_irq_handle_event+0xc8/0x1580 [drm_display_helper]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e049a5fa-89c3-452a-893c-a46bc8c8e197",  "id": "ROOT-OS-ALPINE-315-CVE-2026-28387",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7f2d5383-2df5-47ea-9a99-eb6c3a534c02",  "id": "CVE-2021-47435",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47435"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix mempool NULL pointer race when completing IO\n\ndm_io_dec_pending() calls end_io_acct() first and will then dec md\nin-flight pending count. But if a task is swapping DM table at same\ntime this can result in a crash due to mempool->elements being NULL:\n\ntask1                             task2\ndo_resume\n ->do_suspend\n  ->dm_wait_for_completion\n                                  bio_endio\n\t\t\t\t   ->clone_endio\n\t\t\t\t    ->dm_io_dec_pending\n\t\t\t\t     ->end_io_acct\n\t\t\t\t      ->wakeup task1\n ->dm_swap_table\n  ->__bind\n   ->__bind_mempools\n    ->bioset_exit\n     ->mempool_exit\n                                     ->free_io\n\n[ 67.330330] Unable to handle kernel NULL pointer dereference at\nvirtual address 0000000000000000\n......\n[ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO)\n[ 67.330510] pc : mempool_free+0x70/0xa0\n[ 67.330515] lr : mempool_free+0x4c/0xa0\n[ 67.330520] sp : ffffff8008013b20\n[ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004\n[ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8\n[ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800\n[ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800\n[ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80\n[ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c\n[ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd\n[ 67.330563] x15: 000000000093b41e x14: 0000000000000010\n[ 67.330569] x13: 0000000000007f7a x12: 0000000034155555\n[ 67.330574] x11: 0000000000000001 x10: 0000000000000001\n[ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000\n[ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a\n[ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001\n[ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8\n[ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970\n[ 67.330609] Call trace:\n[ 67.330616] mempool_free+0x70/0xa0\n[ 67.330627] bio_put+0xf8/0x110\n[ 67.330638] dec_pending+0x13c/0x230\n[ 67.330644] clone_endio+0x90/0x180\n[ 67.330649] bio_endio+0x198/0x1b8\n[ 67.330655] dec_pending+0x190/0x230\n[ 67.330660] clone_endio+0x90/0x180\n[ 67.330665] bio_endio+0x198/0x1b8\n[ 67.330673] blk_update_request+0x214/0x428\n[ 67.330683] scsi_end_request+0x2c/0x300\n[ 67.330688] scsi_io_completion+0xa0/0x710\n[ 67.330695] scsi_finish_command+0xd8/0x110\n[ 67.330700] scsi_softirq_done+0x114/0x148\n[ 67.330708] blk_done_softirq+0x74/0xd0\n[ 67.330716] __do_softirq+0x18c/0x374\n[ 67.330724] irq_exit+0xb4/0xb8\n[ 67.330732] __handle_domain_irq+0x84/0xc0\n[ 67.330737] gic_handle_irq+0x148/0x1b0\n[ 67.330744] el1_irq+0xe8/0x190\n[ 67.330753] lpm_cpuidle_enter+0x4f8/0x538\n[ 67.330759] cpuidle_enter_state+0x1fc/0x398\n[ 67.330764] cpuidle_enter+0x18/0x20\n[ 67.330772] do_idle+0x1b4/0x290\n[ 67.330778] cpu_startup_entry+0x20/0x28\n[ 67.330786] secondary_start_kernel+0x160/0x170\n\nFix this by:\n1) Establishing pointers to 'struct dm_io' members in\ndm_io_dec_pending() so that they may be passed into end_io_acct()\n_after_ free_io() is called.\n2) Moving end_io_acct() after free_io().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f68a5d92-ce5e-495d-8618-df07b79f23dc",  "id": "CVE-2023-52750",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer\n\nPrior to LLVM 15.0.0, LLVM's integrated assembler would incorrectly\nbyte-swap NOP when compiling for big-endian, and the resulting series of\nbytes happened to match the encoding of FNMADD S21, S30, S0, S0.\n\nThis went unnoticed until commit:\n\n  34f66c4c4d5518c1 (\"arm64: Use a positive cpucap for FP/SIMD\")\n\nPrior to that commit, the kernel would always enable the use of FPSIMD\nearly in boot when __cpu_setup() initialized CPACR_EL1, and so usage of\nFNMADD within the kernel was not detected, but could result in the\ncorruption of user or kernel FPSIMD state.\n\nAfter that commit, the instructions happen to trap during boot prior to\nFPSIMD being detected and enabled, e.g.\n\n| Unhandled 64-bit el1h sync exception on CPU0, ESR 0x000000001fe00000 -- ASIMD\n| CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1\n| Hardware name: linux,dummy-virt (DT)\n| pstate: 400000c9 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n| pc : __pi_strcmp+0x1c/0x150\n| lr : populate_properties+0xe4/0x254\n| sp : ffffd014173d3ad0\n| x29: ffffd014173d3af0 x28: fffffbfffddffcb8 x27: 0000000000000000\n| x26: 0000000000000058 x25: fffffbfffddfe054 x24: 0000000000000008\n| x23: fffffbfffddfe000 x22: fffffbfffddfe000 x21: fffffbfffddfe044\n| x20: ffffd014173d3b70 x19: 0000000000000001 x18: 0000000000000005\n| x17: 0000000000000010 x16: 0000000000000000 x15: 00000000413e7000\n| x14: 0000000000000000 x13: 0000000000001bcc x12: 0000000000000000\n| x11: 00000000d00dfeed x10: ffffd414193f2cd0 x9 : 0000000000000000\n| x8 : 0101010101010101 x7 : ffffffffffffffc0 x6 : 0000000000000000\n| x5 : 0000000000000000 x4 : 0101010101010101 x3 : 000000000000002a\n| x2 : 0000000000000001 x1 : ffffd014171f2988 x0 : fffffbfffddffcb8\n| Kernel panic - not syncing: Unhandled exception\n| CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1\n| Hardware name: linux,dummy-virt (DT)\n| Call trace:\n|  dump_backtrace+0xec/0x108\n|  show_stack+0x18/0x2c\n|  dump_stack_lvl+0x50/0x68\n|  dump_stack+0x18/0x24\n|  panic+0x13c/0x340\n|  el1t_64_irq_handler+0x0/0x1c\n|  el1_abort+0x0/0x5c\n|  el1h_64_sync+0x64/0x68\n|  __pi_strcmp+0x1c/0x150\n|  unflatten_dt_nodes+0x1e8/0x2d8\n|  __unflatten_device_tree+0x5c/0x15c\n|  unflatten_device_tree+0x38/0x50\n|  setup_arch+0x164/0x1e0\n|  start_kernel+0x64/0x38c\n|  __primary_switched+0xbc/0xc4\n\nRestrict CONFIG_CPU_BIG_ENDIAN to a known good assembler, which is\neither GNU as or LLVM's IAS 15.0.0 and newer, which contains the linked\ncommit.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f79cb03a-c69b-43d0-be58-bb94e4b1cc45",  "id": "SUSE-SU-2019:1721-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bfabb942-d958-454a-992b-dba8b01f9b7f",  "id": "CVE-2022-49932",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace\n\nCall kvm_init() only after _all_ setup is complete, as kvm_init() exposes\n/dev/kvm to userspace and thus allows userspace to create VMs (and call\nother ioctls).  E.g. KVM will encounter a NULL pointer when attempting to\nadd a vCPU to the per-CPU loaded_vmcss_on_cpu list if userspace is able to\ncreate a VM before vmx_init() configures said list.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 0 P4D 0\n Oops: 0002 [#1] SMP\n CPU: 6 PID: 1143 Comm: stable Not tainted 6.0.0-rc7+ #988\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:vmx_vcpu_load_vmcs+0x68/0x230 [kvm_intel]\n  <TASK>\n  vmx_vcpu_load+0x16/0x60 [kvm_intel]\n  kvm_arch_vcpu_load+0x32/0x1f0 [kvm]\n  vcpu_load+0x2f/0x40 [kvm]\n  kvm_arch_vcpu_create+0x231/0x310 [kvm]\n  kvm_vm_ioctl+0x79f/0xe10 [kvm]\n  ? handle_mm_fault+0xb1/0x220\n  __x64_sys_ioctl+0x80/0xb0\n  do_syscall_64+0x2b/0x50\n  entry_SYSCALL_64_after_hwframe+0x46/0xb0\n RIP: 0033:0x7f5a6b05743b\n  </TASK>\n Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel(+) kvm irqbypass",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5d79c67b-c0fb-40b7-94ef-dc748dc996c3",  "id": "CVE-2025-23161",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type\n\nThe access to the PCI config space via pci_ops::read and pci_ops::write is\na low-level hardware access. The functions can be accessed with disabled\ninterrupts even on PREEMPT_RT. The pci_lock is a raw_spinlock_t for this\npurpose.\n\nA spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be\nacquired with disabled interrupts. The vmd_dev::cfg_lock is accessed in\nthe same context as the pci_lock.\n\nMake vmd_dev::cfg_lock a raw_spinlock_t type so it can be used with\ninterrupts disabled.\n\nThis was reported as:\n\n  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n  Call Trace:\n   rt_spin_lock+0x4e/0x130\n   vmd_pci_read+0x8d/0x100 [vmd]\n   pci_user_read_config_byte+0x6f/0xe0\n   pci_read_config+0xfe/0x290\n   sysfs_kf_bin_read+0x68/0x90\n\n[bigeasy: reword commit message]\nTested-off-by: Luis Claudio R. Goncalves <lgoncalv@redhat.com>\n[kwilczynski: commit log]\n[bhelgaas: add back report info from\nhttps://lore.kernel.org/lkml/20241218115951.83062-1-ryotkkr98@gmail.com/]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "37d754be-98d3-4b1b-b22b-b72af9d3ecf2",  "id": "CVE-2024-57875",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: RCU protect disk->conv_zones_bitmap\n\nEnsure that a disk revalidation changing the conventional zones bitmap\nof a disk does not cause invalid memory references when using the\ndisk_zone_is_conv() helper by RCU protecting the disk->conv_zones_bitmap\npointer.\n\ndisk_zone_is_conv() is modified to operate under the RCU read lock and\nthe function disk_set_conv_zones_bitmap() is added to update a disk\nconv_zones_bitmap pointer using rcu_replace_pointer() with the disk\nzone_wplugs_lock spinlock held.\n\ndisk_free_zone_resources() is modified to call\ndisk_update_zone_resources() with a NULL bitmap pointer to free the disk\nconv_zones_bitmap. disk_set_conv_zones_bitmap() is also used in\ndisk_update_zone_resources() to set the new (revalidated) bitmap and\nfree the old one.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5670ed42-ee52-47ad-822d-7b29e9739e4e",  "id": "CVE-2023-30772",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30772"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2986cc88-6bb6-42e9-a4a2-b57855004430",  "id": "CVE-2015-5157",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5157"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a0844d91-34c1-4df8-84b2-cf88892f7f3e",  "id": "CVE-2021-43976",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43976"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd6fbcc2-20f9-45eb-96dd-b79ca26b75e0",  "id": "CVE-2025-38071",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Check return value from memblock_phys_alloc_range()\n\nAt least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of\ncontiguous free memory available at this point, the kernel will crash\nand burn because memblock_phys_alloc_range() returns 0 on failure,\nwhich leads memblock_phys_free() to throw the first 4 MiB of physical\nmemory to the wolves.\n\nAt a minimum it should fail gracefully with a meaningful diagnostic,\nbut in fact everything seems to work fine without the weird reserve\nallocation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ca653992-7804-4f2d-80bf-b3cb3b797e7b",  "id": "CVE-2019-19055",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19055"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering nl80211hdr_put() failures, aka CID-1399c59fa929. NOTE: third parties dispute the relevance of this because it occurs on a code path where a successful allocation has already occurred",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c5f66f0f-96c5-48f9-b849-a13a76815187",  "id": "CVE-2010-4163",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4163"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 2.6.36.2 allows local users to cause a denial of service (panic) via a zero-length I/O request in a device ioctl to a SCSI device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cf899ec5-5ab8-438f-9e3c-730092992fe6",  "id": "CLSA-2023-1700593531",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "576a9968-3711-48c9-8cde-75091c5c181a",  "id": "CVE-2024-26699",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr\n\n[Why]\nThere is a potential memory access violation while\niterating through array of dcn35 clks.\n\n[How]\nLimit iteration per array size.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0f827d29-381c-4712-ae7c-ed2fc53d2c9f",  "id": "AZL-6352",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.2,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "535c57d1-8d49-44e3-8f02-f8a21f5231be",  "id": "CVE-2021-4203",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4203"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1430ea14-31ed-4e20-9eae-e7c12af7116a",  "id": "CVE-2012-2745",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2745"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "efa1b53c-e542-4039-a02e-e5ae2c5f9d38",  "id": "CVE-2023-52641",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame()\n\nIt is preferable to exit through the out: label because\ninternal debugging functions are located there.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f1dc465f-c950-4041-8da6-6ea19b1d835c",  "id": "CVE-2023-1998",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"    }  ],  "cwes": [    1303,    203  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line.\n\nThis happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:51384'"    }  ]},{  "bom-ref": "874e4865-5ed6-4911-be20-18fbe5dc403a",  "id": "CVE-2024-27043",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: edia: dvbdev: fix a use-after-free\n\nIn dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed\nin several error-handling paths. However, *pdvbdev is not set to NULL\nafter dvbdev's deallocation, causing use-after-frees in many places,\nfor example, in the following call chain:\n\nbudget_register\n  |-> dvb_dmxdev_init\n        |-> dvb_register_device\n  |-> dvb_dmxdev_release\n        |-> dvb_unregister_device\n              |-> dvb_remove_device\n                    |-> dvb_device_put\n                          |-> kref_put\n\nWhen calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in\ndvb_register_device) could point to memory that had been freed in\ndvb_register_device. Thereafter, this pointer is transferred to\nkref_put and triggering a use-after-free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c5d32ffe-fad6-4254-881e-2eaaae6e0948",  "id": "CVE-2022-42896",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42896"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim.\n\nWe recommend upgrading past commit   https://www.google.com/url  https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4 https://www.google.com/url ",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "74ac318e-8db6-4881-9810-e86867e07dcb",  "id": "CVE-2021-27364",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27364"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "da2c3ddf-f27d-4cd0-92b1-c2c1ba5109ca",  "id": "CVE-2014-8275",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8275"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eaa0002c-3a9e-4e08-bbc2-f2339f8f9ed3",  "id": "CVE-2020-35519",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35519"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c429cd5b-6b97-4182-8f0e-eaf9542509dc",  "id": "SUSE-SU-2019:14249-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b160f0e-92f2-412f-83c9-bcaf9add5264",  "id": "CVE-2024-35936",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()\n\nThe unhandled case in btrfs_relocate_sys_chunks() loop is a corruption,\nas it could be caused only by two impossible conditions:\n\n- at first the search key is set up to look for a chunk tree item, with\n  offset -1, this is an inexact search and the key->offset will contain\n  the correct offset upon a successful search, a valid chunk tree item\n  cannot have an offset -1\n\n- after first successful search, the found_key corresponds to a chunk\n  item, the offset is decremented by 1 before the next loop, it's\n  impossible to find a chunk item there due to alignment and size\n  constraints",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6bea3826-353b-4f3c-99a6-e52221967372",  "id": "CVE-2010-4248",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4248"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the __exit_signal function in kernel/exit.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors related to multithreaded exec, the use of a thread group leader in kernel/posix-cpu-timers.c, and the selection of a new thread group leader in the de_thread function in fs/exec.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a77ebc50-3780-4627-a707-aac1965e0b8d",  "id": "CVE-2013-4470",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4470"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9bbbea73-401a-4850-90dc-1826b414b886",  "id": "OESA-2024-2386",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bd7d6cc4-7d02-4418-847b-eb093edd980d",  "id": "CVE-2010-4165",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4165"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:16263'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:99147/Linux-Kernel-2.6-TCP_MAXSEG-Denial-Of-Service.html'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'PSS:98797/Linux-Kernel-2.6.37-Denial-Of-Service.html'"    }  ]},{  "bom-ref": "fe680798-4e75-493c-976e-c86cd0171721",  "id": "CVE-2024-24855",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24855"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aa00e21e-b41f-4e42-a5b9-e295c7f3b3a4",  "id": "OESA-2026-1544",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef888967-673d-4c74-9184-fe13534363f5",  "id": "CVE-2010-2066",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2066"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The mext_check_arguments function in fs/ext4/move_extent.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a MOVE_EXT ioctl call that specifies this file as a donor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04a33bca-264d-42c6-9804-40c1594a6a9e",  "id": "CVE-2012-4530",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4530"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle recursion, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:41767'"    }  ]},{  "bom-ref": "b57b8599-fdb4-43d5-9578-d5bdb0f32ae9",  "id": "CVE-2016-0823",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0823"  },  "ratings": [    {      "score": 4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive physical-address information by reading a pagemap file, aka Android internal bug 25739721.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a7eff32-1733-4a48-a07f-77b43794a1ef",  "id": "CVE-2015-3310",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3310"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.",  "affects": [    {      "ref": "73881d6c-a776-4513-80a9-27bcf656c60d",      "versions": [        {          "component": "point-to-point_protocol",          "version": "2.4.2b3"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "83a6f632-8aab-4098-9ae1-419f81b3ca8b",  "id": "CVE-2014-9888",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9888"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/arm/mm/dma-mapping.c in the Linux kernel before 3.13 on ARM platforms, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not prevent executable DMA mappings, which might allow local users to gain privileges via a crafted application, aka Android internal bug 28803642 and Qualcomm internal bug CR642735.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cff2b303-0b07-40ec-acaa-3a447279f5fd",  "id": "CVE-2026-43198",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    821  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix potential race in tcp_v6_syn_recv_sock()\n\nCode in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()\nis done too late.\n\nAfter tcp_v4_syn_recv_sock(), the child socket is already visible\nfrom TCP ehash table and other cpus might use it.\n\nSince newinet->pinet6 is still pointing to the listener ipv6_pinfo\nbad things can happen as syzbot found.\n\nMove the problematic code in tcp_v6_mapped_child_init()\nand call this new helper from tcp_v4_syn_recv_sock() before\nthe ehash insertion.\n\nThis allows the removal of one tcp_sync_mss(), since\ntcp_v4_syn_recv_sock() will call it with the correct\ncontext.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f384ec28-4177-4050-834c-b8d1c2441ead",  "id": "CVE-2019-3896",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3896"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service (DoS).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "436361d6-c76b-4036-afe5-a0ad8269c652",  "id": "CVE-2018-19406",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19406"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "kvm_pv_send_ipi in arch/x86/kvm/lapic.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where the apic map is uninitialized.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ec77545e-96a0-40d3-9b3e-9d9681966008",  "id": "OESA-2025-2486",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "86f60169-1d97-415d-be79-037c2b7a129c",  "id": "CVE-2024-46724",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number\n\nCheck the fb_channel_number range to avoid the array out-of-bounds\nread error",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3880687c-c4f3-4c68-827c-6aa13b9d5c0c",  "id": "CVE-2022-49288",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Fix races among concurrent prealloc proc writes\n\nWe have no protection against concurrent PCM buffer preallocation\nchanges via proc files, and it may potentially lead to UAF or some\nweird problem.  This patch applies the PCM open_mutex to the proc\nwrite operation for avoiding the racy proc writes and the PCM stream\nopen (and further operations).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd2ab882-2324-4346-9637-6b5709856f49",  "id": "RLSA-2024:7848",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f2d9fb3e-5a1a-4931-852d-28fe213e7f60",  "id": "CVE-2016-5400",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5400"  },  "ratings": [    {      "score": 4.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5058d8ce-8796-4c11-9a73-e77806da1884",  "id": "CVE-2024-26958",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: fix UAF in direct writes\n\nIn production we have been hitting the following warning consistently\n\n------------[ cut here ]------------\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0\nWorkqueue: nfsiod nfs_direct_write_schedule_work [nfs]\nRIP: 0010:refcount_warn_saturate+0x9c/0xe0\nPKRU: 55555554\nCall Trace:\n <TASK>\n ? __warn+0x9f/0x130\n ? refcount_warn_saturate+0x9c/0xe0\n ? report_bug+0xcc/0x150\n ? handle_bug+0x3d/0x70\n ? exc_invalid_op+0x16/0x40\n ? asm_exc_invalid_op+0x16/0x20\n ? refcount_warn_saturate+0x9c/0xe0\n nfs_direct_write_schedule_work+0x237/0x250 [nfs]\n process_one_work+0x12f/0x4a0\n worker_thread+0x14e/0x3b0\n ? ZSTD_getCParams_internal+0x220/0x220\n kthread+0xdc/0x120\n ? __btf_name_valid+0xa0/0xa0\n ret_from_fork+0x1f/0x30\n\nThis is because we're completing the nfs_direct_request twice in a row.\n\nThe source of this is when we have our commit requests to submit, we\nprocess them and send them off, and then in the completion path for the\ncommit requests we have\n\nif (nfs_commit_end(cinfo.mds))\n\tnfs_direct_write_complete(dreq);\n\nHowever since we're submitting asynchronous requests we sometimes have\none that completes before we submit the next one, so we end up calling\ncomplete on the nfs_direct_request twice.\n\nThe only other place we use nfs_generic_commit_list() is in\n__nfs_commit_inode, which wraps this call in a\n\nnfs_commit_begin();\nnfs_commit_end();\n\nWhich is a common pattern for this style of completion handling, one\nthat is also repeated in the direct code with get_dreq()/put_dreq()\ncalls around where we process events as well as in the completion paths.\n\nFix this by using the same pattern for the commit requests.\n\nBefore with my 200 node rocksdb stress running this warning would pop\nevery 10ish minutes.  With my patch the stress test has been running for\nseveral hours without popping.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bbf52299-dae4-4211-a2d8-050c364d7f5c",  "id": "CVE-2025-38229",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cxusb: no longer judge rbuf when the write fails\n\nsyzbot reported a uninit-value in cxusb_i2c_xfer. [1]\n\nOnly when the write operation of usb_bulk_msg() in dvb_usb_generic_rw()\nsucceeds and rlen is greater than 0, the read operation of usb_bulk_msg()\nwill be executed to read rlen bytes of data from the dvb device into the\nrbuf.\n\nIn this case, although rlen is 1, the write operation failed which resulted\nin the dvb read operation not being executed, and ultimately variable i was\nnot initialized.\n\n[1]\nBUG: KMSAN: uninit-value in cxusb_gpio_tuner drivers/media/usb/dvb-usb/cxusb.c:124 [inline]\nBUG: KMSAN: uninit-value in cxusb_i2c_xfer+0x153a/0x1a60 drivers/media/usb/dvb-usb/cxusb.c:196\n cxusb_gpio_tuner drivers/media/usb/dvb-usb/cxusb.c:124 [inline]\n cxusb_i2c_xfer+0x153a/0x1a60 drivers/media/usb/dvb-usb/cxusb.c:196\n __i2c_transfer+0xe25/0x3150 drivers/i2c/i2c-core-base.c:-1\n i2c_transfer+0x317/0x4a0 drivers/i2c/i2c-core-base.c:2315\n i2c_transfer_buffer_flags+0x125/0x1e0 drivers/i2c/i2c-core-base.c:2343\n i2c_master_send include/linux/i2c.h:109 [inline]\n i2cdev_write+0x210/0x280 drivers/i2c/i2c-dev.c:183\n do_loop_readv_writev fs/read_write.c:848 [inline]\n vfs_writev+0x963/0x14e0 fs/read_write.c:1057\n do_writev+0x247/0x5c0 fs/read_write.c:1101\n __do_sys_writev fs/read_write.c:1169 [inline]\n __se_sys_writev fs/read_write.c:1166 [inline]\n __x64_sys_writev+0x98/0xe0 fs/read_write.c:1166\n x64_sys_call+0x2229/0x3c80 arch/x86/include/generated/asm/syscalls_64.h:21\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d884b2f5-260f-44b5-8c89-54bccce499e3",  "id": "CVE-2023-53108",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: Fix size of interrupt data\n\niucv_irq_data needs to be 4 bytes larger.\nThese bytes are not used by the iucv module, but written by\nthe z/VM hypervisor in case a CPU is deconfigured.\n\nReported as:\nBUG dma-kmalloc-64 (Not tainted): kmalloc Redzone overwritten\n-----------------------------------------------------------------------------\n0x0000000000400564-0x0000000000400567 @offset=1380. First byte 0x80 instead of 0xcc\nAllocated in iucv_cpu_prepare+0x44/0xd0 age=167839 cpu=2 pid=1\n__kmem_cache_alloc_node+0x166/0x450\nkmalloc_node_trace+0x3a/0x70\niucv_cpu_prepare+0x44/0xd0\ncpuhp_invoke_callback+0x156/0x2f0\ncpuhp_issue_call+0xf0/0x298\n__cpuhp_setup_state_cpuslocked+0x136/0x338\n__cpuhp_setup_state+0xf4/0x288\niucv_init+0xf4/0x280\ndo_one_initcall+0x78/0x390\ndo_initcalls+0x11a/0x140\nkernel_init_freeable+0x25e/0x2a0\nkernel_init+0x2e/0x170\n__ret_from_fork+0x3c/0x58\nret_from_fork+0xa/0x40\nFreed in iucv_init+0x92/0x280 age=167839 cpu=2 pid=1\n__kmem_cache_free+0x308/0x358\niucv_init+0x92/0x280\ndo_one_initcall+0x78/0x390\ndo_initcalls+0x11a/0x140\nkernel_init_freeable+0x25e/0x2a0\nkernel_init+0x2e/0x170\n__ret_from_fork+0x3c/0x58\nret_from_fork+0xa/0x40\nSlab 0x0000037200010000 objects=32 used=30 fp=0x0000000000400640 flags=0x1ffff00000010200(slab|head|node=0|zone=0|\nObject 0x0000000000400540 @offset=1344 fp=0x0000000000000000\nRedzone  0000000000400500: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  ................\nRedzone  0000000000400510: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  ................\nRedzone  0000000000400520: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  ................\nRedzone  0000000000400530: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  ................\nObject   0000000000400540: 00 01 00 03 00 00 00 00 00 00 00 00 00 00 00 00  ................\nObject   0000000000400550: f3 86 81 f2 f4 82 f8 82 f0 f0 f0 f0 f0 f0 f0 f2  ................\nObject   0000000000400560: 00 00 00 00 80 00 00 00 cc cc cc cc cc cc cc cc  ................\nObject   0000000000400570: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  ................\nRedzone  0000000000400580: cc cc cc cc cc cc cc cc                          ........\nPadding  00000000004005d4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ\nPadding  00000000004005e4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ\nPadding  00000000004005f4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a              ZZZZZZZZZZZZ\nCPU: 6 PID: 121030 Comm: 116-pai-crypto. Not tainted 6.3.0-20230221.rc0.git4.99b8246b2d71.300.fc37.s390x+debug #1\nHardware name: IBM 3931 A01 704 (z/VM 7.3.0)\nCall Trace:\n[<000000032aa034ec>] dump_stack_lvl+0xac/0x100\n[<0000000329f5a6cc>] check_bytes_and_report+0x104/0x140\n[<0000000329f5aa78>] check_object+0x370/0x3c0\n[<0000000329f5ede6>] free_debug_processing+0x15e/0x348\n[<0000000329f5f06a>] free_to_partial_list+0x9a/0x2f0\n[<0000000329f5f4a4>] __slab_free+0x1e4/0x3a8\n[<0000000329f61768>] __kmem_cache_free+0x308/0x358\n[<000000032a91465c>] iucv_cpu_dead+0x6c/0x88\n[<0000000329c2fc66>] cpuhp_invoke_callback+0x156/0x2f0\n[<000000032aa062da>] _cpu_down.constprop.0+0x22a/0x5e0\n[<0000000329c3243e>] cpu_device_down+0x4e/0x78\n[<000000032a61dee0>] device_offline+0xc8/0x118\n[<000000032a61e048>] online_store+0x60/0xe0\n[<000000032a08b6b0>] kernfs_fop_write_iter+0x150/0x1e8\n[<0000000329fab65c>] vfs_write+0x174/0x360\n[<0000000329fab9fc>] ksys_write+0x74/0x100\n[<000000032aa03a5a>] __do_syscall+0x1da/0x208\n[<000000032aa177b2>] system_call+0x82/0xb0\nINFO: lockdep is turned off.\nFIX dma-kmalloc-64: Restoring kmalloc Redzone 0x0000000000400564-0x0000000000400567=0xcc\nFIX dma-kmalloc-64: Object at 0x0000000000400540 not freed",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dca36d30-a7c4-463c-b952-ee99c5e2569d",  "id": "CVE-2024-53173",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.0: Fix a use-after-free problem in the asynchronous open()\n\nYang Erkun reports that when two threads are opening files at the same\ntime, and are forced to abort before a reply is seen, then the call to\nnfs_release_seqid() in nfs4_opendata_free() can result in a\nuse-after-free of the pointer to the defunct rpc task of the other\nthread.\nThe fix is to ensure that if the RPC call is aborted before the call to\nnfs_wait_on_sequence() is complete, then we must call nfs_release_seqid()\nin nfs4_open_release() before the rpc_task is freed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6752d27f-1c40-463e-b303-1ee8d7bf216d",  "id": "SUSE-SU-2020:0474-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "038bcadc-789b-4189-bfd8-9d646499d64f",  "id": "CVE-2024-40978",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedi: Fix crash while reading debugfs attribute\n\nThe qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly\non a __user pointer, which results into the crash.\n\nTo fix this issue, use a small local stack buffer for sprintf() and then\ncall simple_read_from_buffer(), which in turns make the copy_to_user()\ncall.\n\nBUG: unable to handle page fault for address: 00007f4801111000\nPGD 8000000864df6067 P4D 8000000864df6067 PUD 864df7067 PMD 846028067 PTE 0\nOops: 0002 [#1] PREEMPT SMP PTI\nHardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/15/2023\nRIP: 0010:memcpy_orig+0xcd/0x130\nRSP: 0018:ffffb7a18c3ffc40 EFLAGS: 00010202\nRAX: 00007f4801111000 RBX: 00007f4801111000 RCX: 000000000000000f\nRDX: 000000000000000f RSI: ffffffffc0bfd7a0 RDI: 00007f4801111000\nRBP: ffffffffc0bfd7a0 R08: 725f746f6e5f6f64 R09: 3d7265766f636572\nR10: ffffb7a18c3ffd08 R11: 0000000000000000 R12: 00007f4881110fff\nR13: 000000007fffffff R14: ffffb7a18c3ffca0 R15: ffffffffc0bfd7af\nFS:  00007f480118a740(0000) GS:ffff98e38af00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f4801111000 CR3: 0000000864b8e001 CR4: 00000000007706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n <TASK>\n ? __die_body+0x1a/0x60\n ? page_fault_oops+0x183/0x510\n ? exc_page_fault+0x69/0x150\n ? asm_exc_page_fault+0x22/0x30\n ? memcpy_orig+0xcd/0x130\n vsnprintf+0x102/0x4c0\n sprintf+0x51/0x80\n qedi_dbg_do_not_recover_cmd_read+0x2f/0x50 [qedi 6bcfdeeecdea037da47069eca2ba717c84a77324]\n full_proxy_read+0x50/0x80\n vfs_read+0xa5/0x2e0\n ? folio_add_new_anon_rmap+0x44/0xa0\n ? set_pte_at+0x15/0x30\n ? do_pte_missing+0x426/0x7f0\n ksys_read+0xa5/0xe0\n do_syscall_64+0x58/0x80\n ? __count_memcg_events+0x46/0x90\n ? count_memcg_event_mm+0x3d/0x60\n ? handle_mm_fault+0x196/0x2f0\n ? do_user_addr_fault+0x267/0x890\n ? exc_page_fault+0x69/0x150\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x7f4800f20b4d",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2d9e22b1-43c6-45da-a30c-932e40f5a03e",  "id": "CVE-2019-19062",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19062"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d7aa2b85-2905-44a0-b994-1edd13cecf11",  "id": "OESA-2026-2965",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "03abacbc-70bc-4524-a674-a4a85e71f761",  "id": "CVE-2024-47664",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware\n\nIf the value of max_speed_hz is 0, it may cause a division by zero\nerror in hisi_calc_effective_speed().\nThe value of max_speed_hz is provided by firmware.\nFirmware is generally considered as a trusted domain. However, as\ndivision by zero errors can cause system failure, for defense measure,\nthe value of max_speed is validated here. So 0 is regarded as invalid\nand an error code is returned.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2dcdc528-f3b5-4fda-9f9d-26c21aa1d93b",  "id": "AZL-89934",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b317310-bf14-4c97-a00d-cdf7116db7ca",  "id": "CVE-2017-10661",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10661"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:43345'"    }  ]},{  "bom-ref": "93efd2e8-845d-4abb-a7e8-4de5a7c2bfa7",  "id": "CVE-2026-46151",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usblp: fix heap leak in IEEE 1284 device ID via short response\n\nusblp_ctrl_msg() collapses the usb_control_msg() return value to\n0/-errno, discarding the actual number of bytes transferred.  A broken\nprinter can complete the GET_DEVICE_ID control transfer short and the\ndriver has no way to know.\n\nusblp_cache_device_id_string() reads the 2-byte big-endian length prefix\nfrom the response and trusts it (clamped only to the buffer bounds).\nThe buffer is kmalloc(1024) at probe time. A device that sends exactly\ntwo bytes (e.g. 0x03 0xFF, claiming a 1023-byte ID) leaves\ndevice_id_string[2..1022] holding stale kmalloc heap.\n\nThat stale data is then exposed:\n  - via the ieee1284_id sysfs attribute (sprintf(\"%s\", buf+2), truncated\n    at the first NUL in the stale heap), and\n  - via the IOCNR_GET_DEVICE_ID ioctl, which copy_to_user()s the full\n    claimed length regardless of NULs, up to 1021 bytes of uninitialized\n    heap, with the leak size chosen by the device.\n\nFix this up by just zapping the buffer with zeros before each request\nsent to the device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "748f00f3-32aa-4865-9e90-58ac79fada2d",  "id": "CVE-2014-3144",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3144"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions.  NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "313f1fcc-c6d3-49ae-bf7a-bc80932d22f8",  "id": "CVE-2023-52825",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix a race condition of vram buffer unref in svm code\n\nprange->svm_bo unref can happen in both mmu callback and a callback after\nmigrate to system ram. Both are async call in different tasks. Sync svm_bo\nunref operation to avoid random \"use-after-free\".",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b58421e5-2fe5-4420-a703-a7722cdf7e59",  "id": "CVE-2017-15127",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15127"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    460  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the hugetlb_mcopy_atomic_pte function in mm/hugetlb.c in the Linux kernel before 4.13. A superfluous implicit page unlock for VM_SHARED hugetlbfs mapping could trigger a local denial of service (BUG).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "28dfc78f-d4f4-488e-bbfa-11f797b2a2cc",  "id": "CVE-2013-2596",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2596"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bdd3a169-39d1-4d98-9f9b-8779a7aa6858",  "id": "ALSA-2024:7848",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b62d9b6c-533b-43d4-924c-bc9b4412f757",  "id": "CVE-2010-3297",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3297"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "The eql_g_master_cfg function in drivers/net/eql.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an EQL_GETMASTRCFG ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "46d2124f-cdb7-42df-8ff2-fbbf9ad4c975",  "id": "AZL-81947",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2f6d4af-6b69-457b-ae02-5ed29ae80ec2",  "id": "CVE-2013-1813",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1813"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "edfc1a07-5967-4f0d-9924-977c63bc0745",  "id": "CVE-2021-47606",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47606"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: netlink: af_netlink: Prevent empty skb by adding a check on len.\n\nAdding a check on len parameter to avoid empty skb. This prevents a\ndivision error in netem_enqueue function which is caused when skb->len=0\nand skb->data_len=0 in the randomized corruption step as shown below.\n\nskb->data[prandom_u32() % skb_headlen(skb)] ^= 1<<(prandom_u32() % 8);\n\nCrash Report:\n[  343.170349] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family\n0 port 6081 - 0\n[  343.216110] netem: version 1.3\n[  343.235841] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI\n[  343.236680] CPU: 3 PID: 4288 Comm: reproducer Not tainted 5.16.0-rc1+\n[  343.237569] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS 1.11.0-2.el7 04/01/2014\n[  343.238707] RIP: 0010:netem_enqueue+0x1590/0x33c0 [sch_netem]\n[  343.239499] Code: 89 85 58 ff ff ff e8 5f 5d e9 d3 48 8b b5 48 ff ff\nff 8b 8d 50 ff ff ff 8b 85 58 ff ff ff 48 8b bd 70 ff ff ff 31 d2 2b 4f\n74 <f7> f1 48 b8 00 00 00 00 00 fc ff df 49 01 d5 4c 89 e9 48 c1 e9 03\n[  343.241883] RSP: 0018:ffff88800bcd7368 EFLAGS: 00010246\n[  343.242589] RAX: 00000000ba7c0a9c RBX: 0000000000000001 RCX:\n0000000000000000\n[  343.243542] RDX: 0000000000000000 RSI: ffff88800f8edb10 RDI:\nffff88800f8eda40\n[  343.244474] RBP: ffff88800bcd7458 R08: 0000000000000000 R09:\nffffffff94fb8445\n[  343.245403] R10: ffffffff94fb8336 R11: ffffffff94fb8445 R12:\n0000000000000000\n[  343.246355] R13: ffff88800a5a7000 R14: ffff88800a5b5800 R15:\n0000000000000020\n[  343.247291] FS:  00007fdde2bd7700(0000) GS:ffff888109780000(0000)\nknlGS:0000000000000000\n[  343.248350] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  343.249120] CR2: 00000000200000c0 CR3: 000000000ef4c000 CR4:\n00000000000006e0\n[  343.250076] Call Trace:\n[  343.250423]  <TASK>\n[  343.250713]  ? memcpy+0x4d/0x60\n[  343.251162]  ? netem_init+0xa0/0xa0 [sch_netem]\n[  343.251795]  ? __sanitizer_cov_trace_pc+0x21/0x60\n[  343.252443]  netem_enqueue+0xe28/0x33c0 [sch_netem]\n[  343.253102]  ? stack_trace_save+0x87/0xb0\n[  343.253655]  ? filter_irq_stacks+0xb0/0xb0\n[  343.254220]  ? netem_init+0xa0/0xa0 [sch_netem]\n[  343.254837]  ? __kasan_check_write+0x14/0x20\n[  343.255418]  ? _raw_spin_lock+0x88/0xd6\n[  343.255953]  dev_qdisc_enqueue+0x50/0x180\n[  343.256508]  __dev_queue_xmit+0x1a7e/0x3090\n[  343.257083]  ? netdev_core_pick_tx+0x300/0x300\n[  343.257690]  ? check_kcov_mode+0x10/0x40\n[  343.258219]  ? _raw_spin_unlock_irqrestore+0x29/0x40\n[  343.258899]  ? __kasan_init_slab_obj+0x24/0x30\n[  343.259529]  ? setup_object.isra.71+0x23/0x90\n[  343.260121]  ? new_slab+0x26e/0x4b0\n[  343.260609]  ? kasan_poison+0x3a/0x50\n[  343.261118]  ? kasan_unpoison+0x28/0x50\n[  343.261637]  ? __kasan_slab_alloc+0x71/0x90\n[  343.262214]  ? memcpy+0x4d/0x60\n[  343.262674]  ? write_comp_data+0x2f/0x90\n[  343.263209]  ? __kasan_check_write+0x14/0x20\n[  343.263802]  ? __skb_clone+0x5d6/0x840\n[  343.264329]  ? __sanitizer_cov_trace_pc+0x21/0x60\n[  343.264958]  dev_queue_xmit+0x1c/0x20\n[  343.265470]  netlink_deliver_tap+0x652/0x9c0\n[  343.266067]  netlink_unicast+0x5a0/0x7f0\n[  343.266608]  ? netlink_attachskb+0x860/0x860\n[  343.267183]  ? __sanitizer_cov_trace_pc+0x21/0x60\n[  343.267820]  ? write_comp_data+0x2f/0x90\n[  343.268367]  netlink_sendmsg+0x922/0xe80\n[  343.268899]  ? netlink_unicast+0x7f0/0x7f0\n[  343.269472]  ? __sanitizer_cov_trace_pc+0x21/0x60\n[  343.270099]  ? write_comp_data+0x2f/0x90\n[  343.270644]  ? netlink_unicast+0x7f0/0x7f0\n[  343.271210]  sock_sendmsg+0x155/0x190\n[  343.271721]  ____sys_sendmsg+0x75f/0x8f0\n[  343.272262]  ? kernel_sendmsg+0x60/0x60\n[  343.272788]  ? write_comp_data+0x2f/0x90\n[  343.273332]  ? write_comp_data+0x2f/0x90\n[  343.273869]  ___sys_sendmsg+0x10f/0x190\n[  343.274405]  ? sendmsg_copy_msghdr+0x80/0x80\n[  343.274984]  ? slab_post_alloc_hook+0x70/0x230\n[  343.275597]  ? futex_wait_setup+0x240/0x240\n[  343.276175]  ? security_file_alloc+0x3e/0x170\n[  343.276779]  ? write_comp_d\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d3ef039-c199-4be8-921f-37d73d7eed07",  "id": "CVE-2025-38415",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check return result of sb_min_blocksize\n\nSyzkaller reports an \"UBSAN: shift-out-of-bounds in squashfs_bio_read\" bug.\n\nSyzkaller forks multiple processes which after mounting the Squashfs\nfilesystem, issues an ioctl(\"/dev/loop0\", LOOP_SET_BLOCK_SIZE, 0x8000). \nNow if this ioctl occurs at the same time another process is in the\nprocess of mounting a Squashfs filesystem on /dev/loop0, the failure\noccurs.  When this happens the following code in squashfs_fill_super()\nfails.\n\n----\nmsblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);\nmsblk->devblksize_log2 = ffz(~msblk->devblksize);\n----\n\nsb_min_blocksize() returns 0, which means msblk->devblksize is set to 0.\n\nAs a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2\nis set to 64.\n\nThis subsequently causes the\n\nUBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36\nshift exponent 64 is too large for 64-bit type 'u64' (aka\n'unsigned long long')\n\nThis commit adds a check for a 0 return by sb_min_blocksize().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "21806080-6cd4-4380-bc18-0f05defe9a51",  "id": "CVE-2021-47633",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47633"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111\n\nThe bug was found during fuzzing. Stacktrace locates it in\nath5k_eeprom_convert_pcal_info_5111.\nWhen none of the curve is selected in the loop, idx can go\nup to AR5K_EEPROM_N_PD_CURVES. The line makes pd out of bound.\npd = &chinfo[pier].pd_curves[idx];\n\nThere are many OOB writes using pd later in the code. So I\nadded a sanity check for idx. Checks for other loops involving\nAR5K_EEPROM_N_PD_CURVES are not needed as the loop index is not\nused outside the loops.\n\nThe patch is NOT tested with real device.\n\nThe following is the fuzzing report\n\nBUG: KASAN: slab-out-of-bounds in ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\nWrite of size 1 at addr ffff8880174a4d60 by task modprobe/214\n\nCPU: 0 PID: 214 Comm: modprobe Not tainted 5.6.0 #1\nCall Trace:\n dump_stack+0x76/0xa0\n print_address_description.constprop.0+0x16/0x200\n ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\n ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\n __kasan_report.cold+0x37/0x7c\n ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\n kasan_report+0xe/0x20\n ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]\n ? apic_timer_interrupt+0xa/0x20\n ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k]\n ? ath5k_pci_eeprom_read+0x228/0x3c0 [ath5k]\n ath5k_eeprom_init+0x2513/0x6290 [ath5k]\n ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k]\n ? usleep_range+0xb8/0x100\n ? apic_timer_interrupt+0xa/0x20\n ? ath5k_eeprom_read_pcal_info_2413+0x2f20/0x2f20 [ath5k]\n ath5k_hw_init+0xb60/0x1970 [ath5k]\n ath5k_init_ah+0x6fe/0x2530 [ath5k]\n ? kasprintf+0xa6/0xe0\n ? ath5k_stop+0x140/0x140 [ath5k]\n ? _dev_notice+0xf6/0xf6\n ? apic_timer_interrupt+0xa/0x20\n ath5k_pci_probe.cold+0x29a/0x3d6 [ath5k]\n ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k]\n ? mutex_lock+0x89/0xd0\n ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k]\n local_pci_probe+0xd3/0x160\n pci_device_probe+0x23f/0x3e0\n ? pci_device_remove+0x280/0x280\n ? pci_device_remove+0x280/0x280\n really_probe+0x209/0x5d0",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d6c32656-468a-49e4-a97c-99fa24304684",  "id": "CVE-2024-36286",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()\n\nsyzbot reported that nf_reinject() could be called without rcu_read_lock() :\n\nWARNING: suspicious RCU usage\n6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0 Not tainted\n\nnet/netfilter/nfnetlink_queue.c:263 suspicious rcu_dereference_check() usage!\n\nother info that might help us debug this:\n\nrcu_scheduler_active = 2, debug_locks = 1\n2 locks held by syz-executor.4/13427:\n  #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline]\n  #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2190 [inline]\n  #0: ffffffff8e334f60 (rcu_callback){....}-{0:0}, at: rcu_core+0xa86/0x1830 kernel/rcu/tree.c:2471\n  #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]\n  #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: nfqnl_flush net/netfilter/nfnetlink_queue.c:405 [inline]\n  #1: ffff88801ca92958 (&inst->lock){+.-.}-{2:2}, at: instance_destroy_rcu+0x30/0x220 net/netfilter/nfnetlink_queue.c:172\n\nstack backtrace:\nCPU: 0 PID: 13427 Comm: syz-executor.4 Not tainted 6.9.0-rc7-syzkaller-02060-g5c1672705a1a #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\nCall Trace:\n <IRQ>\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712\n  nf_reinject net/netfilter/nfnetlink_queue.c:323 [inline]\n  nfqnl_reinject+0x6ec/0x1120 net/netfilter/nfnetlink_queue.c:397\n  nfqnl_flush net/netfilter/nfnetlink_queue.c:410 [inline]\n  instance_destroy_rcu+0x1ae/0x220 net/netfilter/nfnetlink_queue.c:172\n  rcu_do_batch kernel/rcu/tree.c:2196 [inline]\n  rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2471\n  handle_softirqs+0x2d6/0x990 kernel/softirq.c:554\n  __do_softirq kernel/softirq.c:588 [inline]\n  invoke_softirq kernel/softirq.c:428 [inline]\n  __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637\n  irq_exit_rcu+0x9/0x30 kernel/softirq.c:649\n  instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]\n  sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043\n </IRQ>\n <TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "847282e0-c011-4654-8feb-cda9f72cff53",  "id": "CVE-2026-43472",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nunshare: fix unshare_fs() handling\n\nThere's an unpleasant corner case in unshare(2), when we have a\nCLONE_NEWNS in flags and current->fs hadn't been shared at all; in that\ncase copy_mnt_ns() gets passed current->fs instead of a private copy,\nwhich causes interesting warts in proof of correctness]\n\n> I guess if private means fs->users == 1, the condition could still be true.\n\nUnfortunately, it's worse than just a convoluted proof of correctness.\nConsider the case when we have CLONE_NEWCGROUP in addition to CLONE_NEWNS\n(and current->fs->users == 1).\n\nWe pass current->fs to copy_mnt_ns(), all right.  Suppose it succeeds and\nflips current->fs->{pwd,root} to corresponding locations in the new namespace.\nNow we proceed to copy_cgroup_ns(), which fails (e.g. with -ENOMEM).\nWe call put_mnt_ns() on the namespace created by copy_mnt_ns(), it's\ndestroyed and its mount tree is dissolved, but...  current->fs->root and\ncurrent->fs->pwd are both left pointing to now detached mounts.\n\nThey are pinning those, so it's not a UAF, but it leaves the calling\nprocess with unshare(2) failing with -ENOMEM _and_ leaving it with\npwd and root on detached isolated mounts.  The last part is clearly a bug.\n\nThere is other fun related to that mess (races with pivot_root(), including\nthe one between pivot_root() and fork(), of all things), but this one\nis easy to isolate and fix - treat CLONE_NEWNS as \"allocate a new\nfs_struct even if it hadn't been shared in the first place\".  Sure, we could\ngo for something like \"if both CLONE_NEWNS *and* one of the things that might\nend up failing after copy_mnt_ns() call in create_new_namespaces() are set,\nforce allocation of new fs_struct\", but let's keep it simple - the cost\nof copy_fs_struct() is trivial.\n\nAnother benefit is that copy_mnt_ns() with CLONE_NEWNS *always* gets\na freshly allocated fs_struct, yet to be attached to anything.  That\nseriously simplifies the analysis...\n\nFWIW, that bug had been there since the introduction of unshare(2) ;-/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "283da4d4-495b-4c93-ae0e-ec8ef45bddc8",  "id": "CVE-2023-4611",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4611"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind() and VMA-locked page fault, and may allow a local attacker to crash the system or lead to a kernel information leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d0e5abe5-3c10-4e51-b76e-27e019c02ed5",  "id": "CVE-2022-50497",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: fix shift-out-of-bounds in check_special_flags\n\nUBSAN reported a shift-out-of-bounds warning:\n\n left shift of 1 by 31 places cannot be represented in type 'int'\n Call Trace:\n  <TASK>\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106\n  ubsan_epilogue+0xa/0x44 lib/ubsan.c:151\n  __ubsan_handle_shift_out_of_bounds+0x1e7/0x208 lib/ubsan.c:322\n  check_special_flags fs/binfmt_misc.c:241 [inline]\n  create_entry fs/binfmt_misc.c:456 [inline]\n  bm_register_write+0x9d3/0xa20 fs/binfmt_misc.c:654\n  vfs_write+0x11e/0x580 fs/read_write.c:582\n  ksys_write+0xcf/0x120 fs/read_write.c:637\n  do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n  do_syscall_64+0x34/0x80 arch/x86/entry/common.c:80\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n RIP: 0033:0x4194e1\n\nSince the type of Node's flags is unsigned long, we should define these\nmacros with same type too.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2fd9cad-3a8f-42cd-b62e-750b0ff908f3",  "id": "CVE-2024-49908",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor (v2)\n\nThis commit adds a null check for the 'afb' variable in the\namdgpu_dm_update_cursor function. Previously, 'afb' was assumed to be\nnull at line 8388, but was used later in the code without a null check.\nThis could potentially lead to a null pointer dereference.\n\nChanges since v1:\n- Moved the null check for 'afb' to the line where 'afb' is used. (Alex)\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:8433 amdgpu_dm_update_cursor()\n\terror: we previously assumed 'afb' could be null (see line 8388)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db059b53-b99c-46c6-8444-54ab87dbd8bf",  "id": "CVE-2010-3848",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3848"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "Stack-based buffer overflow in the econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to gain privileges by providing a large number of iovec structures.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:17787'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:104820/Linux-Kernel-Econet-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "d3e3b0cb-0b02-4e8b-b0a3-bff56c3c4d67",  "id": "CVE-2014-5045",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5045"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    59  ],  "analysis": {    "state": "in_triage"  },  "description": "The mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a certain reference count during attempts to use the umount system call in conjunction with a symlink, which allows local users to cause a denial of service (memory consumption or use-after-free) or possibly have unspecified other impact via the umount program.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "226cb0bc-9aed-4f82-b4aa-c872fa831c5c",  "id": "CVE-2024-43854",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: initialize integrity buffer to zero before writing it to media\n\nMetadata added by bio_integrity_prep is using plain kmalloc, which leads\nto random kernel memory being written media.  For PI metadata this is\nlimited to the app tag that isn't used by kernel generated metadata,\nbut for non-PI metadata the entire buffer leaks kernel memory.\n\nFix this by adding the __GFP_ZERO flag to allocations for writes.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c28b77c5-f242-4a52-beab-9d3aee025628",  "id": "CVE-2023-2860",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2860"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds read vulnerability was found in the SR-IPv6 implementation in the Linux kernel. The flaw exists within the processing of seg6 attributes. The issue results from the improper validation of user-supplied data, which can result in a read past the end of an allocated buffer. This flaw allows a privileged local user to disclose sensitive information on affected installations of the Linux kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f6198d1e-5e5e-4261-bff0-3d7e942cb864",  "id": "CVE-2022-49347",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix bug_on in ext4_writepages\n\nwe got issue as follows:\nEXT4-fs error (device loop0): ext4_mb_generate_buddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free cls\n------------[ cut here ]------------\nkernel BUG at fs/ext4/inode.c:2708!\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 2 PID: 2147 Comm: rep Not tainted 5.18.0-rc2-next-20220413+ #155\nRIP: 0010:ext4_writepages+0x1977/0x1c10\nRSP: 0018:ffff88811d3e7880 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88811c098000\nRDX: 0000000000000000 RSI: ffff88811c098000 RDI: 0000000000000002\nRBP: ffff888128140f50 R08: ffffffffb1ff6387 R09: 0000000000000000\nR10: 0000000000000007 R11: ffffed10250281ea R12: 0000000000000001\nR13: 00000000000000a4 R14: ffff88811d3e7bb8 R15: ffff888128141028\nFS:  00007f443aed9740(0000) GS:ffff8883aef00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020007200 CR3: 000000011c2a4000 CR4: 00000000000006e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n do_writepages+0x130/0x3a0\n filemap_fdatawrite_wbc+0x83/0xa0\n filemap_flush+0xab/0xe0\n ext4_alloc_da_blocks+0x51/0x120\n __ext4_ioctl+0x1534/0x3210\n __x64_sys_ioctl+0x12c/0x170\n do_syscall_64+0x3b/0x90\n\nIt may happen as follows:\n1. write inline_data inode\nvfs_write\n  new_sync_write\n    ext4_file_write_iter\n      ext4_buffered_write_iter\n        generic_perform_write\n          ext4_da_write_begin\n            ext4_da_write_inline_data_begin -> If inline data size too\n            small will allocate block to write, then mapping will has\n            dirty page\n                ext4_da_convert_inline_data_to_extent ->clear EXT4_STATE_MAY_INLINE_DATA\n2. fallocate\ndo_vfs_ioctl\n  ioctl_preallocate\n    vfs_fallocate\n      ext4_fallocate\n        ext4_convert_inline_data\n          ext4_convert_inline_data_nolock\n            ext4_map_blocks -> fail will goto restore data\n            ext4_restore_inline_data\n              ext4_create_inline_data\n              ext4_write_inline_data\n              ext4_set_inode_state -> set inode EXT4_STATE_MAY_INLINE_DATA\n3. writepages\n__ext4_ioctl\n  ext4_alloc_da_blocks\n    filemap_flush\n      filemap_fdatawrite_wbc\n        do_writepages\n          ext4_writepages\n            if (ext4_has_inline_data(inode))\n              BUG_ON(ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))\n\nThe root cause of this issue is we destory inline data until call\next4_writepages under delay allocation mode.  But there maybe already\nconvert from inline to extent.  To solve this issue, we call\nfilemap_flush first..",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d306f667-ad1b-4ffc-ab71-66e6287e4592",  "id": "CVE-2023-53220",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: az6007: Fix null-ptr-deref in az6007_i2c_xfer()\n\nIn az6007_i2c_xfer, msg is controlled by user. When msg[i].buf\nis null and msg[i].len is zero, former checks on msg[i].buf would be\npassed. Malicious data finally reach az6007_i2c_xfer. If accessing\nmsg[i].buf[0] without sanity check, null ptr deref would happen.\nWe add check on msg[i].len to prevent crash.\n\nSimilar commit:\ncommit 0ed554fd769a\n(\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8d411487-9644-499a-89fc-079083cc7142",  "id": "CVE-2013-2634",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2634"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd8d8238-4122-4b46-becd-8fffea476156",  "id": "CVE-2014-1690",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1690"  },  "ratings": [    {      "score": 2.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4af78f31-9059-4485-a4bd-6996d73470fe",  "id": "CVE-2024-42286",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: validate nvme_local_port correctly\n\nThe driver load failed with error message,\n\nqla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef\n\nand with a kernel crash,\n\n\tBUG: unable to handle kernel NULL pointer dereference at 0000000000000070\n\tWorkqueue: events_unbound qla_register_fcport_fn [qla2xxx]\n\tRIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc]\n\tRSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282\n\tRAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000\n\tRDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000\n\tRBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030\n\tR10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4\n\tR13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8\n\tFS:  0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000\n\tCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n\tCR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0\n\tCall Trace:\n\tqla_nvme_register_remote+0xeb/0x1f0 [qla2xxx]\n\t? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx]\n\tqla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx]\n\tqla_register_fcport_fn+0x54/0xc0 [qla2xxx]\n\nExit the qla_nvme_register_remote() function when qla_nvme_register_hba()\nfails and correctly validate nvme_local_port.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8bcb4654-c80b-46c0-9f71-a5995f72a11c",  "id": "MGASA-2017-0379",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "27b5524b-f1e8-4ee5-851c-c8d6b7f7e892",  "id": "CVE-2017-14140",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14140"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "434c1f1a-9697-4a9f-8373-ecc28fbd3874",  "id": "CVE-2012-2669",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2669"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin of Netlink messages, which allows local users to spoof Netlink communication via a crafted connector message.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a250768f-4945-4520-a933-232baf2c6eb7",  "id": "CVE-2013-2852",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2852"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    134  ],  "analysis": {    "state": "in_triage"  },  "description": "Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:38559'"    }  ]},{  "bom-ref": "b578dd8f-0782-4dc5-8c7c-a4d30797920d",  "id": "CVE-2020-26088",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26088"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    276  ],  "analysis": {    "state": "in_triage"  },  "description": "A missing CAP_NET_RAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "78b96b70-17a8-4e96-95f3-399f5726bbb5",  "id": "CVE-2019-19966",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19966"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.1.6, there is a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that will cause denial of service, aka CID-dea37a972655.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "721f3f52-788e-46cb-bbdd-ec9eee738a88",  "id": "CVE-2021-29646",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29646"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key in net/tipc/node.c does not properly validate certain data sizes, aka CID-0217ed2848e8.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b4b60f67-0bcb-4ca5-a63d-fc5d2676ac4b",  "id": "RHSA-2026:38503",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9235f5de-5767-46c6-be10-e74dfa6a1a9a",  "id": "CVE-2024-43899",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix null pointer deref in dcn20_resource.c\n\nFixes a hang thats triggered when MPV is run on a DCN401 dGPU:\n\nmpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all\n\nand then enabling fullscreen playback (double click on the video)\n\nThe following calltrace will be seen:\n\n[  181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[  181.843997] #PF: supervisor instruction fetch in kernel mode\n[  181.844003] #PF: error_code(0x0010) - not-present page\n[  181.844009] PGD 0 P4D 0\n[  181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI\n[  181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G        W  OE      6.5.0-41-generic #41~22.04.2-Ubuntu\n[  181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018\n[  181.844044] RIP: 0010:0x0\n[  181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n[  181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246\n[  181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004\n[  181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400\n[  181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c\n[  181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8\n[  181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005\n[  181.844121] FS:  00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000\n[  181.844128] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0\n[  181.844141] Call Trace:\n[  181.844146]  <TASK>\n[  181.844153]  ? show_regs+0x6d/0x80\n[  181.844167]  ? __die+0x24/0x80\n[  181.844179]  ? page_fault_oops+0x99/0x1b0\n[  181.844192]  ? do_user_addr_fault+0x31d/0x6b0\n[  181.844204]  ? exc_page_fault+0x83/0x1b0\n[  181.844216]  ? asm_exc_page_fault+0x27/0x30\n[  181.844237]  dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu]\n[  181.845115]  amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu]\n[  181.845985]  amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu]\n[  181.846848]  fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu]\n[  181.847734]  fill_dc_plane_attributes+0x162/0x350 [amdgpu]\n[  181.848748]  dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu]\n[  181.849791]  ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu]\n[  181.850840]  amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f9e43cb-2d02-44e1-b87e-126487157384",  "id": "CLSA-2026-1780062952",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e3d170be-e84d-4e42-a03f-f961770921e2",  "id": "CVE-2022-48763",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Forcibly leave nested virt when SMM state is toggled\n\nForcibly leave nested virtualization operation if userspace toggles SMM\nstate via KVM_SET_VCPU_EVENTS or KVM_SYNC_X86_EVENTS.  If userspace\nforces the vCPU out of SMM while it's post-VMXON and then injects an SMI,\nvmx_enter_smm() will overwrite vmx->nested.smm.vmxon and end up with both\nvmxon=false and smm.vmxon=false, but all other nVMX state allocated.\n\nDon't attempt to gracefully handle the transition as (a) most transitions\nare nonsencial, e.g. forcing SMM while L2 is running, (b) there isn't\nsufficient information to handle all transitions, e.g. SVM wants access\nto the SMRAM save state, and (c) KVM_SET_VCPU_EVENTS must precede\nKVM_SET_NESTED_STATE during state restore as the latter disallows putting\nthe vCPU into L2 if SMM is active, and disallows tagging the vCPU as\nbeing post-VMXON in SMM if SMM is not active.\n\nAbuse of KVM_SET_VCPU_EVENTS manifests as a WARN and memory leak in nVMX\ndue to failure to free vmcs01's shadow VMCS, but the bug goes far beyond\njust a memory leak, e.g. toggling SMM on while L2 is active puts the vCPU\nin an architecturally impossible state.\n\n  WARNING: CPU: 0 PID: 3606 at free_loaded_vmcs arch/x86/kvm/vmx/vmx.c:2665 [inline]\n  WARNING: CPU: 0 PID: 3606 at free_loaded_vmcs+0x158/0x1a0 arch/x86/kvm/vmx/vmx.c:2656\n  Modules linked in:\n  CPU: 1 PID: 3606 Comm: syz-executor725 Not tainted 5.17.0-rc1-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n  RIP: 0010:free_loaded_vmcs arch/x86/kvm/vmx/vmx.c:2665 [inline]\n  RIP: 0010:free_loaded_vmcs+0x158/0x1a0 arch/x86/kvm/vmx/vmx.c:2656\n  Code: <0f> 0b eb b3 e8 8f 4d 9f 00 e9 f7 fe ff ff 48 89 df e8 92 4d 9f 00\n  Call Trace:\n   <TASK>\n   kvm_arch_vcpu_destroy+0x72/0x2f0 arch/x86/kvm/x86.c:11123\n   kvm_vcpu_destroy arch/x86/kvm/../../../virt/kvm/kvm_main.c:441 [inline]\n   kvm_destroy_vcpus+0x11f/0x290 arch/x86/kvm/../../../virt/kvm/kvm_main.c:460\n   kvm_free_vcpus arch/x86/kvm/x86.c:11564 [inline]\n   kvm_arch_destroy_vm+0x2e8/0x470 arch/x86/kvm/x86.c:11676\n   kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:1217 [inline]\n   kvm_put_kvm+0x4fa/0xb00 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1250\n   kvm_vm_release+0x3f/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1273\n   __fput+0x286/0x9f0 fs/file_table.c:311\n   task_work_run+0xdd/0x1a0 kernel/task_work.c:164\n   exit_task_work include/linux/task_work.h:32 [inline]\n   do_exit+0xb29/0x2a30 kernel/exit.c:806\n   do_group_exit+0xd2/0x2f0 kernel/exit.c:935\n   get_signal+0x4b0/0x28c0 kernel/signal.c:2862\n   arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868\n   handle_signal_work kernel/entry/common.c:148 [inline]\n   exit_to_user_mode_loop kernel/entry/common.c:172 [inline]\n   exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207\n   __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]\n   syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300\n   do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n   </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8ed3a1b3-3901-44eb-949c-06779153ae4b",  "id": "CVE-2024-46723",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix ucode out-of-bounds read warning\n\nClear warning that read ucode[] may out-of-bounds.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "051d4d58-2d41-41ce-854a-9a6ae5485f08",  "id": "SUSE-SU-2023:3160-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f536f60-9b05-480d-8fea-7974e5d3fe36",  "id": "ALSA-2023:0946",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f393f031-35c1-4fe8-98a6-a790ea7aedac",  "id": "CVE-2023-39194",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39194"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99077877-626b-4511-94de-a19e301f31b0",  "id": "CVE-2022-49125",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sprd: fix potential NULL dereference\n\n'drm' could be null in sprd_drm_shutdown, and drm_warn maybe dereference\nit, remove this warning log.\n\n\nv1 -> v2:\n- Split checking platform_get_resource() return value to a separate patch\n- Use dev_warn() instead of removing the warning log",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d100e63-0e47-4465-aee8-7406ccf0b9ca",  "id": "CVE-2026-53253",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: reject short frames before parsing\n\nA BNEP peer can send a short BNEP SDU. bnep_rx_frame() reads the\npacket type byte immediately and, for control packets, reads the control\nopcode and setup UUID-size byte before proving that those bytes are\npresent. bnep_rx_control() also dereferences the control opcode without\nrejecting an empty control payload.\n\nUse skb_pull_data() for the fixed fields in bnep_rx_frame() so a NULL\nreturn gates each dereference. Split the control handler so the frame\npath can pass an opcode that has already been pulled, and keep the\nbyte-buffer wrapper for extension control payloads.\n\nFor BNEP_SETUP_CONN_REQ, name the UUID-size byte before pulling the\nsetup payload. struct bnep_setup_conn_req carries destination and source\nservice UUIDs after that byte, each uuid_size bytes, so the parser now\ndocuments that tuple explicitly instead of leaving the pull length as an\nopaque multiplication.\n\nValidation reproduced this kernel report:\nKASAN slab-out-of-bounds in bnep_rx_frame.isra.0+0x130c/0x1790\nThe buggy address belongs to the object at ffff88800c0f7908 which belongs\nto the cache kmalloc-8 of size 8\nThe buggy address is located 0 bytes to the right of allocated 1-byte\nregion [ffff88800c0f7908, ffff88800c0f7909)\nRead of size 1\nCall trace:\n  dump_stack_lvl+0xb3/0x140 (?:?)\n  print_address_description+0x57/0x3a0 (?:?)\n  bnep_rx_frame+0x130c/0x1790 (net/bluetooth/bnep/core.c:306)\n  print_report+0xb9/0x2b0 (?:?)\n  __virt_addr_valid+0x1ba/0x3a0 (?:?)\n  srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n  kasan_addr_to_slab+0x21/0x60 (?:?)\n  kasan_report+0xe0/0x110 (?:?)\n  process_one_work+0xfce/0x17e0 (kernel/workqueue.c:3200)\n  worker_thread+0x65c/0xe40 (?:?)\n  __kthread_parkme+0x184/0x230 (?:?)\n  kthread+0x35e/0x470 (?:?)\n  _raw_spin_unlock_irq+0x28/0x50 (?:?)\n  ret_from_fork+0x586/0x870 (?:?)\n  __switch_to+0x74f/0xdc0 (?:?)\n  ret_from_fork_asm+0x1a/0x30 (?:?)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "33f71454-9336-490b-ac63-62fce6865097",  "id": "RLSA-2022:7288",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0245b556-6862-4083-a18e-f2fe1ac7cd95",  "id": "CVE-2023-53174",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix possible memory leak if device_add() fails\n\nIf device_add() returns error, the name allocated by dev_set_name() needs\nbe freed. As the comment of device_add() says, put_device() should be used\nto decrease the reference count in the error path. So fix this by calling\nput_device(), then the name can be freed in kobject_cleanp().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1b495095-5d97-4ec7-892b-2ecec1da8380",  "id": "CVE-2010-3067",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3067"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef52dab0-81e3-476d-9dfb-56014dac740f",  "id": "CVE-2012-2384",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2384"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the i915_gem_do_execbuffer function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "85db75aa-322d-4b93-b02a-2368b9c04896",  "id": "CVE-2014-2523",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2523"  },  "ratings": [    {      "score": 10,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "38dc9590-dc61-4c1a-9186-3770e9f655c1",  "id": "CVE-2026-23452",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM: runtime: Fix a race condition related to device removal\n\nThe following code in pm_runtime_work() may dereference the dev->parent\npointer after the parent device has been freed:\n\n\t/* Maybe the parent is now able to suspend. */\n\tif (parent && !parent->power.ignore_children) {\n\t\tspin_unlock(&dev->power.lock);\n\n\t\tspin_lock(&parent->power.lock);\n\t\trpm_idle(parent, RPM_ASYNC);\n\t\tspin_unlock(&parent->power.lock);\n\n\t\tspin_lock(&dev->power.lock);\n\t}\n\nFix this by inserting a flush_work() call in pm_runtime_remove().\n\nWithout this patch blktest block/001 triggers the following complaint\nsporadically:\n\nBUG: KASAN: slab-use-after-free in lock_acquire+0x70/0x160\nRead of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081\nWorkqueue: pm pm_runtime_work\nCall Trace:\n <TASK>\n dump_stack_lvl+0x61/0x80\n print_address_description.constprop.0+0x8b/0x310\n print_report+0xfd/0x1d7\n kasan_report+0xd8/0x1d0\n __kasan_check_byte+0x42/0x60\n lock_acquire.part.0+0x38/0x230\n lock_acquire+0x70/0x160\n _raw_spin_lock+0x36/0x50\n rpm_suspend+0xc6a/0xfe0\n rpm_idle+0x578/0x770\n pm_runtime_work+0xee/0x120\n process_one_work+0xde3/0x1410\n worker_thread+0x5eb/0xfe0\n kthread+0x37b/0x480\n ret_from_fork+0x6cb/0x920\n ret_from_fork_asm+0x11/0x20\n </TASK>\n\nAllocated by task 4314:\n kasan_save_stack+0x2a/0x50\n kasan_save_track+0x18/0x40\n kasan_save_alloc_info+0x3d/0x50\n __kasan_kmalloc+0xa0/0xb0\n __kmalloc_noprof+0x311/0x990\n scsi_alloc_target+0x122/0xb60 [scsi_mod]\n __scsi_scan_target+0x101/0x460 [scsi_mod]\n scsi_scan_channel+0x179/0x1c0 [scsi_mod]\n scsi_scan_host_selected+0x259/0x2d0 [scsi_mod]\n store_scan+0x2d2/0x390 [scsi_mod]\n dev_attr_store+0x43/0x80\n sysfs_kf_write+0xde/0x140\n kernfs_fop_write_iter+0x3ef/0x670\n vfs_write+0x506/0x1470\n ksys_write+0xfd/0x230\n __x64_sys_write+0x76/0xc0\n x64_sys_call+0x213/0x1810\n do_syscall_64+0xee/0xfc0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nFreed by task 4314:\n kasan_save_stack+0x2a/0x50\n kasan_save_track+0x18/0x40\n kasan_save_free_info+0x3f/0x50\n __kasan_slab_free+0x67/0x80\n kfree+0x225/0x6c0\n scsi_target_dev_release+0x3d/0x60 [scsi_mod]\n device_release+0xa3/0x220\n kobject_cleanup+0x105/0x3a0\n kobject_put+0x72/0xd0\n put_device+0x17/0x20\n scsi_device_dev_release+0xacf/0x12c0 [scsi_mod]\n device_release+0xa3/0x220\n kobject_cleanup+0x105/0x3a0\n kobject_put+0x72/0xd0\n put_device+0x17/0x20\n scsi_device_put+0x7f/0xc0 [scsi_mod]\n sdev_store_delete+0xa5/0x120 [scsi_mod]\n dev_attr_store+0x43/0x80\n sysfs_kf_write+0xde/0x140\n kernfs_fop_write_iter+0x3ef/0x670\n vfs_write+0x506/0x1470\n ksys_write+0xfd/0x230\n __x64_sys_write+0x76/0xc0\n x64_sys_call+0x213/0x1810",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f1e173a-26c1-4cf2-8cfc-0eb24080726c",  "id": "CVE-2024-49905",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2)\n\nThis commit adds a null check for the 'afb' variable in the\namdgpu_dm_plane_handle_cursor_update function. Previously, 'afb' was\nassumed to be null, but was used later in the code without a null check.\nThis could potentially lead to a null pointer dereference.\n\nChanges since v1:\n- Moved the null check for 'afb' to the line where 'afb' is used. (Alex)\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:1298 amdgpu_dm_plane_handle_cursor_update() error: we previously assumed 'afb' could be null (see line 1252)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c9429810-4058-4b0c-9bab-1c3b8e250aec",  "id": "CVE-2024-42065",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Add a NULL check in xe_ttm_stolen_mgr_init\n\nAdd an explicit check to ensure that the mgr is not NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3d2eb297-e0ab-46b8-bc3c-c0cf096fc159",  "id": "CVE-2021-47548",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47548"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()\n\nThe if statement:\n  if (port >= DSAF_GE_NUM)\n        return;\n\nlimits the value of port less than DSAF_GE_NUM (i.e., 8).\nHowever, if the value of port is 6 or 7, an array overflow could occur:\n  port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off;\n\nbecause the length of dsaf_dev->mac_cb is DSAF_MAX_PORT_NUM (i.e., 6).\n\nTo fix this possible array overflow, we first check port and if it is\ngreater than or equal to DSAF_MAX_PORT_NUM, the function returns.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "05b0739b-6684-4a4f-9e8c-5c286309df3f",  "id": "SUSE-SU-2021:14791-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "68b7f4d4-6ee3-46a9-8886-a3efffeb380d",  "id": "CVE-2024-26771",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: edma: Add some null pointer checks to the edma_probe\n\ndevm_kasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure. Ensure the allocation was successful\nby checking the pointer validity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "22994edc-48af-4318-b88b-3febbf4dcb15",  "id": "CVE-2019-16921",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16921"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    665  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 4.17, hns_roce_alloc_ucontext in drivers/infiniband/hw/hns/hns_roce_main.c does not initialize the resp data structure, which might allow attackers to obtain sensitive information from kernel stack memory, aka CID-df7e40425813.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "263fff0e-3074-4118-b3ce-404ba320319b",  "id": "CVE-2023-52586",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: Add mutex lock in control vblank irq\n\nAdd a mutex lock to control vblank irq to synchronize vblank\nenable/disable operations happening from different threads to prevent\nrace conditions while registering/unregistering the vblank irq callback.\n\nv4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a\n    parameter of dpu_encoder_phys.\n    -Switch from atomic refcnt to a simple int counter as mutex has\n    now been added\nv3: Mistakenly did not change wording in last version. It is done now.\nv2: Slightly changed wording of commit message\n\nPatchwork: https://patchwork.freedesktop.org/patch/571854/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7effd843-d76b-441c-9817-eec534ab3373",  "id": "CVE-2023-42756",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42756"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "38146e90-64d2-4bb4-a9a2-cb8930547c9f",  "id": "CVE-2024-26945",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: iaa - Fix nr_cpus < nr_iaa case\n\nIf nr_cpus < nr_iaa, the calculated cpus_per_iaa will be 0, which\ncauses a divide-by-0 in rebalance_wq_table().\n\nMake sure cpus_per_iaa is 1 in that case, and also in the nr_iaa == 0\ncase, even though cpus_per_iaa is never used if nr_iaa == 0, for\nparanoia.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8acc896c-3020-4214-91dc-06f36ea2303a",  "id": "CVE-2024-42074",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: acp: add a null check for chip_pdev structure\n\nWhen acp platform device creation is skipped, chip->chip_pdev value will\nremain NULL. Add NULL check for chip->chip_pdev structure in\nsnd_acp_resume() function to avoid null pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dca9b03f-39f2-495b-80d3-afbd10c323fc",  "id": "MGASA-2025-0244",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a93f8e1-e4cc-4bfe-b644-81af9798ca33",  "id": "CVE-2021-46936",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46936"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix use-after-free in tw_timer_handler\n\nA real world panic issue was found as follow in Linux 5.4.\n\n    BUG: unable to handle page fault for address: ffffde49a863de28\n    PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0\n    RIP: 0010:tw_timer_handler+0x20/0x40\n    Call Trace:\n     <IRQ>\n     call_timer_fn+0x2b/0x120\n     run_timer_softirq+0x1ef/0x450\n     __do_softirq+0x10d/0x2b8\n     irq_exit+0xc7/0xd0\n     smp_apic_timer_interrupt+0x68/0x120\n     apic_timer_interrupt+0xf/0x20\n\nThis issue was also reported since 2017 in the thread [1],\nunfortunately, the issue was still can be reproduced after fixing\nDCCP.\n\nThe ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net\nnamespace is destroyed since tcp_sk_ops is registered befrore\nipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops\nin the list of pernet_list. There will be a use-after-free on\nnet->mib.net_statistics in tw_timer_handler after ipv4_mib_exit_net\nif there are some inflight time-wait timers.\n\nThis bug is not introduced by commit f2bf415cfed7 (\"mib: add net to\nNET_ADD_STATS_BH\") since the net_statistics is a global variable\ninstead of dynamic allocation and freeing. Actually, commit\n61a7e26028b9 (\"mib: put net statistics on struct net\") introduces\nthe bug since it put net statistics on struct net and free it when\nnet namespace is destroyed.\n\nMoving init_ipv4_mibs() to the front of tcp_init() to fix this bug\nand replace pr_crit() with panic() since continuing is meaningless\nwhen init_ipv4_mibs() fails.\n\n[1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli=1",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51e225a9-83b6-4fc8-987f-2af762684504",  "id": "CVE-2025-23131",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: prevent NPD when writing a positive value to event_done\n\ndo_uevent returns the value written to event_done. In case it is a\npositive value, new_lockspace would undo all the work, and lockspace\nwould not be set. __dlm_new_lockspace, however, would treat that\npositive value as a success due to commit 8511a2728ab8 (\"dlm: fix use\ncount with multiple joins\").\n\nDown the line, device_create_lockspace would pass that NULL lockspace to\ndlm_find_lockspace_local, leading to a NULL pointer dereference.\n\nTreating such positive values as successes prevents the problem. Given\nthis has been broken for so long, this is unlikely to break userspace\nexpectations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "699b1b30-b30e-4926-91ea-600fa716007b",  "id": "OESA-2026-2437",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3409b6f1-1f33-403b-a583-169546038dfd",  "id": "CVE-2022-33742",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33742"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1deb11fc-2a8a-4ba4-9edf-5cc64fb0f20a",  "id": "CVE-2023-52585",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()\n\nReturn invalid error code -EINVAL for invalid block id.\n\nFixes the below:\n\ndrivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:1183 amdgpu_ras_query_error_status_helper() error: we previously assumed 'info' could be null (see line 1176)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "70cef4a0-6aa6-43ed-9bc5-8e52abfb60bc",  "id": "CVE-2014-1874",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1874"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ce7184cd-e468-4201-8907-c8c681d415ef",  "id": "CVE-2025-60876",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60876"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    284  ],  "analysis": {    "state": "in_triage"  },  "description": "BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "287f2d5e-eccc-444f-99a4-13b9b13f943b",  "id": "CVE-2015-8970",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8970"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "crypto/algif_skcipher.c in the Linux kernel before 4.4.2 does not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51835682-06ca-40e5-ba84-d7279a15bd3b",  "id": "CVE-2021-3773",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3773"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e1c8354a-1b59-4bff-969c-01270c1ec9f6",  "id": "CVE-2022-49615",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error\n\nThe initial settings will be written before the codec probe function.\nBut, the rt711->component doesn't be assigned yet.\nIf IO error happened during initial settings operations, it will cause the kernel panic.\nThis patch changed component->dev to slave->dev to fix this issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "76f6f26d-9201-470b-bd54-8ad32ede9392",  "id": "CVE-2019-17054",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17054"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    276  ],  "analysis": {    "state": "in_triage"  },  "description": "atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-6cc03e8aa36c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "008e9b32-73af-475a-ad41-5b1ad590ff04",  "id": "CVE-2025-71111",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    367  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83791d) Convert macros to functions to avoid TOCTOU\n\nThe macro FAN_FROM_REG evaluates its arguments multiple times. When used\nin lockless contexts involving shared driver data, this leads to\nTime-of-Check to Time-of-Use (TOCTOU) race conditions, potentially\ncausing divide-by-zero errors.\n\nConvert the macro to a static function. This guarantees that arguments\nare evaluated only once (pass-by-value), preventing the race\nconditions.\n\nAdditionally, in store_fan_div, move the calculation of the minimum\nlimit inside the update lock. This ensures that the read-modify-write\nsequence operates on consistent data.\n\nAdhere to the principle of minimal changes by only converting macros\nthat evaluate arguments multiple times and are used in lockless\ncontexts.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "14c2c4ac-84b2-47e2-9f77-1c49ec4bf681",  "id": "CVE-2026-31728",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_ether: Fix race between gether_disconnect and eth_stop\n\nA race condition between gether_disconnect() and eth_stop() leads to a\nNULL pointer dereference. Specifically, if eth_stop() is triggered\nconcurrently while gether_disconnect() is tearing down the endpoints,\neth_stop() attempts to access the cleared endpoint descriptor, causing\nthe following NPE:\n\n  Unable to handle kernel NULL pointer dereference\n  Call trace:\n   __dwc3_gadget_ep_enable+0x60/0x788\n   dwc3_gadget_ep_enable+0x70/0xe4\n   usb_ep_enable+0x60/0x15c\n   eth_stop+0xb8/0x108\n\nBecause eth_stop() crashes while holding the dev->lock, the thread\nrunning gether_disconnect() fails to acquire the same lock and spins\nforever, resulting in a hardlockup:\n\n  Core - Debugging Information for Hardlockup core(7)\n  Call trace:\n   queued_spin_lock_slowpath+0x94/0x488\n   _raw_spin_lock+0x64/0x6c\n   gether_disconnect+0x19c/0x1e8\n   ncm_set_alt+0x68/0x1a0\n   composite_setup+0x6a0/0xc50\n\nThe root cause is that the clearing of dev->port_usb in\ngether_disconnect() is delayed until the end of the function.\n\nMove the clearing of dev->port_usb to the very beginning of\ngether_disconnect() while holding dev->lock. This cuts off the link\nimmediately, ensuring eth_stop() will see dev->port_usb as NULL and\nsafely bail out.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8c5215a9-a31d-4e53-94dc-eae8da085729",  "id": "CVE-2015-0204",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0204"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the \"FREAK\" issue.  NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "850e2349-e701-4255-a786-3f686daf7c65",  "id": "CVE-2019-15213",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15213"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.2.3. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/dvb-usb/dvb-usb-init.c driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b6e281b2-573b-4697-90dd-d7d3eee700a6",  "id": "CVE-2012-3552",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3552"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f6cc36eb-19d0-4a56-86ca-9b686552b4cc",  "id": "OESA-2025-2490",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd7a22f5-483e-4f93-90ad-02cfa9d46808",  "id": "CVE-2022-49651",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsrcu: Tighten cleanup_srcu_struct() GP checks\n\nCurrently, cleanup_srcu_struct() checks for a grace period in progress,\nbut it does not check for a grace period that has not yet started but\nwhich might start at any time.  Such a situation could result in a\nuse-after-free bug, so this commit adds a check for a grace period that\nis needed but not yet started to cleanup_srcu_struct().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b6e3a233-4d74-41cf-831d-05d15775618f",  "id": "CVE-2026-23237",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: classmate-laptop: Add missing NULL pointer checks\n\nIn a few places in the Classmate laptop driver, code using the accel\nobject may run before that object's address is stored in the driver\ndata of the input device using it.\n\nFor example, cmpc_accel_sensitivity_store_v4() is the \"show\" method\nof cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(),\nbefore calling dev_set_drvdata() for inputdev->dev.  If the sysfs\nattribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev)\ncall in in cmpc_accel_sensitivity_store_v4() returns NULL which\nleads to a NULL pointer dereference going forward.\n\nMoreover, sysfs attributes using the input device are added before\ninitializing that device by cmpc_add_acpi_notify_device() and if one\nof them is accessed before running that function, a NULL pointer\ndereference will occur.\n\nFor example, cmpc_accel_sensitivity_attr_v4 is added before calling\ncmpc_add_acpi_notify_device() and if it is read prematurely, the\ndev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4()\nreturns NULL which leads to a NULL pointer dereference going forward.\n\nFix this by adding NULL pointer checks in all of the relevant places.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a436e95e-1581-4609-a1d1-e3fda1cd4080",  "id": "CVE-2016-2107",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2107"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200,    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:39768'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'SNYK:SNYK-COCOAPODS-OPENSSL-471320'"    }  ]},{  "bom-ref": "bb2ff7d1-10a5-4045-b30a-0a9a5275190a",  "id": "CVE-2022-49632",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nicmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.\n\nWhile reading sysctl_icmp_errors_use_inbound_ifaddr, it can be changed\nconcurrently.  Thus, we need to add READ_ONCE() to its reader.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c1f521fb-bee6-4372-9075-c771501aeec0",  "id": "CVE-2021-45469",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45469"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an invalid last xattr entry.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bc1a02e4-5277-4d89-971f-e8c307246724",  "id": "CVE-2019-18675",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18675"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel through 5.3.13 has a start_offset+size Integer Overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its own mmap implementation. This allows local users (with /dev/video0 access) to obtain read and write permissions on kernel physical pages, which can possibly result in a privilege escalation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "98934a9e-1430-457e-a4d1-294097030ef1",  "id": "CVE-2024-46823",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkunit/overflow: Fix UB in overflow_allocation_test\n\nThe 'device_name' array doesn't exist out of the\n'overflow_allocation_test' function scope. However, it is being used as\na driver name when calling 'kunit_driver_create' from\n'kunit_device_register'. It produces the kernel panic with KASAN\nenabled.\n\nSince this variable is used in one place only, remove it and pass the\ndevice name into kunit_device_register directly as an ascii string.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4ddd8f7b-39b2-4065-a50e-ff7723127ba6",  "id": "CVE-2018-25015",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25015"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 4.14.16. There is a use-after-free in net/sctp/socket.c for a held lock after a peel off, aka CID-a0ff660058b8.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eb189e32-7dc2-4fa2-82c0-5200b0aa68d0",  "id": "CVE-2017-9150",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9150"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value available for restricting the output of the print_bpf_insn function, which allows local users to obtain sensitive address information via crafted bpf system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:42048'"    }  ]},{  "bom-ref": "7dadbafe-183b-42fb-8ba6-ff638e22033c",  "id": "CVE-2023-53209",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: Fix possible NULL dereference\n\nIn a call to mac80211_hwsim_select_tx_link() the sta pointer might\nbe NULL, thus need to check that it is not NULL before accessing it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "460ff71a-48e5-4a61-9951-fcc5dd0e5972",  "id": "CVE-2026-23157",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not strictly require dirty metadata threshold for metadata writepages\n\n[BUG]\nThere is an internal report that over 1000 processes are\nwaiting at the io_schedule_timeout() of balance_dirty_pages(), causing\na system hang and trigger a kernel coredump.\n\nThe kernel is v6.4 kernel based, but the root problem still applies to\nany upstream kernel before v6.18.\n\n[CAUSE]\nFrom Jan Kara for his wisdom on the dirty page balance behavior first.\n\n  This cgroup dirty limit was what was actually playing the role here\n  because the cgroup had only a small amount of memory and so the dirty\n  limit for it was something like 16MB.\n\n  Dirty throttling is responsible for enforcing that nobody can dirty\n  (significantly) more dirty memory than there's dirty limit. Thus when\n  a task is dirtying pages it periodically enters into balance_dirty_pages()\n  and we let it sleep there to slow down the dirtying.\n\n  When the system is over dirty limit already (either globally or within\n  a cgroup of the running task), we will not let the task exit from\n  balance_dirty_pages() until the number of dirty pages drops below the\n  limit.\n\n  So in this particular case, as I already mentioned, there was a cgroup\n  with relatively small amount of memory and as a result with dirty limit\n  set at 16MB. A task from that cgroup has dirtied about 28MB worth of\n  pages in btrfs btree inode and these were practically the only dirty\n  pages in that cgroup.\n\nSo that means the only way to reduce the dirty pages of that cgroup is\nto writeback the dirty pages of btrfs btree inode, and only after that\nthose processes can exit balance_dirty_pages().\n\nNow back to the btrfs part, btree_writepages() is responsible for\nwriting back dirty btree inode pages.\n\nThe problem here is, there is a btrfs internal threshold that if the\nbtree inode's dirty bytes are below the 32M threshold, it will not\ndo any writeback.\n\nThis behavior is to batch as much metadata as possible so we won't write\nback those tree blocks and then later re-COW them again for another\nmodification.\n\nThis internal 32MiB is higher than the existing dirty page size (28MiB),\nmeaning no writeback will happen, causing a deadlock between btrfs and\ncgroup:\n\n- Btrfs doesn't want to write back btree inode until more dirty pages\n\n- Cgroup/MM doesn't want more dirty pages for btrfs btree inode\n  Thus any process touching that btree inode is put into sleep until\n  the number of dirty pages is reduced.\n\nThanks Jan Kara a lot for the analysis of the root cause.\n\n[ENHANCEMENT]\nSince kernel commit b55102826d7d (\"btrfs: set AS_KERNEL_FILE on the\nbtree_inode\"), btrfs btree inode pages will only be charged to the root\ncgroup which should have a much larger limit than btrfs' 32MiB\nthreshold.\nSo it should not affect newer kernels.\n\nBut for all current LTS kernels, they are all affected by this problem,\nand backporting the whole AS_KERNEL_FILE may not be a good idea.\n\nEven for newer kernels I still think it's a good idea to get\nrid of the internal threshold at btree_writepages(), since for most cases\ncgroup/MM has a better view of full system memory usage than btrfs' fixed\nthreshold.\n\nFor internal callers using btrfs_btree_balance_dirty() since that\nfunction is already doing internal threshold check, we don't need to\nbother them.\n\nBut for external callers of btree_writepages(), just respect their\nrequests and write back whatever they want, ignoring the internal\nbtrfs threshold to avoid such deadlock on btree inode dirty page\nbalancing.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e1b9df20-9147-4120-ba53-c4dd1f6221bd",  "id": "CVE-2015-8967",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8967"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the \"strict page permissions\" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e925e891-d050-4037-8ada-9aca03d62746",  "id": "ROOT-OS-ALPINE-315-CVE-2024-5535",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b9177c3f-419f-44a5-bcae-5cd8f2ab4566",  "id": "CVE-2026-45923",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: catc: enable basic endpoint checking\n\ncatc_probe() fills three URBs with hardcoded endpoint pipes without\nverifying the endpoint descriptors:\n\n  - usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX\n  - usb_rcvintpipe(usbdev, 2) for interrupt status\n\nA malformed USB device can present these endpoints with transfer types\nthat differ from what the driver assumes.\n\nAdd a catc_usb_ep enum for endpoint numbers, replacing magic constants\nthroughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints()\ncalls after usb_set_interface() to verify endpoint types before use,\nrejecting devices with mismatched descriptors at probe time.\n\nSimilar to\n- commit 90b7f2961798 (\"net: usb: rtl8150: enable basic endpoint checking\")\nwhich fixed the issue in rtl8150.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "01ce2b25-8634-45b7-90e7-f3c9b446dd58",  "id": "CVE-2019-17351",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17351"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of service because of unrestricted resource consumption during the mapping of guest memory, aka CID-6ef36ab967c7.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb037512-308c-4200-a2e2-8182105c0a6f",  "id": "CVE-2023-53295",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Do not update file length for failed writes to inline files\n\nWhen write to inline file fails (or happens only partly), we still\nupdated length of inline data as if the whole write succeeded. Fix the\nupdate of length of inline data to happen only if the write succeeds.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d30c19f6-de6d-4627-a0c3-6f3dc453f366",  "id": "CVE-2019-9497",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9497"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    287,    301  ],  "analysis": {    "state": "in_triage"  },  "description": "The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0fd1b3ac-b1e3-4f5a-aa57-0d377e21e5dd",  "id": "CVE-2022-49158",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix warning message due to adisc being flushed\n\nFix warning message due to adisc being flushed.  Linux kernel triggered a\nwarning message where a different error code type is not matching up with\nthe expected type. Add additional translation of one error code type to\nanother.\n\nWARNING: CPU: 2 PID: 1131623 at drivers/scsi/qla2xxx/qla_init.c:498\nqla2x00_async_adisc_sp_done+0x294/0x2b0 [qla2xxx]\nCPU: 2 PID: 1131623 Comm: drmgr Not tainted 5.13.0-rc1-autotest #1\n..\nGPR28: c000000aaa9c8890 c0080000079ab678 c00000140a104800 c00000002bd19000\nNIP [c00800000790857c] qla2x00_async_adisc_sp_done+0x294/0x2b0 [qla2xxx]\nLR [c008000007908578] qla2x00_async_adisc_sp_done+0x290/0x2b0 [qla2xxx]\nCall Trace:\n[c00000001cdc3620] [c008000007908578] qla2x00_async_adisc_sp_done+0x290/0x2b0 [qla2xxx] (unreliable)\n[c00000001cdc3710] [c0080000078f3080] __qla2x00_abort_all_cmds+0x1b8/0x580 [qla2xxx]\n[c00000001cdc3840] [c0080000078f589c] qla2x00_abort_all_cmds+0x34/0xd0 [qla2xxx]\n[c00000001cdc3880] [c0080000079153d8] qla2x00_abort_isp_cleanup+0x3f0/0x570 [qla2xxx]\n[c00000001cdc3920] [c0080000078fb7e8] qla2x00_remove_one+0x3d0/0x480 [qla2xxx]\n[c00000001cdc39b0] [c00000000071c274] pci_device_remove+0x64/0x120\n[c00000001cdc39f0] [c0000000007fb818] device_release_driver_internal+0x168/0x2a0\n[c00000001cdc3a30] [c00000000070e304] pci_stop_bus_device+0xb4/0x100\n[c00000001cdc3a70] [c00000000070e4f0] pci_stop_and_remove_bus_device+0x20/0x40\n[c00000001cdc3aa0] [c000000000073940] pci_hp_remove_devices+0x90/0x130\n[c00000001cdc3b30] [c0080000070704d0] disable_slot+0x38/0x90 [rpaphp] [\nc00000001cdc3b60] [c00000000073eb4c] power_write_file+0xcc/0x180\n[c00000001cdc3be0] [c0000000007354bc] pci_slot_attr_store+0x3c/0x60\n[c00000001cdc3c00] [c00000000055f820] sysfs_kf_write+0x60/0x80 [c00000001cdc3c20]\n[c00000000055df10] kernfs_fop_write_iter+0x1a0/0x290\n[c00000001cdc3c70] [c000000000447c4c] new_sync_write+0x14c/0x1d0\n[c00000001cdc3d10] [c00000000044b134] vfs_write+0x224/0x330\n[c00000001cdc3d60] [c00000000044b3f4] ksys_write+0x74/0x130\n[c00000001cdc3db0] [c00000000002df70] system_call_exception+0x150/0x2d0\n[c00000001cdc3e10] [c00000000000d45c] system_call_common+0xec/0x278",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18cf2d1e-8efe-46d8-80cd-5d5770c17672",  "id": "CVE-2014-2039",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2039"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by executing a crafted instruction.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e4c9f18c-a012-4818-9408-b81d66cfab7d",  "id": "CVE-2025-21772",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npartitions: mac: fix handling of bogus partition table\n\nFix several issues in partition probing:\n\n - The bailout for a bad partoffset must use put_dev_sector(), since the\n   preceding read_part_sector() succeeded.\n - If the partition table claims a silly sector size like 0xfff bytes\n   (which results in partition table entries straddling sector boundaries),\n   bail out instead of accessing out-of-bounds memory.\n - We must not assume that the partition table contains proper NUL\n   termination - use strnlen() and strncmp() instead of strlen() and\n   strcmp().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "740cafc5-0d08-4e92-bec4-c66a99ff5ddb",  "id": "ALSA-2026:19066",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0914770-376b-4103-817c-b340ccd7f337",  "id": "CVE-2015-8539",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8539"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    269  ],  "analysis": {    "state": "in_triage"  },  "description": "The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "87013a50-9270-4e5f-8505-b717a0db1354",  "id": "CVE-2025-38700",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated\n\nIn case of an ib_fast_reg_mr allocation failure during iSER setup, the\nmachine hits a panic because iscsi_conn->dd_data is initialized\nunconditionally, even when no memory is allocated (dd_size == 0).  This\nleads invalid pointer dereference during connection teardown.\n\nFix by setting iscsi_conn->dd_data only if memory is actually allocated.\n\nPanic trace:\n------------\n iser: iser_create_fastreg_desc: Failed to allocate ib_fast_reg_mr err=-12\n iser: iser_alloc_rx_descriptors: failed allocating rx descriptors / data buffers\n BUG: unable to handle page fault for address: fffffffffffffff8\n RIP: 0010:swake_up_locked.part.5+0xa/0x40\n Call Trace:\n  complete+0x31/0x40\n  iscsi_iser_conn_stop+0x88/0xb0 [ib_iser]\n  iscsi_stop_conn+0x66/0xc0 [scsi_transport_iscsi]\n  iscsi_if_stop_conn+0x14a/0x150 [scsi_transport_iscsi]\n  iscsi_if_rx+0x1135/0x1834 [scsi_transport_iscsi]\n  ? netlink_lookup+0x12f/0x1b0\n  ? netlink_deliver_tap+0x2c/0x200\n  netlink_unicast+0x1ab/0x280\n  netlink_sendmsg+0x257/0x4f0\n  ? _copy_from_user+0x29/0x60\n  sock_sendmsg+0x5f/0x70",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c0ae69c-af2b-4a64-b9ac-52f7cf7e0ed5",  "id": "CVE-2020-12656",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12656"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel through 5.6.10 lacks certain domain_release calls, leading to a memory leak. Note: This was disputed with the assertion that the issue does not grant any access not already available. It is a problem that on unloading a specific kernel module some memory is leaked, but loading kernel modules is a privileged operation. A user could also write a kernel module to consume any amount of memory they like and load that replicating the effect of this bug",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "519d947e-4708-4114-ab19-9571b8322724",  "id": "CVE-2015-2877",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2877"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection (CAIN) attack.  NOTE: the vendor states \"Basically if you care about this attack vector, disable deduplication.\" Share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure, and can be classified as potentially misunderstood behaviors rather than vulnerabilities",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d3881e5-a5ea-489f-a303-e74f59223693",  "id": "CVE-2018-1093",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1093"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb437354-38e9-4176-b627-12e6337489ad",  "id": "SUSE-SU-2016:3257-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff8abad5-1881-4d28-8078-c8a832b9e3f9",  "id": "CVE-2022-50019",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: Fix refcount leak bug in ucc_uart.c\n\nIn soc_info(), of_find_node_by_type() will return a node pointer\nwith refcount incremented. We should use of_node_put() when it is\nnot used anymore.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d27ec8d0-1fa7-44b3-b85c-72ee1a557abc",  "id": "ROOT-OS-DEBIAN-12-CVE-2026-75803",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c189f3b-71d2-48d3-8835-22562a963f89",  "id": "CVE-2019-19073",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19073"  },  "ratings": [    {      "score": 4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, and the htc_connect_service() function, aka CID-853acf7caf10.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e8eb8976-83a2-4c41-a227-d8500e010e36",  "id": "CVE-2024-42232",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix race between delayed_work() and ceph_monc_stop()\n\nThe way the delayed work is handled in ceph_monc_stop() is prone to\nraces with mon_fault() and possibly also finish_hunting().  Both of\nthese can requeue the delayed work which wouldn't be canceled by any of\nthe following code in case that happens after cancel_delayed_work_sync()\nruns -- __close_session() doesn't mess with the delayed work in order\nto avoid interfering with the hunting interval logic.  This part was\nmissed in commit b5d91704f53e (\"libceph: behave in mon_fault() if\ncur_mon < 0\") and use-after-free can still ensue on monc and objects\nthat hang off of it, with monc->auth and monc->monmap being\nparticularly susceptible to quickly being reused.\n\nTo fix this:\n\n- clear monc->cur_mon and monc->hunting as part of closing the session\n  in ceph_monc_stop()\n- bail from delayed_work() if monc->cur_mon is cleared, similar to how\n  it's done in mon_fault() and finish_hunting() (based on monc->hunting)\n- call cancel_delayed_work_sync() after the session is closed",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4bc195ed-d0d9-4c75-826f-2e8ea4868a16",  "id": "CVE-2016-9794",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9794"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted SNDRV_PCM_TRIGGER_START command.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "de7add20-348f-4139-9c71-2e60da58f2c7",  "id": "SUSE-SU-2022:1288-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2e50db5-2dbf-4b3f-9c57-8effc5b2a02e",  "id": "CVE-2017-8924",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8924"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b79f5cd9-ecdf-483f-9736-61cec3ec6979",  "id": "CVE-2024-42104",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: add missing check for inode numbers on directory entries\n\nSyzbot reported that mounting and unmounting a specific pattern of\ncorrupted nilfs2 filesystem images causes a use-after-free of metadata\nfile inodes, which triggers a kernel bug in lru_add_fn().\n\nAs Jan Kara pointed out, this is because the link count of a metadata file\ngets corrupted to 0, and nilfs_evict_inode(), which is called from iput(),\ntries to delete that inode (ifile inode in this case).\n\nThe inconsistency occurs because directories containing the inode numbers\nof these metadata files that should not be visible in the namespace are\nread without checking.\n\nFix this issue by treating the inode numbers of these internal files as\nerrors in the sanity check helper when reading directory folios/pages.\n\nAlso thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer\nanalysis.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'SNYK:SNYK-UNMANAGED-TORVALDSLINUX-20696766'"    }  ]},{  "bom-ref": "bd02c87d-8ec5-4242-bb51-c2e0d61d912a",  "id": "CVE-2024-53195",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Get rid of userspace_irqchip_in_use\n\nImproper use of userspace_irqchip_in_use led to syzbot hitting the\nfollowing WARN_ON() in kvm_timer_update_irq():\n\nWARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/arch_timer.c:459\nkvm_timer_update_irq+0x21c/0x394\nCall trace:\n  kvm_timer_update_irq+0x21c/0x394 arch/arm64/kvm/arch_timer.c:459\n  kvm_timer_vcpu_reset+0x158/0x684 arch/arm64/kvm/arch_timer.c:968\n  kvm_reset_vcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264\n  kvm_vcpu_set_target arch/arm64/kvm/arm.c:1553 [inline]\n  kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1573 [inline]\n  kvm_arch_vcpu_ioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695\n  kvm_vcpu_ioctl+0x4ec/0xf74 virt/kvm/kvm_main.c:4658\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\n  __se_sys_ioctl fs/ioctl.c:893 [inline]\n  __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893\n  __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n  invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49\n  el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132\n  do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151\n  el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712\n  el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730\n  el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598\n\nThe following sequence led to the scenario:\n - Userspace creates a VM and a vCPU.\n - The vCPU is initialized with KVM_ARM_VCPU_PMU_V3 during\n   KVM_ARM_VCPU_INIT.\n - Without any other setup, such as vGIC or vPMU, userspace issues\n   KVM_RUN on the vCPU. Since the vPMU is requested, but not setup,\n   kvm_arm_pmu_v3_enable() fails in kvm_arch_vcpu_run_pid_change().\n   As a result, KVM_RUN returns after enabling the timer, but before\n   incrementing 'userspace_irqchip_in_use':\n   kvm_arch_vcpu_run_pid_change()\n       ret = kvm_arm_pmu_v3_enable()\n           if (!vcpu->arch.pmu.created)\n               return -EINVAL;\n       if (ret)\n           return ret;\n       [...]\n       if (!irqchip_in_kernel(kvm))\n           static_branch_inc(&userspace_irqchip_in_use);\n - Userspace ignores the error and issues KVM_ARM_VCPU_INIT again.\n   Since the timer is already enabled, control moves through the\n   following flow, ultimately hitting the WARN_ON():\n   kvm_timer_vcpu_reset()\n       if (timer->enabled)\n          kvm_timer_update_irq()\n              if (!userspace_irqchip())\n                  ret = kvm_vgic_inject_irq()\n                      ret = vgic_lazy_init()\n                          if (unlikely(!vgic_initialized(kvm)))\n                              if (kvm->arch.vgic.vgic_model !=\n                                  KVM_DEV_TYPE_ARM_VGIC_V2)\n                                      return -EBUSY;\n                  WARN_ON(ret);\n\nTheoretically, since userspace_irqchip_in_use's functionality can be\nsimply replaced by '!irqchip_in_kernel()', get rid of the static key\nto avoid the mismanagement, which also helps with the syzbot issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d3c6043-a24f-4ccc-96ad-ffbff266fa86",  "id": "CVE-2011-1019",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1019"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The dev_load function in net/core/dev.c in the Linux kernel before 2.6.38 allows local users to bypass an intended CAP_SYS_MODULE capability requirement and load arbitrary modules by leveraging the CAP_NET_ADMIN capability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e4550319-d7c0-4eac-8702-071d3c3fedf6",  "id": "CVE-2022-50463",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/52xx: Fix a resource leak in an error handling path\n\nThe error handling path of mpc52xx_lpbfifo_probe() has a request_irq()\nthat is not balanced by a corresponding free_irq().\n\nAdd the missing call, as already done in the remove function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ba914a78-df67-4df3-8d19-7ddc0eaac037",  "id": "CVE-2021-22555",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22555"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:50135'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'MSF:netfilter_xtables_heap_oob_write_priv_esc'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'PSS:163528/Linux-Kernel-Netfilter-Heap-Out-Of-Bounds-Write.html'"    },    {      "name": "EMBA:sbom:4:exploit",      "value": "'PSS:179985/Linux-xt_compat_target_from_user-Heap-Out-Of-Bounds-Write.html'"    }  ]},{  "bom-ref": "954df801-5257-4da7-827a-892f71e09237",  "id": "CVE-2024-46843",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Remove SCSI host only if added\n\nIf host tries to remove ufshcd driver from a UFS device it would cause a\nkernel panic if ufshcd_async_scan fails during ufshcd_probe_hba before\nadding a SCSI host with scsi_add_host and MCQ is enabled since SCSI host\nhas been defered after MCQ configuration introduced by commit 0cab4023ec7b\n(\"scsi: ufs: core: Defer adding host to SCSI if MCQ is supported\").\n\nTo guarantee that SCSI host is removed only if it has been added, set the\nscsi_host_added flag to true after adding a SCSI host and check whether it\nis set or not before removing it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8500ec74-00df-4836-b69a-7934cb68737c",  "id": "CVE-2018-5814",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5814"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4f9425e4-6bfb-44de-8e36-f0b16573d0fc",  "id": "CVE-2016-3136",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3136"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device without two interrupt-in endpoint descriptors.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:39541'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:136140/Linux-mct_u232-Null-Pointer-Dereference.html'"    }  ]},{  "bom-ref": "b5c2e389-0895-433a-8734-75d483527a75",  "id": "CVE-2016-1583",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1583"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:39992'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:137560/Linux-ecryptfs-Stack-Overflow.html'"    }  ]},{  "bom-ref": "61f49772-64a2-4b1f-a3d2-fce097185b96",  "id": "CVE-2021-47612",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47612"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fix segfault in nfc_genl_dump_devices_done\n\nWhen kmalloc in nfc_genl_dump_devices() fails then\nnfc_genl_dump_devices_done() segfaults as below\n\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 0 PID: 25 Comm: kworker/0:1 Not tainted 5.16.0-rc4-01180-g2a987e65025e-dirty #5\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-6.fc35 04/01/2014\nWorkqueue: events netlink_sock_destruct_work\nRIP: 0010:klist_iter_exit+0x26/0x80\nCall Trace:\n<TASK>\nclass_dev_iter_exit+0x15/0x20\nnfc_genl_dump_devices_done+0x3b/0x50\ngenl_lock_done+0x84/0xd0\nnetlink_sock_destruct+0x8f/0x270\n__sk_destruct+0x64/0x3b0\nsk_destruct+0xa8/0xd0\n__sk_free+0x2e8/0x3d0\nsk_free+0x51/0x90\nnetlink_sock_destruct_work+0x1c/0x20\nprocess_one_work+0x411/0x710\nworker_thread+0x6fd/0xa80",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4167ce28-89a6-47e0-a4af-bf0389eaa451",  "id": "DLA-1532-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c971ce7-5aba-4378-bf4a-436cb954aa37",  "id": "DLA-1921-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c59c8a0b-9c0d-41ce-ad0b-d632015cf9ea",  "id": "CVE-2019-15214",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15214"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "89427950-ba8b-4d76-81bb-3e8c92b2f51d",  "id": "CVE-2024-42068",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    252  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()\n\nset_memory_ro() can fail, leaving memory unprotected.\n\nCheck its return and take it into account as an error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2c1daa47-7531-4b97-b4f1-3fffabcd52e2",  "id": "CVE-2024-23850",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23850"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolume can be read out too soon after its root item is inserted upon subvolume creation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45609267-a6fd-4b04-9b63-c126a114c93c",  "id": "CVE-2010-5328",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5328"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group ID of zero from reaching the swapper process, which allows local users to cause a denial of service (system crash) by leveraging access to this process group.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c02c1c43-14ea-47c6-8270-8aa69b16d883",  "id": "CVE-2016-2549",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2549"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "sound/core/hrtimer.c in the Linux kernel before 4.4.1 does not prevent recursive callback access, which allows local users to cause a denial of service (deadlock) via a crafted ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "88060d3f-1975-47b5-9e86-1469743eb643",  "id": "CVE-2024-41089",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes\n\nIn nv17_tv_get_hd_modes(), the return value of drm_mode_duplicate() is\nassigned to mode, which will lead to a possible NULL pointer dereference\non failure of drm_mode_duplicate(). The same applies to drm_cvt_mode().\nAdd a check to avoid null pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f5da37e6-06fd-4c5c-929a-108e5cb90db6",  "id": "CVE-2024-57807",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: megaraid_sas: Fix for a potential deadlock\n\nThis fixes a 'possible circular locking dependency detected' warning\n      CPU0                    CPU1\n      ----                    ----\n lock(&instance->reset_mutex);\n                              lock(&shost->scan_mutex);\n                              lock(&instance->reset_mutex);\n lock(&shost->scan_mutex);\n\nFix this by temporarily releasing the reset_mutex.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e6f26a79-fdf4-40d0-83aa-efc6b0589f77",  "id": "CVE-2023-53622",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix possible data races in gfs2_show_options()\n\nSome fields such as gt_logd_secs of the struct gfs2_tune are accessed\nwithout holding the lock gt_spin in gfs2_show_options():\n\n  val = sdp->sd_tune.gt_logd_secs;\n  if (val != 30)\n    seq_printf(s, \",commit=%d\", val);\n\nAnd thus can cause data races when gfs2_show_options() and other functions\nsuch as gfs2_reconfigure() are concurrently executed:\n\n  spin_lock(&gt->gt_spin);\n  gt->gt_logd_secs = newargs->ar_commit;\n\nTo fix these possible data races, the lock sdp->sd_tune.gt_spin is\nacquired before accessing the fields of gfs2_tune and released after these\naccesses.\n\nFurther changes by Andreas:\n\n- Don't hold the spin lock over the seq_printf operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32689be2-a0e8-4492-a94f-d0febd24d107",  "id": "CVE-2022-49295",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: call genl_unregister_family() first in nbd_cleanup()\n\nOtherwise there may be race between module removal and the handling of\nnetlink command, which can lead to the oops as shown below:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000098\n  Oops: 0002 [#1] SMP PTI\n  CPU: 1 PID: 31299 Comm: nbd-client Tainted: G            E     5.14.0-rc4\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n  RIP: 0010:down_write+0x1a/0x50\n  Call Trace:\n   start_creating+0x89/0x130\n   debugfs_create_dir+0x1b/0x130\n   nbd_start_device+0x13d/0x390 [nbd]\n   nbd_genl_connect+0x42f/0x748 [nbd]\n   genl_family_rcv_msg_doit.isra.0+0xec/0x150\n   genl_rcv_msg+0xe5/0x1e0\n   netlink_rcv_skb+0x55/0x100\n   genl_rcv+0x29/0x40\n   netlink_unicast+0x1a8/0x250\n   netlink_sendmsg+0x21b/0x430\n   ____sys_sendmsg+0x2a4/0x2d0\n   ___sys_sendmsg+0x81/0xc0\n   __sys_sendmsg+0x62/0xb0\n   __x64_sys_sendmsg+0x1f/0x30\n   do_syscall_64+0x3b/0xc0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n  Modules linked in: nbd(E-)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4b8c186a-9691-4b02-9814-e20604a03740",  "id": "CVE-2024-42280",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: Fix a use after free in hfcmulti_tx()\n\nDon't dereference *sp after calling dev_kfree_skb(*sp).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0e8be449-11dc-4f81-8670-04863491069a",  "id": "CVE-2013-3237",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3237"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "14395445-809a-4f47-ae0d-742e32a17dac",  "id": "CVE-2015-3291",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3291"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    17  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform does not properly determine when nested NMI processing is occurring, which allows local users to cause a denial of service (skipped NMI) by modifying the rsp register, issuing a syscall instruction, and triggering an NMI.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef3ae1de-24a2-4f02-afe5-67da90d20cea",  "id": "CVE-2017-16643",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16643"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fb4856e7-94e3-4dd8-a42d-40406c9bc616",  "id": "CVE-2021-33655",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33655"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c263855-ead7-46ad-bf46-6e951f34af64",  "id": "CVE-2012-2319",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2319"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple buffer overflows in the hfsplus filesystem implementation in the Linux kernel before 3.3.5 allow local users to gain privileges via a crafted HFS plus filesystem, a related issue to CVE-2009-4020.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f7fe8b5e-4e3e-4968-9baa-f1878c7ff584",  "id": "AZL-9815",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "53a5e564-48d9-4077-b8fd-d37f0408e35c",  "id": "CVE-2022-0382",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0382"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. This issue is limited to no more than 7 bytes, and the user cannot control what is read. This flaw affects the Linux kernel versions prior to 5.17-rc1.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04f81c67-3904-4bc1-a3aa-f27dfc8b41a9",  "id": "SUSE-SU-2018:2928-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6772ac20-56dd-458f-836c-020510cc20bc",  "id": "AZL-89922",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2320d90c-e45c-4f4e-b91e-616811fed4f7",  "id": "CVE-2026-31575",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/userfaultfd: fix hugetlb fault mutex hash calculation\n\nIn mfill_atomic_hugetlb(), linear_page_index() is used to calculate the\npage index for hugetlb_fault_mutex_hash().  However, linear_page_index()\nreturns the index in PAGE_SIZE units, while hugetlb_fault_mutex_hash()\nexpects the index in huge page units.  This mismatch means that different\naddresses within the same huge page can produce different hash values,\nleading to the use of different mutexes for the same huge page.  This can\ncause races between faulting threads, which can corrupt the reservation\nmap and trigger the BUG_ON in resv_map_release().\n\nFix this by introducing hugetlb_linear_page_index(), which returns the\npage index in huge page granularity, and using it in place of\nlinear_page_index().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "196366db-5d64-493d-93c2-e42217baa9fd",  "id": "CVE-2022-49731",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()\n\nIn an unlikely (and probably wrong?) case that the 'ppi' parameter of\nata_host_alloc_pinfo() points to an array starting with a NULL pointer,\nthere's going to be a kernel oops as the 'pi' local variable won't get\nreassigned from the initial value of NULL. Initialize 'pi' instead to\n'&ata_dummy_port_info' to fix the possible kernel oops for good...\n\nFound by Linux Verification Center (linuxtesting.org) with the SVACE static\nanalysis tool.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e261e4c6-85f8-4e32-a662-058e4fe4e4e9",  "id": "CVE-2024-43909",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/pm: Fix the null pointer dereference for smu7\n\noptimize the code to avoid pass a null pointer (hwmgr->backend)\nto function smu7_update_edc_leakage_table.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "efa13bba-1ae3-4d34-9d3f-a8f0e993216d",  "id": "DLA-2563-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d050cb03-1e54-4840-a5fe-836338954892",  "id": "DSA-4844-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9053769d-51cc-4aee-aeec-ae622ccb8bb0",  "id": "CVE-2024-49904",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: add list empty check to avoid null pointer issue\n\nAdd list empty check to avoid null pointer issues in some corner cases.\n- list_for_each_entry_safe()",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2c23525f-a34c-4cbc-b5fb-7d87f474faef",  "id": "CVE-2024-46842",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info\n\nThe MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the\nroutine unconditionally frees submitted mailbox commands regardless of\nreturn status.  The issue is that for MBX_TIMEOUT cases, when firmware\nreturns SFP information at a later time, that same mailbox memory region\nreferences previously freed memory in its cmpl routine.\n\nFix by adding checks for the MBX_TIMEOUT return code.  During mailbox\nresource cleanup, check the mbox flag to make sure that the wait did not\ntimeout.  If the MBOX_WAKE flag is not set, then do not free the resources\nbecause it will be freed when firmware completes the mailbox at a later\ntime in its cmpl routine.\n\nAlso, increase the timeout from 30 to 60 seconds to accommodate boot\nscripts requiring longer timeouts.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bda08439-b9f1-405c-a81b-47381fe70c99",  "id": "RHSA-2014:0679",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "58b6521e-c38a-48d8-94b8-0312672e98b4",  "id": "CVE-2020-11565",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11565"  },  "ratings": [    {      "score": 6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability because the issue “is a bug in parsing mount options which can only be specified by a privileged user, so triggering the bug does not grant any powers not already held.”",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7668cd6b-8d53-4356-9ff1-b3ebed5fbbf2",  "id": "CVE-2022-50408",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()\n\n> ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb);\n\nmay be schedule, and then complete before the line\n\n> ndev->stats.tx_bytes += skb->len;\n\n[   46.912801] ==================================================================\n[   46.920552] BUG: KASAN: use-after-free in brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac]\n[   46.928673] Read of size 4 at addr ffffff803f5882e8 by task systemd-resolve/328\n[   46.935991]\n[   46.937514] CPU: 1 PID: 328 Comm: systemd-resolve Tainted: G           O      5.4.199-[REDACTED] #1\n[   46.947255] Hardware name: [REDACTED]\n[   46.954568] Call trace:\n[   46.957037]  dump_backtrace+0x0/0x2b8\n[   46.960719]  show_stack+0x24/0x30\n[   46.964052]  dump_stack+0x128/0x194\n[   46.967557]  print_address_description.isra.0+0x64/0x380\n[   46.972877]  __kasan_report+0x1d4/0x240\n[   46.976723]  kasan_report+0xc/0x18\n[   46.980138]  __asan_report_load4_noabort+0x18/0x20\n[   46.985027]  brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac]\n[   46.990613]  dev_hard_start_xmit+0x1bc/0xda0\n[   46.994894]  sch_direct_xmit+0x198/0xd08\n[   46.998827]  __qdisc_run+0x37c/0x1dc0\n[   47.002500]  __dev_queue_xmit+0x1528/0x21f8\n[   47.006692]  dev_queue_xmit+0x24/0x30\n[   47.010366]  neigh_resolve_output+0x37c/0x678\n[   47.014734]  ip_finish_output2+0x598/0x2458\n[   47.018927]  __ip_finish_output+0x300/0x730\n[   47.023118]  ip_output+0x2e0/0x430\n[   47.026530]  ip_local_out+0x90/0x140\n[   47.030117]  igmpv3_sendpack+0x14c/0x228\n[   47.034049]  igmpv3_send_cr+0x384/0x6b8\n[   47.037895]  igmp_ifc_timer_expire+0x4c/0x118\n[   47.042262]  call_timer_fn+0x1cc/0xbe8\n[   47.046021]  __run_timers+0x4d8/0xb28\n[   47.049693]  run_timer_softirq+0x24/0x40\n[   47.053626]  __do_softirq+0x2c0/0x117c\n[   47.057387]  irq_exit+0x2dc/0x388\n[   47.060715]  __handle_domain_irq+0xb4/0x158\n[   47.064908]  gic_handle_irq+0x58/0xb0\n[   47.068581]  el0_irq_naked+0x50/0x5c\n[   47.072162]\n[   47.073665] Allocated by task 328:\n[   47.077083]  save_stack+0x24/0xb0\n[   47.080410]  __kasan_kmalloc.isra.0+0xc0/0xe0\n[   47.084776]  kasan_slab_alloc+0x14/0x20\n[   47.088622]  kmem_cache_alloc+0x15c/0x468\n[   47.092643]  __alloc_skb+0xa4/0x498\n[   47.096142]  igmpv3_newpack+0x158/0xd78\n[   47.099987]  add_grhead+0x210/0x288\n[   47.103485]  add_grec+0x6b0/0xb70\n[   47.106811]  igmpv3_send_cr+0x2e0/0x6b8\n[   47.110657]  igmp_ifc_timer_expire+0x4c/0x118\n[   47.115027]  call_timer_fn+0x1cc/0xbe8\n[   47.118785]  __run_timers+0x4d8/0xb28\n[   47.122457]  run_timer_softirq+0x24/0x40\n[   47.126389]  __do_softirq+0x2c0/0x117c\n[   47.130142]\n[   47.131643] Freed by task 180:\n[   47.134712]  save_stack+0x24/0xb0\n[   47.138041]  __kasan_slab_free+0x108/0x180\n[   47.142146]  kasan_slab_free+0x10/0x18\n[   47.145904]  slab_free_freelist_hook+0xa4/0x1b0\n[   47.150444]  kmem_cache_free+0x8c/0x528\n[   47.154292]  kfree_skbmem+0x94/0x108\n[   47.157880]  consume_skb+0x10c/0x5a8\n[   47.161466]  __dev_kfree_skb_any+0x88/0xa0\n[   47.165598]  brcmu_pkt_buf_free_skb+0x44/0x68 [brcmutil]\n[   47.171023]  brcmf_txfinalize+0xec/0x190 [brcmfmac]\n[   47.176016]  brcmf_proto_bcdc_txcomplete+0x1c0/0x210 [brcmfmac]\n[   47.182056]  brcmf_sdio_sendfromq+0x8dc/0x1e80 [brcmfmac]\n[   47.187568]  brcmf_sdio_dpc+0xb48/0x2108 [brcmfmac]\n[   47.192529]  brcmf_sdio_dataworker+0xc8/0x238 [brcmfmac]\n[   47.197859]  process_one_work+0x7fc/0x1a80\n[   47.201965]  worker_thread+0x31c/0xc40\n[   47.205726]  kthread+0x2d8/0x370\n[   47.208967]  ret_from_fork+0x10/0x18\n[   47.212546]\n[   47.214051] The buggy address belongs to the object at ffffff803f588280\n[   47.214051]  which belongs to the cache skbuff_head_cache of size 208\n[   47.227086] The buggy address is located 104 bytes inside of\n[   47.227086]  208-byte region [ffffff803f588280, ffffff803f588350)\n[   47.238814] The buggy address belongs to the page:\n[   47.243618] page:ffffffff00dd6200 refcount:1 mapcou\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0f9f65cb-5edb-4f55-9a95-f989eafd8ab1",  "id": "CVE-2023-1192",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1192"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bfd327b7-0e7f-4762-aab7-31d7ffa89ebc",  "id": "CVE-2018-1091",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1091"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119,    391  ],  "analysis": {    "state": "in_triage"  },  "description": "In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "00cb33d9-fe3c-4c67-b543-ae462f7e8f46",  "id": "CVE-2022-50504",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/rtas: avoid scheduling in rtas_os_term()\n\nIt's unsafe to use rtas_busy_delay() to handle a busy status from\nthe ibm,os-term RTAS function in rtas_os_term():\n\nKernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\nBUG: sleeping function called from invalid context at arch/powerpc/kernel/rtas.c:618\nin_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0\npreempt_count: 2, expected: 0\nCPU: 7 PID: 1 Comm: swapper/0 Tainted: G      D            6.0.0-rc5-02182-gf8553a572277-dirty #9\nCall Trace:\n[c000000007b8f000] [c000000001337110] dump_stack_lvl+0xb4/0x110 (unreliable)\n[c000000007b8f040] [c0000000002440e4] __might_resched+0x394/0x3c0\n[c000000007b8f0e0] [c00000000004f680] rtas_busy_delay+0x120/0x1b0\n[c000000007b8f100] [c000000000052d04] rtas_os_term+0xb8/0xf4\n[c000000007b8f180] [c0000000001150fc] pseries_panic+0x50/0x68\n[c000000007b8f1f0] [c000000000036354] ppc_panic_platform_handler+0x34/0x50\n[c000000007b8f210] [c0000000002303c4] notifier_call_chain+0xd4/0x1c0\n[c000000007b8f2b0] [c0000000002306cc] atomic_notifier_call_chain+0xac/0x1c0\n[c000000007b8f2f0] [c0000000001d62b8] panic+0x228/0x4d0\n[c000000007b8f390] [c0000000001e573c] do_exit+0x140c/0x1420\n[c000000007b8f480] [c0000000001e586c] make_task_dead+0xdc/0x200\n\nUse rtas_busy_delay_time() instead, which signals without side effects\nwhether to attempt the ibm,os-term RTAS call again.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a66f5475-641b-4d93-a91a-e0cc0347699d",  "id": "CVE-2016-7117",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7117"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    19  ],  "analysis": {    "state": "in_triage"  },  "description": "Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "66279987-0080-44a6-9e13-96bcb0ee4764",  "id": "CVE-2021-31916",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31916"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4a1d084a-1b3c-469a-9814-2dad4b2d98a5",  "id": "CVE-2022-49327",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: avoid journal no-space deadlock by reserving 1 journal bucket\n\nThe journal no-space deadlock was reported time to time. Such deadlock\ncan happen in the following situation.\n\nWhen all journal buckets are fully filled by active jset with heavy\nwrite I/O load, the cache set registration (after a reboot) will load\nall active jsets and inserting them into the btree again (which is\ncalled journal replay). If a journaled bkey is inserted into a btree\nnode and results btree node split, new journal request might be\ntriggered. For example, the btree grows one more level after the node\nsplit, then the root node record in cache device super block will be\nupgrade by bch_journal_meta() from bch_btree_set_root(). But there is no\nspace in journal buckets, the journal replay has to wait for new journal\nbucket to be reclaimed after at least one journal bucket replayed. This\nis one example that how the journal no-space deadlock happens.\n\nThe solution to avoid the deadlock is to reserve 1 journal bucket in\nrun time, and only permit the reserved journal bucket to be used during\ncache set registration procedure for things like journal replay. Then\nthe journal space will never be fully filled, there is no chance for\njournal no-space deadlock to happen anymore.\n\nThis patch adds a new member \"bool do_reserve\" in struct journal, it is\ninititalized to 0 (false) when struct journal is allocated, and set to\n1 (true) by bch_journal_space_reserve() when all initialization done in\nrun_cache_set(). In the run time when journal_reclaim() tries to\nallocate a new journal bucket, free_journal_buckets() is called to check\nwhether there are enough free journal buckets to use. If there is only\n1 free journal bucket and journal->do_reserve is 1 (true), the last\nbucket is reserved and free_journal_buckets() will return 0 to indicate\nno free journal bucket. Then journal_reclaim() will give up, and try\nnext time to see whetheer there is free journal bucket to allocate. By\nthis method, there is always 1 jouranl bucket reserved in run time.\n\nDuring the cache set registration, journal->do_reserve is 0 (false), so\nthe reserved journal bucket can be used to avoid the no-space deadlock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "930ef0e2-61cb-4ec3-93bd-5d99fcf2e41d",  "id": "CVE-2026-23460",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rose: fix NULL pointer dereference in rose_transmit_link on reconnect\n\nsyzkaller reported a bug [1], and the reproducer is available at [2].\n\nROSE sockets use four sk->sk_state values: TCP_CLOSE, TCP_LISTEN,\nTCP_SYN_SENT, and TCP_ESTABLISHED. rose_connect() already rejects\ncalls for TCP_ESTABLISHED (-EISCONN) and TCP_CLOSE with SS_CONNECTING\n(-ECONNREFUSED), but lacks a check for TCP_SYN_SENT.\n\nWhen rose_connect() is called a second time while the first connection\nattempt is still in progress (TCP_SYN_SENT), it overwrites\nrose->neighbour via rose_get_neigh(). If that returns NULL, the socket\nis left with rose->state == ROSE_STATE_1 but rose->neighbour == NULL.\nWhen the socket is subsequently closed, rose_release() sees\nROSE_STATE_1 and calls rose_write_internal() ->\nrose_transmit_link(skb, NULL), causing a NULL pointer dereference.\n\nPer connect(2), a second connect() while a connection is already in\nprogress should return -EALREADY. Add this missing check for\nTCP_SYN_SENT to complete the state validation in rose_connect().\n\n[1] https://syzkaller.appspot.com/bug?extid=d00f90e0af54102fb271\n[2] https://gist.github.com/mrpre/9e6779e0d13e2c66779b1653fef80516",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4c7a6a6d-c15e-485c-abcb-690708f28bd1",  "id": "CVE-2024-42228",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc\n\nInitialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001.\nV2: To really improve the handling we would actually\n   need to have a separate value of 0xffffffff.(Christian)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6389e50a-5b34-49f4-93d6-8c27cfba52b3",  "id": "CVE-2023-53620",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix soft lockup in status_resync\n\nstatus_resync() will calculate 'curr_resync - recovery_active' to show\nuser a progress bar like following:\n\n[============>........]  resync = 61.4%\n\n'curr_resync' and 'recovery_active' is updated in md_do_sync(), and\nstatus_resync() can read them concurrently, hence it's possible that\n'curr_resync - recovery_active' can overflow to a huge number. In this\ncase status_resync() will be stuck in the loop to print a large amount\nof '=', which will end up soft lockup.\n\nFix the problem by setting 'resync' to MD_RESYNC_ACTIVE in this case,\nthis way resync in progress will be reported to user.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ce7ae215-28dc-4252-95e5-acff5b2944df",  "id": "SUSE-SU-2020:14295-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e56b8ef4-e1cb-403f-b00c-e738c80d72df",  "id": "CVE-2022-49111",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix use after free in hci_send_acl\n\nThis fixes the following trace caused by receiving\nHCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without\nfirst checking if conn->type is in fact AMP_LINK and in case it is\ndo properly cleanup upper layers with hci_disconn_cfm:\n\n ==================================================================\n    BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50\n    Read of size 8 at addr ffff88800e404818 by task bluetoothd/142\n\n    CPU: 0 PID: 142 Comm: bluetoothd Not tainted\n    5.17.0-rc5-00006-gda4022eeac1a #7\n    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n    rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n    Call Trace:\n     <TASK>\n     dump_stack_lvl+0x45/0x59\n     print_address_description.constprop.0+0x1f/0x150\n     kasan_report.cold+0x7f/0x11b\n     hci_send_acl+0xaba/0xc50\n     l2cap_do_send+0x23f/0x3d0\n     l2cap_chan_send+0xc06/0x2cc0\n     l2cap_sock_sendmsg+0x201/0x2b0\n     sock_sendmsg+0xdc/0x110\n     sock_write_iter+0x20f/0x370\n     do_iter_readv_writev+0x343/0x690\n     do_iter_write+0x132/0x640\n     vfs_writev+0x198/0x570\n     do_writev+0x202/0x280\n     do_syscall_64+0x38/0x90\n     entry_SYSCALL_64_after_hwframe+0x44/0xae\n    RSP: 002b:00007ffce8a099b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014\n    Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3\n    0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 14 00 00 00 0f 05\n    <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10\n    RDX: 0000000000000001 RSI: 00007ffce8a099e0 RDI: 0000000000000015\n    RAX: ffffffffffffffda RBX: 00007ffce8a099e0 RCX: 00007f788fc3cf77\n    R10: 00007ffce8af7080 R11: 0000000000000246 R12: 000055e4ccf75580\n    RBP: 0000000000000015 R08: 0000000000000002 R09: 0000000000000001\n    </TASK>\n    R13: 000055e4ccf754a0 R14: 000055e4ccf75cd0 R15: 000055e4ccf4a6b0\n\n    Allocated by task 45:\n        kasan_save_stack+0x1e/0x40\n        __kasan_kmalloc+0x81/0xa0\n        hci_chan_create+0x9a/0x2f0\n        l2cap_conn_add.part.0+0x1a/0xdc0\n        l2cap_connect_cfm+0x236/0x1000\n        le_conn_complete_evt+0x15a7/0x1db0\n        hci_le_conn_complete_evt+0x226/0x2c0\n        hci_le_meta_evt+0x247/0x450\n        hci_event_packet+0x61b/0xe90\n        hci_rx_work+0x4d5/0xc50\n        process_one_work+0x8fb/0x15a0\n        worker_thread+0x576/0x1240\n        kthread+0x29d/0x340\n        ret_from_fork+0x1f/0x30\n\n    Freed by task 45:\n        kasan_save_stack+0x1e/0x40\n        kasan_set_track+0x21/0x30\n        kasan_set_free_info+0x20/0x30\n        __kasan_slab_free+0xfb/0x130\n        kfree+0xac/0x350\n        hci_conn_cleanup+0x101/0x6a0\n        hci_conn_del+0x27e/0x6c0\n        hci_disconn_phylink_complete_evt+0xe0/0x120\n        hci_event_packet+0x812/0xe90\n        hci_rx_work+0x4d5/0xc50\n        process_one_work+0x8fb/0x15a0\n        worker_thread+0x576/0x1240\n        kthread+0x29d/0x340\n        ret_from_fork+0x1f/0x30\n\n    The buggy address belongs to the object at ffff88800c0f0500\n    The buggy address is located 24 bytes inside of\n    which belongs to the cache kmalloc-128 of size 128\n    The buggy address belongs to the page:\n    128-byte region [ffff88800c0f0500, ffff88800c0f0580)\n    flags: 0x100000000000200(slab|node=0|zone=1)\n    page:00000000fe45cd86 refcount:1 mapcount:0\n    mapping:0000000000000000 index:0x0 pfn:0xc0f0\n    raw: 0000000000000000 0000000080100010 00000001ffffffff\n    0000000000000000\n    raw: 0100000000000200 ffffea00003a2c80 dead000000000004\n    ffff8880078418c0\n    page dumped because: kasan: bad access detected\n    ffff88800c0f0400: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc\n    Memory state around the buggy address:\n    >ffff88800c0f0500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n    ffff88800c0f0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n    ffff88800c0f0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n                   \n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ca883988-0a5e-403d-b854-513c3040e388",  "id": "SUSE-SU-2018:4274-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6bcab60e-7f39-4557-93f5-be51764666f6",  "id": "SUSE-SU-2017:0441-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c73e3a36-621c-4197-b7d0-90dd1b537632",  "id": "openSUSE-SU-2026:11256-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e99ced7e-b6da-4a1d-83dc-b5d6a3b93ce3",  "id": "CVE-2024-35940",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore/zone: Add a null pointer check to the psz_kmsg_read\n\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure. Ensure the allocation was successful\nby checking the pointer validity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7617160f-979e-49cd-8589-0d1e6625bb4b",  "id": "OESA-2022-1761",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5b36d809-2c65-4719-8816-3e464f24c73a",  "id": "CVE-2025-39833",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: hfcpci: Fix warning when deleting uninitialized timer\n\nWith CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads\nto the following splat:\n\n[  250.215892] ODEBUG: assert_init not available (active state 0) object: ffffffffc01a3dc0 object type: timer_list hint: 0x0\n[  250.217520] WARNING: CPU: 0 PID: 233 at lib/debugobjects.c:612 debug_print_object+0x1b6/0x2c0\n[  250.218775] Modules linked in: hfcpci(-) mISDN_core\n[  250.219537] CPU: 0 UID: 0 PID: 233 Comm: rmmod Not tainted 6.17.0-rc2-g6f713187ac98 #2 PREEMPT(voluntary)\n[  250.220940] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  250.222377] RIP: 0010:debug_print_object+0x1b6/0x2c0\n[  250.223131] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 41 56 48 8b 14 dd a0 4e 01 9f 48 89 ee 48 c7 c7 20 46 01 9f e8 cb 84d\n[  250.225805] RSP: 0018:ffff888015ea7c08 EFLAGS: 00010286\n[  250.226608] RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffffffff9be93a95\n[  250.227708] RDX: 1ffff1100d945138 RSI: 0000000000000008 RDI: ffff88806ca289c0\n[  250.228993] RBP: ffffffff9f014a00 R08: 0000000000000001 R09: ffffed1002bd4f39\n[  250.230043] R10: ffff888015ea79cf R11: 0000000000000001 R12: 0000000000000001\n[  250.231185] R13: ffffffff9eea0520 R14: 0000000000000000 R15: ffff888015ea7cc8\n[  250.232454] FS:  00007f3208f01540(0000) GS:ffff8880caf5a000(0000) knlGS:0000000000000000\n[  250.233851] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  250.234856] CR2: 00007f32090a7421 CR3: 0000000004d63000 CR4: 00000000000006f0\n[  250.236117] Call Trace:\n[  250.236599]  <TASK>\n[  250.236967]  ? trace_irq_enable.constprop.0+0xd4/0x130\n[  250.237920]  debug_object_assert_init+0x1f6/0x310\n[  250.238762]  ? __pfx_debug_object_assert_init+0x10/0x10\n[  250.239658]  ? __lock_acquire+0xdea/0x1c70\n[  250.240369]  __try_to_del_timer_sync+0x69/0x140\n[  250.241172]  ? __pfx___try_to_del_timer_sync+0x10/0x10\n[  250.242058]  ? __timer_delete_sync+0xc6/0x120\n[  250.242842]  ? lock_acquire+0x30/0x80\n[  250.243474]  ? __timer_delete_sync+0xc6/0x120\n[  250.244262]  __timer_delete_sync+0x98/0x120\n[  250.245015]  HFC_cleanup+0x10/0x20 [hfcpci]\n[  250.245704]  __do_sys_delete_module+0x348/0x510\n[  250.246461]  ? __pfx___do_sys_delete_module+0x10/0x10\n[  250.247338]  do_syscall_64+0xc1/0x360\n[  250.247924]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by initializing hfc_tl timer with DEFINE_TIMER macro.\nAlso, use mod_timer instead of manual timeout update.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "691c8810-a4f8-4c63-852c-b1c3765755a9",  "id": "CVE-2024-46809",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check BIOS images before it is used\n\nBIOS images may fail to load and null checks are added before they are\nused.\n\nThis fixes 6 NULL_RETURNS issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "496e3796-59cc-4526-84e4-e9e5d784ed2c",  "id": "CVE-2021-47336",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47336"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmackfs: restrict bytes count in smk_set_cipso()\n\nOops, I failed to update subject line.\n\nFrom 07571157c91b98ce1a4aa70967531e64b78e8346 Mon Sep 17 00:00:00 2001\nDate: Mon, 12 Apr 2021 22:25:06 +0900\nSubject: [PATCH] smackfs: restrict bytes count in smk_set_cipso()\n\nCommit 7ef4c19d245f3dc2 (\"smackfs: restrict bytes count in smackfs write\nfunctions\") missed that count > SMK_CIPSOMAX check applies to only\nformat == SMK_FIXED24_FMT case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0845e48c-4d1a-409b-9abf-7cb245e40582",  "id": "CVE-2024-45028",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mmc_test: Fix NULL dereference on allocation failure\n\nIf the \"test->highmem = alloc_pages()\" allocation fails then calling\n__free_pages(test->highmem) will result in a NULL dereference.  Also\nchange the error code to -ENOMEM instead of returning success.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed9e46b3-83a0-4c83-b910-f8400a0e3c55",  "id": "CVE-2021-47325",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47325"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu: Fix arm_smmu_device refcount leak in address translation\n\nThe reference counting issue happens in several exception handling paths\nof arm_smmu_iova_to_phys_hard(). When those error scenarios occur, the\nfunction forgets to decrease the refcount of \"smmu\" increased by\narm_smmu_rpm_get(), causing a refcount leak.\n\nFix this issue by jumping to \"out\" label when those error scenarios\noccur.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "abd5c866-906c-445c-9069-738d8fed39cc",  "id": "CVE-2026-22978",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: avoid kernel-infoleak from struct iw_point\n\nstruct iw_point has a 32bit hole on 64bit arches.\n\nstruct iw_point {\n  void __user   *pointer;       /* Pointer to the data  (in user space) */\n  __u16         length;         /* number of fields or size in bytes */\n  __u16         flags;          /* Optional params */\n};\n\nMake sure to zero the structure to avoid disclosing 32bits of kernel data\nto user space.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b90bd60-4ada-44da-95e3-f355273fabc3",  "id": "CVE-2020-14390",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14390"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "60fa9107-159b-4814-8328-80947f6ab904",  "id": "CVE-2026-31608",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()\n\nsmb_direct_flush_send_list() already calls smb_direct_free_sendmsg(),\nso we should not call it again after post_sendmsg()\nmoved it to the batch list.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d8a00670-a414-47e8-ad51-5889e2fa0b34",  "id": "CVE-2012-1165",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1165"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message, a different vulnerability than CVE-2006-7250.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c08efaf9-9472-4408-ae5d-347b4dd0b544",  "id": "OESA-2024-2179",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b8fc8f8-e8bb-4aff-b93c-c2fe2dea37a9",  "id": "CVE-2024-49859",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to check atomic_file in f2fs ioctl interfaces\n\nSome f2fs ioctl interfaces like f2fs_ioc_set_pin_file(),\nf2fs_move_file_range(), and f2fs_defragment_range() missed to\ncheck atomic_write status, which may cause potential race issue,\nfix it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c1fdcf9c-871c-4ab6-ad78-1d61cf4ceb0a",  "id": "CVE-2025-21780",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()\n\nIt malicious user provides a small pptable through sysfs and then\na bigger pptable, it may cause buffer overflow attack in function\nsmu_sys_set_pp_table().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bd018bb1-b150-4d9f-86e4-6232a2e4f1ff",  "id": "CVE-2024-53146",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent a potential integer overflow\n\nIf the tag length is >= U32_MAX - 3 then the \"length + 4\" addition\ncan result in an integer overflow. Address this by splitting the\ndecoding into several steps so that decode_cb_compound4res() does\nnot have to perform arithmetic on the unsafe length value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2ec50bce-2f3b-4f30-8cc0-48c20d36344d",  "id": "CVE-2021-47409",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47409"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f13b599e-0eb3-493a-98a9-232ed4fac058",  "id": "CVE-2020-27194",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27194"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    681  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.8.15. scalar32_min_max_or in kernel/bpf/verifier.c mishandles bounds tracking during use of 64-bit values, aka CID-5b9fbeb75b6a.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ab7508a-6807-41d9-b289-c2d4a4d83bd1",  "id": "CVE-2014-9870",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9870"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 3.11 on ARM platforms, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not properly consider user-space access to the TPIDRURW register, which allows local users to gain privileges via a crafted application, aka Android internal bug 28749743 and Qualcomm internal bug CR561044.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "192f9ca6-a440-48d3-9dde-4c14ccdb49e2",  "id": "CVE-2011-1180",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1180"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple stack-based buffer overflows in the iriap_getvaluebyclass_indication function in net/irda/iriap.c in the Linux kernel before 2.6.39 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging connectivity to an IrDA infrared network and sending a large integer value for a (1) name length or (2) attribute length.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9799a376-ae76-42a6-98a7-473a18f2889e",  "id": "openSUSE-SU-2026:11161-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3a8669d1-32cc-4c66-b446-3d7c58208768",      "versions": [        {          "component": "radvd",          "version": "1.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "12cad0b6-c759-4da1-bc4e-cf1350660134",  "id": "CVE-2021-46939",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46939"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400,    662  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Restructure trace_clock_global() to never block\n\nIt was reported that a fix to the ring buffer recursion detection would\ncause a hung machine when performing suspend / resume testing. The\nfollowing backtrace was extracted from debugging that case:\n\nCall Trace:\n trace_clock_global+0x91/0xa0\n __rb_reserve_next+0x237/0x460\n ring_buffer_lock_reserve+0x12a/0x3f0\n trace_buffer_lock_reserve+0x10/0x50\n __trace_graph_return+0x1f/0x80\n trace_graph_return+0xb7/0xf0\n ? trace_clock_global+0x91/0xa0\n ftrace_return_to_handler+0x8b/0xf0\n ? pv_hash+0xa0/0xa0\n return_to_handler+0x15/0x30\n ? ftrace_graph_caller+0xa0/0xa0\n ? trace_clock_global+0x91/0xa0\n ? __rb_reserve_next+0x237/0x460\n ? ring_buffer_lock_reserve+0x12a/0x3f0\n ? trace_event_buffer_lock_reserve+0x3c/0x120\n ? trace_event_buffer_reserve+0x6b/0xc0\n ? trace_event_raw_event_device_pm_callback_start+0x125/0x2d0\n ? dpm_run_callback+0x3b/0xc0\n ? pm_ops_is_empty+0x50/0x50\n ? platform_get_irq_byname_optional+0x90/0x90\n ? trace_device_pm_callback_start+0x82/0xd0\n ? dpm_run_callback+0x49/0xc0\n\nWith the following RIP:\n\nRIP: 0010:native_queued_spin_lock_slowpath+0x69/0x200\n\nSince the fix to the recursion detection would allow a single recursion to\nhappen while tracing, this lead to the trace_clock_global() taking a spin\nlock and then trying to take it again:\n\nring_buffer_lock_reserve() {\n  trace_clock_global() {\n    arch_spin_lock() {\n      queued_spin_lock_slowpath() {\n        /* lock taken */\n        (something else gets traced by function graph tracer)\n          ring_buffer_lock_reserve() {\n            trace_clock_global() {\n              arch_spin_lock() {\n                queued_spin_lock_slowpath() {\n                /* DEAD LOCK! */\n\nTracing should *never* block, as it can lead to strange lockups like the\nabove.\n\nRestructure the trace_clock_global() code to instead of simply taking a\nlock to update the recorded \"prev_time\" simply use it, as two events\nhappening on two different CPUs that calls this at the same time, really\ndoesn't matter which one goes first. Use a trylock to grab the lock for\nupdating the prev_time, and if it fails, simply try again the next time.\nIf it failed to be taken, that means something else is already updating\nit.\n\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=212761",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "54a9ba9f-6875-4bef-9cf6-4839d00b8992",  "id": "CVE-2017-16526",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16526"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b94af903-d8a4-439d-9d0b-83240172f7bd",  "id": "CVE-2010-1173",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1173"  },  "ratings": [    {      "score": 7.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:14594'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:92642/Linux-Kernel-2.6.33.3-SCTP-INIT-Denial-Of-Service.html'"    }  ]},{  "bom-ref": "72f86aaf-d193-44a8-b300-e0e0b52807a4",  "id": "CLSA-2026-1771003241",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "30783898-b507-44c4-ad55-be8a49bbd46a",  "id": "CVE-2010-3437",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3437"  },  "ratings": [    {      "score": 6.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and system crash) via a crafted index value in a PKT_CTRL_CMD_STATUS ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:15150'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:94334/Linux-Kernel-pktcdvd-Kernel-Memory-Disclosure.html'"    }  ]},{  "bom-ref": "39eff180-20d9-4a1f-a242-dbd8007359f8",  "id": "CVE-2025-38068",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: lzo - Fix compression buffer overrun\n\nUnlike the decompression code, the compression code in LZO never\nchecked for output overruns.  It instead assumes that the caller\nalways provides enough buffer space, disregarding the buffer length\nprovided by the caller.\n\nAdd a safe compression interface that checks for the end of buffer\nbefore each write.  Use the safe interface in crypto/lzo.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e174ff78-7a69-48c8-8c39-51c41271ce0d",  "id": "CVE-2021-3923",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3923"  },  "ratings": [    {      "score": 2.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51b3c2d1-f27d-4c4f-8fb0-4c8e81adea39",  "id": "CLSA-2024-1735311149",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e3521695-912a-403a-a52a-a1fbd166f04e",  "id": "CVE-2019-19816",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19816"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4c082b3e-a060-441a-bf37-96d15001af15",  "id": "CVE-2024-46750",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Add missing bridge lock to pci_bus_lock()\n\nOne of the true positives that the cfg_access_lock lockdep effort\nidentified is this sequence:\n\n  WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70\n  RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70\n  Call Trace:\n   <TASK>\n   ? __warn+0x8c/0x190\n   ? pci_bridge_secondary_bus_reset+0x5d/0x70\n   ? report_bug+0x1f8/0x200\n   ? handle_bug+0x3c/0x70\n   ? exc_invalid_op+0x18/0x70\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? pci_bridge_secondary_bus_reset+0x5d/0x70\n   pci_reset_bus+0x1d8/0x270\n   vmd_probe+0x778/0xa10\n   pci_device_probe+0x95/0x120\n\nWhere pci_reset_bus() users are triggering unlocked secondary bus resets.\nIronically pci_bus_reset(), several calls down from pci_reset_bus(), uses\npci_bus_lock() before issuing the reset which locks everything *but* the\nbridge itself.\n\nFor the same motivation as adding:\n\n  bridge = pci_upstream_bridge(dev);\n  if (bridge)\n    pci_dev_lock(bridge);\n\nto pci_reset_function() for the \"bus\" and \"cxl_bus\" reset cases, add\npci_dev_lock() for @bus->self to pci_bus_lock().\n\n[bhelgaas: squash in recursive locking deadlock fix from Keith Busch:\nhttps://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ce1b306-d1e4-47eb-8608-8ca519e7790b",  "id": "CVE-2025-39828",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().\n\nsyzbot reported the splat below. [0]\n\nWhen atmtcp_v_open() or atmtcp_v_close() is called via connect()\nor close(), atmtcp_send_control() is called to send an in-kernel\nspecial message.\n\nThe message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length.\nAlso, a pointer of struct atm_vcc is set to atmtcp_control.vcc.\n\nThe notable thing is struct atmtcp_control is uAPI but has a\nspace for an in-kernel pointer.\n\n  struct atmtcp_control {\n  \tstruct atmtcp_hdr hdr;\t/* must be first */\n  ...\n  \tatm_kptr_t vcc;\t\t/* both directions */\n  ...\n  } __ATM_API_ALIGN;\n\n  typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t;\n\nThe special message is processed in atmtcp_recv_control() called\nfrom atmtcp_c_send().\n\natmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths:\n\n  1. .ndo_start_xmit() (vcc->send() == atm_send_aal0())\n  2. vcc_sendmsg()\n\nThe problem is sendmsg() does not validate the message length and\nuserspace can abuse atmtcp_recv_control() to overwrite any kptr\nby atmtcp_control.\n\nLet's add a new ->pre_send() hook to validate messages from sendmsg().\n\n[0]:\nOops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI\nKASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f]\nCPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\nRIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline]\nRIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297\nCode: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c\nRSP: 0018:ffffc90003f5f810 EFLAGS: 00010203\nRAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000\nRDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c\nRBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd\nR10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000\nR13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff\nFS:  00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0\nCall Trace:\n <TASK>\n vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645\n sock_sendmsg_nosec net/socket.c:714 [inline]\n __sock_sendmsg+0x219/0x270 net/socket.c:729\n ____sys_sendmsg+0x505/0x830 net/socket.c:2614\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668\n __sys_sendmsg net/socket.c:2700 [inline]\n __do_sys_sendmsg net/socket.c:2705 [inline]\n __se_sys_sendmsg net/socket.c:2703 [inline]\n __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f8d7e96a4a9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9\nRDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005\nRBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f\nR10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac\nR13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250\n </TASK>\nModules linked in:",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c79db55-0daf-4959-9467-780d5c584f9f",  "id": "CVE-2026-31414",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_expect: use expect->helper\n\nUse expect->helper in ctnetlink and /proc to dump the helper name.\nUsing nfct_help() without holding a reference to the master conntrack\nis unsafe.\n\nUse exp->master->helper in ctnetlink path if userspace does not provide\nan explicit helper when creating an expectation to retain the existing\nbehaviour. The ctnetlink expectation path holds the reference on the\nmaster conntrack and nf_conntrack_expect lock and the nfnetlink glue\npath refers to the master ct that is attached to the skb.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "87805e93-8ce8-452d-aa3d-ea32eec37b87",  "id": "CVE-2023-52479",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix uaf in smb20_oplock_break_ack\n\ndrop reference after use opinfo.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "98691cb1-1c0d-4ff2-9913-d614b38adaf1",  "id": "OESA-2025-1886",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4164a670-c26f-46f8-98de-525271732083",  "id": "CVE-2016-10741",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10741"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c28cc8b-f8b5-4c27-b84f-f35c8195f402",  "id": "CVE-2017-8824",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8824"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:43234'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:145235/Linux-Kernel-DCCP-Socket-Use-After-Free.html'"    }  ]},{  "bom-ref": "f7d4c797-211d-4b7a-99cd-cec0689946f2",  "id": "CVE-2023-3338",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3338"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ec09bc1a-b7b5-4520-a9ba-104678e0f739",  "id": "CVE-2011-1171",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1171"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a284917c-7d7a-4c1b-ac45-3f09aa047a66",  "id": "CVE-2025-38574",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.6,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npptp: ensure minimal skb length in pptp_xmit()\n\nCommit aabc6596ffb3 (\"net: ppp: Add bound checking for skb data\non ppp_sync_txmung\") fixed ppp_sync_txmunge()\n\nWe need a similar fix in pptp_xmit(), otherwise we might\nread uninit data as reported by syzbot.\n\nBUG: KMSAN: uninit-value in pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193\n  pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193\n  ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2290 [inline]\n  ppp_input+0x1d6/0xe60 drivers/net/ppp/ppp_generic.c:2314\n  pppoe_rcv_core+0x1e8/0x760 drivers/net/ppp/pppoe.c:379\n  sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148\n  __release_sock+0x1d3/0x330 net/core/sock.c:3213\n  release_sock+0x6b/0x270 net/core/sock.c:3767\n  pppoe_sendmsg+0x15d/0xcb0 drivers/net/ppp/pppoe.c:904\n  sock_sendmsg_nosec net/socket.c:712 [inline]\n  __sock_sendmsg+0x330/0x3d0 net/socket.c:727\n  ____sys_sendmsg+0x893/0xd80 net/socket.c:2566\n  ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620\n  __sys_sendmmsg+0x2d9/0x7c0 net/socket.c:2709",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d077a77e-266c-438f-b6c8-6eb16d94d94a",  "id": "CVE-2017-9242",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9242"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service (system crash) via crafted system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e59c3767-04ae-431c-b161-7b7bd19b1d16",  "id": "CVE-2015-7990",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7990"  },  "ratings": [    {      "score": 5.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "64c591c7-f474-4128-90fa-4172d771296e",  "id": "CVE-2020-36313",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36313"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.7. The KVM subsystem allows out-of-range access to memslots after a deletion, aka CID-0774a964ef56. This affects arch/s390/kvm/kvm-s390.c, include/linux/kvm_host.h, and virt/kvm/kvm_main.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c9d6798-209e-49cf-a999-b7af535be806",  "id": "CVE-2023-1855",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1855"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem. This vulnerability could even lead to a kernel information leak problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "826fc827-9980-4998-b81b-85dac72ebf6c",  "id": "CVE-2023-53275",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()\n\nThe variable codec->regmap is often protected by the lock\ncodec->regmap_lock when is accessed. However, it is accessed without\nholding the lock when is accessed in snd_hdac_regmap_sync():\n\n  if (codec->regmap)\n\nIn my opinion, this may be a harmful race, because if codec->regmap is\nset to NULL right after the condition is checked, a null-pointer\ndereference can occur in the called function regcache_sync():\n\n  map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c\n\nTo fix this possible null-pointer dereference caused by data race, the\nmutex_lock coverage is extended to protect the if statement as well as the\nfunction call to regcache_sync().\n\n[ Note: the lack of the regmap_lock itself is harmless for the current\n  codec driver implementations, as snd_hdac_regmap_sync() is only for\n  PM runtime resume that is prohibited during the codec probe.\n  But the change makes the whole code more consistent, so it's merged\n  as is -- tiwai ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b157d5e1-b6b9-47e2-b41b-affc4eee2bf2",  "id": "CLSA-2023-1698949525",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "526920cc-8d17-442f-9228-631c98817478",  "id": "CVE-2024-53089",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Mark hrtimer to expire in hard interrupt context\n\nLike commit 2c0d278f3293f (\"KVM: LAPIC: Mark hrtimer to expire in hard\ninterrupt context\") and commit 9090825fa9974 (\"KVM: arm/arm64: Let the\ntimer expire in hardirq context on RT\"), On PREEMPT_RT enabled kernels\nunmarked hrtimers are moved into soft interrupt expiry mode by default.\nThen the timers are canceled from an preempt-notifier which is invoked\nwith disabled preemption which is not allowed on PREEMPT_RT.\n\nThe timer callback is short so in could be invoked in hard-IRQ context.\nSo let the timer expire on hard-IRQ context even on -RT.\n\nThis fix a \"scheduling while atomic\" bug for PREEMPT_RT enabled kernels:\n\n BUG: scheduling while atomic: qemu-system-loo/1011/0x00000002\n Modules linked in: amdgpu rfkill nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat ns\n CPU: 1 UID: 0 PID: 1011 Comm: qemu-system-loo Tainted: G        W          6.12.0-rc2+ #1774\n Tainted: [W]=WARN\n Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022\n Stack : ffffffffffffffff 0000000000000000 9000000004e3ea38 9000000116744000\n         90000001167475a0 0000000000000000 90000001167475a8 9000000005644830\n         90000000058dc000 90000000058dbff8 9000000116747420 0000000000000001\n         0000000000000001 6a613fc938313980 000000000790c000 90000001001c1140\n         00000000000003fe 0000000000000001 000000000000000d 0000000000000003\n         0000000000000030 00000000000003f3 000000000790c000 9000000116747830\n         90000000057ef000 0000000000000000 9000000005644830 0000000000000004\n         0000000000000000 90000000057f4b58 0000000000000001 9000000116747868\n         900000000451b600 9000000005644830 9000000003a13998 0000000010000020\n         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d\n         ...\n Call Trace:\n [<9000000003a13998>] show_stack+0x38/0x180\n [<9000000004e3ea34>] dump_stack_lvl+0x84/0xc0\n [<9000000003a71708>] __schedule_bug+0x48/0x60\n [<9000000004e45734>] __schedule+0x1114/0x1660\n [<9000000004e46040>] schedule_rtlock+0x20/0x60\n [<9000000004e4e330>] rtlock_slowlock_locked+0x3f0/0x10a0\n [<9000000004e4f038>] rt_spin_lock+0x58/0x80\n [<9000000003b02d68>] hrtimer_cancel_wait_running+0x68/0xc0\n [<9000000003b02e30>] hrtimer_cancel+0x70/0x80\n [<ffff80000235eb70>] kvm_restore_timer+0x50/0x1a0 [kvm]\n [<ffff8000023616c8>] kvm_arch_vcpu_load+0x68/0x2a0 [kvm]\n [<ffff80000234c2d4>] kvm_sched_in+0x34/0x60 [kvm]\n [<9000000003a749a0>] finish_task_switch.isra.0+0x140/0x2e0\n [<9000000004e44a70>] __schedule+0x450/0x1660\n [<9000000004e45cb0>] schedule+0x30/0x180\n [<ffff800002354c70>] kvm_vcpu_block+0x70/0x120 [kvm]\n [<ffff800002354d80>] kvm_vcpu_halt+0x60/0x3e0 [kvm]\n [<ffff80000235b194>] kvm_handle_gspr+0x3f4/0x4e0 [kvm]\n [<ffff80000235f548>] kvm_handle_exit+0x1c8/0x260 [kvm]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b6f6752-7eab-4005-815c-9dac795f4d7b",  "id": "CVE-2021-47378",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47378"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: destroy cm id before destroy qp to avoid use after free\n\nWe should always destroy cm_id before destroy qp to avoid to get cma\nevent after qp was destroyed, which may lead to use after free.\nIn RDMA connection establishment error flow, don't destroy qp in cm\nevent handler.Just report cm_error to upper level, qp will be destroy\nin nvme_rdma_alloc_queue() after destroy cm id.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e1988a2-a05d-499b-be0d-beb7f0b21301",  "id": "CVE-2022-48710",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix a possible null pointer dereference\n\nIn radeon_fp_native_mode(), the return value of drm_mode_duplicate()\nis assigned to mode, which will lead to a NULL pointer dereference\non failure of drm_mode_duplicate(). Add a check to avoid npd.\n\nThe failure status of drm_cvt_mode() on the other path is checked too.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7ed4f6d6-b353-4395-aa5f-208fa595b1ec",  "id": "CVE-2018-10322",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10322"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_ilock_attr_map_shared invalid pointer dereference) via a crafted xfs image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2dbd1cd5-6de4-409b-851b-2532c9eb28c5",  "id": "CVE-2023-52486",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Don't unref the same fb many times by mistake due to deadlock handling\n\nIf we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl()\nwe proceed to unref the fb and then retry the whole thing from the top.\nBut we forget to reset the fb pointer back to NULL, and so if we then\nget another error during the retry, before the fb lookup, we proceed\nthe unref the same fb again without having gotten another reference.\nThe end result is that the fb will (eventually) end up being freed\nwhile it's still in use.\n\nReset fb to NULL once we've unreffed it to avoid doing it again\nuntil we've done another fb lookup.\n\nThis turned out to be pretty easy to hit on a DG2 when doing async\nflips (and CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y). The first symptom I\nsaw that drm_closefb() simply got stuck in a busy loop while walking\nthe framebuffer list. Fortunately I was able to convince it to oops\ninstead, and from there it was easier to track down the culprit.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e58e1356-b8b0-4ce5-82f3-f2d563a3dc4b",  "id": "CVE-2010-3296",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3296"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d4b2112-c023-46b4-ae5a-465d7f0fd908",  "id": "CVE-2011-1581",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1581"  },  "ratings": [    {      "score": 9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The bond_select_queue function in drivers/net/bonding/bond_main.c in the Linux kernel before 2.6.39, when a network device with a large number of receive queues is installed but the default tx_queues setting is used, does not properly restrict queue indexes, which allows remote attackers to cause a denial of service (BUG and system crash) or possibly have unspecified other impact by sending network traffic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d9d52ba-7740-428d-8563-6e04f76e7b5f",  "id": "CVE-2022-50102",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()\n\nSince the user can control the arguments of the ioctl() from the user\nspace, under special arguments that may result in a divide-by-zero bug\nin:\n  drivers/video/fbdev/arkfb.c:784: ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul);\nwith hdiv=1, pixclock=1 and hmul=2 you end up with (1*1)/2 = (int) 0.\nand then in:\n  drivers/video/fbdev/arkfb.c:504: rv = dac_set_freq(par->dac, 0, 1000000000 / pixclock);\nwe'll get a division-by-zero.\n\nThe following log can reveal it:\n\ndivide error: 0000 [#1] PREEMPT SMP KASAN PTI\nRIP: 0010:ark_set_pixclock drivers/video/fbdev/arkfb.c:504 [inline]\nRIP: 0010:arkfb_set_par+0x10fc/0x24c0 drivers/video/fbdev/arkfb.c:784\nCall Trace:\n fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034\n do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110\n fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189\n\nFix this by checking the argument of ark_set_pixclock() first.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "247b2ad4-9365-44b5-a365-748904266730",  "id": "CVE-2019-13233",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13233"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds violation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d9e07d22-0e25-4e57-8781-779f21598320",  "id": "CVE-2022-49155",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()\n\n[   12.323788] BUG: using smp_processor_id() in preemptible [00000000] code: systemd-udevd/1020\n[   12.332297] caller is qla2xxx_create_qpair+0x32a/0x5d0 [qla2xxx]\n[   12.338417] CPU: 7 PID: 1020 Comm: systemd-udevd Tainted: G          I      --------- ---  5.14.0-29.el9.x86_64 #1\n[   12.348827] Hardware name: Dell Inc. PowerEdge R610/0F0XJ6, BIOS 6.6.0 05/22/2018\n[   12.356356] Call Trace:\n[   12.358821]  dump_stack_lvl+0x34/0x44\n[   12.362514]  check_preemption_disabled+0xd9/0xe0\n[   12.367164]  qla2xxx_create_qpair+0x32a/0x5d0 [qla2xxx]\n[   12.372481]  qla2x00_probe_one+0xa3a/0x1b80 [qla2xxx]\n[   12.377617]  ? _raw_spin_lock_irqsave+0x19/0x40\n[   12.384284]  local_pci_probe+0x42/0x80\n[   12.390162]  ? pci_match_device+0xd7/0x110\n[   12.396366]  pci_device_probe+0xfd/0x1b0\n[   12.402372]  really_probe+0x1e7/0x3e0\n[   12.408114]  __driver_probe_device+0xfe/0x180\n[   12.414544]  driver_probe_device+0x1e/0x90\n[   12.420685]  __driver_attach+0xc0/0x1c0\n[   12.426536]  ? __device_attach_driver+0xe0/0xe0\n[   12.433061]  ? __device_attach_driver+0xe0/0xe0\n[   12.439538]  bus_for_each_dev+0x78/0xc0\n[   12.445294]  bus_add_driver+0x12b/0x1e0\n[   12.451021]  driver_register+0x8f/0xe0\n[   12.456631]  ? 0xffffffffc07bc000\n[   12.461773]  qla2x00_module_init+0x1be/0x229 [qla2xxx]\n[   12.468776]  do_one_initcall+0x44/0x200\n[   12.474401]  ? load_module+0xad3/0xba0\n[   12.479908]  ? kmem_cache_alloc_trace+0x45/0x410\n[   12.486268]  do_init_module+0x5c/0x280\n[   12.491730]  __do_sys_init_module+0x12e/0x1b0\n[   12.497785]  do_syscall_64+0x3b/0x90\n[   12.503029]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[   12.509764] RIP: 0033:0x7f554f73ab2e",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "94396c77-e77e-4f06-9f8e-8cb9e0c8b110",  "id": "CVE-2006-4343",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4343"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers to cause a denial of service (client crash) via unknown vectors that trigger a null pointer dereference.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:4773'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:62019/openssl-dos.txt.html'"    }  ]},{  "bom-ref": "dbb5a08e-885a-42a8-bd4c-dcf306bb3ae4",  "id": "CVE-2019-15031",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15031"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"    }  ],  "cwes": [    662  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process, because MSR_TM_ACTIVE is misused in arch/powerpc/kernel/process.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b007e361-013a-4201-af8e-f0c5b0ce4afd",  "id": "CVE-2024-41001",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/sqpoll: work around a potential audit memory leak\n\nkmemleak complains that there's a memory leak related to connect\nhandling:\n\nunreferenced object 0xffff0001093bdf00 (size 128):\ncomm \"iou-sqp-455\", pid 457, jiffies 4294894164\nhex dump (first 32 bytes):\n02 00 fa ea 7f 00 00 01 00 00 00 00 00 00 00 00  ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\nbacktrace (crc 2e481b1a):\n[<00000000c0a26af4>] kmemleak_alloc+0x30/0x38\n[<000000009c30bb45>] kmalloc_trace+0x228/0x358\n[<000000009da9d39f>] __audit_sockaddr+0xd0/0x138\n[<0000000089a93e34>] move_addr_to_kernel+0x1a0/0x1f8\n[<000000000b4e80e6>] io_connect_prep+0x1ec/0x2d4\n[<00000000abfbcd99>] io_submit_sqes+0x588/0x1e48\n[<00000000e7c25e07>] io_sq_thread+0x8a4/0x10e4\n[<00000000d999b491>] ret_from_fork+0x10/0x20\n\nwhich can can happen if:\n\n1) The command type does something on the prep side that triggers an\n   audit call.\n2) The thread hasn't done any operations before this that triggered\n   an audit call inside ->issue(), where we have audit_uring_entry()\n   and audit_uring_exit().\n\nWork around this by issuing a blanket NOP operation before the SQPOLL\ndoes anything.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a97859fa-f645-4561-9d18-1ff8593cca98",  "id": "CVE-2024-42145",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/core: Implement a limit on UMAD receive List\n\nThe existing behavior of ib_umad, which maintains received MAD\npackets in an unbounded list, poses a risk of uncontrolled growth.\nAs user-space applications extract packets from this list, the rate\nof extraction may not match the rate of incoming packets, leading\nto potential list overflow.\n\nTo address this, we introduce a limit to the size of the list. After\nconsidering typical scenarios, such as OpenSM processing, which can\nhandle approximately 100k packets per second, and the 1-second retry\ntimeout for most packets, we set the list size limit to 200k. Packets\nreceived beyond this limit are dropped, assuming they are likely timed\nout by the time they are handled by user-space.\n\nNotably, packets queued on the receive list due to reasons like\ntimed-out sends are preserved even when the list is full.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "57d4befc-1471-4cdc-aade-3a14c4d8445c",  "id": "CVE-2018-1092",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1092"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i_links_count, which allows attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f75de8b5-0786-42c2-8f15-cc65dc0e3ccc",  "id": "CVE-2023-52784",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: stop the device in bond_setup_by_slave()\n\nCommit 9eed321cde22 (\"net: lapbether: only support ethernet devices\")\nhas been able to keep syzbot away from net/lapb, until today.\n\nIn the following splat [1], the issue is that a lapbether device has\nbeen created on a bonding device without members. Then adding a non\nARPHRD_ETHER member forced the bonding master to change its type.\n\nThe fix is to make sure we call dev_close() in bond_setup_by_slave()\nso that the potential linked lapbether devices (or any other devices\nhaving assumptions on the physical device) are removed.\n\nA similar bug has been addressed in commit 40baec225765\n(\"bonding: fix panic on non-ARPHRD_ETHER enslave failure\")\n\n[1]\nskbuff: skb_under_panic: text:ffff800089508810 len:44 put:40 head:ffff0000c78e7c00 data:ffff0000c78e7bea tail:0x16 end:0x140 dev:bond0\nkernel BUG at net/core/skbuff.c:192 !\nInternal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\nModules linked in:\nCPU: 0 PID: 6007 Comm: syz-executor383 Not tainted 6.6.0-rc3-syzkaller-gbf6547d8715b #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : skb_panic net/core/skbuff.c:188 [inline]\npc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202\nlr : skb_panic net/core/skbuff.c:188 [inline]\nlr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202\nsp : ffff800096a06aa0\nx29: ffff800096a06ab0 x28: ffff800096a06ba0 x27: dfff800000000000\nx26: ffff0000ce9b9b50 x25: 0000000000000016 x24: ffff0000c78e7bea\nx23: ffff0000c78e7c00 x22: 000000000000002c x21: 0000000000000140\nx20: 0000000000000028 x19: ffff800089508810 x18: ffff800096a06100\nx17: 0000000000000000 x16: ffff80008a629a3c x15: 0000000000000001\nx14: 1fffe00036837a32 x13: 0000000000000000 x12: 0000000000000000\nx11: 0000000000000201 x10: 0000000000000000 x9 : cb50b496c519aa00\nx8 : cb50b496c519aa00 x7 : 0000000000000001 x6 : 0000000000000001\nx5 : ffff800096a063b8 x4 : ffff80008e280f80 x3 : ffff8000805ad11c\nx2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086\nCall trace:\nskb_panic net/core/skbuff.c:188 [inline]\nskb_under_panic+0x13c/0x140 net/core/skbuff.c:202\nskb_push+0xf0/0x108 net/core/skbuff.c:2446\nip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1384\ndev_hard_header include/linux/netdevice.h:3136 [inline]\nlapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257\nlapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447\nlapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149\nlapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251\n__lapb_disconnect_request+0x9c/0x17c net/lapb/lapb_iface.c:326\nlapb_device_event+0x288/0x4e0 net/lapb/lapb_iface.c:492\nnotifier_call_chain+0x1a4/0x510 kernel/notifier.c:93\nraw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461\ncall_netdevice_notifiers_info net/core/dev.c:1970 [inline]\ncall_netdevice_notifiers_extack net/core/dev.c:2008 [inline]\ncall_netdevice_notifiers net/core/dev.c:2022 [inline]\n__dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508\ndev_close_many+0x1e0/0x470 net/core/dev.c:1559\ndev_close+0x174/0x250 net/core/dev.c:1585\nlapbeth_device_event+0x2e4/0x958 drivers/net/wan/lapbether.c:466\nnotifier_call_chain+0x1a4/0x510 kernel/notifier.c:93\nraw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461\ncall_netdevice_notifiers_info net/core/dev.c:1970 [inline]\ncall_netdevice_notifiers_extack net/core/dev.c:2008 [inline]\ncall_netdevice_notifiers net/core/dev.c:2022 [inline]\n__dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508\ndev_close_many+0x1e0/0x470 net/core/dev.c:1559\ndev_close+0x174/0x250 net/core/dev.c:1585\nbond_enslave+0x2298/0x30cc drivers/net/bonding/bond_main.c:2332\nbond_do_ioctl+0x268/0xc64 drivers/net/bonding/bond_main.c:4539\ndev_ifsioc+0x754/0x9ac\ndev_ioctl+0x4d8/0xd34 net/core/dev_ioctl.c:786\nsock_do_ioctl+0x1d4/0x2d0 net/socket.c:1217\nsock_ioctl+0x4e8/0x834 net/socket.c:1322\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "593a66b7-6e06-4386-b87f-cb822356f10e",  "id": "CVE-2024-58094",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: add check read-only before truncation in jfs_truncate_nolock()\n\nAdded a check for \"read-only\" mode in the `jfs_truncate_nolock`\nfunction to avoid errors related to writing to a read-only\nfilesystem.\n\nCall stack:\n\nblock_write_begin() {\n  jfs_write_failed() {\n    jfs_truncate() {\n      jfs_truncate_nolock() {\n        txEnd() {\n          ...\n          log = JFS_SBI(tblk->sb)->log;\n          // (log == NULL)\n\nIf the `isReadOnly(ip)` condition is triggered in\n`jfs_truncate_nolock`, the function execution will stop, and no\nfurther data modification will occur. Instead, the `xtTruncate`\nfunction will be called with the \"COMMIT_WMAP\" flag, preventing\nmodifications in \"read-only\" mode.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2451185b-ef8f-4b30-bbfb-4fa3e2dc9614",  "id": "CVE-2017-16647",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16647"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/net/usb/asix_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6be5eea7-0ff3-478f-a495-3c1d1c8cfff1",  "id": "CVE-2024-58001",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: handle a symlink read error correctly\n\nPatch series \"Convert ocfs2 to use folios\".\n\nMark did a conversion of ocfs2 to use folios and sent it to me as a\ngiant patch for review ;-)\n\nSo I've redone it as individual patches, and credited Mark for the patches\nwhere his code is substantially the same.  It's not a bad way to do it;\nhis patch had some bugs and my patches had some bugs.  Hopefully all our\nbugs were different from each other.  And hopefully Mark likes all the\nchanges I made to his code!\n\n\nThis patch (of 23):\n\nIf we can't read the buffer, be sure to unlock the page before returning.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "29063292-1e96-42a2-8222-e7879ecdcd29",  "id": "CVE-2023-53405",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: gr_udc: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "916a8da1-e645-42b5-966e-94942439ad61",  "id": "CLSA-2022-1658171496",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd94f55d-2973-464c-b37b-e1089e448261",  "id": "CVE-2022-2318",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2318"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6761424a-ed73-43ca-aeb6-65a148a9bd7d",  "id": "CVE-2017-1000379",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000379"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:42275'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:143205/Linux-Kernel-ldso_hwcap_64-Stack-Clash-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "a2f0eff5-5021-4c46-bde4-becae6102ab9",  "id": "CVE-2026-53004",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks\n\nsctp_getsockopt_peer_auth_chunks() checks that the caller's optval\nbuffer is large enough for the peer AUTH chunk list with\n\n    if (len < num_chunks)\n            return -EINVAL;\n\nbut then writes num_chunks bytes to p->gauth_chunks, which lives\nat offset offsetof(struct sctp_authchunks, gauth_chunks) == 8\ninside optval.  The check is missing the sizeof(struct\nsctp_authchunks) = 8-byte header.  When the caller supplies\nlen == num_chunks (for any num_chunks > 0) the test passes but\ncopy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes\npast the declared buffer.\n\nThe sibling function sctp_getsockopt_local_auth_chunks() at the\nnext line already has the correct check:\n\n    if (len < sizeof(struct sctp_authchunks) + num_chunks)\n            return -EINVAL;\n\nAlign the peer variant with its sibling.\n\nReproducer confirms on v7.0-13-generic: an unprivileged userspace\ncaller that opens a loopback SCTP association with AUTH enabled,\nqueries num_chunks with a short optval, then issues the real\ngetsockopt with len == num_chunks and sentinel bytes painted past\nthe buffer observes those sentinel bytes overwritten with the\npeer's AUTH chunk type.  The bytes written are under the peer's\ncontrol but land in the caller's own userspace; this is not a\nkernel memory corruption, but it is a kernel-side contract\nviolation that can silently corrupt adjacent userspace data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff347aba-9559-474c-82ef-29080e28cdba",  "id": "CVE-2021-42008",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42008"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "91d4cbcf-60bd-41a1-b511-afa848f4ef04",  "id": "CVE-2024-41080",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix possible deadlock in io_register_iowq_max_workers()\n\nThe io_register_iowq_max_workers() function calls io_put_sq_data(),\nwhich acquires the sqd->lock without releasing the uring_lock.\nSimilar to the commit 009ad9f0c6ee (\"io_uring: drop ctx->uring_lock\nbefore acquiring sqd->lock\"), this can lead to a potential deadlock\nsituation.\n\nTo resolve this issue, the uring_lock is released before calling\nio_put_sq_data(), and then it is re-acquired after the function call.\n\nThis change ensures that the locks are acquired in the correct\norder, preventing the possibility of a deadlock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "57e7a808-3e19-4fe4-9075-5c3fa2932cb8",  "id": "DLA-1701-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7976aad5-663d-41c4-9223-0ed83dae7101",  "id": "CVE-2017-7542",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7542"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190,    835  ],  "analysis": {    "state": "in_triage"  },  "description": "The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b9e7f441-9577-46d8-8c79-f6b8a469a881",  "id": "CVE-2022-48738",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: ops: Reject out of bounds values in snd_soc_put_volsw()\n\nWe don't currently validate that the values being set are within the range\nwe advertised to userspace as being valid, do so and reject any values\nthat are out of range.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "340a5bba-0f7f-4f3f-ba9d-f2a48725cdf0",  "id": "CVE-2023-52760",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix slab-use-after-free in gfs2_qd_dealloc\n\nIn gfs2_put_super(), whether withdrawn or not, the quota should\nbe cleaned up by gfs2_quota_cleanup().\n\nOtherwise, struct gfs2_sbd will be freed before gfs2_qd_dealloc (rcu\ncallback) has run for all gfs2_quota_data objects, resulting in\nuse-after-free.\n\nAlso, gfs2_destroy_threads() and gfs2_quota_cleanup() is already called\nby gfs2_make_fs_ro(), so in gfs2_put_super(), after calling\ngfs2_make_fs_ro(), there is no need to call them again.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "21853c8d-2900-4a7d-9af2-b7109e10b97f",  "id": "CVE-2018-7757",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7757"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    772  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9dbfd25-a186-47d4-872d-31739c4f89cb",  "id": "CVE-2017-14340",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14340"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h in the Linux kernel before 4.13.2 does not verify that a filesystem has a realtime device, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via vectors related to setting an RHINHERIT flag on a directory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "14fc9903-ec5a-4bd8-b07e-f84689b475d0",  "id": "CVE-2024-42301",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndev/parport: fix the array out-of-bounds risk\n\nFixed array out-of-bounds issues caused by sprintf\nby replacing it with snprintf for safer data copying,\nensuring the destination buffer is not overflowed.\n\nBelow is the stack trace I encountered during the actual issue:\n\n[ 66.575408s] [pid:5118,cpu4,QThread,4]Kernel panic - not syncing: stack-protector:\nKernel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport]\n[ 66.575408s] [pid:5118,cpu4,QThread,5]CPU: 4 PID: 5118 Comm:\nQThread Tainted: G S W O 5.10.97-arm64-desktop #7100.57021.2\n[ 66.575439s] [pid:5118,cpu4,QThread,6]TGID: 5087 Comm: EFileApp\n[ 66.575439s] [pid:5118,cpu4,QThread,7]Hardware name: HUAWEI HUAWEI QingYun\nPGUX-W515x-B081/SP1PANGUXM, BIOS 1.00.07 04/29/2024\n[ 66.575439s] [pid:5118,cpu4,QThread,8]Call trace:\n[ 66.575469s] [pid:5118,cpu4,QThread,9] dump_backtrace+0x0/0x1c0\n[ 66.575469s] [pid:5118,cpu4,QThread,0] show_stack+0x14/0x20\n[ 66.575469s] [pid:5118,cpu4,QThread,1] dump_stack+0xd4/0x10c\n[ 66.575500s] [pid:5118,cpu4,QThread,2] panic+0x1d8/0x3bc\n[ 66.575500s] [pid:5118,cpu4,QThread,3] __stack_chk_fail+0x2c/0x38\n[ 66.575500s] [pid:5118,cpu4,QThread,4] do_hardware_base_addr+0xcc/0xd0 [parport]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1f298ed5-43f2-43e6-98e1-82ddb018e587",  "id": "CVE-2015-8956",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8956"  },  "ratings": [    {      "score": 6.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 4.2 allows local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6e7ef4ac-5c67-4beb-aefa-56d578139fcb",  "id": "CVE-2022-49075",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix qgroup reserve overflow the qgroup limit\n\nWe use extent_changeset->bytes_changed in qgroup_reserve_data() to record\nhow many bytes we set for EXTENT_QGROUP_RESERVED state. Currently the\nbytes_changed is set as \"unsigned int\", and it will overflow if we try to\nfallocate a range larger than 4GiB. The result is we reserve less bytes\nand eventually break the qgroup limit.\n\nUnlike regular buffered/direct write, which we use one changeset for\neach ordered extent, which can never be larger than 256M.  For\nfallocate, we use one changeset for the whole range, thus it no longer\nrespects the 256M per extent limit, and caused the problem.\n\nThe following example test script reproduces the problem:\n\n  $ cat qgroup-overflow.sh\n  #!/bin/bash\n\n  DEV=/dev/sdj\n  MNT=/mnt/sdj\n\n  mkfs.btrfs -f $DEV\n  mount $DEV $MNT\n\n  # Set qgroup limit to 2GiB.\n  btrfs quota enable $MNT\n  btrfs qgroup limit 2G $MNT\n\n  # Try to fallocate a 3GiB file. This should fail.\n  echo\n  echo \"Try to fallocate a 3GiB file...\"\n  fallocate -l 3G $MNT/3G.file\n\n  # Try to fallocate a 5GiB file.\n  echo\n  echo \"Try to fallocate a 5GiB file...\"\n  fallocate -l 5G $MNT/5G.file\n\n  # See we break the qgroup limit.\n  echo\n  sync\n  btrfs qgroup show -r $MNT\n\n  umount $MNT\n\nWhen running the test:\n\n  $ ./qgroup-overflow.sh\n  (...)\n\n  Try to fallocate a 3GiB file...\n  fallocate: fallocate failed: Disk quota exceeded\n\n  Try to fallocate a 5GiB file...\n\n  qgroupid         rfer         excl     max_rfer\n  --------         ----         ----     --------\n  0/5           5.00GiB      5.00GiB      2.00GiB\n\nSince we have no control of how bytes_changed is used, it's better to\nset it to u64.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f7edb02d-f2b4-4db9-bb2f-9fe692cec50f",  "id": "CVE-2020-10711",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10711"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fb4c34d3-7626-4cb0-abe2-4678162a2aa3",  "id": "CVE-2024-56757",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    404  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: mediatek: add intf release flow when usb disconnect\n\nMediaTek claim an special usb intr interface for ISO data transmission.\nThe interface need to be released before unregistering hci device when\nusb disconnect. Removing BT usb dongle without properly releasing the\ninterface may cause Kernel panic while unregister hci device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10b0cf69-e139-40c3-bd8e-060b55f7683e",  "id": "CVE-2023-3212",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3212"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6cb747b5-7c23-49fd-b64e-829cf64350a9",  "id": "CVE-2022-28391",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28391"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    88  ],  "analysis": {    "state": "in_triage"  },  "description": "BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "14922f8b-cd7a-440b-8fed-f2917ed09b55",  "id": "CVE-2022-49326",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtl818x: Prevent using not initialized queues\n\nUsing not existing queues can panic the kernel with rtl8180/rtl8185 cards.\nIgnore the skb priority for those cards, they only have one tx queue. Pierre\nAsselin (pa@panix.com) reported the kernel crash in the Gentoo forum:\n\nhttps://forums.gentoo.org/viewtopic-t-1147832-postdays-0-postorder-asc-start-25.html\n\nHe also confirmed that this patch fixes the issue. In summary this happened:\n\nAfter updating wpa_supplicant from 2.9 to 2.10 the kernel crashed with a\n\"divide error: 0000\" when connecting to an AP. Control port tx now tries to\nuse IEEE80211_AC_VO for the priority, which wpa_supplicants starts to use in\n2.10.\n\nSince only the rtl8187se part of the driver supports QoS, the priority\nof the skb is set to IEEE80211_AC_BE (2) by mac80211 for rtl8180/rtl8185\ncards.\n\nrtl8180 is then unconditionally reading out the priority and finally crashes on\ndrivers/net/wireless/realtek/rtl818x/rtl8180/dev.c line 544 without this\npatch:\n\tidx = (ring->idx + skb_queue_len(&ring->queue)) % ring->entries\n\n\"ring->entries\" is zero for rtl8180/rtl8185 cards, tx_ring[2] never got\ninitialized.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c14a161f-6491-4e97-8137-a3704216bf8b",  "id": "CVE-2023-6531",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6531"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:176533/Linux-Broken-Unix-GC-Interaction-Use-After-Free.html'"    }  ]},{  "bom-ref": "df7be424-7567-4bc4-9cd4-ecf4e54c7c26",  "id": "CVE-2024-50006",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix i_data_sem unlock order in ext4_ind_migrate()\n\nFuzzing reports a possible deadlock in jbd2_log_wait_commit.\n\nThis issue is triggered when an EXT4_IOC_MIGRATE ioctl is set to require\nsynchronous updates because the file descriptor is opened with O_SYNC.\nThis can lead to the jbd2_journal_stop() function calling\njbd2_might_wait_for_commit(), potentially causing a deadlock if the\nEXT4_IOC_MIGRATE call races with a write(2) system call.\n\nThis problem only arises when CONFIG_PROVE_LOCKING is enabled. In this\ncase, the jbd2_might_wait_for_commit macro locks jbd2_handle in the\njbd2_journal_stop function while i_data_sem is locked. This triggers\nlockdep because the jbd2_journal_start function might also lock the same\njbd2_handle simultaneously.\n\nFound by Linux Verification Center (linuxtesting.org) with syzkaller.\n\nRule: add",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ecf9ac22-4fe1-4a5c-83f7-17e1d792bf7e",  "id": "CVE-2012-2133",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2133"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Use-after-free vulnerability in the Linux kernel before 3.3.6, when huge pages are enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges by interacting with a hugetlbfs filesystem, as demonstrated by a umount operation that triggers improper handling of quota data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31161ff5-ee96-4a2b-ace8-464e97434e53",  "id": "CVE-2021-47276",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47276"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    706  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Do not blindly read the ip address in ftrace_bug()\n\nIt was reported that a bug on arm64 caused a bad ip address to be used for\nupdating into a nop in ftrace_init(), but the error path (rightfully)\nreturned -EINVAL and not -EFAULT, as the bug caused more than one error to\noccur. But because -EINVAL was returned, the ftrace_bug() tried to report\nwhat was at the location of the ip address, and read it directly. This\ncaused the machine to panic, as the ip was not pointing to a valid memory\naddress.\n\nInstead, read the ip address with copy_from_kernel_nofault() to safely\naccess the memory, and if it faults, report that the address faulted,\notherwise report what was in that location.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "96cc7113-97c6-4d7a-8323-954776430ce1",  "id": "CVE-2023-52475",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: powermate - fix use-after-free in powermate_config_complete\n\nsyzbot has found a use-after-free bug [1] in the powermate driver. This\nhappens when the device is disconnected, which leads to a memory free from\nthe powermate_device struct.  When an asynchronous control message\ncompletes after the kfree and its callback is invoked, the lock does not\nexist anymore and hence the bug.\n\nUse usb_kill_urb() on pm->config to cancel any in-progress requests upon\ndevice disconnection.\n\n[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fb3aa538-baaa-4302-9b8f-be0c8c8b8b98",  "id": "CVE-2022-48827",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix the behavior of READ near OFFSET_MAX\n\nDan Aloni reports:\n> Due to commit 8cfb9015280d (\"NFS: Always provide aligned buffers to\n> the RPC read layers\") on the client, a read of 0xfff is aligned up\n> to server rsize of 0x1000.\n>\n> As a result, in a test where the server has a file of size\n> 0x7fffffffffffffff, and the client tries to read from the offset\n> 0x7ffffffffffff000, the read causes loff_t overflow in the server\n> and it returns an NFS code of EINVAL to the client. The client as\n> a result indefinitely retries the request.\n\nThe Linux NFS client does not handle NFS?ERR_INVAL, even though all\nNFS specifications permit servers to return that status code for a\nREAD.\n\nInstead of NFS?ERR_INVAL, have out-of-range READ requests succeed\nand return a short result. Set the EOF flag in the result to prevent\nthe client from retrying the READ request. This behavior appears to\nbe consistent with Solaris NFS servers.\n\nNote that NFSv3 and NFSv4 use u64 offset values on the wire. These\nmust be converted to loff_t internally before use -- an implicit\ntype cast is not adequate for this purpose. Otherwise VFS checks\nagainst sb->s_maxbytes do not work properly.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32210ddd-8ecb-4b64-88cd-35afe5b4ab81",  "id": "CVE-2024-41013",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't walk off the end of a directory data block\n\nThis adds sanity checks for xfs_dir2_data_unused and xfs_dir2_data_entry\nto make sure don't stray beyond valid memory region. Before patching, the\nloop simply checks that the start offset of the dup and dep is within the\nrange. So in a crafted image, if last entry is xfs_dir2_data_unused, we\ncan change dup->length to dup->length-1 and leave 1 byte of space. In the\nnext traversal, this space will be considered as dup or dep. We may\nencounter an out of bound read when accessing the fixed members.\n\nIn the patch, we make sure that the remaining bytes large enough to hold\nan unused entry before accessing xfs_dir2_data_unused and\nxfs_dir2_data_unused is XFS_DIR2_DATA_ALIGN byte aligned. We also make\nsure that the remaining bytes large enough to hold a dirent with a\nsingle-byte name before accessing xfs_dir2_data_entry.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8383325d-7271-47da-b1d2-dc9915cca056",  "id": "OESA-2026-2963",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb55ad54-9332-4738-ac49-5546d6665eb3",  "id": "CVE-2026-23266",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: rivafb: fix divide error in nv3_arb()\n\nA userspace program can trigger the RIVA NV3 arbitration code by calling\nthe FBIOPUT_VSCREENINFO ioctl on /dev/fb*. When doing so, the driver\nrecomputes FIFO arbitration parameters in nv3_arb(), using state->mclk_khz\n(derived from the PRAMDAC MCLK PLL) as a divisor without validating it\nfirst.\n\nIn a normal setup, state->mclk_khz is provided by the real hardware and is\nnon-zero. However, an attacker can construct a malicious or misconfigured\ndevice (e.g. a crafted/emulated PCI device) that exposes a bogus PLL\nconfiguration, causing state->mclk_khz to become zero.  Once\nnv3_get_param() calls nv3_arb(), the division by state->mclk_khz in the gns\ncalculation causes a divide error and crashes the kernel.\n\nFix this by checking whether state->mclk_khz is zero and bailing out before\ndoing the division.\n\nThe following log reveals it:\n\nrivafb: setting virtual Y resolution to 2184\ndivide error: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 PID: 2187 Comm: syz-executor.0 Not tainted 5.18.0-rc1+ #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\nRIP: 0010:nv3_arb drivers/video/fbdev/riva/riva_hw.c:439 [inline]\nRIP: 0010:nv3_get_param+0x3ab/0x13b0 drivers/video/fbdev/riva/riva_hw.c:546\nCall Trace:\n  nv3CalcArbitration.constprop.0+0x255/0x460 drivers/video/fbdev/riva/riva_hw.c:603\n  nv3UpdateArbitrationSettings drivers/video/fbdev/riva/riva_hw.c:637 [inline]\n  CalcStateExt+0x447/0x1b90 drivers/video/fbdev/riva/riva_hw.c:1246\n  riva_load_video_mode+0x8a9/0xea0 drivers/video/fbdev/riva/fbdev.c:779\n  rivafb_set_par+0xc0/0x5f0 drivers/video/fbdev/riva/fbdev.c:1196\n  fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1033\n  do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1109\n  fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1188\n  __x64_sys_ioctl+0x122/0x190 fs/ioctl.c:856",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d0a7fb43-bdf8-4357-90e3-6fb4bfbeb911",  "id": "CVE-2024-26587",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: netdevsim: don't try to destroy PHC on VFs\n\nPHC gets initialized in nsim_init_netdevsim(), which\nis only called if (nsim_dev_port_is_pf()).\n\nCreate a counterpart of nsim_init_netdevsim() and\nmove the mock_phc_destroy() there.\n\nThis fixes a crash trying to destroy netdevsim with\nVFs instantiated, as caught by running the devlink.sh test:\n\n    BUG: kernel NULL pointer dereference, address: 00000000000000b8\n    RIP: 0010:mock_phc_destroy+0xd/0x30\n    Call Trace:\n     <TASK>\n     nsim_destroy+0x4a/0x70 [netdevsim]\n     __nsim_dev_port_del+0x47/0x70 [netdevsim]\n     nsim_dev_reload_destroy+0x105/0x120 [netdevsim]\n     nsim_drv_remove+0x2f/0xb0 [netdevsim]\n     device_release_driver_internal+0x1a1/0x210\n     bus_remove_device+0xd5/0x120\n     device_del+0x159/0x490\n     device_unregister+0x12/0x30\n     del_device_store+0x11a/0x1a0 [netdevsim]\n     kernfs_fop_write_iter+0x130/0x1d0\n     vfs_write+0x30b/0x4b0\n     ksys_write+0x69/0xf0\n     do_syscall_64+0xcc/0x1e0\n     entry_SYSCALL_64_after_hwframe+0x6f/0x77",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8c07740-532c-4cdb-8c45-1a55cc82a249",  "id": "CVE-2023-53410",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: ULPI: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dcc7b6a1-29cb-40be-9917-ff8049aecaca",  "id": "CVE-2022-49771",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm ioctl: fix misbehavior if list_versions races with module loading\n\n__list_versions will first estimate the required space using the\n\"dm_target_iterate(list_version_get_needed, &needed)\" call and then will\nfill the space using the \"dm_target_iterate(list_version_get_info,\n&iter_info)\" call. Each of these calls locks the targets using the\n\"down_read(&_lock)\" and \"up_read(&_lock)\" calls, however between the first\nand second \"dm_target_iterate\" there is no lock held and the target\nmodules can be loaded at this point, so the second \"dm_target_iterate\"\ncall may need more space than what was the first \"dm_target_iterate\"\nreturned.\n\nThe code tries to handle this overflow (see the beginning of\nlist_version_get_info), however this handling is incorrect.\n\nThe code sets \"param->data_size = param->data_start + needed\" and\n\"iter_info.end = (char *)vers+len\" - \"needed\" is the size returned by the\nfirst dm_target_iterate call; \"len\" is the size of the buffer allocated by\nuserspace.\n\n\"len\" may be greater than \"needed\"; in this case, the code will write up\nto \"len\" bytes into the buffer, however param->data_size is set to\n\"needed\", so it may write data past the param->data_size value. The ioctl\ninterface copies only up to param->data_size into userspace, thus part of\nthe result will be truncated.\n\nFix this bug by setting \"iter_info.end = (char *)vers + needed;\" - this\nguarantees that the second \"dm_target_iterate\" call will write only up to\nthe \"needed\" buffer and it will exit with \"DM_BUFFER_FULL_FLAG\" if it\noverflows the \"needed\" space - in this case, userspace will allocate a\nlarger buffer and retry.\n\nNote that there is also a bug in list_version_get_needed - we need to add\n\"strlen(tt->name) + 1\" to the needed size, not \"strlen(tt->name)\".",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fbdcb406-5680-42f8-8d6b-66c35e5ca6a1",  "id": "CVE-2022-50516",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: dlm: fix invalid derefence of sb_lvbptr\n\nI experience issues when putting a lkbsb on the stack and have sb_lvbptr\nfield to a dangled pointer while not using DLM_LKF_VALBLK. It will crash\nwith the following kernel message, the dangled pointer is here\n0xdeadbeef as example:\n\n[  102.749317] BUG: unable to handle page fault for address: 00000000deadbeef\n[  102.749320] #PF: supervisor read access in kernel mode\n[  102.749323] #PF: error_code(0x0000) - not-present page\n[  102.749325] PGD 0 P4D 0\n[  102.749332] Oops: 0000 [#1] PREEMPT SMP PTI\n[  102.749336] CPU: 0 PID: 1567 Comm: lock_torture_wr Tainted: G        W         5.19.0-rc3+ #1565\n[  102.749343] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-2.module+el8.7.0+15506+033991b0 04/01/2014\n[  102.749344] RIP: 0010:memcpy_erms+0x6/0x10\n[  102.749353] Code: cc cc cc cc eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe\n[  102.749355] RSP: 0018:ffff97a58145fd08 EFLAGS: 00010202\n[  102.749358] RAX: ffff901778b77070 RBX: 0000000000000000 RCX: 0000000000000040\n[  102.749360] RDX: 0000000000000040 RSI: 00000000deadbeef RDI: ffff901778b77070\n[  102.749362] RBP: ffff97a58145fd10 R08: ffff901760b67a70 R09: 0000000000000001\n[  102.749364] R10: ffff9017008e2cb8 R11: 0000000000000001 R12: ffff901760b67a70\n[  102.749366] R13: ffff901760b78f00 R14: 0000000000000003 R15: 0000000000000001\n[  102.749368] FS:  0000000000000000(0000) GS:ffff901876e00000(0000) knlGS:0000000000000000\n[  102.749372] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  102.749374] CR2: 00000000deadbeef CR3: 000000017c49a004 CR4: 0000000000770ef0\n[  102.749376] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  102.749378] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  102.749379] PKRU: 55555554\n[  102.749381] Call Trace:\n[  102.749382]  <TASK>\n[  102.749383]  ? send_args+0xb2/0xd0\n[  102.749389]  send_common+0xb7/0xd0\n[  102.749395]  _unlock_lock+0x2c/0x90\n[  102.749400]  unlock_lock.isra.56+0x62/0xa0\n[  102.749405]  dlm_unlock+0x21e/0x330\n[  102.749411]  ? lock_torture_stats+0x80/0x80 [dlm_locktorture]\n[  102.749416]  torture_unlock+0x5a/0x90 [dlm_locktorture]\n[  102.749419]  ? preempt_count_sub+0xba/0x100\n[  102.749427]  lock_torture_writer+0xbd/0x150 [dlm_locktorture]\n[  102.786186]  kthread+0x10a/0x130\n[  102.786581]  ? kthread_complete_and_exit+0x20/0x20\n[  102.787156]  ret_from_fork+0x22/0x30\n[  102.787588]  </TASK>\n[  102.787855] Modules linked in: dlm_locktorture torture rpcsec_gss_krb5 intel_rapl_msr intel_rapl_common kvm_intel iTCO_wdt iTCO_vendor_support kvm vmw_vsock_virtio_transport qxl irqbypass vmw_vsock_virtio_transport_common drm_ttm_helper crc32_pclmul joydev crc32c_intel ttm vsock virtio_scsi virtio_balloon snd_pcm drm_kms_helper virtio_console snd_timer snd drm soundcore syscopyarea i2c_i801 sysfillrect sysimgblt i2c_smbus pcspkr fb_sys_fops lpc_ich serio_raw\n[  102.792536] CR2: 00000000deadbeef\n[  102.792930] ---[ end trace 0000000000000000 ]---\n\nThis patch fixes the issue by checking also on DLM_LKF_VALBLK on exflags\nis set when copying the lvbptr array instead of if it's just null which\nfixes for me the issue.\n\nI think this patch can fix other dlm users as well, depending how they\nhandle the init, freeing memory handling of sb_lvbptr and don't set\nDLM_LKF_VALBLK for some dlm_lock() calls. It might a there could be a\nhidden issue all the time. However with checking on DLM_LKF_VALBLK the\nuser always need to provide a sb_lvbptr non-null value. There might be\nmore intelligent handling between per ls lvblen, DLM_LKF_VALBLK and\nnon-null to report the user the way how DLM API is used is wrong but can\nbe added for later, this will only fix the current behaviour.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8346c493-c539-4923-836e-cadb8cf94d84",  "id": "CVE-2020-12653",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12653"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was found in Linux kernel before 5.5.4. The mwifiex_cmd_append_vsie_tlv() function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of an incorrect memcpy and buffer overflow, aka CID-b70261a288ea.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a4f56cae-565a-48af-a27f-4e9ed174d323",  "id": "CLSA-2026-1777455447",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8bfb80c3-c472-4d78-b466-ad0c3614ae58",  "id": "CVE-2024-44942",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC\n\nsyzbot reports a f2fs bug as below:\n\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/inline.c:258!\nCPU: 1 PID: 34 Comm: kworker/u8:2 Not tainted 6.9.0-rc6-syzkaller-00012-g9e4bc4bcae01 #0\nRIP: 0010:f2fs_write_inline_data+0x781/0x790 fs/f2fs/inline.c:258\nCall Trace:\n f2fs_write_single_data_page+0xb65/0x1d60 fs/f2fs/data.c:2834\n f2fs_write_cache_pages fs/f2fs/data.c:3133 [inline]\n __f2fs_write_data_pages fs/f2fs/data.c:3288 [inline]\n f2fs_write_data_pages+0x1efe/0x3a90 fs/f2fs/data.c:3315\n do_writepages+0x35b/0x870 mm/page-writeback.c:2612\n __writeback_single_inode+0x165/0x10b0 fs/fs-writeback.c:1650\n writeback_sb_inodes+0x905/0x1260 fs/fs-writeback.c:1941\n wb_writeback+0x457/0xce0 fs/fs-writeback.c:2117\n wb_do_writeback fs/fs-writeback.c:2264 [inline]\n wb_workfn+0x410/0x1090 fs/fs-writeback.c:2304\n process_one_work kernel/workqueue.c:3254 [inline]\n process_scheduled_works+0xa12/0x17c0 kernel/workqueue.c:3335\n worker_thread+0x86d/0xd70 kernel/workqueue.c:3416\n kthread+0x2f2/0x390 kernel/kthread.c:388\n ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\nThe root cause is: inline_data inode can be fuzzed, so that there may\nbe valid blkaddr in its direct node, once f2fs triggers background GC\nto migrate the block, it will hit f2fs_bug_on() during dirty page\nwriteback.\n\nLet's add sanity check on F2FS_INLINE_DATA flag in inode during GC,\nso that, it can forbid migrating inline_data inode's data block for\nfixing.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "22fd2ca6-d770-4067-be3a-8468c03cf7c4",  "id": "CVE-2023-52736",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: Do not unset preset when cleaning up codec\n\nSeveral functions that take part in codec's initialization and removal\nare re-used by ASoC codec drivers implementations. Drivers mimic the\nbehavior of hda_codec_driver_probe/remove() found in\nsound/pci/hda/hda_bind.c with their component->probe/remove() instead.\n\nOne of the reasons for that is the expectation of\nsnd_hda_codec_device_new() to receive a valid pointer to an instance of\nstruct snd_card. This expectation can be met only once sound card\ncomponents probing commences.\n\nAs ASoC sound card may be unbound without codec device being actually\nremoved from the system, unsetting ->preset in\nsnd_hda_codec_cleanup_for_unbind() interferes with module unload -> load\nscenario causing null-ptr-deref. Preset is assigned only once, during\ndevice/driver matching whereas ASoC codec driver's module reloading may\noccur several times throughout the lifetime of an audio stack.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8685eacd-1696-4e64-8c85-6f8e52faeef5",  "id": "RHSA-2025:21174",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a9021df-88bc-451a-86c3-e20f6f67f6fd",  "id": "CLSA-2026-1770667352",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "21dee4d9-8e71-4a93-8383-e664f2238aef",  "id": "ALSA-2025:1330",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b279c959-11f4-4f1c-9fd0-4bbf4b70ec0f",  "id": "OESA-2025-1884",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "913f5ecb-145c-4968-ae09-cc06119498f1",  "id": "CVE-2010-3904",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3904"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    1284  ],  "analysis": {    "state": "in_triage"  },  "description": "The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:44677'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'MSF:rds_rds_page_copy_user_priv_esc'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'PSS:94993/Linux-Kernel-2.6.36-rc8-RDS-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "892a15e8-abb2-472d-8459-b622a38668d5",  "id": "CVE-2019-12984",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12984"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC attributes, leading to denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6aa1d4e3-b707-44ad-b978-a06258ced5b4",  "id": "CVE-2024-43908",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix the null pointer dereference to ras_manager\n\nCheck ras_manager before using it",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5422d819-6b7b-4652-b39a-dd13e6f5a7ec",  "id": "CVE-2024-46705",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: reset mmio mappings with devm\n\nSet our various mmio mappings to NULL. This should make it easier to\ncatch something rogue trying to mess with mmio after device removal. For\nexample, we might unmap everything and then start hitting some mmio\naddress which has already been unmamped by us and then remapped by\nsomething else, causing all kinds of carnage.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "315149a3-bd7b-403e-8f46-ac68375d1d81",  "id": "CVE-2021-47249",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47249"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: fix memory leak in rds_recvmsg\n\nSyzbot reported memory leak in rds. The problem\nwas in unputted refcount in case of error.\n\nint rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,\n\t\tint msg_flags)\n{\n...\n\n\tif (!rds_next_incoming(rs, &inc)) {\n\t\t...\n\t}\n\nAfter this \"if\" inc refcount incremented and\n\n\tif (rds_cmsg_recv(inc, msg, rs)) {\n\t\tret = -EFAULT;\n\t\tgoto out;\n\t}\n...\nout:\n\treturn ret;\n}\n\nin case of rds_cmsg_recv() fail the refcount won't be\ndecremented. And it's easy to see from ftrace log, that\nrds_inc_addref() don't have rds_inc_put() pair in\nrds_recvmsg() after rds_cmsg_recv()\n\n 1)               |  rds_recvmsg() {\n 1)   3.721 us    |    rds_inc_addref();\n 1)   3.853 us    |    rds_message_inc_copy_to_user();\n 1) + 10.395 us   |    rds_cmsg_recv();\n 1) + 34.260 us   |  }",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "537f693e-9290-48a3-85ed-8efe62a900c7",  "id": "DSA-1701-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7447ba4c-7bc1-4b76-9f35-00c8a47f168d",  "id": "CVE-2024-53179",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of signing key\n\nCustomers have reported use-after-free in @ses->auth_key.response with\nSMB2.1 + sign mounts which occurs due to following race:\n\ntask A                         task B\ncifs_mount()\n dfs_mount_share()\n  get_session()\n   cifs_mount_get_session()    cifs_send_recv()\n    cifs_get_smb_ses()          compound_send_recv()\n     cifs_setup_session()        smb2_setup_request()\n      kfree_sensitive()           smb2_calc_signature()\n                                   crypto_shash_setkey() *UAF*\n\nFix this by ensuring that we have a valid @ses->auth_key.response by\nchecking whether @ses->ses_status is SES_GOOD or SES_EXITING with\n@ses->ses_lock held.  After commit 24a9799aa8ef (\"smb: client: fix UAF\nin smb2_reconnect_server()\"), we made sure to call ->logoff() only\nwhen @ses was known to be good (e.g. valid ->auth_key.response), so\nit's safe to access signing key when @ses->ses_status == SES_EXITING.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5c8f6bc3-5751-456c-83fd-f2db03207a82",  "id": "CVE-2011-4080",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4080"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The sysrq_sysctl_handler function in kernel/sysctl.c in the Linux kernel before 2.6.39 does not require the CAP_SYS_ADMIN capability to modify the dmesg_restrict value, which allows local users to bypass intended access restrictions and read the kernel ring buffer by leveraging root privileges, as demonstrated by a root user in a Linux Containers (aka LXC) environment.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c55388f2-a00f-4d9a-8aab-0fd30e6bcae2",  "id": "RLSA-2026:19218",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b0d44b58-4837-46ba-84be-09c30fcfa1f0",  "id": "CVE-2026-31427",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp\n\nprocess_sdp() declares union nf_inet_addr rtp_addr on the stack and\npasses it to the nf_nat_sip sdp_session hook after walking the SDP\nmedia descriptions. However rtp_addr is only initialized inside the\nmedia loop when a recognized media type with a non-zero port is found.\n\nIf the SDP body contains no m= lines, only inactive media sections\n(m=audio 0 ...) or only unrecognized media types, rtp_addr is never\nassigned. Despite that, the function still calls hooks->sdp_session()\nwith &rtp_addr, causing nf_nat_sdp_session() to format the stale stack\nvalue as an IP address and rewrite the SDP session owner and connection\nlines with it.\n\nWith CONFIG_INIT_STACK_ALL_ZERO (default on most distributions) this\nresults in the session-level o= and c= addresses being rewritten to\n0.0.0.0 for inactive SDP sessions. Without stack auto-init the\nrewritten address is whatever happened to be on the stack.\n\nFix this by pre-initializing rtp_addr from the session-level connection\naddress (caddr) when available, and tracking via a have_rtp_addr flag\nwhether any valid address was established. Skip the sdp_session hook\nentirely when no valid address exists.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2393c169-dce1-45a8-b969-bbe8d76028f3",  "id": "CVE-2022-34494",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34494"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f50ff90-159a-4bae-b6fc-3c0513343ab1",  "id": "CVE-2024-26843",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi: runtime: Fix potential overflow of soft-reserved region size\n\nmd_size will have been narrowed if we have >= 4GB worth of pages in a\nsoft-reserved region.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "77800c9a-6b37-4560-9052-526bb357cf35",  "id": "CVE-2024-26816",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86, relocs: Ignore relocations in .notes section\n\nWhen building with CONFIG_XEN_PV=y, .text symbols are emitted into\nthe .notes section so that Xen can find the \"startup_xen\" entry point.\nThis information is used prior to booting the kernel, so relocations\nare not useful. In fact, performing relocations against the .notes\nsection means that the KASLR base is exposed since /sys/kernel/notes\nis world-readable.\n\nTo avoid leaking the KASLR base without breaking unprivileged tools that\nare expecting to read /sys/kernel/notes, skip performing relocations in\nthe .notes section. The values readable in .notes are then identical to\nthose found in System.map.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18cb4e35-390b-4858-b5cf-d0a24ec58897",  "id": "CVE-2023-52805",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds in diAlloc\n\nCurrently there is not check against the agno of the iag while\nallocating new inodes to avoid fragmentation problem. Added the check\nwhich is required.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f24ef40a-d32d-4f35-b9be-ca7a63e8d8e5",  "id": "CVE-2026-43230",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: Clear reconnect pending bit\n\nWhen canceling the reconnect worker, care must be taken to reset the\nreconnect-pending bit. If the reconnect worker has not yet been\nscheduled before it is canceled, the reconnect-pending bit will stay\non forever.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "383c0e2a-e2c4-4b2b-9a84-b8a3c08ab478",  "id": "CVE-2026-23089",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()\n\nWhen snd_usb_create_mixer() fails, snd_usb_mixer_free() frees\nmixer->id_elems but the controls already added to the card still\nreference the freed memory. Later when snd_card_register() runs,\nthe OSS mixer layer calls their callbacks and hits a use-after-free read.\n\nCall trace:\n  get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411\n  get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241\n  mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381\n  snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887\n  ...\n  snd_card_register+0x4ed/0x6d0 sound/core/init.c:923\n  usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025\n\nFix by calling snd_ctl_remove() for all mixer controls before freeing\nid_elems. We save the next pointer first because snd_ctl_remove()\nfrees the current element.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b9a63da2-fcec-46e4-af4b-2c0ecb64f36c",  "id": "SUSE-SU-2023:2469-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2397951-b846-4511-882a-9d0124b81872",  "id": "CVE-2024-41093",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: avoid using null object of framebuffer\n\nInstead of using state->fb->obj[0] directly, get object from framebuffer\nby calling drm_gem_fb_get_obj() and return error code when object is\nnull to avoid using null object of framebuffer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc41c4e8-2333-40f5-9f75-2e98930d7a61",  "id": "CVE-2013-0914",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0914"  },  "ratings": [    {      "score": 3.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dbaf9040-9dd0-48ab-9b68-96d5f7714f6b",  "id": "CVE-2024-41012",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfilelock: Remove locks reliably when fcntl/close race is detected\n\nWhen fcntl_setlk() races with close(), it removes the created lock with\ndo_lock_file_wait().\nHowever, LSMs can allow the first do_lock_file_wait() that created the lock\nwhile denying the second do_lock_file_wait() that tries to remove the lock.\nSeparately, posix_lock_file() could also fail to\nremove a lock due to GFP_KERNEL allocation failure (when splitting a range\nin the middle).\n\nAfter the bug has been triggered, use-after-free reads will occur in\nlock_get_status() when userspace reads /proc/locks. This can likely be used\nto read arbitrary kernel memory, but can't corrupt kernel memory.\n\nFix it by calling locks_remove_posix() instead, which is designed to\nreliably get rid of POSIX locks associated with the given file and\nfiles_struct and is also used by filp_flush().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:180403/Linux-lock_get_status-Use-After-Free.html'"    }  ]},{  "bom-ref": "157ffdd3-b63b-4a07-80e7-d8d496b30f81",  "id": "CVE-2022-50366",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowercap: intel_rapl: fix UBSAN shift-out-of-bounds issue\n\nWhen value < time_unit, the parameter of ilog2() will be zero and\nthe return value is -1. u64(-1) is too large for shift exponent\nand then will trigger shift-out-of-bounds:\n\nshift exponent 18446744073709551615 is too large for 32-bit type 'int'\nCall Trace:\n rapl_compute_time_window_core\n rapl_write_data_raw\n set_time_window\n store_constraint_time_window_us",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "39c5cfdd-6bf6-4c79-9b44-0e2574e1d70f",  "id": "OESA-2026-2509",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5b604b42-c709-4429-b4d0-09ee6238efa0",  "id": "CVE-2018-10881",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10881"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9e7c18e2-b416-4c82-836e-591196fdf829",  "id": "MGASA-2026-0029",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "73f9d7dd-3717-44a9-81f4-ba7292d50943",  "id": "CVE-2013-0228",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0228"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows guest OS users to gain guest OS privileges via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5ee430b1-d931-49fd-9cf6-ce5d56cfae2c",  "id": "CVE-2025-22025",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: put dl_stid if fail to queue dl_recall\n\nBefore calling nfsd4_run_cb to queue dl_recall to the callback_wq, we\nincrement the reference count of dl_stid.\nWe expect that after the corresponding work_struct is processed, the\nreference count of dl_stid will be decremented through the callback\nfunction nfsd4_cb_recall_release.\nHowever, if the call to nfsd4_run_cb fails, the incremented reference\ncount of dl_stid will not be decremented correspondingly, leading to the\nfollowing nfs4_stid leak:\nunreferenced object 0xffff88812067b578 (size 344):\n  comm \"nfsd\", pid 2761, jiffies 4295044002 (age 5541.241s)\n  hex dump (first 32 bytes):\n    01 00 00 00 6b 6b 6b 6b b8 02 c0 e2 81 88 ff ff  ....kkkk........\n    00 6b 6b 6b 6b 6b 6b 6b 00 00 00 00 ad 4e ad de  .kkkkkkk.....N..\n  backtrace:\n    kmem_cache_alloc+0x4b9/0x700\n    nfsd4_process_open1+0x34/0x300\n    nfsd4_open+0x2d1/0x9d0\n    nfsd4_proc_compound+0x7a2/0xe30\n    nfsd_dispatch+0x241/0x3e0\n    svc_process_common+0x5d3/0xcc0\n    svc_process+0x2a3/0x320\n    nfsd+0x180/0x2e0\n    kthread+0x199/0x1d0\n    ret_from_fork+0x30/0x50\n    ret_from_fork_asm+0x1b/0x30\nunreferenced object 0xffff8881499f4d28 (size 368):\n  comm \"nfsd\", pid 2761, jiffies 4295044005 (age 5541.239s)\n  hex dump (first 32 bytes):\n    01 00 00 00 00 00 00 00 30 4d 9f 49 81 88 ff ff  ........0M.I....\n    30 4d 9f 49 81 88 ff ff 20 00 00 00 01 00 00 00  0M.I.... .......\n  backtrace:\n    kmem_cache_alloc+0x4b9/0x700\n    nfs4_alloc_stid+0x29/0x210\n    alloc_init_deleg+0x92/0x2e0\n    nfs4_set_delegation+0x284/0xc00\n    nfs4_open_delegation+0x216/0x3f0\n    nfsd4_process_open2+0x2b3/0xee0\n    nfsd4_open+0x770/0x9d0\n    nfsd4_proc_compound+0x7a2/0xe30\n    nfsd_dispatch+0x241/0x3e0\n    svc_process_common+0x5d3/0xcc0\n    svc_process+0x2a3/0x320\n    nfsd+0x180/0x2e0\n    kthread+0x199/0x1d0\n    ret_from_fork+0x30/0x50\n    ret_from_fork_asm+0x1b/0x30\nFix it by checking the result of nfsd4_run_cb and call nfs4_put_stid if\nfail to queue dl_recall.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "27bd17d0-4a86-445b-b8ba-335bf35e6117",  "id": "CVE-2022-49516",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: always check VF VSI pointer values\n\nThe ice_get_vf_vsi function can return NULL in some cases, such as if\nhandling messages during a reset where the VSI is being removed and\nrecreated.\n\nSeveral places throughout the driver do not bother to check whether this\nVSI pointer is valid. Static analysis tools maybe report issues because\nthey detect paths where a potentially NULL pointer could be dereferenced.\n\nFix this by checking the return value of ice_get_vf_vsi everywhere.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cbefc8af-e519-44ae-8551-7711746b33e3",  "id": "SUSE-SU-2018:1887-2",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18743d7c-3bd5-427a-a532-993c79cdd5ab",  "id": "DLA-81-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae654ab3-01ed-4b57-8b25-c5324071e249",  "id": "CVE-2022-47929",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47929"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with \"tc qdisc\" and \"tc class\" commands. This affects qdisc_graft in net/sched/sch_api.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3056f55d-e84f-4e4a-bfdd-058e1b42c79d",  "id": "CVE-2022-48636",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup\n\nFix Oops in dasd_alias_get_start_dev() function caused by the pavgroup\npointer being NULL.\n\nThe pavgroup pointer is checked on the entrance of the function but\nwithout the lcu->lock being held. Therefore there is a race window\nbetween dasd_alias_get_start_dev() and _lcu_update() which sets\npavgroup to NULL with the lcu->lock held.\n\nFix by checking the pavgroup pointer with lcu->lock held.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "421f64dc-a53d-44fb-942c-be4cb9f53305",  "id": "CVE-2014-3534",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3534"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    269  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a crafted application that makes a ptrace system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d841945-9ffa-4127-8589-d313b610e02e",  "id": "CVE-2023-34324",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34324"  },  "ratings": [    {      "score": 4.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "Closing of an event channel in the Linux kernel can result in a deadlock.\nThis happens when the close is being performed in parallel to an unrelated\nXen console action and the handling of a Xen console interrupt in an\nunprivileged guest.\n\nThe closing of an event channel is e.g. triggered by removal of a\nparavirtual device on the other side. As this action will cause console\nmessages to be issued on the other side quite often, the chance of\ntriggering the deadlock is not neglectable.\n\nNote that 32-bit Arm-guests are not affected, as the 32-bit Linux kernel\non Arm doesn't use queued-RW-locks, which are required to trigger the\nissue (on Arm32 a waiting writer doesn't block further readers to get\nthe lock).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b1c185c9-b003-40e2-ac51-09cf89f5c792",  "id": "CVE-2024-44948",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mtrr: Check if fixed MTRRs exist before saving them\n\nMTRRs have an obsolete fixed variant for fine grained caching control\nof the 640K-1MB region that uses separate MSRs. This fixed variant has\na separate capability bit in the MTRR capability MSR.\n\nSo far all x86 CPUs which support MTRR have this separate bit set, so it\nwent unnoticed that mtrr_save_state() does not check the capability bit\nbefore accessing the fixed MTRR MSRs.\n\nThough on a CPU that does not support the fixed MTRR capability this\nresults in a #GP.  The #GP itself is harmless because the RDMSR fault is\nhandled gracefully, but results in a WARN_ON().\n\nAdd the missing capability check to prevent this.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "42a28309-df30-4e77-a66c-498aebbe755e",  "id": "CVE-2022-49597",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix data-races around sysctl_tcp_base_mss.\n\nWhile reading sysctl_tcp_base_mss, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its readers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "68fcde3d-a664-4167-a2cf-ebfddd9878e3",  "id": "CVE-2022-48792",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task\n\nCurrently a use-after-free may occur if a sas_task is aborted by the upper\nlayer before we handle the I/O completion in mpi_ssp_completion() or\nmpi_sata_completion().\n\nIn this case, the following are the two steps in handling those I/O\ncompletions:\n\n - Call complete() to inform the upper layer handler of completion of\n   the I/O.\n\n - Release driver resources associated with the sas_task in\n   pm8001_ccb_task_free() call.\n\nWhen complete() is called, the upper layer may free the sas_task. As such,\nwe should not touch the associated sas_task afterwards, but we do so in the\npm8001_ccb_task_free() call.\n\nFix by swapping the complete() and pm8001_ccb_task_free() calls ordering.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8ddf29fa-c1cc-4de0-b39f-c2c1740837a1",  "id": "CVE-2023-4244",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4244"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.\n\n\n\nDue to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it is possible to underflow the reference counter causing a use-after-free vulnerability.\n\n\n\nWe recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5aa3c0cb-da9e-4f6b-aa22-7576791fbf47",  "id": "CVE-2024-49974",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Limit the number of concurrent async COPY operations\n\nNothing appears to limit the number of concurrent async COPY\noperations that clients can start. In addition, AFAICT each async\nCOPY can copy an unlimited number of 4MB chunks, so can run for a\nlong time. Thus IMO async COPY can become a DoS vector.\n\nAdd a restriction mechanism that bounds the number of concurrent\nbackground COPY operations. Start simple and try to be fair -- this\npatch implements a per-namespace limit.\n\nAn async COPY request that occurs while this limit is exceeded gets\nNFS4ERR_DELAY. The requesting client can choose to send the request\nagain after a delay or fall back to a traditional read/write style\ncopy.\n\nIf there is need to make the mechanism more sophisticated, we can\nvisit that in future patches.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bfdfd1f1-7a0f-4e02-a257-9d2f059f08f5",  "id": "AZL-67997",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f479252a-940d-4496-a025-f13ea5270626",  "id": "CVE-2022-42328",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42328"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc447ffb-16ce-4d74-bace-943a439d3906",  "id": "CVE-2022-50422",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libsas: Fix use-after-free bug in smp_execute_task_sg()\n\nWhen executing SMP task failed, the smp_execute_task_sg() calls del_timer()\nto delete \"slow_task->timer\". However, if the timer handler\nsas_task_internal_timedout() is running, the del_timer() in\nsmp_execute_task_sg() will not stop it and a UAF will happen. The process\nis shown below:\n\n      (thread 1)               |        (thread 2)\nsmp_execute_task_sg()          | sas_task_internal_timedout()\n ...                           |\n del_timer()                   |\n ...                           |  ...\n sas_free_task(task)           |\n  kfree(task->slow_task) //FREE|\n                               |  task->slow_task->... //USE\n\nFix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure\nthe timer handler have finished before the \"task->slow_task\" is\ndeallocated.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "90792ca9-5bb2-4f6b-8e5a-0b107918ffa4",  "id": "CVE-2024-56531",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: Use snd_card_free_when_closed() at disconnection\n\nThe USB disconnect callback is supposed to be short and not too-long\nwaiting.  OTOH, the current code uses snd_card_free() at\ndisconnection, but this waits for the close of all used fds, hence it\ncan take long.  It eventually blocks the upper layer USB ioctls, which\nmay trigger a soft lockup.\n\nAn easy workaround is to replace snd_card_free() with\nsnd_card_free_when_closed().  This variant returns immediately while\nthe release of resources is done asynchronously by the card device\nrelease at the last close.\n\nThis patch also splits the code to the disconnect and the free phases;\nthe former is called immediately at the USB disconnect callback while\nthe latter is called from the card destructor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e63e2bc9-89d6-497c-a568-35f1f7515cbe",  "id": "CVE-2024-38538",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: xmit: make sure we have at least eth header len bytes\n\nsyzbot triggered an uninit value[1] error in bridge device's xmit path\nby sending a short (less than ETH_HLEN bytes) skb. To fix it check if\nwe can actually pull that amount instead of assuming.\n\nTested with dropwatch:\n drop at: br_dev_xmit+0xb93/0x12d0 [bridge] (0xffffffffc06739b3)\n origin: software\n timestamp: Mon May 13 11:31:53 2024 778214037 nsec\n protocol: 0x88a8\n length: 2\n original length: 2\n drop reason: PKT_TOO_SMALL\n\n[1]\nBUG: KMSAN: uninit-value in br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65\n br_dev_xmit+0x61d/0x1cb0 net/bridge/br_device.c:65\n __netdev_start_xmit include/linux/netdevice.h:4903 [inline]\n netdev_start_xmit include/linux/netdevice.h:4917 [inline]\n xmit_one net/core/dev.c:3531 [inline]\n dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547\n __dev_queue_xmit+0x34db/0x5350 net/core/dev.c:4341\n dev_queue_xmit include/linux/netdevice.h:3091 [inline]\n __bpf_tx_skb net/core/filter.c:2136 [inline]\n __bpf_redirect_common net/core/filter.c:2180 [inline]\n __bpf_redirect+0x14a6/0x1620 net/core/filter.c:2187\n ____bpf_clone_redirect net/core/filter.c:2460 [inline]\n bpf_clone_redirect+0x328/0x470 net/core/filter.c:2432\n ___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997\n __bpf_prog_run512+0xb5/0xe0 kernel/bpf/core.c:2238\n bpf_dispatcher_nop_func include/linux/bpf.h:1234 [inline]\n __bpf_prog_run include/linux/filter.h:657 [inline]\n bpf_prog_run include/linux/filter.h:664 [inline]\n bpf_test_run+0x499/0xc30 net/bpf/test_run.c:425\n bpf_prog_test_run_skb+0x14ea/0x1f20 net/bpf/test_run.c:1058\n bpf_prog_test_run+0x6b7/0xad0 kernel/bpf/syscall.c:4269\n __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5678\n __do_sys_bpf kernel/bpf/syscall.c:5767 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5765 [inline]\n __x64_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5765\n x64_sys_call+0x96b/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:322\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "920a6f53-a590-464f-84e3-c6393ed4fc82",  "id": "CVE-2015-8812",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8812"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "64d2c398-ab18-42c0-bc61-0892d901b592",  "id": "DSA-3436-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6dc6371f-bf24-4072-927a-8afbfbd09d94",  "id": "CLSA-2024-1708638837",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "72ab3e44-3f46-403c-9e99-9739d058c96f",  "id": "MGASA-2017-0042",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "36b273ac-4107-4768-88d7-26dc6226906e",  "id": "CVE-2019-12378",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12378"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: This has been disputed as not an issue",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d631c021-e613-4b9a-ae97-810769712721",  "id": "RHSA-2015:0066",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "63d171f4-6b98-443b-a6e4-1bc4d904c213",  "id": "CVE-2015-8543",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8543"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The networking implementation in the Linux kernel through 4.3.3, as used in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ebe4b880-3d85-4490-9e07-10b145514960",  "id": "AZL-81944",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5ceefd70-12e5-40db-a775-c6e874b510c2",  "id": "CVE-2017-8831",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8831"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a \"double fetch\" vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eef90f32-8b50-4cf4-9b12-8a07e222344b",  "id": "CVE-2012-0810",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0810"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stack corruption and panic) via a crafted application that triggers certain lock contention.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fe3d0796-bd3d-4709-a30b-11704c48e491",  "id": "RHSA-2020:5566",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a8a5c7a9-dbe2-434b-b0da-304e9ded357e",  "id": "CVE-2020-15780",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15780"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    862  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84321eac-eab2-47f3-ab10-998ab63590b7",  "id": "CVE-2023-22998",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22998"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    436  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c81928aa-6c8f-4330-bcca-b46ead984bef",  "id": "CVE-2025-37856",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: harden block_group::bg_list against list_del() races\n\nAs far as I can tell, these calls of list_del_init() on bg_list cannot\nrun concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(),\nas they are in transaction error paths and situations where the block\ngroup is readonly.\n\nHowever, if there is any chance at all of racing with mark_bg_unused(),\nor a different future user of bg_list, better to be safe than sorry.\n\nOtherwise we risk the following interleaving (bg_list refcount in parens)\n\nT1 (some random op)                       T2 (btrfs_mark_bg_unused)\n                                        !list_empty(&bg->bg_list); (1)\nlist_del_init(&bg->bg_list); (1)\n                                        list_move_tail (1)\nbtrfs_put_block_group (0)\n                                        btrfs_delete_unused_bgs\n                                             bg = list_first_entry\n                                             list_del_init(&bg->bg_list);\n                                             btrfs_put_block_group(bg); (-1)\n\nUltimately, this results in a broken ref count that hits zero one deref\nearly and the real final deref underflows the refcount, resulting in a WARNING.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9ae945f2-518f-4153-8292-909a73200989",  "id": "CVE-2011-1598",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1598"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The bcm_release function in net/can/bcm.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cf649180-22ea-4e9d-961e-ddbfa067fc5b",  "id": "CVE-2022-48757",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    668  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix information leakage in /proc/net/ptype\n\nIn one net namespace, after creating a packet socket without binding\nit to a device, users in other net namespaces can observe the new\n`packet_type` added by this packet socket by reading `/proc/net/ptype`\nfile. This is minor information leakage as packet socket is\nnamespace aware.\n\nAdd a net pointer in `packet_type` to keep the net namespace of\nof corresponding packet socket. In `ptype_seq_show`, this net pointer\nmust be checked when it is not NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cc4031b0-3895-4be4-8549-02877ac90754",  "id": "AZL-42949",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "47b0e28e-e03c-4ef7-b62e-5814182813bc",  "id": "CVE-2022-49116",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: use memset avoid memory leaks\n\nUse memset to initialize structs to prevent memory leaks\nin l2cap_ecred_connect",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b807d9df-7e65-44c6-8751-3718906000e5",  "id": "CVE-2019-10064",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10064"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    331  ],  "analysis": {    "state": "in_triage"  },  "description": "hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8037cb8-eceb-4127-bb8e-c2efeb8743c6",  "id": "CLSA-2025-1760029279",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fb1a2f4b-5362-4848-be1a-fdf942d1b0fe",  "id": "CVE-2016-2117",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2117"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9159c51c-46f2-42f4-802b-af8ad0b60b65",  "id": "CVE-2024-47667",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)\n\nErrata #i2037 in AM65x/DRA80xM Processors Silicon Revision 1.0\n(SPRZ452D_July 2018_Revised December 2019 [1]) mentions when an\ninbound PCIe TLP spans more than two internal AXI 128-byte bursts,\nthe bus may corrupt the packet payload and the corrupt data may\ncause associated applications or the processor to hang.\n\nThe workaround for Errata #i2037 is to limit the maximum read\nrequest size and maximum payload size to 128 bytes. Add workaround\nfor Errata #i2037 here.\n\nThe errata and workaround is applicable only to AM65x SR 1.0 and\nlater versions of the silicon will have this fixed.\n\n[1] -> https://www.ti.com/lit/er/sprz452i/sprz452i.pdf",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fa141618-2341-4edc-aeee-4fcf56cbab1d",  "id": "CVE-2023-2194",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2194"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace \"data->block[0]\" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e81980d5-c138-447e-b9c8-c3ae6232ad70",  "id": "CVE-2023-42754",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42754"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3de38f45-f619-4692-90d7-0fac81064e52",  "id": "CVE-2013-1827",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1827"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for a certain (1) sender or (2) receiver getsockopt call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b1e8dfe2-a5bf-4dae-9183-d397a7f13e2b",  "id": "CVE-2014-3688",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3688"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of service (memory consumption) by triggering a large number of chunks in an association's output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "55bdd847-4669-4f9e-a33f-e3bc6bd9ddea",  "id": "CVE-2014-7283",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7283"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of service (filesystem corruption, and OOPS or panic) via operations on directories that have hash collisions, as demonstrated by rmdir operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c6c4b63-170e-425a-b366-35e8f8810b78",  "id": "CVE-2016-6787",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6787"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 31095224.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2398f97d-c125-4db4-902a-22ea20d73b1c",  "id": "CVE-2019-9496",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9496"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    287,    642  ],  "analysis": {    "state": "in_triage"  },  "description": "An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a6cccde0-0131-49e2-9d18-7ff1350ec459",  "id": "AZL-34574",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b0734c84-e4e7-4890-8be8-4562aa58be26",  "id": "CVE-2024-46807",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/amdgpu: Check tbo resource pointer\n\nValidate tbo resource pointer, skip if NULL",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d340b6c-9ef0-44c7-82c7-023cd60379a9",  "id": "CVE-2013-2892",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2892"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/hid/hid-pl.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PANTHERLORD is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ebcbaca-656b-4af4-a579-0446d7ff7d54",  "id": "CVE-2013-0290",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0290"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "60688871-95ca-4f35-9610-e3fd97ef8fd6",  "id": "CVE-2017-6345",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6345"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in required circumstances, which allows local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "621a2895-27aa-4072-bd12-f92011eceea2",  "id": "CVE-2023-52584",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 3.8,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspmi: mediatek: Fix UAF on device remove\n\nThe pmif driver data that contains the clocks is allocated along with\nspmi_controller.\nOn device remove, spmi_controller will be freed first, and then devres\n, including the clocks, will be cleanup.\nThis leads to UAF because putting the clocks will access the clocks in\nthe pmif driver data, which is already freed along with spmi_controller.\n\nThis can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and\nbuilding the kernel with KASAN.\n\nFix the UAF issue by using unmanaged clk_bulk_get() and putting the\nclocks before freeing spmi_controller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4dd7a5fb-3c0c-4f36-b48f-3dc71bbe924f",  "id": "CVE-2020-36310",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36310"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a set_memory_region_test infinite loop for certain nested page faults, aka CID-e72436bc3a52.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6c72b1c2-3dd2-4aa8-a82f-943255f58734",  "id": "CVE-2020-10942",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10942"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2005c362-6bff-4bed-9d4c-0aca1c64f73e",  "id": "MGASA-2021-0176",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "339776cb-1b45-4bad-b889-2199362ecd55",  "id": "CVE-2011-2521",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2521"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "The x86_assign_hw_event function in arch/x86/kernel/cpu/perf_event.c in the Performance Events subsystem in the Linux kernel before 2.6.39 does not properly calculate counter values, which allows local users to cause a denial of service (panic) via the perf program.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0bae06f1-2bfe-4000-aab7-be2efe39ecf9",  "id": "CLSA-2021-1638804058",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fbcb8954-e381-4687-bd65-9f631596c6d8",  "id": "CVE-2020-14305",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14305"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5ee66d33-3c7c-47a5-9986-dcb37c2bfee9",  "id": "CVE-2011-1476",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1476"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer underflow in the Open Sound System (OSS) subsystem in the Linux kernel before 2.6.39 on unspecified non-x86 platforms allows local users to cause a denial of service (memory corruption) by leveraging write access to /dev/sequencer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ad0e3ff3-e447-439b-b534-daed2595a057",  "id": "CVE-2023-52443",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: avoid crash when parsed profile name is empty\n\nWhen processing a packed profile in unpack_profile() described like\n\n \"profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}\"\n\na string \":samba-dcerpcd\" is unpacked as a fully-qualified name and then\npassed to aa_splitn_fqname().\n\naa_splitn_fqname() treats \":samba-dcerpcd\" as only containing a namespace.\nThus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later\naa_alloc_profile() crashes as the new profile name is NULL now.\n\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\nRIP: 0010:strlen+0x1e/0xa0\nCall Trace:\n <TASK>\n ? strlen+0x1e/0xa0\n aa_policy_init+0x1bb/0x230\n aa_alloc_profile+0xb1/0x480\n unpack_profile+0x3bc/0x4960\n aa_unpack+0x309/0x15e0\n aa_replace_profiles+0x213/0x33c0\n policy_update+0x261/0x370\n profile_replace+0x20e/0x2a0\n vfs_write+0x2af/0xe00\n ksys_write+0x126/0x250\n do_syscall_64+0x46/0xf0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n </TASK>\n---[ end trace 0000000000000000 ]---\nRIP: 0010:strlen+0x1e/0xa0\n\nIt seems such behaviour of aa_splitn_fqname() is expected and checked in\nother places where it is called (e.g. aa_remove_profiles). Well, there\nis an explicit comment \"a ns name without a following profile is allowed\"\ninside.\n\nAFAICS, nothing can prevent unpacked \"name\" to be in form like\n\":samba-dcerpcd\" - it is passed from userspace.\n\nDeny the whole profile set replacement in such case and inform user with\nEPROTO and an explaining message.\n\nFound by Linux Verification Center (linuxtesting.org).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e171be2e-c04e-431e-8e33-4b7ed9178c72",  "id": "CVE-2014-3645",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3645"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3902ca37-d59a-4987-b17e-100da4f977d7",  "id": "CVE-2024-22705",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22705"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c71e3442-0346-4754-ac88-a99923c7dcfc",  "id": "CVE-2011-2689",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2689"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The gfs2_fallocate function in fs/gfs2/file.c in the Linux kernel before 3.0-rc1 does not ensure that the size of a chunk allocation is a multiple of the block size, which allows local users to cause a denial of service (BUG and system crash) by arranging for all resource groups to have too little free space.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ebc0e836-52b9-4c23-b7e9-fec88c816855",  "id": "CVE-2010-2492",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2492"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b5ad158d-795f-4e22-8181-d2522d24900d",  "id": "CVE-2022-0934",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0934"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "557c454a-8955-4db4-a8a7-d4d3525146cf",  "id": "CVE-2022-49432",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/xics: fix refcount leak in icp_opal_init()\n\nThe of_find_compatible_node() function returns a node pointer with\nrefcount incremented, use of_node_put() on it when done.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "671969f8-6f47-4ca7-a3e1-b0669ae5ad23",  "id": "CVE-2019-25045",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25045"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6012facd-d91a-46be-a1db-9d9d3b165913",  "id": "CVE-2011-2208",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2208"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer signedness error in the osf_getdomainname function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform allows local users to obtain sensitive information from kernel memory via a crafted call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10dc29de-1435-4579-97b5-1cfe50bc069e",  "id": "CVE-2016-3134",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3134"  },  "ratings": [    {      "score": 8.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:39545'"    }  ]},{  "bom-ref": "40889143-884e-40d2-b2cc-9acd3d0829ec",  "id": "SUSE-SU-2023:2634-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0a44ef3b-220e-4885-bf0b-836ff3302c3c",  "id": "CVE-2011-1078",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1078"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The sco_sock_getsockopt_old function in net/bluetooth/sco.c in the Linux kernel before 2.6.39 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via the SCO_CONNINFO option.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eb4dd3f6-1c9d-4a96-acdf-befe0209247b",  "id": "CVE-2024-26719",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau: offload fence uevents work to workqueue\n\nThis should break the deadlock between the fctx lock and the irq lock.\n\nThis offloads the processing off the work from the irq into a workqueue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c3157a89-0302-4a9b-b1cd-68fb6d1fdb35",  "id": "CVE-2020-10774",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10774"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    805  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when reading the /proc/sys/kernel/rh_features file. This flaw allows a local user to read uninitialized values from the kernel memory. The highest threat from this vulnerability is to confidentiality.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5027cd08-e297-4d2c-8e5e-e973611ed3be",  "id": "CVE-2019-15098",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15098"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8900c127-63ba-4479-99fe-676434ee765d",  "id": "CVE-2021-47113",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47113"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: abort in rename_exchange if we fail to insert the second ref\n\nError injection stress uncovered a problem where we'd leave a dangling\ninode ref if we failed during a rename_exchange.  This happens because\nwe insert the inode ref for one side of the rename, and then for the\nother side.  If this second inode ref insert fails we'll leave the first\none dangling and leave a corrupt file system behind.  Fix this by\naborting if we did the insert for the first inode ref.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9bb3177d-0b2e-47a7-b513-9ea632ef6305",  "id": "CVE-2011-1747",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1747"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The agp subsystem in the Linux kernel 2.6.38.5 and earlier does not properly restrict memory allocation by the (1) AGPIOC_RESERVE and (2) AGPIOC_ALLOCATE ioctls, which allows local users to cause a denial of service (memory consumption) by making many calls to these ioctls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2d8ca9bc-9e97-4da3-96eb-1a1ba88b98cd",  "id": "RHSA-2018:3221",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a5941bb0-13a5-4aa4-b9a5-5ce1b541add9",  "id": "DSA-2100-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "61e17bbb-5180-4330-908f-e3bbbc0ac67b",  "id": "CVE-2023-53544",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: davinci: Fix clk use after free\n\nThe remove function first frees the clks and only then calls\ncpufreq_unregister_driver(). If one of the cpufreq callbacks is called\njust before cpufreq_unregister_driver() is run, the freed clks might be\nused.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "34992034-48a3-4dca-a7b1-98705c2c9b6e",  "id": "CVE-2023-39192",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39192"  },  "ratings": [    {      "score": 6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ea92fadb-4870-4be2-9a98-4ba91846956c",  "id": "CVE-2016-5728",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5728"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (memory corruption and system crash) by changing a certain header, aka a \"double fetch\" vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "507d27ab-d589-4c64-8ee6-de29a5fd1592",  "id": "CVE-2026-45869",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()\n\nIn `probe()`, `request_irq()` is called before allocating/registering a\n`power_supply` handle. If an interrupt is fired between the call to\n`request_irq()` and `power_supply_register()`, the `power_supply` handle\nwill be used uninitialized in `power_supply_changed()` in\n`wm97xx_bat_update()` (triggered from the interrupt handler). This will\nlead to a `NULL` pointer dereference since\n\nFix this racy `NULL` pointer dereference by making sure the IRQ is\nrequested _after_ the registration of the `power_supply` handle. Since\nthe IRQ is the last thing requests in the `probe()` now, remove the\nerror path for freeing it. Instead add one for unregistering the\n`power_supply` handle when IRQ request fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45e09d2d-c975-4b46-a185-14d36b12df52",  "id": "RHSA-2026:19066",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6053b841-b41d-4da1-bb72-b585bef0c6cb",  "id": "CVE-2021-38204",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38204"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "08c7c7ba-07b4-41be-a63a-ecf2495d6530",  "id": "CVE-2017-18360",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18360"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In change_port_settings in drivers/usb/serial/io_ti.c in the Linux kernel before 4.11.3, local users could cause a denial of service by division-by-zero in the serial device layer by trying to set very high baud rates.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b587b613-0e06-4f01-9b6b-46e7a9789a54",  "id": "CVE-2023-53292",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none\n\nAfter grabbing q->sysfs_lock, q->elevator may become NULL because of\nelevator switch.\n\nFix the NULL dereference on q->elevator by checking it with lock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f38cb9c1-496d-44de-a5b4-d21bb11b63e7",  "id": "CVE-2020-24394",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24394"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    732  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "15a4970f-d9b2-40cc-817b-b3e3bef4892a",  "id": "CVE-2024-42081",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/xe_devcoredump: Check NULL before assignments\n\nAssign 'xe_devcoredump_snapshot *' and 'xe_device *' only if\n'coredump' is not NULL.\n\nv2\n- Fix commit messages.\n\nv3\n- Define variables before code.(Ashutosh/Jose)\n\nv4\n- Drop return check for coredump_to_xe. (Jose/Rodrigo)\n\nv5\n- Modify misleading commit message. (Matt)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "83920c0d-2775-4d3c-a41b-59efe72df9e5",  "id": "CVE-2023-4394",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4394"  },  "ratings": [    {      "score": 6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    400,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system in the Linux Kernel. This flaw allows a local attacker with special privileges to cause a system crash or leak internal kernel information",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db6dc664-cbc5-4d43-a30d-8023e3f12ee1",  "id": "CVE-2023-6915",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6915"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69da8a90-248d-46ec-8d0f-11ee4b217fb0",  "id": "CVE-2021-47416",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47416"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: mdio: fix memory leak\n\nSyzbot reported memory leak in MDIO bus interface, the problem was in\nwrong state logic.\n\nMDIOBUS_ALLOCATED indicates 2 states:\n\t1. Bus is only allocated\n\t2. Bus allocated and __mdiobus_register() fails, but\n\t   device_register() was called\n\nIn case of device_register() has been called we should call put_device()\nto correctly free the memory allocated for this device, but mdiobus_free()\ncalls just kfree(dev) in case of MDIOBUS_ALLOCATED state\n\nTo avoid this behaviour we need to set bus->state to MDIOBUS_UNREGISTERED\n_before_ calling device_register(), because put_device() should be\ncalled even in case of device_register() failure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc8dacc8-0bfb-4f3c-9e55-a78ce41bdba1",  "id": "CVE-2025-38332",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Use memcpy() for BIOS version\n\nThe strlcat() with FORTIFY support is triggering a panic because it\nthinks the target buffer will overflow although the correct target\nbuffer size is passed in.\n\nAnyway, instead of memset() with 0 followed by a strlcat(), just use\nmemcpy() and ensure that the resulting buffer is NULL terminated.\n\nBIOSVersion is only used for the lpfc_printf_log() which expects a\nproperly terminated string.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6aced5f3-3f7c-4e82-8b74-5c4ea1057570",  "id": "CVE-2018-12904",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12904"  },  "ratings": [    {      "score": 4.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:44944'"    }  ]},{  "bom-ref": "99f3f02f-e8c4-4bce-8ff6-bad219fef888",  "id": "openSUSE-SU-2021:3531-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "455d42a6-4a83-4021-8f40-1150e13791b1",  "id": "CVE-2023-53339",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix BUG_ON condition in btrfs_cancel_balance\n\nPausing and canceling balance can race to interrupt balance lead to BUG_ON\npanic in btrfs_cancel_balance. The BUG_ON condition in btrfs_cancel_balance\ndoes not take this race scenario into account.\n\nHowever, the race condition has no other side effects. We can fix that.\n\nReproducing it with panic trace like this:\n\n  kernel BUG at fs/btrfs/volumes.c:4618!\n  RIP: 0010:btrfs_cancel_balance+0x5cf/0x6a0\n  Call Trace:\n   <TASK>\n   ? do_nanosleep+0x60/0x120\n   ? hrtimer_nanosleep+0xb7/0x1a0\n   ? sched_core_clone_cookie+0x70/0x70\n   btrfs_ioctl_balance_ctl+0x55/0x70\n   btrfs_ioctl+0xa46/0xd20\n   __x64_sys_ioctl+0x7d/0xa0\n   do_syscall_64+0x38/0x80\n   entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\n  Race scenario as follows:\n  > mutex_unlock(&fs_info->balance_mutex);\n  > --------------------\n  > .......issue pause and cancel req in another thread\n  > --------------------\n  > ret = __btrfs_balance(fs_info);\n  >\n  > mutex_lock(&fs_info->balance_mutex);\n  > if (ret == -ECANCELED && atomic_read(&fs_info->balance_pause_req)) {\n  >         btrfs_info(fs_info, \"balance: paused\");\n  >         btrfs_exclop_balance(fs_info, BTRFS_EXCLOP_BALANCE_PAUSED);\n  > }",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0c3b3428-0d70-4025-8c5f-8dbc6fbab6e2",  "id": "CVE-2022-49117",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmips: ralink: fix a refcount leak in ill_acc_of_setup()\n\nof_node_put(np) needs to be called when pdev == NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "53bba4c1-60a2-415a-83c0-74e780a6057f",  "id": "OESA-2026-2700",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ebcbae4-6de5-4b1a-9303-17a3e120cb2f",  "id": "CVE-2023-53415",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dwc3: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.\n\nNote, the root dentry for the debugfs directory for the device needs to\nbe saved so we don't have to keep looking it up, which required a bit\nmore refactoring to properly create and remove it when needed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bd47e008-342a-4bd3-b16a-00cdb5b3ae4b",  "id": "CLSA-2023-1676026152",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ba0a727b-bbdc-4155-bf5e-f9d7772fc8bc",  "id": "ROOT-OS-ALPINE-317-CVE-2025-69418",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c259d18c-8a0b-4640-aa91-b16789826206",  "id": "RHSA-2023:1437",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2db37a4-32cd-4ba6-bf16-efe7670f375f",  "id": "CVE-2022-49180",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nLSM: general protection fault in legacy_parse_param\n\nThe usual LSM hook \"bail on fail\" scheme doesn't work for cases where\na security module may return an error code indicating that it does not\nrecognize an input.  In this particular case Smack sees a mount option\nthat it recognizes, and returns 0. A call to a BPF hook follows, which\nreturns -ENOPARAM, which confuses the caller because Smack has processed\nits data.\n\nThe SELinux hook incorrectly returns 1 on success. There was a time\nwhen this was correct, however the current expectation is that it\nreturn 0 on success. This is repaired.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2a3282c-f6d3-46be-8e97-fc4a8bde0262",  "id": "CVE-2025-71131",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: seqiv - Do not use req->iv after crypto_aead_encrypt\n\nAs soon as crypto_aead_encrypt is called, the underlying request\nmay be freed by an asynchronous completion.  Thus dereferencing\nreq->iv after it returns is invalid.\n\nInstead of checking req->iv against info, create a new variable\nunaligned_info and use it for that purpose instead.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f65e61ee-d2bd-4138-bf6d-d589b1fe9591",  "id": "CVE-2024-46814",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check msg_id before processing transcation\n\n[WHY & HOW]\nHDCP_MESSAGE_ID_INVALID (-1) is not a valid msg_id nor is it a valid\narray index, and it needs checking before used.\n\nThis fixes 4 OVERRUN issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69fe41e9-51ba-4624-a736-679a3e9a01db",  "id": "CVE-2023-52809",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()\n\nfc_lport_ptp_setup() did not check the return value of fc_rport_create()\nwhich can return NULL and would cause a NULL pointer dereference. Address\nthis issue by checking return value of fc_rport_create() and log error\nmessage on fc_rport_create() failed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c42ac1fb-5a2d-4d6a-87a0-6fffcc7faa82",  "id": "CVE-2022-49673",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm raid: fix KASAN warning in raid5_add_disks\n\nThere's a KASAN warning in raid5_add_disk when running the LVM testsuite.\nThe warning happens in the test\nlvconvert-raid-reshape-linear_to_raid6-single-type.sh. We fix the warning\nby verifying that rdev->saved_raid_disk is within limits.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ec5c1b6-d283-46c6-b11d-6c4ce8744694",  "id": "CVE-2024-46860",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change\n\nWhen disabling wifi mt7921_ipv6_addr_change() is called as a notifier.\nAt this point mvif->phy is already NULL so we cannot use it here.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e219708e-e869-403c-a177-22bf52323b8a",  "id": "CVE-2017-14991",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14991"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uninitialized kernel heap-memory locations via an SG_GET_REQUEST_TABLE ioctl call for /dev/sg0.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "25cfc7f7-711c-441e-bb03-03e72b5b142b",  "id": "CVE-2011-2492",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2492"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cc8c5ce7-7628-4280-ad4d-e22bcfe1bc97",  "id": "CVE-2023-1079",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1079"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b7b5639-4e93-47fa-8833-7a06a0f69d6b",  "id": "CVE-2015-7884",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7884"  },  "ratings": [    {      "score": 2.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b52c9a56-308f-4732-ab76-4d9fe2ecac07",  "id": "CVE-2010-1488",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1488"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The proc_oom_score function in fs/proc/base.c in the Linux kernel before 2.6.34-rc4 uses inappropriate data structures during selection of a candidate for the OOM killer, which might allow local users to cause a denial of service via unspecified patterns of task creation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c88ddf8f-e512-45d2-8b86-f9f1e3c5a694",  "id": "CVE-2022-3104",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3104"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return value of kmalloc() and will cause the null pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c1377153-c37e-4da8-8b97-8f50d832d254",  "id": "CVE-2019-19533",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19533"  },  "ratings": [    {      "score": 2.4,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    772  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.3.4, there is an info-leak bug that can be caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c driver, aka CID-a10feaf8c464.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b88a4e88-999b-4080-b8d8-933983aacf8b",  "id": "CVE-2019-11191",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11191"  },  "ratings": [    {      "score": 2.5,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is enabled and ia32_aout is loaded, allows local users to bypass ASLR on setuid a.out programs (if any exist) because install_exec_creds() is called too late in load_aout_binary() in fs/binfmt_aout.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat. NOTE: the software maintainer disputes that this is a vulnerability because ASLR for a.out format executables has never been supported",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c67b2e96-7802-4454-918a-9cc4a46e06a1",  "id": "CVE-2017-15107",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15107"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    358  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45c2f219-af20-41ee-8d2b-bef555c1dd49",  "id": "CVE-2021-47236",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47236"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cdc_eem: fix tx fixup skb leak\n\nwhen usbnet transmit a skb, eem fixup it in eem_tx_fixup(),\nif skb_copy_expand() failed, it return NULL,\nusbnet_start_xmit() will have no chance to free original skb.\n\nfix it by free orginal skb in eem_tx_fixup() first,\nthen check skb clone status, if failed, return NULL to usbnet.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff4525c7-5787-4a33-9b2d-f824e6a9ab26",  "id": "CVE-2009-4355",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4355"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "92dd1919-8b56-469f-8dff-8a3e1d8bc0ce",  "id": "CVE-2022-3112",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3112"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4e31c9c8-d830-4f66-b7f4-540c06c78cef",  "id": "CVE-2024-36950",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: ohci: mask bus reset interrupts between ISR and bottom half\n\nIn the FireWire OHCI interrupt handler, if a bus reset interrupt has\noccurred, mask bus reset interrupts until bus_reset_work has serviced and\ncleared the interrupt.\n\nNormally, we always leave bus reset interrupts masked. We infer the bus\nreset from the self-ID interrupt that happens shortly thereafter. A\nscenario where we unmask bus reset interrupts was introduced in 2008 in\na007bb857e0b26f5d8b73c2ff90782d9c0972620: If\nOHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we\nwill unmask bus reset interrupts so we can log them.\n\nirq_handler logs the bus reset interrupt. However, we can't clear the bus\nreset event flag in irq_handler, because we won't service the event until\nlater. irq_handler exits with the event flag still set. If the\ncorresponding interrupt is still unmasked, the first bus reset will\nusually freeze the system due to irq_handler being called again each\ntime it exits. This freeze can be reproduced by loading firewire_ohci\nwith \"modprobe firewire_ohci debug=-1\" (to enable all debugging output).\nApparently there are also some cases where bus_reset_work will get called\nsoon enough to clear the event, and operation will continue normally.\n\nThis freeze was first reported a few months after a007bb85 was committed,\nbut until now it was never fixed. The debug level could safely be set\nto -1 through sysfs after the module was loaded, but this would be\nineffectual in logging bus reset interrupts since they were only\nunmasked during initialization.\n\nirq_handler will now leave the event flag set but mask bus reset\ninterrupts, so irq_handler won't be called again and there will be no\nfreeze. If OHCI_PARAM_DEBUG_BUSRESETS is enabled, bus_reset_work will\nunmask the interrupt after servicing the event, so future interrupts\nwill be caught as desired.\n\nAs a side effect to this change, OHCI_PARAM_DEBUG_BUSRESETS can now be\nenabled through sysfs in addition to during initial module loading.\nHowever, when enabled through sysfs, logging of bus reset interrupts will\nbe effective only starting with the second bus reset, after\nbus_reset_work has executed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "145d3883-1e39-4e2d-8e0e-5ef2988c9e36",  "id": "CVE-2023-52921",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix possible UAF in amdgpu_cs_pass1()\n\nSince the gang_size check is outside of chunk parsing\nloop, we need to reset i before we free the chunk data.\n\nSuggested by Ye Zhang (@VAR10CK) of Baidu Security.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "23abab2a-8696-4481-82f4-cb6c83d78579",  "id": "DSA-1763-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee18b063-a89d-4642-a820-3a9676eabd2e",  "id": "CVE-2025-71073",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: lkkbd - disable pending work before freeing device\n\nlkkbd_interrupt() schedules lk->tq via schedule_work(), and the work\nhandler lkkbd_reinit() dereferences the lkkbd structure and its\nserio/input_dev fields.\n\nlkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd\nstructure without preventing the reinit work from being queued again\nuntil serio_close() returns. This can allow the work handler to run\nafter the structure has been freed, leading to a potential use-after-free.\n\nUse disable_work_sync() instead of cancel_work_sync() to ensure the\nreinit work cannot be re-queued, and call it both in lkkbd_disconnect()\nand in lkkbd_connect() error paths after serio_open().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b81f511c-9bd3-4484-84f6-4016d678669c",  "id": "CVE-2024-40974",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: Enforce hcall result buffer validity and size\n\nplpar_hcall(), plpar_hcall9(), and related functions expect callers to\nprovide valid result buffers of certain minimum size. Currently this\nis communicated only through comments in the code and the compiler has\nno idea.\n\nFor example, if I write a bug like this:\n\n  long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE\n  plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...);\n\nThis compiles with no diagnostics emitted, but likely results in stack\ncorruption at runtime when plpar_hcall9() stores results past the end\nof the array. (To be clear this is a contrived example and I have not\nfound a real instance yet.)\n\nTo make this class of error less likely, we can use explicitly-sized\narray parameters instead of pointers in the declarations for the hcall\nAPIs. When compiled with -Warray-bounds[1], the code above now\nprovokes a diagnostic like this:\n\nerror: array argument is too small;\nis of size 32, callee requires at least 72 [-Werror,-Warray-bounds]\n   60 |                 plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf,\n      |                 ^                                   ~~~~~~\n\n[1] Enabled for LLVM builds but not GCC for now. See commit\n    0da6e5fd6c37 (\"gcc: disable '-Warray-bounds' for gcc-13 too\") and\n    related changes.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f66c3fb9-df21-489b-8497-76ae925033fb",  "id": "CVE-2023-53333",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.199999999999999,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one\n\nEric Dumazet says:\n  nf_conntrack_dccp_packet() has an unique:\n\n  dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);\n\n  And nothing more is 'pulled' from the packet, depending on the content.\n  dh->dccph_doff, and/or dh->dccph_x ...)\n  So dccp_ack_seq() is happily reading stuff past the _dh buffer.\n\nBUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0\nRead of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371\n[..]\n\nFix this by increasing the stack buffer to also include room for\nthe extra sequence numbers and all the known dccp packet type headers,\nthen pull again after the initial validation of the basic header.\n\nWhile at it, mark packets invalid that lack 48bit sequence bit but\nwhere RFC says the type MUST use them.\n\nCompile tested only.\n\nv2: first skb_header_pointer() now needs to adjust the size to\n    only pull the generic header. (Eric)\n\nHeads-up: I intend to remove dccp conntrack support later this year.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bfdbd01d-a592-429a-8b32-a43f5e841c8f",  "id": "CVE-2022-0492",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0492"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    287,    862  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'MSF:docker_cgroup_escape'"    }  ]},{  "bom-ref": "67376140-40a6-4ae9-bb0c-938b87e1a4fe",  "id": "CVE-2021-47110",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47110"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    459  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Disable kvmclock on all CPUs on shutdown\n\nCurrenly, we disable kvmclock from machine_shutdown() hook and this\nonly happens for boot CPU. We need to disable it for all CPUs to\nguard against memory corruption e.g. on restore from hibernate.\n\nNote, writing '0' to kvmclock MSR doesn't clear memory location, it\njust prevents hypervisor from updating the location so for the short\nwhile after write and while CPU is still alive, the clock remains usable\nand correct so we don't need to switch to some other clocksource.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "20481fb8-9f47-4ddd-b311-61cfdc8c63a3",  "id": "CVE-2023-52578",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: use DEV_STATS_INC()\n\nsyzbot/KCSAN reported data-races in br_handle_frame_finish() [1]\nThis function can run from multiple cpus without mutual exclusion.\n\nAdopt SMP safe DEV_STATS_INC() to update dev->stats fields.\n\nHandles updates to dev->stats.tx_dropped while we are at it.\n\n[1]\nBUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish\n\nread-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 1:\nbr_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189\nbr_nf_hook_thresh+0x1ed/0x220\nbr_nf_pre_routing_finish_ipv6+0x50f/0x540\nNF_HOOK include/linux/netfilter.h:304 [inline]\nbr_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178\nbr_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508\nnf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]\nnf_hook_bridge_pre net/bridge/br_input.c:272 [inline]\nbr_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417\n__netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417\n__netif_receive_skb_one_core net/core/dev.c:5521 [inline]\n__netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637\nprocess_backlog+0x21f/0x380 net/core/dev.c:5965\n__napi_poll+0x60/0x3b0 net/core/dev.c:6527\nnapi_poll net/core/dev.c:6594 [inline]\nnet_rx_action+0x32b/0x750 net/core/dev.c:6727\n__do_softirq+0xc1/0x265 kernel/softirq.c:553\nrun_ksoftirqd+0x17/0x20 kernel/softirq.c:921\nsmpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164\nkthread+0x1d7/0x210 kernel/kthread.c:388\nret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147\nret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304\n\nread-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 0:\nbr_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189\nbr_nf_hook_thresh+0x1ed/0x220\nbr_nf_pre_routing_finish_ipv6+0x50f/0x540\nNF_HOOK include/linux/netfilter.h:304 [inline]\nbr_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178\nbr_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508\nnf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]\nnf_hook_bridge_pre net/bridge/br_input.c:272 [inline]\nbr_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417\n__netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417\n__netif_receive_skb_one_core net/core/dev.c:5521 [inline]\n__netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637\nprocess_backlog+0x21f/0x380 net/core/dev.c:5965\n__napi_poll+0x60/0x3b0 net/core/dev.c:6527\nnapi_poll net/core/dev.c:6594 [inline]\nnet_rx_action+0x32b/0x750 net/core/dev.c:6727\n__do_softirq+0xc1/0x265 kernel/softirq.c:553\ndo_softirq+0x5e/0x90 kernel/softirq.c:454\n__local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381\n__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]\n_raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210\nspin_unlock_bh include/linux/spinlock.h:396 [inline]\nbatadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1356\nbatadv_tt_purge+0x2b/0x630 net/batman-adv/translation-table.c:3560\nprocess_one_work kernel/workqueue.c:2630 [inline]\nprocess_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703\nworker_thread+0x525/0x730 kernel/workqueue.c:2784\nkthread+0x1d7/0x210 kernel/kthread.c:388\nret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147\nret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304\n\nvalue changed: 0x00000000000d7190 -> 0x00000000000d7191\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 PID: 14848 Comm: kworker/u4:11 Not tainted 6.6.0-rc1-syzkaller-00236-gad8a69f361b9 #0",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f2632639-901f-45c2-8d41-6e5a0e48268b",  "id": "AZL-35085",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c49abe2c-6a2d-4d42-9ea4-5d62e3cf4fa8",  "id": "CVE-2014-4655",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4655"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b135460-9eac-4407-a79d-eb564acd992c",  "id": "CVE-2024-49910",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func\n\nThis commit adds a null check for the set_output_gamma function pointer\nin the dcn401_set_output_transfer_func function. Previously,\nset_output_gamma was being checked for null, but then it was being\ndereferenced without any null check. This could lead to a null pointer\ndereference if set_output_gamma is null.\n\nTo fix this, we now ensure that set_output_gamma is not null before\ndereferencing it. We do this by adding a null check for set_output_gamma\nbefore the call to set_output_gamma.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a5cc548f-6b5a-4f42-bf6e-4e9117b5c753",  "id": "ROOT-OS-ALPINE-323-CVE-2026-14456",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8954d7d4-0479-4b24-a150-153b7517d2a1",  "id": "ALSA-2024:1335",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cc28a888-7fa9-47e3-94a4-ba0ffb7e5e0c",  "id": "CVE-2018-8822",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8822"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in the Linux kernel through 4.15.11, and in drivers/staging/ncpfs/ncplib_kernel.c in the Linux kernel 4.16-rc through 4.16-rc6, could be exploited by malicious NCPFS servers to crash the kernel or execute code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8fab5650-cb8e-472f-bff2-f8aa3da6ba40",  "id": "SUSE-SU-2022:0135-2",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e6061ff4-cc4a-4b06-b8c5-6eb259ce092d",  "id": "CVE-2024-49940",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: prevent possible tunnel refcount underflow\n\nWhen a session is created, it sets a backpointer to its tunnel. When\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\nrefcount if session->tunnel is non-NULL. However, session->tunnel is\nset in l2tp_session_create, before the tunnel refcount is incremented\nby l2tp_session_register, which leaves a small window where\nsession->tunnel is non-NULL when the tunnel refcount hasn't been\nbumped.\n\nMoving the assignment to l2tp_session_register is trivial but\nl2tp_session_create calls l2tp_session_set_header_len which uses\nsession->tunnel to get the tunnel's encap. Add an encap arg to\nl2tp_session_set_header_len to avoid using session->tunnel.\n\nIf l2tpv3 sessions have colliding IDs, it is possible for\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\nsession which doesn't yet have session->tunnel set. Add a check for\nthis case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2beae192-aa11-4494-aba2-3cfa6d8a1e71",  "id": "CVE-2021-3772",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3772"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"    }  ],  "cwes": [    354  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31fce0f6-9165-4cd5-9dfc-d255cb39d453",  "id": "CVE-2022-49527",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi: avoid null dereference in deinit\n\nIf venus_probe fails at pm_runtime_put_sync the error handling first\ncalls hfi_destroy and afterwards hfi_core_deinit. As hfi_destroy sets\ncore->ops to NULL, hfi_core_deinit cannot call the core_deinit function\nanymore.\n\nAvoid this null pointer derefence by skipping the call when necessary.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0d1f3593-1599-4049-bb01-ee6e382121f3",  "id": "MGASA-2021-0254",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bc014cf9-e388-481c-b2aa-7230a69f7d95",  "id": "CVE-2024-42115",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: Fix potential illegal address access in jffs2_free_inode\n\nDuring the stress testing of the jffs2 file system,the following\nabnormal printouts were found:\n[ 2430.649000] Unable to handle kernel paging request at virtual address 0069696969696948\n[ 2430.649622] Mem abort info:\n[ 2430.649829]   ESR = 0x96000004\n[ 2430.650115]   EC = 0x25: DABT (current EL), IL = 32 bits\n[ 2430.650564]   SET = 0, FnV = 0\n[ 2430.650795]   EA = 0, S1PTW = 0\n[ 2430.651032]   FSC = 0x04: level 0 translation fault\n[ 2430.651446] Data abort info:\n[ 2430.651683]   ISV = 0, ISS = 0x00000004\n[ 2430.652001]   CM = 0, WnR = 0\n[ 2430.652558] [0069696969696948] address between user and kernel address ranges\n[ 2430.653265] Internal error: Oops: 96000004 [#1] PREEMPT SMP\n[ 2430.654512] CPU: 2 PID: 20919 Comm: cat Not tainted 5.15.25-g512f31242bf6 #33\n[ 2430.655008] Hardware name: linux,dummy-virt (DT)\n[ 2430.655517] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 2430.656142] pc : kfree+0x78/0x348\n[ 2430.656630] lr : jffs2_free_inode+0x24/0x48\n[ 2430.657051] sp : ffff800009eebd10\n[ 2430.657355] x29: ffff800009eebd10 x28: 0000000000000001 x27: 0000000000000000\n[ 2430.658327] x26: ffff000038f09d80 x25: 0080000000000000 x24: ffff800009d38000\n[ 2430.658919] x23: 5a5a5a5a5a5a5a5a x22: ffff000038f09d80 x21: ffff8000084f0d14\n[ 2430.659434] x20: ffff0000bf9a6ac0 x19: 0169696969696940 x18: 0000000000000000\n[ 2430.659969] x17: ffff8000b6506000 x16: ffff800009eec000 x15: 0000000000004000\n[ 2430.660637] x14: 0000000000000000 x13: 00000001000820a1 x12: 00000000000d1b19\n[ 2430.661345] x11: 0004000800000000 x10: 0000000000000001 x9 : ffff8000084f0d14\n[ 2430.662025] x8 : ffff0000bf9a6b40 x7 : ffff0000bf9a6b48 x6 : 0000000003470302\n[ 2430.662695] x5 : ffff00002e41dcc0 x4 : ffff0000bf9aa3b0 x3 : 0000000003470342\n[ 2430.663486] x2 : 0000000000000000 x1 : ffff8000084f0d14 x0 : fffffc0000000000\n[ 2430.664217] Call trace:\n[ 2430.664528]  kfree+0x78/0x348\n[ 2430.664855]  jffs2_free_inode+0x24/0x48\n[ 2430.665233]  i_callback+0x24/0x50\n[ 2430.665528]  rcu_do_batch+0x1ac/0x448\n[ 2430.665892]  rcu_core+0x28c/0x3c8\n[ 2430.666151]  rcu_core_si+0x18/0x28\n[ 2430.666473]  __do_softirq+0x138/0x3cc\n[ 2430.666781]  irq_exit+0xf0/0x110\n[ 2430.667065]  handle_domain_irq+0x6c/0x98\n[ 2430.667447]  gic_handle_irq+0xac/0xe8\n[ 2430.667739]  call_on_irq_stack+0x28/0x54\nThe parameter passed to kfree was 5a5a5a5a, which corresponds to the target field of\nthe jffs_inode_info structure. It was found that all variables in the jffs_inode_info\nstructure were 5a5a5a5a, except for the first member sem. It is suspected that these\nvariables are not initialized because they were set to 5a5a5a5a during memory testing,\nwhich is meant to detect uninitialized memory.The sem variable is initialized in the\nfunction jffs2_i_init_once, while other members are initialized in\nthe function jffs2_init_inode_info.\n\nThe function jffs2_init_inode_info is called after iget_locked,\nbut in the iget_locked function, the destroy_inode process is triggered,\nwhich releases the inode and consequently, the target member of the inode\nis not initialized.In concurrent high pressure scenarios, iget_locked\nmay enter the destroy_inode branch as described in the code.\n\nSince the destroy_inode functionality of jffs2 only releases the target,\nthe fix method is to set target to NULL in jffs2_i_init_once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a33d9e0-af93-408e-91f6-10d212ffac7c",  "id": "CVE-2013-7266",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7266"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The mISDN_sock_recvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a certain length value is consistent with the size of an associated data structure, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "59889110-e8a5-43a1-95fb-fde9b3e54b74",  "id": "CLSA-2024-1725524582",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9130c07-cbfb-4440-a5a1-e3e939d7cb6d",  "id": "CVE-2026-43103",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lapbether: handle NETDEV_PRE_TYPE_CHANGE\n\nlapbeth_data_transmit() expects the underlying device type\nto be ARPHRD_ETHER.\n\nReturning NOTIFY_BAD from lapbeth_device_event() makes sure\nbonding driver can not break this expectation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f6d4215b-14c6-43a5-ae34-bc4fa3f5c4de",  "id": "CVE-2022-40307",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40307"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fd044726-1c9f-45e7-bf21-ee818d9f72ab",  "id": "CVE-2011-1016",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1016"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The Radeon GPU drivers in the Linux kernel before 2.6.38-rc5 do not properly validate data related to the AA resolve registers, which allows local users to write to arbitrary memory locations associated with (1) Video RAM (aka VRAM) or (2) the Graphics Translation Table (GTT) via crafted values.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9dc8a4e-f6af-4f0e-a74d-e39cefbc248c",  "id": "CVE-2012-6701",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6701"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in fs/aio.c in the Linux kernel before 3.4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b24eda8-d244-43df-b6b2-b8f9aa121279",  "id": "CVE-2019-12382",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12382"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel through 5.1.5. There is an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: The vendor disputes this issues as not being a vulnerability because kstrdup() returning NULL is handled sufficiently and there is no chance for a NULL pointer dereference",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "16e0dd53-8439-4900-a1fe-c1758bb1639f",  "id": "CVE-2019-5489",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5489"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    319  ],  "analysis": {    "state": "in_triage"  },  "description": "The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "42f97ec0-ad2d-4471-bded-2641be3efbb8",  "id": "SUSE-SU-2026:20905-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e91ea822-2a4c-4964-8608-993ad910d38d",  "id": "CLSA-2021-1634922899",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6eb7c92f-e9df-4bb2-84f4-7f2e7bcfdf35",  "id": "CVE-2021-47404",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47404"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: betop: fix slab-out-of-bounds Write in betop_probe\n\nSyzbot reported slab-out-of-bounds Write bug in hid-betopff driver.\nThe problem is the driver assumes the device must have an input report but\nsome malicious devices violate this assumption.\n\nSo this patch checks hid_device's input is non empty before it's been used.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1bfffd97-43df-4f73-a864-859ca3c1293e",  "id": "CVE-2022-49729",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred\n\nSimilar to the handling of play_deferred in commit 19cfe912c37b\n(\"Bluetooth: btusb: Fix memory leak in play_deferred\"), we thought\na patch might be needed here as well.\n\nCurrently usb_submit_urb is called directly to submit deferred tx\nurbs after unanchor them.\n\nSo the usb_giveback_urb_bh would failed to unref it in usb_unanchor_urb\nand cause memory leak.\n\nPut those urbs in tx_anchor to avoid the leak, and also fix the error\nhandling.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aebe81a2-24cd-49c2-9b65-319fc9dc4ca5",  "id": "CVE-2021-47333",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47333"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: alcor_pci: fix null-ptr-deref when there is no PCI bridge\n\nThere is an issue with the ASPM(optional) capability checking function.\nA device might be attached to root complex directly, in this case,\nbus->self(bridge) will be NULL, thus priv->parent_pdev is NULL.\nSince alcor_pci_init_check_aspm(priv->parent_pdev) checks the PCI link's\nASPM capability and populate parent_cap_off, which will be used later by\nalcor_pci_aspm_ctrl() to dynamically turn on/off device, what we can do\nhere is to avoid checking the capability if we are on the root complex.\nThis will make pdev_cap_off 0 and alcor_pci_aspm_ctrl() will simply\nreturn when bring called, effectively disable ASPM for the device.\n\n[    1.246492] BUG: kernel NULL pointer dereference, address: 00000000000000c0\n[    1.248731] RIP: 0010:pci_read_config_byte+0x5/0x40\n[    1.253998] Call Trace:\n[    1.254131]  ? alcor_pci_find_cap_offset.isra.0+0x3a/0x100 [alcor_pci]\n[    1.254476]  alcor_pci_probe+0x169/0x2d5 [alcor_pci]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0150201d-9a16-4f52-ac49-1f33e8831cad",  "id": "CVE-2023-53435",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncassini: Fix a memory leak in the error handling path of cas_init_one()\n\ncas_saturn_firmware_init() allocates some memory using vmalloc(). This\nmemory is freed in the .remove() function but not it the error handling\npath of the probe.\n\nAdd the missing vfree() to avoid a memory leak, should an error occur.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e570472-0111-4c36-bddc-20befb42b161",  "id": "CVE-2023-52900",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix general protection fault in nilfs_btree_insert()\n\nIf nilfs2 reads a corrupted disk image and tries to reads a b-tree node\nblock by calling __nilfs_btree_get_block() against an invalid virtual\nblock address, it returns -ENOENT because conversion of the virtual block\naddress to a disk block address fails.  However, this return value is the\nsame as the internal code that b-tree lookup routines return to indicate\nthat the block being searched does not exist, so functions that operate on\nthat b-tree may misbehave.\n\nWhen nilfs_btree_insert() receives this spurious 'not found' code from\nnilfs_btree_do_lookup(), it misunderstands that the 'not found' check was\nsuccessful and continues the insert operation using incomplete lookup path\ndata, causing the following crash:\n\n general protection fault, probably for non-canonical address\n 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN\n KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\n ...\n RIP: 0010:nilfs_btree_get_nonroot_node fs/nilfs2/btree.c:418 [inline]\n RIP: 0010:nilfs_btree_prepare_insert fs/nilfs2/btree.c:1077 [inline]\n RIP: 0010:nilfs_btree_insert+0x6d3/0x1c10 fs/nilfs2/btree.c:1238\n Code: bc 24 80 00 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89\n ff e8 4b 02 92 fe 4d 8b 3f 49 83 c7 28 4c 89 f8 48 c1 e8 03 <42> 80 3c\n 28 00 74 08 4c 89 ff e8 2e 02 92 fe 4d 8b 3f 49 83 c7 02\n ...\n Call Trace:\n <TASK>\n  nilfs_bmap_do_insert fs/nilfs2/bmap.c:121 [inline]\n  nilfs_bmap_insert+0x20d/0x360 fs/nilfs2/bmap.c:147\n  nilfs_get_block+0x414/0x8d0 fs/nilfs2/inode.c:101\n  __block_write_begin_int+0x54c/0x1a80 fs/buffer.c:1991\n  __block_write_begin fs/buffer.c:2041 [inline]\n  block_write_begin+0x93/0x1e0 fs/buffer.c:2102\n  nilfs_write_begin+0x9c/0x110 fs/nilfs2/inode.c:261\n  generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772\n  __generic_file_write_iter+0x176/0x400 mm/filemap.c:3900\n  generic_file_write_iter+0xab/0x310 mm/filemap.c:3932\n  call_write_iter include/linux/fs.h:2186 [inline]\n  new_sync_write fs/read_write.c:491 [inline]\n  vfs_write+0x7dc/0xc50 fs/read_write.c:584\n  ksys_write+0x177/0x2a0 fs/read_write.c:637\n  do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n ...\n </TASK>\n\nThis patch fixes the root cause of this problem by replacing the error\ncode that __nilfs_btree_get_block() returns on block address conversion\nfailure from -ENOENT to another internal code -EINVAL which means that the\nb-tree metadata is corrupted.\n\nBy returning -EINVAL, it propagates without glitches, and for all relevant\nb-tree operations, functions in the upper bmap layer output an error\nmessage indicating corrupted b-tree metadata via\nnilfs_bmap_convert_error(), and code -EIO will be eventually returned as\nit should be.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9f3e6581-315c-42af-ade4-899b43c43f2b",  "id": "CVE-2021-47145",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47145"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not BUG_ON in link_to_fixup_dir\n\nWhile doing error injection testing I got the following panic\n\n  kernel BUG at fs/btrfs/tree-log.c:1862!\n  invalid opcode: 0000 [#1] SMP NOPTI\n  CPU: 1 PID: 7836 Comm: mount Not tainted 5.13.0-rc1+ #305\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014\n  RIP: 0010:link_to_fixup_dir+0xd5/0xe0\n  RSP: 0018:ffffb5800180fa30 EFLAGS: 00010216\n  RAX: fffffffffffffffb RBX: 00000000fffffffb RCX: ffff8f595287faf0\n  RDX: ffffb5800180fa37 RSI: ffff8f5954978800 RDI: 0000000000000000\n  RBP: ffff8f5953af9450 R08: 0000000000000019 R09: 0000000000000001\n  R10: 000151f408682970 R11: 0000000120021001 R12: ffff8f5954978800\n  R13: ffff8f595287faf0 R14: ffff8f5953c77dd0 R15: 0000000000000065\n  FS:  00007fc5284c8c40(0000) GS:ffff8f59bbd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fc5287f47c0 CR3: 000000011275e002 CR4: 0000000000370ee0\n  Call Trace:\n   replay_one_buffer+0x409/0x470\n   ? btree_read_extent_buffer_pages+0xd0/0x110\n   walk_up_log_tree+0x157/0x1e0\n   walk_log_tree+0xa6/0x1d0\n   btrfs_recover_log_trees+0x1da/0x360\n   ? replay_one_extent+0x7b0/0x7b0\n   open_ctree+0x1486/0x1720\n   btrfs_mount_root.cold+0x12/0xea\n   ? __kmalloc_track_caller+0x12f/0x240\n   legacy_get_tree+0x24/0x40\n   vfs_get_tree+0x22/0xb0\n   vfs_kern_mount.part.0+0x71/0xb0\n   btrfs_mount+0x10d/0x380\n   ? vfs_parse_fs_string+0x4d/0x90\n   legacy_get_tree+0x24/0x40\n   vfs_get_tree+0x22/0xb0\n   path_mount+0x433/0xa10\n   __x64_sys_mount+0xe3/0x120\n   do_syscall_64+0x3d/0x80\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nWe can get -EIO or any number of legitimate errors from\nbtrfs_search_slot(), panicing here is not the appropriate response.  The\nerror path for this code handles errors properly, simply return the\nerror.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "41e9e509-6aa9-4547-96df-d2ac9d99b7bb",  "id": "CVE-2010-1146",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1146"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel 2.6.33.2 and earlier, when a ReiserFS filesystem exists, does not restrict read or write access to the .reiserfs_priv directory, which allows local users to gain privileges by modifying (1) extended attributes or (2) ACLs, as demonstrated by deleting a file under .reiserfs_priv/xattrs/.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:12130'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:88223/Linux-Kernel-2.6.34-rc3-ReiserFS-xattr-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "3c61cc5a-86cd-4d16-948f-dae88eb772ca",  "id": "CVE-2022-49316",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Don't hold the layoutget locks across multiple RPC calls\n\nWhen doing layoutget as part of the open() compound, we have to be\ncareful to release the layout locks before we can call any further RPC\ncalls, such as setattr(). The reason is that those calls could trigger\na recall, which could deadlock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1e7c323e-e975-4c2c-bdc1-42e6c41cb0a7",  "id": "CVE-2020-26541",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26541"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "334431be-7ea3-422d-8bf8-e966910e6530",  "id": "CVE-2024-49875",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    354  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: map the EBADMSG to nfserr_io to avoid warning\n\nExt4 will throw -EBADMSG through ext4_readdir when a checksum error\noccurs, resulting in the following WARNING.\n\nFix it by mapping EBADMSG to nfserr_io.\n\nnfsd_buffered_readdir\n iterate_dir // -EBADMSG -74\n  ext4_readdir // .iterate_shared\n   ext4_dx_readdir\n    ext4_htree_fill_tree\n     htree_dirblock_to_tree\n      ext4_read_dirblock\n       __ext4_read_dirblock\n        ext4_dirblock_csum_verify\n         warn_no_space_for_csum\n          __warn_no_space_for_csum\n        return ERR_PTR(-EFSBADCRC) // -EBADMSG -74\n nfserrno // WARNING\n\n[  161.115610] ------------[ cut here ]------------\n[  161.116465] nfsd: non-standard errno: -74\n[  161.117315] WARNING: CPU: 1 PID: 780 at fs/nfsd/nfsproc.c:878 nfserrno+0x9d/0xd0\n[  161.118596] Modules linked in:\n[  161.119243] CPU: 1 PID: 780 Comm: nfsd Not tainted 5.10.0-00014-g79679361fd5d #138\n[  161.120684] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qe\nmu.org 04/01/2014\n[  161.123601] RIP: 0010:nfserrno+0x9d/0xd0\n[  161.124676] Code: 0f 87 da 30 dd 00 83 e3 01 b8 00 00 00 05 75 d7 44 89 ee 48 c7 c7 c0 57 24 98 89 44 24 04 c6\n 05 ce 2b 61 03 01 e8 99 20 d8 00 <0f> 0b 8b 44 24 04 eb b5 4c 89 e6 48 c7 c7 a0 6d a4 99 e8 cc 15 33\n[  161.127797] RSP: 0018:ffffc90000e2f9c0 EFLAGS: 00010286\n[  161.128794] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[  161.130089] RDX: 1ffff1103ee16f6d RSI: 0000000000000008 RDI: fffff520001c5f2a\n[  161.131379] RBP: 0000000000000022 R08: 0000000000000001 R09: ffff8881f70c1827\n[  161.132664] R10: ffffed103ee18304 R11: 0000000000000001 R12: 0000000000000021\n[  161.133949] R13: 00000000ffffffb6 R14: ffff8881317c0000 R15: ffffc90000e2fbd8\n[  161.135244] FS:  0000000000000000(0000) GS:ffff8881f7080000(0000) knlGS:0000000000000000\n[  161.136695] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  161.137761] CR2: 00007fcaad70b348 CR3: 0000000144256006 CR4: 0000000000770ee0\n[  161.139041] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  161.140291] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  161.141519] PKRU: 55555554\n[  161.142076] Call Trace:\n[  161.142575]  ? __warn+0x9b/0x140\n[  161.143229]  ? nfserrno+0x9d/0xd0\n[  161.143872]  ? report_bug+0x125/0x150\n[  161.144595]  ? handle_bug+0x41/0x90\n[  161.145284]  ? exc_invalid_op+0x14/0x70\n[  161.146009]  ? asm_exc_invalid_op+0x12/0x20\n[  161.146816]  ? nfserrno+0x9d/0xd0\n[  161.147487]  nfsd_buffered_readdir+0x28b/0x2b0\n[  161.148333]  ? nfsd4_encode_dirent_fattr+0x380/0x380\n[  161.149258]  ? nfsd_buffered_filldir+0xf0/0xf0\n[  161.150093]  ? wait_for_concurrent_writes+0x170/0x170\n[  161.151004]  ? generic_file_llseek_size+0x48/0x160\n[  161.151895]  nfsd_readdir+0x132/0x190\n[  161.152606]  ? nfsd4_encode_dirent_fattr+0x380/0x380\n[  161.153516]  ? nfsd_unlink+0x380/0x380\n[  161.154256]  ? override_creds+0x45/0x60\n[  161.155006]  nfsd4_encode_readdir+0x21a/0x3d0\n[  161.155850]  ? nfsd4_encode_readlink+0x210/0x210\n[  161.156731]  ? write_bytes_to_xdr_buf+0x97/0xe0\n[  161.157598]  ? __write_bytes_to_xdr_buf+0xd0/0xd0\n[  161.158494]  ? lock_downgrade+0x90/0x90\n[  161.159232]  ? nfs4svc_decode_voidarg+0x10/0x10\n[  161.160092]  nfsd4_encode_operation+0x15a/0x440\n[  161.160959]  nfsd4_proc_compound+0x718/0xe90\n[  161.161818]  nfsd_dispatch+0x18e/0x2c0\n[  161.162586]  svc_process_common+0x786/0xc50\n[  161.163403]  ? nfsd_svc+0x380/0x380\n[  161.164137]  ? svc_printk+0x160/0x160\n[  161.164846]  ? svc_xprt_do_enqueue.part.0+0x365/0x380\n[  161.165808]  ? nfsd_svc+0x380/0x380\n[  161.166523]  ? rcu_is_watching+0x23/0x40\n[  161.167309]  svc_process+0x1a5/0x200\n[  161.168019]  nfsd+0x1f5/0x380\n[  161.168663]  ? nfsd_shutdown_threads+0x260/0x260\n[  161.169554]  kthread+0x1c4/0x210\n[  161.170224]  ? kthread_insert_work_sanity_check+0x80/0x80\n[  161.171246]  ret_from_fork+0x1f/0x30",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eb40de45-1cf7-4249-8470-d292a7598413",  "id": "CVE-2024-40966",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: add the option to have a tty reject a new ldisc\n\n... and use it to limit the virtual terminals to just N_TTY.  They are\nkind of special, and in particular, the \"con_write()\" routine violates\nthe \"writes cannot sleep\" rule that some ldiscs rely on.\n\nThis avoids the\n\n   BUG: sleeping function called from invalid context at kernel/printk/printk.c:2659\n\nwhen N_GSM has been attached to a virtual console, and gsmld_write()\ncalls con_write() while holding a spinlock, and con_write() then tries\nto get the console lock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "92523b4c-9d30-4ddb-84fc-3c6c4199e82f",  "id": "DLA-1586-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "de36ba46-7f99-4596-8c49-64f61c8eb26e",  "id": "SUSE-SU-2017:2619-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a035cd5b-e733-412d-aa36-7691c31b8349",  "id": "CVE-2016-2106",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2106"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc8514bf-7be6-4994-af5a-fb145fcb8742",  "id": "CVE-2022-49524",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pci: cx23885: Fix the error handling in cx23885_initdev()\n\nWhen the driver fails to call the dma_set_mask(), the driver will get\nthe following splat:\n\n[   55.853884] BUG: KASAN: use-after-free in __process_removed_driver+0x3c/0x240\n[   55.854486] Read of size 8 at addr ffff88810de60408 by task modprobe/590\n[   55.856822] Call Trace:\n[   55.860327]  __process_removed_driver+0x3c/0x240\n[   55.861347]  bus_for_each_dev+0x102/0x160\n[   55.861681]  i2c_del_driver+0x2f/0x50\n\nThis is because the driver has initialized the i2c related resources\nin cx23885_dev_setup() but not released them in error handling, fix this\nbug by modifying the error path that jumps after failing to call the\ndma_set_mask().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2a2cdc66-0658-47c7-8717-76dbf867c371",  "id": "CVE-2023-53322",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Wait for io return on terminate rport\n\nSystem crash due to use after free.\nCurrent code allows terminate_rport_io to exit before making\nsure all IOs has returned. For FCP-2 device, IO's can hang\non in HW because driver has not tear down the session in FW at\nfirst sign of cable pull. When dev_loss_tmo timer pops,\nterminate_rport_io is called and upper layer is about to\nfree various resources. Terminate_rport_io trigger qla to do\nthe final cleanup, but the cleanup might not be fast enough where it\nleave qla still holding on to the same resource.\n\nWait for IO's to return to upper layer before resources are freed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c9582ca-0ac1-4fce-8835-63b6d6816053",  "id": "openSUSE-SU-2026:10258-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e340587f-ff55-4e95-9b62-5e7030b64a8e",  "id": "DLA-1330-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3e6cb641-460b-40c3-92b8-c142540ba425",  "id": "CVE-2022-50346",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: init quota for 'old.inode' in 'ext4_rename'\n\nSyzbot found the following issue:\next4_parse_param: s_want_extra_isize=128\next4_inode_info_init: s_want_extra_isize=32\next4_rename: old.inode=ffff88823869a2c8 old.dir=ffff888238699828 new.inode=ffff88823869d7e8 new.dir=ffff888238699828\n__ext4_mark_inode_dirty: inode=ffff888238699828 ea_isize=32 want_ea_size=128\n__ext4_mark_inode_dirty: inode=ffff88823869a2c8 ea_isize=32 want_ea_size=128\next4_xattr_block_set: inode=ffff88823869a2c8\n------------[ cut here ]------------\nWARNING: CPU: 13 PID: 2234 at fs/ext4/xattr.c:2070 ext4_xattr_block_set.cold+0x22/0x980\nModules linked in:\nRIP: 0010:ext4_xattr_block_set.cold+0x22/0x980\nRSP: 0018:ffff888227d3f3b0 EFLAGS: 00010202\nRAX: 0000000000000001 RBX: ffff88823007a000 RCX: 0000000000000000\nRDX: 0000000000000a03 RSI: 0000000000000040 RDI: ffff888230078178\nRBP: 0000000000000000 R08: 000000000000002c R09: ffffed1075c7df8e\nR10: ffff8883ae3efc6b R11: ffffed1075c7df8d R12: 0000000000000000\nR13: ffff88823869a2c8 R14: ffff8881012e0460 R15: dffffc0000000000\nFS:  00007f350ac1f740(0000) GS:ffff8883ae200000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f350a6ed6a0 CR3: 0000000237456000 CR4: 00000000000006e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n ? ext4_xattr_set_entry+0x3b7/0x2320\n ? ext4_xattr_block_set+0x0/0x2020\n ? ext4_xattr_set_entry+0x0/0x2320\n ? ext4_xattr_check_entries+0x77/0x310\n ? ext4_xattr_ibody_set+0x23b/0x340\n ext4_xattr_move_to_block+0x594/0x720\n ext4_expand_extra_isize_ea+0x59a/0x10f0\n __ext4_expand_extra_isize+0x278/0x3f0\n __ext4_mark_inode_dirty.cold+0x347/0x410\n ext4_rename+0xed3/0x174f\n vfs_rename+0x13a7/0x2510\n do_renameat2+0x55d/0x920\n __x64_sys_rename+0x7d/0xb0\n do_syscall_64+0x3b/0xa0\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nAs 'ext4_rename' will modify 'old.inode' ctime and mark inode dirty,\nwhich may trigger expand 'extra_isize' and allocate block. If inode\ndidn't init quota will lead to warning.  To solve above issue, init\n'old.inode' firstly in 'ext4_rename'.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2cdbbeb3-1ca7-4fc2-b70e-b58f98c2e27d",  "id": "CVE-2014-3568",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3568"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cadc070e-f5f3-43aa-8064-6e7512037269",  "id": "CVE-2024-40904",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages\n\nThe syzbot fuzzer found that the interrupt-URB completion callback in\nthe cdc-wdm driver was taking too long, and the driver's immediate\nresubmission of interrupt URBs with -EPROTO status combined with the\ndummy-hcd emulation to cause a CPU lockup:\n\ncdc_wdm 1-1:1.0: nonzero urb status received: -71\ncdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes\nwatchdog: BUG: soft lockup - CPU#0 stuck for 26s! [syz-executor782:6625]\nCPU#0 Utilization every 4s during lockup:\n\t#1:  98% system,\t  0% softirq,\t  3% hardirq,\t  0% idle\n\t#2:  98% system,\t  0% softirq,\t  3% hardirq,\t  0% idle\n\t#3:  98% system,\t  0% softirq,\t  3% hardirq,\t  0% idle\n\t#4:  98% system,\t  0% softirq,\t  3% hardirq,\t  0% idle\n\t#5:  98% system,\t  1% softirq,\t  3% hardirq,\t  0% idle\nModules linked in:\nirq event stamp: 73096\nhardirqs last  enabled at (73095): [<ffff80008037bc00>] console_emit_next_record kernel/printk/printk.c:2935 [inline]\nhardirqs last  enabled at (73095): [<ffff80008037bc00>] console_flush_all+0x650/0xb74 kernel/printk/printk.c:2994\nhardirqs last disabled at (73096): [<ffff80008af10b00>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline]\nhardirqs last disabled at (73096): [<ffff80008af10b00>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551\nsoftirqs last  enabled at (73048): [<ffff8000801ea530>] softirq_handle_end kernel/softirq.c:400 [inline]\nsoftirqs last  enabled at (73048): [<ffff8000801ea530>] handle_softirqs+0xa60/0xc34 kernel/softirq.c:582\nsoftirqs last disabled at (73043): [<ffff800080020de8>] __do_softirq+0x14/0x20 kernel/softirq.c:588\nCPU: 0 PID: 6625 Comm: syz-executor782 Tainted: G        W          6.10.0-rc2-syzkaller-g8867bbd4a056 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\n\nTesting showed that the problem did not occur if the two error\nmessages -- the first two lines above -- were removed; apparently adding\nmaterial to the kernel log takes a surprisingly large amount of time.\n\nIn any case, the best approach for preventing these lockups and to\navoid spamming the log with thousands of error messages per second is\nto ratelimit the two dev_err() calls.  Therefore we replace them with\ndev_err_ratelimited().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f76317c4-dfab-4a41-a52b-47f7a7a6bd3f",  "id": "CVE-2019-11477",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11477"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1e802ad6-14e5-40d6-99e2-1abd9eada841",  "id": "AZL-75281",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f0bbe503-12c9-4e4e-ab48-fdefdd2e66f3",  "id": "MGASA-2015-0246",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "efd3f0d4-5563-4214-bb1d-8f4c4946ce54",  "id": "SUSE-SU-2021:14802-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "57e6be71-07cf-4513-93f6-5d1661c2b62c",  "id": "CVE-2018-20854",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20854"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 4.20. drivers/phy/mscc/phy-ocelot-serdes.c has an off-by-one error with a resultant ctrl->phys out-of-bounds read.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a8bc5c04-a9fd-494b-a4dc-e1e0bc3dccc8",  "id": "CVE-2025-22022",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Apply the link chain quirk on NEC isoc endpoints\n\nTwo clearly different specimens of NEC uPD720200 (one with start/stop\nbug, one without) were seen to cause IOMMU faults after some Missed\nService Errors. Faulting address is immediately after a transfer ring\nsegment and patched dynamic debug messages revealed that the MSE was\nreceived when waiting for a TD near the end of that segment:\n\n[ 1.041954] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ffa08fe0\n[ 1.042120] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09000 flags=0x0000]\n[ 1.042146] xhci_hcd: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0005 address=0xffa09040 flags=0x0000]\n\nIt gets even funnier if the next page is a ring segment accessible to\nthe HC. Below, it reports MSE in segment at ff1e8000, plows through a\nzero-filled page at ff1e9000 and starts reporting events for TRBs in\npage at ff1ea000 every microframe, instead of jumping to seg ff1e6000.\n\n[ 7.041671] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0\n[ 7.041999] xhci_hcd: Miss service interval error for slot 1 ep 2 expected TD DMA ff1e8fe0\n[ 7.042011] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042028] xhci_hcd: All TDs skipped for slot 1 ep 2. Clear skip flag.\n[ 7.042134] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042138] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31\n[ 7.042144] xhci_hcd: Looking for event-dma 00000000ff1ea040 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.042259] xhci_hcd: WARN: buffer overrun event for slot 1 ep 2 on endpoint\n[ 7.042262] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 31\n[ 7.042266] xhci_hcd: Looking for event-dma 00000000ff1ea050 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n\nAt some point completion events change from Isoch Buffer Overrun to\nShort Packet and the HC finally finds cycle bit mismatch in ff1ec000.\n\n[ 7.098130] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13\n[ 7.098132] xhci_hcd: Looking for event-dma 00000000ff1ecc50 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.098254] xhci_hcd: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13\n[ 7.098256] xhci_hcd: Looking for event-dma 00000000ff1ecc60 trb-start 00000000ff1e6820 trb-end 00000000ff1e6820\n[ 7.098379] xhci_hcd: Overrun event on slot 1 ep 2\n\nIt's possible that data from the isochronous device were written to\nrandom buffers of pending TDs on other endpoints (either IN or OUT),\nother devices or even other HCs in the same IOMMU domain.\n\nLastly, an error from a different USB device on another HC. Was it\ncaused by the above? I don't know, but it may have been. The disk\nwas working without any other issues and generated PCIe traffic to\nstarve the NEC of upstream BW and trigger those MSEs. The two HCs\nshared one x1 slot by means of a commercial \"PCIe splitter\" board.\n\n[ 7.162604] usb 10-2: reset SuperSpeed USB device number 3 using xhci_hcd\n[ 7.178990] sd 9:0:0:0: [sdb] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x07 driverbyte=DRIVER_OK cmd_age=0s\n[ 7.179001] sd 9:0:0:0: [sdb] tag#0 CDB: opcode=0x28 28 00 04 02 ae 00 00 02 00 00\n[ 7.179004] I/O error, dev sdb, sector 67284480 op 0x0:(READ) flags 0x80700 phys_seg 5 prio class 0\n\nFortunately, it appears that this ridiculous bug is avoided by setting\nthe chain bit of Link TRBs on isochronous rings. Other ancient HCs are\nknown which also expect the bit to be set and they ignore Link TRBs if\nit's not. Reportedly, 0.95 spec guaranteed that the bit is set.\n\nThe bandwidth-starved NEC HC running a 32KB/uframe UVC endpoint reports\ntens of MSEs per second and runs into the bug within seconds. Chaining\nLink TRBs allows the same workload to run for many minutes, many times.\n\nNo ne\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9228aebb-f04e-4c7f-a755-988e27dd1a93",  "id": "CVE-2023-52632",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix lock dependency warning with srcu\n\n======================================================\nWARNING: possible circular locking dependency detected\n6.5.0-kfd-yangp #2289 Not tainted\n------------------------------------------------------\nkworker/0:2/996 is trying to acquire lock:\n        (srcu){.+.+}-{0:0}, at: __synchronize_srcu+0x5/0x1a0\n\nbut task is already holding lock:\n        ((work_completion)(&svms->deferred_list_work)){+.+.}-{0:0}, at:\n\tprocess_one_work+0x211/0x560\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-> #3 ((work_completion)(&svms->deferred_list_work)){+.+.}-{0:0}:\n        __flush_work+0x88/0x4f0\n        svm_range_list_lock_and_flush_work+0x3d/0x110 [amdgpu]\n        svm_range_set_attr+0xd6/0x14c0 [amdgpu]\n        kfd_ioctl+0x1d1/0x630 [amdgpu]\n        __x64_sys_ioctl+0x88/0xc0\n\n-> #2 (&info->lock#2){+.+.}-{3:3}:\n        __mutex_lock+0x99/0xc70\n        amdgpu_amdkfd_gpuvm_restore_process_bos+0x54/0x740 [amdgpu]\n        restore_process_helper+0x22/0x80 [amdgpu]\n        restore_process_worker+0x2d/0xa0 [amdgpu]\n        process_one_work+0x29b/0x560\n        worker_thread+0x3d/0x3d0\n\n-> #1 ((work_completion)(&(&process->restore_work)->work)){+.+.}-{0:0}:\n        __flush_work+0x88/0x4f0\n        __cancel_work_timer+0x12c/0x1c0\n        kfd_process_notifier_release_internal+0x37/0x1f0 [amdgpu]\n        __mmu_notifier_release+0xad/0x240\n        exit_mmap+0x6a/0x3a0\n        mmput+0x6a/0x120\n        do_exit+0x322/0xb90\n        do_group_exit+0x37/0xa0\n        __x64_sys_exit_group+0x18/0x20\n        do_syscall_64+0x38/0x80\n\n-> #0 (srcu){.+.+}-{0:0}:\n        __lock_acquire+0x1521/0x2510\n        lock_sync+0x5f/0x90\n        __synchronize_srcu+0x4f/0x1a0\n        __mmu_notifier_release+0x128/0x240\n        exit_mmap+0x6a/0x3a0\n        mmput+0x6a/0x120\n        svm_range_deferred_list_work+0x19f/0x350 [amdgpu]\n        process_one_work+0x29b/0x560\n        worker_thread+0x3d/0x3d0\n\nother info that might help us debug this:\nChain exists of:\n  srcu --> &info->lock#2 --> (work_completion)(&svms->deferred_list_work)\n\nPossible unsafe locking scenario:\n\n        CPU0                    CPU1\n        ----                    ----\n        lock((work_completion)(&svms->deferred_list_work));\n                        lock(&info->lock#2);\n\t\t\tlock((work_completion)(&svms->deferred_list_work));\n        sync(srcu);",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f47ceb72-b64e-4544-bb06-70ea72c43127",  "id": "CVE-2022-1012",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1012"  },  "ratings": [    {      "score": 8.199999999999999,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "88e87ddd-f996-44ba-8ce4-0d0c4c29ff1d",  "id": "CVE-2013-7267",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7267"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The atalk_recvmsg function in net/appletalk/ddp.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "74cac996-8de1-4d52-b901-68e02768cd2b",  "id": "CVE-2009-1387",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1387"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence DTLS handshake message, related to a \"fragment bug.\"",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff9ccc41-5fa6-4752-8194-a1b0ff99ede4",  "id": "CVE-2025-38245",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().\n\nsyzbot reported a warning below during atm_dev_register(). [0]\n\nBefore creating a new device and procfs/sysfs for it, atm_dev_register()\nlooks up a duplicated device by __atm_dev_lookup().  These operations are\ndone under atm_dev_mutex.\n\nHowever, when removing a device in atm_dev_deregister(), it releases the\nmutex just after removing the device from the list that __atm_dev_lookup()\niterates over.\n\nSo, there will be a small race window where the device does not exist on\nthe device list but procfs/sysfs are still not removed, triggering the\nsplat.\n\nLet's hold the mutex until procfs/sysfs are removed in\natm_dev_deregister().\n\n[0]:\nproc_dir_entry 'atm/atmtcp:0' already registered\nWARNING: CPU: 0 PID: 5919 at fs/proc/generic.c:377 proc_register+0x455/0x5f0 fs/proc/generic.c:377\nModules linked in:\nCPU: 0 UID: 0 PID: 5919 Comm: syz-executor284 Not tainted 6.16.0-rc2-syzkaller-00047-g52da431bf03b #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nRIP: 0010:proc_register+0x455/0x5f0 fs/proc/generic.c:377\nCode: 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 a2 01 00 00 48 8b 44 24 10 48 c7 c7 20 c0 c2 8b 48 8b b0 d8 00 00 00 e8 0c 02 1c ff 90 <0f> 0b 90 90 48 c7 c7 80 f2 82 8e e8 0b de 23 09 48 8b 4c 24 28 48\nRSP: 0018:ffffc9000466fa30 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817ae248\nRDX: ffff888026280000 RSI: ffffffff817ae255 RDI: 0000000000000001\nRBP: ffff8880232bed48 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: ffff888076ed2140\nR13: dffffc0000000000 R14: ffff888078a61340 R15: ffffed100edda444\nFS:  00007f38b3b0c6c0(0000) GS:ffff888124753000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f38b3bdf953 CR3: 0000000076d58000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n proc_create_data+0xbe/0x110 fs/proc/generic.c:585\n atm_proc_dev_register+0x112/0x1e0 net/atm/proc.c:361\n atm_dev_register+0x46d/0x890 net/atm/resources.c:113\n atmtcp_create+0x77/0x210 drivers/atm/atmtcp.c:369\n atmtcp_attach drivers/atm/atmtcp.c:403 [inline]\n atmtcp_ioctl+0x2f9/0xd60 drivers/atm/atmtcp.c:464\n do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159\n sock_do_ioctl+0x115/0x280 net/socket.c:1190\n sock_ioctl+0x227/0x6b0 net/socket.c:1311\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl fs/ioctl.c:893 [inline]\n __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f38b3b74459\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f38b3b0c198 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f38b3bfe318 RCX: 00007f38b3b74459\nRDX: 0000000000000000 RSI: 0000000000006180 RDI: 0000000000000005\nRBP: 00007f38b3bfe310 R08: 65732f636f72702f R09: 65732f636f72702f\nR10: 65732f636f72702f R11: 0000000000000246 R12: 00007f38b3bcb0ac\nR13: 00007f38b3b0c1a0 R14: 0000200000000200 R15: 00007f38b3bcb03b\n </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a9924370-a524-426a-a5da-3ba522108e43",  "id": "CVE-2025-21700",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: Disallow replacing of child qdisc from one parent to another\n\nLion Ackermann was able to create a UAF which can be abused for privilege\nescalation with the following script\n\nStep 1. create root qdisc\ntc qdisc add dev lo root handle 1:0 drr\n\nstep2. a class for packet aggregation do demonstrate uaf\ntc class add dev lo classid 1:1 drr\n\nstep3. a class for nesting\ntc class add dev lo classid 1:2 drr\n\nstep4. a class to graft qdisc to\ntc class add dev lo classid 1:3 drr\n\nstep5.\ntc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024\n\nstep6.\ntc qdisc add dev lo parent 1:2 handle 3:0 drr\n\nstep7.\ntc class add dev lo classid 3:1 drr\n\nstep 8.\ntc qdisc add dev lo parent 3:1 handle 4:0 pfifo\n\nstep 9. Display the class/qdisc layout\n\ntc class ls dev lo\n class drr 1:1 root leaf 2: quantum 64Kb\n class drr 1:2 root leaf 3: quantum 64Kb\n class drr 3:1 root leaf 4: quantum 64Kb\n\ntc qdisc ls\n qdisc drr 1: dev lo root refcnt 2\n qdisc plug 2: dev lo parent 1:1\n qdisc pfifo 4: dev lo parent 3:1 limit 1000p\n qdisc drr 3: dev lo parent 1:2\n\nstep10. trigger the bug <=== prevented by this patch\ntc qdisc replace dev lo parent 1:3 handle 4:0\n\nstep 11. Redisplay again the qdiscs/classes\n\ntc class ls dev lo\n class drr 1:1 root leaf 2: quantum 64Kb\n class drr 1:2 root leaf 3: quantum 64Kb\n class drr 1:3 root leaf 4: quantum 64Kb\n class drr 3:1 root leaf 4: quantum 64Kb\n\ntc qdisc ls\n qdisc drr 1: dev lo root refcnt 2\n qdisc plug 2: dev lo parent 1:1\n qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p\n qdisc drr 3: dev lo parent 1:2\n\nObserve that a) parent for 4:0 does not change despite the replace request.\nThere can only be one parent.  b) refcount has gone up by two for 4:0 and\nc) both class 1:3 and 3:1 are pointing to it.\n\nStep 12.  send one packet to plug\necho \"\" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001))\nstep13.  send one packet to the grafted fifo\necho \"\" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003))\n\nstep14. lets trigger the uaf\ntc class delete dev lo classid 1:3\ntc class delete dev lo classid 1:1\n\nThe semantics of \"replace\" is for a del/add _on the same node_ and not\na delete from one node(3:1) and add to another node (1:3) as in step10.\nWhile we could \"fix\" with a more complex approach there could be\nconsequences to expectations so the patch takes the preventive approach of\n\"disallow such config\".\n\nJoint work with Lion Ackermann <nnamrec@gmail.com>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a05d37d-c45d-474d-80f4-ea2086f7ab69",  "id": "CVE-2023-53390",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: base: dd: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cf32cea3-e884-452b-973e-e16a61509513",  "id": "CVE-2024-26770",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: nvidia-shield: Add missing null pointer checks to LED initialization\n\ndevm_kasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure. Ensure the allocation was successful\nby checking the pointer validity.\n\n[jkosina@suse.com: tweak changelog a bit]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b6f82cae-492b-4bed-8611-071d55b782ff",  "id": "CVE-2023-53230",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix warning in cifs_smb3_do_mount()\n\nThis fixes the following warning reported by kernel test robot\n\n  fs/smb/client/cifsfs.c:982 cifs_smb3_do_mount() warn: possible\n  memory leak of 'cifs_sb'",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c362914d-ef9b-4147-9a05-4fa9d52a0c24",  "id": "CVE-2023-32269",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32269"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order for an attacker to exploit this, the system must have netrom routing configured or the attacker must have the CAP_NET_ADMIN capability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "029fd008-7ffa-4d33-baf6-8040e2c98d5f",  "id": "CVE-2026-23098",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetrom: fix double-free in nr_route_frame()\n\nIn nr_route_frame(), old_skb is immediately freed without checking if\nnr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL,\nthe caller function will free old_skb again, causing a double-free bug.\n\nTherefore, to prevent this, we need to modify it to check whether\nnr_neigh->ax25 is NULL before freeing old_skb.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ead08c3c-b098-40f0-a876-0cb65381f908",  "id": "CVE-2022-49138",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Ignore multiple conn complete events\n\nWhen one of the three connection complete events is received multiple\ntimes for the same handle, the device is registered multiple times which\nleads to memory corruptions. Therefore, consequent events for a single\nconnection are ignored.\n\nThe conn->state can hold different values, therefore HCI_CONN_HANDLE_UNSET\nis introduced to identify new connections. To make sure the events do not\ncontain this or another invalid handle HCI_CONN_HANDLE_MAX and checks\nare introduced.\n\nBuglink: https://bugzilla.kernel.org/show_bug.cgi?id=215497",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b96648ba-e8e3-44c0-926f-aa70a673c147",  "id": "CVE-2021-47668",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47668"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: can_restart: fix use after free bug\n\nAfter calling netif_rx_ni(skb), dereferencing skb is unsafe.\nEspecially, the can_frame cf which aliases skb memory is accessed\nafter the netif_rx_ni() in:\n      stats->rx_bytes += cf->len;\n\nReordering the lines solves the issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3660d22a-949c-45cd-8b64-8693b8c012ba",  "id": "CLSA-2025-1751550314",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0c28ba13-e810-432a-83c2-68383d0fb51b",  "id": "CVE-2014-0077",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0077"  },  "ratings": [    {      "score": 5.5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:H/Au:S/C:P/I:P/A:C"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e007323f-c792-4923-baad-21a22c5cab71",  "id": "CVE-2024-56605",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()\n\nbt_sock_alloc() allocates the sk object and attaches it to the provided\nsock object. On error l2cap_sock_alloc() frees the sk object, but the\ndangling pointer is still attached to the sock object, which may create\nuse-after-free in other code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c195f550-14b9-4a31-a535-20654bd06ae2",  "id": "SUSE-SU-2015:2237-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2f52052-b738-4f0d-be2b-a9e336bdd2c0",  "id": "CVE-2010-5313",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5313"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f0aeace8-9de3-44f5-8151-82067f82886a",  "id": "CVE-2024-36288",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix loop termination condition in gss_free_in_token_pages()\n\nThe in_token->pages[] array is not NULL terminated. This results in\nthe following KASAN splat:\n\n  KASAN: maybe wild-memory-access in range [0x04a2013400000008-0x04a201340000000f]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "377b39e1-9ef9-43c0-b7c9-ef3a7a0978e4",  "id": "CVE-2024-26923",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix garbage collector racing against connect()\n\nGarbage collector does not take into account the risk of embryo getting\nenqueued during the garbage collection. If such embryo has a peer that\ncarries SCM_RIGHTS, two consecutive passes of scan_children() may see a\ndifferent set of children. Leading to an incorrectly elevated inflight\ncount, and then a dangling pointer within the gc_inflight_list.\n\nsockets are AF_UNIX/SOCK_STREAM\nS is an unconnected socket\nL is a listening in-flight socket bound to addr, not in fdtable\nV's fd will be passed via sendmsg(), gets inflight count bumped\n\nconnect(S, addr)\tsendmsg(S, [V]); close(V)\t__unix_gc()\n----------------\t-------------------------\t-----------\n\nNS = unix_create1()\nskb1 = sock_wmalloc(NS)\nL = unix_find_other(addr)\nunix_state_lock(L)\nunix_peer(S) = NS\n\t\t\t// V count=1 inflight=0\n\n \t\t\tNS = unix_peer(S)\n \t\t\tskb2 = sock_alloc()\n\t\t\tskb_queue_tail(NS, skb2[V])\n\n\t\t\t// V became in-flight\n\t\t\t// V count=2 inflight=1\n\n\t\t\tclose(V)\n\n\t\t\t// V count=1 inflight=1\n\t\t\t// GC candidate condition met\n\n\t\t\t\t\t\tfor u in gc_inflight_list:\n\t\t\t\t\t\t  if (total_refs == inflight_refs)\n\t\t\t\t\t\t    add u to gc_candidates\n\n\t\t\t\t\t\t// gc_candidates={L, V}\n\n\t\t\t\t\t\tfor u in gc_candidates:\n\t\t\t\t\t\t  scan_children(u, dec_inflight)\n\n\t\t\t\t\t\t// embryo (skb1) was not\n\t\t\t\t\t\t// reachable from L yet, so V's\n\t\t\t\t\t\t// inflight remains unchanged\n__skb_queue_tail(L, skb1)\nunix_state_unlock(L)\n\t\t\t\t\t\tfor u in gc_candidates:\n\t\t\t\t\t\t  if (u.inflight)\n\t\t\t\t\t\t    scan_children(u, inc_inflight_move_tail)\n\n\t\t\t\t\t\t// V count=1 inflight=2 (!)\n\nIf there is a GC-candidate listening socket, lock/unlock its state. This\nmakes GC wait until the end of any ongoing connect() to that socket. After\nflipping the lock, a possibly SCM-laden embryo is already enqueued. And if\nthere is another embryo coming, it can not possibly carry SCM_RIGHTS. At\nthis point, unix_inflight() can not happen because unix_gc_lock is already\ntaken. Inflight graph remains unaffected.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c294fd7b-45ef-4137-86dc-f36e72a26742",  "id": "CVE-2024-35934",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()\n\nMany syzbot reports show extreme rtnl pressure, and many of them hint\nthat smc acquires rtnl in netns creation for no good reason [1]\n\nThis patch returns early from smc_pnet_net_init()\nif there is no netdevice yet.\n\nI am not even sure why smc_pnet_create_pnetids_list() even exists,\nbecause smc_pnet_netdev_event() is also calling\nsmc_pnet_add_base_pnetid() when handling NETDEV_UP event.\n\n[1] extract of typical syzbot reports\n\n2 locks held by syz-executor.3/12252:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.4/12253:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.1/12257:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.2/12261:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.0/12265:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.3/12268:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.4/12271:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.1/12274:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878\n2 locks held by syz-executor.2/12280:\n  #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline]\n  #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d02656a0-9d83-44f9-9509-44f4086d0b8b",  "id": "OESA-2026-1311",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5bd820f7-e260-451c-a774-7556023941e4",  "id": "CLSA-2026-1778020035",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "39359280-d2c6-4453-a7c2-c097c8e17bde",  "id": "CVE-2024-46861",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: ipheth: do not stop RX on failing RX callback\n\nRX callbacks can fail for multiple reasons:\n\n* Payload too short\n* Payload formatted incorrecly (e.g. bad NCM framing)\n* Lack of memory\n\nNone of these should cause the driver to seize up.\n\nMake such failures non-critical and continue processing further\nincoming URBs.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17613bda-9d93-4067-acfb-4b197174a4fc",  "id": "CVE-2015-8709",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8709"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local users to gain privileges by establishing a user namespace, waiting for a root process to enter that namespace with an unsafe uid or gid, and then using the ptrace system call.  NOTE: the vendor states \"there is no kernel bug here.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5e7cd51-5a51-4d06-acbe-926d0b4b7ec6",  "id": "CVE-2016-5244",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5244"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8ef3bf0-2f56-495b-802f-8007d2f0c328",  "id": "CVE-2022-49750",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: CPPC: Add u64 casts to avoid overflowing\n\nThe fields of the _CPC object are unsigned 32-bits values.\nTo avoid overflows while using _CPC's values, add 'u64' casts.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7dfdab4f-2674-49b5-93b5-7b0ca5093d35",  "id": "CVE-2023-52757",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416,    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential deadlock when releasing mids\n\nAll release_mid() callers seem to hold a reference of @mid so there is\nno need to call kref_put(&mid->refcount, __release_mid) under\n@server->mid_lock spinlock.  If they don't, then an use-after-free bug\nwould have occurred anyways.\n\nBy getting rid of such spinlock also fixes a potential deadlock as\nshown below\n\nCPU 0                                CPU 1\n------------------------------------------------------------------\ncifs_demultiplex_thread()            cifs_debug_data_proc_show()\n release_mid()\n  spin_lock(&server->mid_lock);\n                                     spin_lock(&cifs_tcp_ses_lock)\n\t\t\t\t      spin_lock(&server->mid_lock)\n  __release_mid()\n   smb2_find_smb_tcon()\n    spin_lock(&cifs_tcp_ses_lock) *deadlock*",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e664837c-75d2-4190-bbeb-5a27e165fabe",  "id": "CVE-2024-49868",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix a NULL pointer dereference when failed to start a new trasacntion\n\n[BUG]\nSyzbot reported a NULL pointer dereference with the following crash:\n\n  FAULT_INJECTION: forcing a failure.\n   start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676\n   prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642\n   relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678\n  ...\n  BTRFS info (device loop0): balance: ended with status: -12\n  Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI\n  KASAN: null-ptr-deref in range [0x0000000000000660-0x0000000000000667]\n  RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926\n  Call Trace:\n   <TASK>\n   commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496\n   btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430\n   del_balance_item fs/btrfs/volumes.c:3678 [inline]\n   reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742\n   btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574\n   btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:907 [inline]\n   __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[CAUSE]\nThe allocation failure happens at the start_transaction() inside\nprepare_to_relocate(), and during the error handling we call\nunset_reloc_control(), which makes fs_info->balance_ctl to be NULL.\n\nThen we continue the error path cleanup in btrfs_balance() by calling\nreset_balance_state() which will call del_balance_item() to fully delete\nthe balance item in the root tree.\n\nHowever during the small window between set_reloc_contrl() and\nunset_reloc_control(), we can have a subvolume tree update and created a\nreloc_root for that subvolume.\n\nThen we go into the final btrfs_commit_transaction() of\ndel_balance_item(), and into btrfs_update_reloc_root() inside\ncommit_fs_roots().\n\nThat function checks if fs_info->reloc_ctl is in the merge_reloc_tree\nstage, but since fs_info->reloc_ctl is NULL, it results a NULL pointer\ndereference.\n\n[FIX]\nJust add extra check on fs_info->reloc_ctl inside\nbtrfs_update_reloc_root(), before checking\nfs_info->reloc_ctl->merge_reloc_tree.\n\nThat DEAD_RELOC_TREE handling is to prevent further modification to the\nreloc tree during merge stage, but since there is no reloc_ctl at all,\nwe do not need to bother that.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee6bb5af-0ca1-4867-85d7-d99e24c35495",  "id": "CVE-2014-3506",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3506"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c70c744f-eeb4-491a-a6c9-8c19c3518e15",  "id": "CVE-2026-52918",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: serialize accept_q access\n\nbt_sock_poll() walks the accept queue without synchronization, while\nchild teardown can unlink the same socket and drop its last reference.\nThe unsynchronized accept queue walk has existed since the initial\nBluetooth import.\n\nProtect accept_q with a dedicated lock for queue updates and polling.\nAlso rework bt_accept_dequeue() to take temporary child references under\nthe queue lock before dropping it and locking the child socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b674964e-e43b-481e-8dd7-309608efea50",  "id": "CVE-2014-3683",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3683"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.",  "affects": [    {      "ref": "ebb09eec-6bae-4a02-bcc2-06b4cb332890",      "versions": [        {          "component": "sysklogd",          "version": "0.01"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "340c6f8b-baae-48ec-8f59-8606df813878",  "id": "CVE-2024-50038",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xtables: avoid NFPROTO_UNSPEC where needed\n\nsyzbot managed to call xt_cluster match via ebtables:\n\n WARNING: CPU: 0 PID: 11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780\n [..]\n ebt_do_table+0x174b/0x2a40\n\nModule registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet\nprocessing.  As this is only useful to restrict locally terminating\nTCP/UDP traffic, register this for ipv4 and ipv6 family only.\n\nPablo points out that this is a general issue, direct users of the\nset/getsockopt interface can call into targets/matches that were only\nintended for use with ip(6)tables.\n\nCheck all UNSPEC matches and targets for similar issues:\n\n- matches and targets are fine except if they assume skb_network_header()\n  is valid -- this is only true when called from inet layer: ip(6) stack\n  pulls the ip/ipv6 header into linear data area.\n- targets that return XT_CONTINUE or other xtables verdicts must be\n  restricted too, they are incompatbile with the ebtables traverser, e.g.\n  EBT_CONTINUE is a completely different value than XT_CONTINUE.\n\nMost matches/targets are changed to register for NFPROTO_IPV4/IPV6, as\nthey are provided for use by ip(6)tables.\n\nThe MARK target is also used by arptables, so register for NFPROTO_ARP too.\n\nWhile at it, bail out if connbytes fails to enable the corresponding\nconntrack family.\n\nThis change passes the selftests in iptables.git.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a73f9437-ab78-4359-924a-ab680cdaa6a3",  "id": "CVE-2024-56532",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us122l: Use snd_card_free_when_closed() at disconnection\n\nThe USB disconnect callback is supposed to be short and not too-long\nwaiting.  OTOH, the current code uses snd_card_free() at\ndisconnection, but this waits for the close of all used fds, hence it\ncan take long.  It eventually blocks the upper layer USB ioctls, which\nmay trigger a soft lockup.\n\nAn easy workaround is to replace snd_card_free() with\nsnd_card_free_when_closed().  This variant returns immediately while\nthe release of resources is done asynchronously by the card device\nrelease at the last close.\n\nThe loop of us122l->mmap_count check is dropped as well.  The check is\nuseless for the asynchronous operation with *_when_closed().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8fe853e0-a0a0-4115-908d-f03f4a556a14",  "id": "CVE-2024-53060",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: prevent NULL pointer dereference if ATIF is not supported\n\nacpi_evaluate_object() may return AE_NOT_FOUND (failure), which\nwould result in dereferencing buffer.pointer (obj) while being NULL.\n\nAlthough this case may be unrealistic for the current code, it is\nstill better to protect against possible bugs.\n\nBail out also when status is AE_NOT_FOUND.\n\nThis fixes 1 FORWARD_NULL issue reported by Coverity\nReport: CID 1600951:  Null pointer dereferences  (FORWARD_NULL)\n\n(cherry picked from commit 91c9e221fe2553edf2db71627d8453f083de87a1)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef4777a5-d98a-46fa-99c5-e0108339e183",  "id": "CVE-2016-4581",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4581"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a certain case involving a slave mount, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted series of mount system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b6f4942f-2a79-4e15-957f-cb758cfabd21",  "id": "RHSA-2020:5641",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8779769d-e83c-4a18-bf05-b9c711de3d34",  "id": "CVE-2019-11478",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11478"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400,    770  ],  "analysis": {    "state": "in_triage"  },  "description": "Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit f070ef2ac66716357066b683fb0baf55f8191a2e.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "78bffa71-b016-430f-88a4-448469d75912",  "id": "CVE-2024-41062",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbluetooth/l2cap: sync sock recv cb and release\n\nThe problem occurs between the system call to close the sock and hci_rx_work,\nwhere the former releases the sock and the latter accesses it without lock protection.\n\n           CPU0                       CPU1\n           ----                       ----\n           sock_close                 hci_rx_work\n\t   l2cap_sock_release         hci_acldata_packet\n\t   l2cap_sock_kill            l2cap_recv_frame\n\t   sk_free                    l2cap_conless_channel\n\t                              l2cap_sock_recv_cb\n\nIf hci_rx_work processes the data that needs to be received before the sock is\nclosed, then everything is normal; Otherwise, the work thread may access the\nreleased sock when receiving data.\n\nAdd a chan mutex in the rx callback of the sock to achieve synchronization between\nthe sock release and recv cb.\n\nSock is dead, so set chan data to NULL, avoid others use invalid sock pointer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a4b23022-e0ad-4a39-913d-14df33c6bd37",  "id": "CVE-2024-46840",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: clean up our handling of refs == 0 in snapshot delete\n\nIn reada we BUG_ON(refs == 0), which could be unkind since we aren't\nholding a lock on the extent leaf and thus could get a transient\nincorrect answer.  In walk_down_proc we also BUG_ON(refs == 0), which\ncould happen if we have extent tree corruption.  Change that to return\n-EUCLEAN.  In do_walk_down() we catch this case and handle it correctly,\nhowever we return -EIO, which -EUCLEAN is a more appropriate error code.\nFinally in walk_up_proc we have the same BUG_ON(refs == 0), so convert\nthat to proper error handling.  Also adjust the error message so we can\nactually do something with the information.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e89caf4-fb3e-492f-9acd-0b695b99342a",  "id": "CVE-2021-3428",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3428"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, A local attacker with a special user privilege may cause a system crash problem which can lead to an availability threat.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "747466bb-09ff-4349-ab10-b4b4cbd92e71",  "id": "CVE-2024-49912",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'\n\nThis commit adds a null check for 'stream_status' in the function\n'planes_changed_for_existing_stream'. Previously, the code assumed\n'stream_status' could be null, but did not handle the case where it was\nactually null. This could lead to a null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:3784 planes_changed_for_existing_stream() error: we previously assumed 'stream_status' could be null (see line 3774)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e4efecdc-b2df-4778-b955-430bab215b25",  "id": "CVE-2024-41044",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: reject claimed-as-LCP but actually malformed packets\n\nSince 'ppp_async_encode()' assumes valid LCP packets (with code\nfrom 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that\nLCP packet has an actual body beyond PPP_LCP header bytes, and\nreject claimed-as-LCP but actually malformed data otherwise.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eaec6a95-23c2-471b-8b9b-c4c9b9082be4",  "id": "CVE-2023-52735",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself\n\nsock_map proto callbacks should never call themselves by design. Protect\nagainst bugs like [1] and break out of the recursive loop to avoid a stack\noverflow in favor of a resource leak.\n\n[1] https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bbda83f0-9d3a-4958-9b99-359e490a0420",  "id": "CVE-2012-6543",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6543"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The l2tp_ip6_getname function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d746020-5805-4a2a-87e7-bf2b2fae83a5",  "id": "RHSA-2015:1115",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8a9b5f1-bda7-4436-9e6f-057a0adf28ca",  "id": "DSA-1571-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "40215275-3e71-4367-a591-442ad5db3bbe",  "id": "MGASA-2024-0041",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "00497de6-b4d0-44f5-a529-8dab2c9be827",  "id": "CLSA-2023-1693904973",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d56e88af-6850-40f4-a730-72ca6a329b6a",  "id": "CVE-2024-49969",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index out of bounds in DCN30 color transformation\n\nThis commit addresses a potential index out of bounds issue in the\n`cm3_helper_translate_curve_to_hw_format` function in the DCN30 color\nmanagement module. The issue could occur when the index 'i' exceeds the\nnumber of transfer function points (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure 'i' is within bounds before accessing the\ntransfer function points. If 'i' is out of bounds, the function returns\nfalse to indicate an error.\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:180 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:181 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:182 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "94c133b3-d4e8-4a6e-a06c-d6af1c5e8a65",  "id": "CVE-2022-49733",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC\n\nThere is a small race window at snd_pcm_oss_sync() that is called from\nOSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls\nsnd_pcm_oss_make_ready() at first, then takes the params_lock mutex\nfor the rest.  When the stream is set up again by another thread\nbetween them, it leads to inconsistency, and may result in unexpected\nresults such as NULL dereference of OSS buffer as a fuzzer spotted\nrecently.\n\nThe fix is simply to cover snd_pcm_oss_make_ready() call into the same\nparams_lock mutex with snd_pcm_oss_make_ready_locked() variant.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7cadbc71-1ec7-4238-84f6-d990a16336ce",  "id": "CVE-2019-19252",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19252"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af77a.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b09a07d-b690-4627-9eae-e0a33047f857",  "id": "CVE-2023-1095",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1095"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ec6de9c-6440-4177-8aeb-43174a17f549",  "id": "ROOT-OS-ALPINE-324-CVE-2026-14456",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0f6e0329-390f-4462-bd0e-e7e789e054b3",  "id": "CVE-2020-36766",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36766"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with a hole in the struct.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ea44720a-61de-4f34-82ba-4a1cfd32a40a",  "id": "DTSA-136-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a87fafd5-e360-4088-bcd0-33145d6db0a9",  "id": "CVE-2022-49478",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init\n\nSyzbot reported that -1 is used as array index. The problem was in\nmissing validation check.\n\nhdw->unit_number is initialized with -1 and then if init table walk fails\nthis value remains unchanged. Since code blindly uses this member for\narray indexing adding sanity check is the easiest fix for that.\n\nhdw->workpoll initialization moved upper to prevent warning in\n__flush_work.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee52c809-242f-4670-a11a-f686c415da19",  "id": "CVE-2024-53155",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix uninitialized value in ocfs2_file_read_iter()\n\nSyzbot has reported the following KMSAN splat:\n\nBUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80\n ocfs2_file_read_iter+0x9a4/0xf80\n __io_read+0x8d4/0x20f0\n io_read+0x3e/0xf0\n io_issue_sqe+0x42b/0x22c0\n io_wq_submit_work+0xaf9/0xdc0\n io_worker_handle_work+0xd13/0x2110\n io_wq_worker+0x447/0x1410\n ret_from_fork+0x6f/0x90\n ret_from_fork_asm+0x1a/0x30\n\nUninit was created at:\n __alloc_pages_noprof+0x9a7/0xe00\n alloc_pages_mpol_noprof+0x299/0x990\n alloc_pages_noprof+0x1bf/0x1e0\n allocate_slab+0x33a/0x1250\n ___slab_alloc+0x12ef/0x35e0\n kmem_cache_alloc_bulk_noprof+0x486/0x1330\n __io_alloc_req_refill+0x84/0x560\n io_submit_sqes+0x172f/0x2f30\n __se_sys_io_uring_enter+0x406/0x41c0\n __x64_sys_io_uring_enter+0x11f/0x1a0\n x64_sys_call+0x2b54/0x3ba0\n do_syscall_64+0xcd/0x1e0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nSince an instance of 'struct kiocb' may be passed from the block layer\nwith 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()'\nand use it from where 'ocfs2_dio_end_io()' might take care, i.e. in\n'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d5ea596-2982-4a2a-b3b0-c7efe1cd82e3",  "id": "OESA-2026-2435",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e33a6b84-c2f2-40ce-97d3-092b7171c75e",  "id": "CVE-2020-29661",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29661"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416,    667  ],  "analysis": {    "state": "in_triage"  },  "description": "A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:160681/Linux-TIOCSPGRP-Broken-Locking.html'"    }  ]},{  "bom-ref": "205003a4-bf9c-400a-b298-31d400c39dc8",  "id": "CVE-2026-46259",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nprocfs: fix missing RCU protection when reading real_parent in do_task_stat()\n\nWhen reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent\nwithout proper RCU protection, which leads to:\n\n  cpu 0                               cpu 1\n  -----                               -----\n  do_task_stat\n    var = task->real_parent\n                                      release_task\n                                        call_rcu(delayed_put_task_struct)\n    task_tgid_nr_ns(var)\n      rcu_read_lock   <--- Too late to protect task->real_parent!\n      task_pid_ptr    <--- UAF!\n      rcu_read_unlock\n\nThis patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add\nproper RCU protection for accessing task->real_parent.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "73bca8ce-d111-4bf0-ab15-d39ad1bc2358",  "id": "CLSA-2026-1778583971",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7b04899a-5375-4dc4-aa97-85934d5a8008",  "id": "CVE-2021-4095",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4095"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVM_XEN_HVM_SET_ATTR ioctl. This flaw affects Linux kernel versions prior to 5.17-rc1.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4c642416-4bda-4568-81a9-cc07e3481065",  "id": "CVE-2017-18551",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18551"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "948aa24c-a53e-40c3-937c-1a385fd99079",  "id": "CVE-2026-31675",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_netem: fix out-of-bounds access in packet corruption\n\nIn netem_enqueue(), the packet corruption logic uses\nget_random_u32_below(skb_headlen(skb)) to select an index for\nmodifying skb->data. When an AF_PACKET TX_RING sends fully non-linear\npackets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.\n\nPassing 0 to get_random_u32_below() takes the variable-ceil slow path\nwhich returns an unconstrained 32-bit random integer. Using this\nunconstrained value as an offset into skb->data results in an\nout-of-bounds memory access.\n\nFix this by verifying skb_headlen(skb) is non-zero before attempting\nto corrupt the linear data area. Fully non-linear packets will silently\nbypass the corruption logic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4b3f6120-67ec-4e87-a201-bf924d8d4b6a",  "id": "CVE-2026-43088",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: af_key: zero aligned sockaddr tail in PF_KEY exports\n\nPF_KEY export paths use `pfkey_sockaddr_size()` when reserving sockaddr\npayload space, so IPv6 addresses occupy 32 bytes on the wire. However,\n`pfkey_sockaddr_fill()` initializes only the first 28 bytes of\n`struct sockaddr_in6`, leaving the final 4 aligned bytes uninitialized.\n\nNot every PF_KEY message is affected. The state and policy dump builders\nalready zero the whole message buffer before filling the sockaddr\npayloads. Keep the fix to the export paths that still append aligned\nsockaddr payloads with plain `skb_put()`:\n\n  - `SADB_ACQUIRE`\n  - `SADB_X_NAT_T_NEW_MAPPING`\n  - `SADB_X_MIGRATE`\n\nFix those paths by clearing only the aligned sockaddr tail after\n`pfkey_sockaddr_fill()`.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84a0e6f8-b455-40d4-bb4c-141906140cac",  "id": "CVE-2023-39198",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39198"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "88889277-9bfb-42d8-93d6-5923f900dfac",  "id": "OESA-2026-1879",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4cdbdefd-d508-4715-b0dc-3515f1eeb1fa",  "id": "CVE-2020-25669",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25669"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd being freed. Though the dangling pointer is set to NULL in sunkbd_disconnect, there is still an alias in sunkbd_reinit causing Use After Free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc80e11f-9fa7-4949-8668-71afc33471f1",  "id": "CVE-2023-2002",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2002"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    250,    863  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'SNYK:SNYK-UNMANAGED-TORVALDSLINUX-5507220'"    }  ]},{  "bom-ref": "53247d73-dd45-4116-9453-5880b7439b79",  "id": "CVE-2022-50400",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: greybus: audio_helper: remove unused and wrong debugfs usage\n\nIn the greybus audio_helper code, the debugfs file for the dapm has the\npotential to be removed and memory will be leaked.  There is also the\nvery real potential for this code to remove ALL debugfs entries from the\nsystem, and it seems like this is what will really happen if this code\never runs.  This all is very wrong as the greybus audio driver did not\ncreate this debugfs file, the sound core did and controls the lifespan\nof it.\n\nSo remove all of the debugfs logic from the audio_helper code as there's\nno way it could be correct.  If this really is needed, it can come back\nwith a fixup for the incorrect usage of the debugfs_lookup() call which\nis what caused this to be noticed at all.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "42b1e04e-6af4-460e-8fad-6d5d37dde83f",  "id": "CVE-2026-43050",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: lec: fix use-after-free in sock_def_readable()\n\nA race condition exists between lec_atm_close() setting priv->lecd\nto NULL and concurrent access to priv->lecd in send_to_lecd(),\nlec_handle_bridge(), and lec_atm_send(). When the socket is freed\nvia RCU while another thread is still using it, a use-after-free\noccurs in sock_def_readable() when accessing the socket's wait queue.\n\nThe root cause is that lec_atm_close() clears priv->lecd without\nany synchronization, while callers dereference priv->lecd without\nany protection against concurrent teardown.\n\nFix this by converting priv->lecd to an RCU-protected pointer:\n- Mark priv->lecd as __rcu in lec.h\n- Use rcu_assign_pointer() in lec_atm_close() and lecd_attach()\n  for safe pointer assignment\n- Use rcu_access_pointer() for NULL checks that do not dereference\n  the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and\n  lecd_attach()\n- Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(),\n  lec_handle_bridge() and lec_atm_send() to safely access lecd\n- Use rcu_assign_pointer() followed by synchronize_rcu() in\n  lec_atm_close() to ensure all readers have completed before\n  proceeding. This is safe since lec_atm_close() is called from\n  vcc_release() which holds lock_sock(), a sleeping lock.\n- Remove the manual sk_receive_queue drain from lec_atm_close()\n  since vcc_destroy_socket() already drains it after lec_atm_close()\n  returns.\n\nv2: Switch from spinlock + sock_hold/put approach to RCU to properly\n    fix the race. The v1 spinlock approach had two issues pointed out\n    by Eric Dumazet:\n    1. priv->lecd was still accessed directly after releasing the\n       lock instead of using a local copy.\n    2. The spinlock did not prevent packets being queued after\n       lec_atm_close() drains sk_receive_queue since timer and\n       workqueue paths bypass netif_stop_queue().\n\nNote: Syzbot patch testing was attempted but the test VM terminated\n    unexpectedly with \"Connection to localhost closed by remote host\",\n    likely due to a QEMU AHCI emulation issue unrelated to this fix.\n    Compile testing with \"make W=1 net/atm/lec.o\" passes cleanly.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cc4c47e9-1501-460e-89f9-f3bfd80963c5",  "id": "CVE-2012-2137",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2137"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an incorrect check by the setup_routing_entry function before invoking the kvm_set_irq function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c0a1840e-8a1b-4cc1-a644-c422071f0d98",  "id": "CVE-2025-38177",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    459  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_hfsc: make hfsc_qlen_notify() idempotent\n\nhfsc_qlen_notify() is not idempotent either and not friendly\nto its callers, like fq_codel_dequeue(). Let's make it idempotent\nto ease qdisc_tree_reduce_backlog() callers' life:\n\n1. update_vf() decreases cl->cl_nactive, so we can check whether it is\nnon-zero before calling it.\n\n2. eltree_remove() always removes RB node cl->el_node, but we can use\n   RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ea5abe3-e1a5-452e-9885-491d790837f4",  "id": "CVE-2022-41850",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41850"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f6b3a54a-ed3f-42fd-aa04-0b4ecc13d2b5",  "id": "CVE-2025-21922",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: Fix KMSAN uninit-value warning with bpf\n\nSyzbot caught an \"KMSAN: uninit-value\" warning [1], which is caused by the\nppp driver not initializing a 2-byte header when using socket filter.\n\nThe following code can generate a PPP filter BPF program:\n'''\nstruct bpf_program fp;\npcap_t *handle;\nhandle = pcap_open_dead(DLT_PPP_PPPD, 65535);\npcap_compile(handle, &fp, \"ip and outbound\", 0, 0);\nbpf_dump(&fp, 1);\n'''\nIts output is:\n'''\n(000) ldh [2]\n(001) jeq #0x21 jt 2 jf 5\n(002) ldb [0]\n(003) jeq #0x1 jt 4 jf 5\n(004) ret #65535\n(005) ret #0\n'''\nWen can find similar code at the following link:\nhttps://github.com/ppp-project/ppp/blob/master/pppd/options.c#L1680\nThe maintainer of this code repository is also the original maintainer\nof the ppp driver.\n\nAs you can see the BPF program skips 2 bytes of data and then reads the\n'Protocol' field to determine if it's an IP packet. Then it read the first\nbyte of the first 2 bytes to determine the direction.\n\nThe issue is that only the first byte indicating direction is initialized\nin current ppp driver code while the second byte is not initialized.\n\nFor normal BPF programs generated by libpcap, uninitialized data won't be\nused, so it's not a problem. However, for carefully crafted BPF programs,\nsuch as those generated by syzkaller [2], which start reading from offset\n0, the uninitialized data will be used and caught by KMSAN.\n\n[1] https://syzkaller.appspot.com/bug?extid=853242d9c9917165d791\n[2] https://syzkaller.appspot.com/text?tag=ReproC&x=11994913980000",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3e27b889-6628-4ee5-9a0f-397fef546ff3",  "id": "CVE-2023-52642",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    862  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rc: bpf attach/detach requires write permission\n\nNote that bpf attach/detach also requires CAP_NET_ADMIN.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "254dc20e-785b-4d20-82cd-553db07f5c65",  "id": "CVE-2017-11473",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11473"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 3.2 allows local users to gain privileges via a crafted ACPI table.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "adc81c61-a585-4971-ab23-0e2e75abb2e1",  "id": "CVE-2017-13077",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13077"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    330  ],  "analysis": {    "state": "in_triage"  },  "description": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "50b3950b-937e-4b09-97ce-c072c144f5f2",  "id": "CVE-2015-6937",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6937"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The __rds_conn_create function in net/rds/connection.c in the Linux kernel through 4.2.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9263ddb2-b0cd-43f0-bc30-2e9ec5f85180",  "id": "CVE-2024-53194",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix use-after-free of slot->bus on hot remove\n\nDennis reports a boot crash on recent Lenovo laptops with a USB4 dock.\n\nSince commit 0fc70886569c (\"thunderbolt: Reset USB4 v2 host router\") and\ncommit 59a54c5f3dbd (\"thunderbolt: Reset topology created by the boot\nfirmware\"), USB4 v2 and v1 Host Routers are reset on probe of the\nthunderbolt driver.\n\nThe reset clears the Presence Detect State and Data Link Layer Link Active\nbits at the USB4 Host Router's Root Port and thus causes hot removal of the\ndock.\n\nThe crash occurs when pciehp is unbound from one of the dock's Downstream\nPorts:  pciehp creates a pci_slot on bind and destroys it on unbind.  The\npci_slot contains a pointer to the pci_bus below the Downstream Port, but\na reference on that pci_bus is never acquired.  The pci_bus is destroyed\nbefore the pci_slot, so a use-after-free ensues when pci_slot_release()\naccesses slot->bus.\n\nIn principle this should not happen because pci_stop_bus_device() unbinds\npciehp (and therefore destroys the pci_slot) before the pci_bus is\ndestroyed by pci_remove_bus_device().\n\nHowever the stacktrace provided by Dennis shows that pciehp is unbound from\npci_remove_bus_device() instead of pci_stop_bus_device().  To understand\nthe significance of this, one needs to know that the PCI core uses a two\nstep process to remove a portion of the hierarchy:  It first unbinds all\ndrivers in the sub-hierarchy in pci_stop_bus_device() and then actually\nremoves the devices in pci_remove_bus_device().  There is no precaution to\nprevent driver binding in-between pci_stop_bus_device() and\npci_remove_bus_device().\n\nIn Dennis' case, it seems removal of the hierarchy by pciehp races with\ndriver binding by pci_bus_add_devices().  pciehp is bound to the\nDownstream Port after pci_stop_bus_device() has run, so it is unbound by\npci_remove_bus_device() instead of pci_stop_bus_device().  Because the\npci_bus has already been destroyed at that point, accesses to it result in\na use-after-free.\n\nOne might conclude that driver binding needs to be prevented after\npci_stop_bus_device() has run.  However it seems risky that pci_slot points\nto pci_bus without holding a reference.  Solely relying on correct ordering\nof driver unbind versus pci_bus destruction is certainly not defensive\nprogramming.\n\nIf pci_slot has a need to access data in pci_bus, it ought to acquire a\nreference.  Amend pci_create_slot() accordingly.  Dennis reports that the\ncrash is not reproducible with this change.\n\nAbridged stacktrace:\n\n  pcieport 0000:00:07.0: PME: Signaling with IRQ 156\n  pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+\n  pci_bus 0000:20: dev 00, created physical slot 12\n  pcieport 0000:00:07.0: pciehp: Slot(12): Card not present\n  ...\n  pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0\n  Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1\n  RIP: 0010:dev_driver_string+0x12/0x40\n  pci_destroy_slot\n  pciehp_remove\n  pcie_port_remove_service\n  device_release_driver_internal\n  bus_remove_device\n  device_del\n  device_unregister\n  remove_iter\n  device_for_each_child\n  pcie_portdrv_remove\n  pci_device_remove\n  device_release_driver_internal\n  bus_remove_device\n  device_del\n  pci_remove_bus_device (recursive invocation)\n  pci_remove_bus_device\n  pciehp_unconfigure_device\n  pciehp_disable_slot\n  pciehp_handle_presence_or_link_change\n  pciehp_ist",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bebe6d20-4766-4aea-a121-e8ee1e2dc226",  "id": "CVE-2018-13099",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13099"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/f2fs/inline.c in the Linux kernel through 4.4. A denial of service (out-of-bounds memory access and BUG) can occur for a modified f2fs filesystem image in which an inline inode contains an invalid reserved blkaddr.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d8479513-8c93-44d5-9f24-dc584d5e299f",  "id": "CVE-2024-49934",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name\n\nIt's observed that a crash occurs during hot-remove a memory device,\nin which user is accessing the hugetlb. See calltrace as following:\n\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 14045 at arch/x86/mm/fault.c:1278 do_user_addr_fault+0x2a0/0x790\nModules linked in: kmem device_dax cxl_mem cxl_pmem cxl_port cxl_pci dax_hmem dax_pmem nd_pmem cxl_acpi nd_btt cxl_core crc32c_intel nvme virtiofs fuse nvme_core nfit libnvdimm dm_multipath scsi_dh_rdac scsi_dh_emc s\nmirror dm_region_hash dm_log dm_mod\nCPU: 1 PID: 14045 Comm: daxctl Not tainted 6.10.0-rc2-lizhijian+ #492\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nRIP: 0010:do_user_addr_fault+0x2a0/0x790\nCode: 48 8b 00 a8 04 0f 84 b5 fe ff ff e9 1c ff ff ff 4c 89 e9 4c 89 e2 be 01 00 00 00 bf 02 00 00 00 e8 b5 ef 24 00 e9 42 fe ff ff <0f> 0b 48 83 c4 08 4c 89 ea 48 89 ee 4c 89 e7 5b 5d 41 5c 41 5d 41\nRSP: 0000:ffffc90000a575f0 EFLAGS: 00010046\nRAX: ffff88800c303600 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000001000 RSI: ffffffff82504162 RDI: ffffffff824b2c36\nRBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffffc90000a57658\nR13: 0000000000001000 R14: ffff88800bc2e040 R15: 0000000000000000\nFS:  00007f51cb57d880(0000) GS:ffff88807fd00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000001000 CR3: 00000000072e2004 CR4: 00000000001706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n ? __warn+0x8d/0x190\n ? do_user_addr_fault+0x2a0/0x790\n ? report_bug+0x1c3/0x1d0\n ? handle_bug+0x3c/0x70\n ? exc_invalid_op+0x14/0x70\n ? asm_exc_invalid_op+0x16/0x20\n ? do_user_addr_fault+0x2a0/0x790\n ? exc_page_fault+0x31/0x200\n exc_page_fault+0x68/0x200\n<...snip...>\nBUG: unable to handle page fault for address: 0000000000001000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0\n Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n ---[ end trace 0000000000000000 ]---\n BUG: unable to handle page fault for address: 0000000000001000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 800000000ad92067 P4D 800000000ad92067 PUD 7677067 PMD 0\n Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n CPU: 1 PID: 14045 Comm: daxctl Kdump: loaded Tainted: G        W          6.10.0-rc2-lizhijian+ #492\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n RIP: 0010:dentry_name+0x1f4/0x440\n<...snip...>\n? dentry_name+0x2fa/0x440\nvsnprintf+0x1f3/0x4f0\nvprintk_store+0x23a/0x540\nvprintk_emit+0x6d/0x330\n_printk+0x58/0x80\ndump_mapping+0x10b/0x1a0\n? __pfx_free_object_rcu+0x10/0x10\n__dump_page+0x26b/0x3e0\n? vprintk_emit+0xe0/0x330\n? _printk+0x58/0x80\n? dump_page+0x17/0x50\ndump_page+0x17/0x50\ndo_migrate_range+0x2f7/0x7f0\n? do_migrate_range+0x42/0x7f0\n? offline_pages+0x2f4/0x8c0\noffline_pages+0x60a/0x8c0\nmemory_subsys_offline+0x9f/0x1c0\n? lockdep_hardirqs_on+0x77/0x100\n? _raw_spin_unlock_irqrestore+0x38/0x60\ndevice_offline+0xe3/0x110\nstate_store+0x6e/0xc0\nkernfs_fop_write_iter+0x143/0x200\nvfs_write+0x39f/0x560\nksys_write+0x65/0xf0\ndo_syscall_64+0x62/0x130\n\nPreviously, some sanity check have been done in dump_mapping() before\nthe print facility parsing '%pd' though, it's still possible to run into\nan invalid dentry.d_name.name.\n\nSince dump_mapping() only needs to dump the filename only, retrieve it\nby itself in a safer way to prevent an unnecessary crash.\n\nNote that either retrieving the filename with '%pd' or\nstrncpy_from_kernel_nofault(), the filename could be unreliable.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2af4d613-76c0-4e12-9657-93c4a0fe6824",  "id": "CVE-2015-1593",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1593"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "622694ed-9e71-4b9c-8e74-cd4db08a9a3e",  "id": "CVE-2024-38596",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix data races in unix_release_sock/unix_stream_sendmsg\n\nA data-race condition has been identified in af_unix. In one data path,\nthe write function unix_release_sock() atomically writes to\nsk->sk_shutdown using WRITE_ONCE. However, on the reader side,\nunix_stream_sendmsg() does not read it atomically. Consequently, this\nissue is causing the following KCSAN splat to occur:\n\n\tBUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg\n\n\twrite (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28:\n\tunix_release_sock (net/unix/af_unix.c:640)\n\tunix_release (net/unix/af_unix.c:1050)\n\tsock_close (net/socket.c:659 net/socket.c:1421)\n\t__fput (fs/file_table.c:422)\n\t__fput_sync (fs/file_table.c:508)\n\t__se_sys_close (fs/open.c:1559 fs/open.c:1541)\n\t__x64_sys_close (fs/open.c:1541)\n\tx64_sys_call (arch/x86/entry/syscall_64.c:33)\n\tdo_syscall_64 (arch/x86/entry/common.c:?)\n\tentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\n\tread to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14:\n\tunix_stream_sendmsg (net/unix/af_unix.c:2273)\n\t__sock_sendmsg (net/socket.c:730 net/socket.c:745)\n\t____sys_sendmsg (net/socket.c:2584)\n\t__sys_sendmmsg (net/socket.c:2638 net/socket.c:2724)\n\t__x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750)\n\tx64_sys_call (arch/x86/entry/syscall_64.c:33)\n\tdo_syscall_64 (arch/x86/entry/common.c:?)\n\tentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\n\tvalue changed: 0x01 -> 0x03\n\nThe line numbers are related to commit dd5a440a31fa (\"Linux 6.9-rc7\").\n\nCommit e1d09c2c2f57 (\"af_unix: Fix data races around sk->sk_shutdown.\")\naddressed a comparable issue in the past regarding sk->sk_shutdown.\nHowever, it overlooked resolving this particular data path.\nThis patch only offending unix_stream_sendmsg() function, since the\nother reads seem to be protected by unix_state_lock() as discussed in",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "570b6ce8-850c-46f0-9e90-e1273f062a81",  "id": "CVE-2021-47321",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47321"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: Fix possible use-after-free by calling del_timer_sync()\n\nThis driver's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6e18579d-14cb-4ba3-afab-1b302475d321",  "id": "CVE-2020-36322",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36322"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    459  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the FUSE filesystem implementation in the Linux kernel before 5.10.6, aka CID-5d069dbe8aaf. fuse_do_getattr() calls make_bad_inode() in inappropriate situations, causing a system crash. NOTE: the original fix for this vulnerability was incomplete, and its incompleteness is tracked as CVE-2021-28950.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cc5e1432-dbb8-4aec-b6a7-39f910c61e2c",  "id": "CVE-2014-3690",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3690"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae7944b4-2c17-4aa3-b375-81d2b7676b2a",  "id": "CVE-2026-53131",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.4,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: require Ethernet MAC header before using eth_hdr()\n\n`ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and\n`hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`\nafter either assuming that the skb is associated with an Ethernet\ndevice or checking only that the `ETH_HLEN` bytes at\n`skb_mac_header(skb)` lie between `skb->head` and `skb->data`.\n\nMake these paths first verify that the skb is associated with an\nEthernet device, that the MAC header was set, and that it spans at\nleast a full Ethernet header before accessing `eth_hdr(skb)`.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "da4ffc6a-8020-4906-bdc2-6f0135835c49",  "id": "OESA-2024-1721",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cde8525d-ac35-4d0c-bcde-353392cb05aa",  "id": "CVE-2022-49308",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nextcon: Modify extcon device to be created after driver data is set\n\nCurrently, someone can invoke the sysfs such as state_show()\nintermittently before dev_set_drvdata() is done.\nAnd it can be a cause of kernel Oops because of edev is Null at that time.\nSo modified the driver registration to after setting drviver data.\n\n- Oops's backtrace.\n\nBacktrace:\n[<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show)\n[<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show)\n[<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)\n[<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read)\n[<c025e11c>] (seq_read) from [<c02c50a0>] (kernfs_fop_read)\n[<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read)\n[<c0231c5c>] (__vfs_read) from [<c0231ee0>] (vfs_read)\n[<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read)\n[<c02323f0>] (ksys_read) from [<c02324fc>] (sys_read)\n[<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b59fadf0-e08e-4a1a-b14e-6268d0ae34ae",  "id": "CVE-2025-21846",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nacct: perform last write from workqueue\n\nIn [1] it was reported that the acct(2) system call can be used to\ntrigger NULL deref in cases where it is set to write to a file that\ntriggers an internal lookup. This can e.g., happen when pointing acc(2)\nto /sys/power/resume. At the point the where the write to this file\nhappens the calling task has already exited and called exit_fs(). A\nlookup will thus trigger a NULL-deref when accessing current->fs.\n\nReorganize the code so that the the final write happens from the\nworkqueue but with the caller's credentials. This preserves the\n(strange) permission model and has almost no regression risk.\n\nThis api should stop to exist though.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "81ddf165-e1ad-4f4b-bb74-92741f84200a",  "id": "CVE-2024-50073",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: Fix use-after-free in gsm_cleanup_mux\n\nBUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0\ndrivers/tty/n_gsm.c:3160 [n_gsm]\nRead of size 8 at addr ffff88815fe99c00 by task poc/3379\nCPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56\nHardware name: VMware, Inc. VMware Virtual Platform/440BX\nDesktop Reference Platform, BIOS 6.00 11/12/2020\nCall Trace:\n <TASK>\n gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]\n __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm]\n __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389\n update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500\n __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846\n __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161\n gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]\n _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107\n __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm]\n ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195\n ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79\n __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338\n __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805\n tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818\n\nAllocated by task 65:\n gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm]\n gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm]\n gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm]\n gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm]\n tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391\n tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39\n flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445\n process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229\n worker_thread+0x3dc/0x950 kernel/workqueue.c:3391\n kthread+0x2a3/0x370 kernel/kthread.c:389\n ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257\n\nFreed by task 3367:\n kfree+0x126/0x420 mm/slub.c:4580\n gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm]\n gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm]\n tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818\n\n[Analysis]\ngsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux\ncan be freed by multi threads through ioctl,which leads\nto the occurrence of uaf. Protect it by gsm tx lock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f434612-e176-47b3-83e9-4c5ecf1b711b",  "id": "CVE-2012-0207",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0207"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "The igmp_heard_query function in net/ipv4/igmp.c in the Linux kernel before 3.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and panic) via IGMP packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:18378'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:108765/Linux-IGMP-Remote-Denial-Of-Service.html'"    }  ]},{  "bom-ref": "fde08cba-ef99-46c6-a165-f4074e5b532b",  "id": "CVE-2019-25160",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25160"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlabel: fix out-of-bounds memory accesses\n\nThere are two array out-of-bounds memory accesses, one in\ncipso_v4_map_lvl_valid(), the other in netlbl_bitmap_walk().  Both\nerrors are embarassingly simple, and the fixes are straightforward.\n\nAs a FYI for anyone backporting this patch to kernels prior to v4.8,\nyou'll want to apply the netlbl_bitmap_walk() patch to\ncipso_v4_bitmap_walk() as netlbl_bitmap_walk() doesn't exist before\nLinux v4.8.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "00accdbd-b94d-4161-8d11-e2cdfdc40407",  "id": "CVE-2015-5707",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5707"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel 2.6.x through 4.x before 4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large iov_count value in a write request.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c0a516c1-6df0-41e4-b260-f2fa302fbdeb",  "id": "CVE-2022-50358",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbrcmfmac: return error when getting invalid max_flowrings from dongle\n\nWhen firmware hit trap at initialization, host will read abnormal\nmax_flowrings number from dongle, and it will cause kernel panic when\ndoing iowrite to initialize dongle ring.\nTo detect this error at early stage, we directly return error when getting\ninvalid max_flowrings(>256).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f329ac8d-b69a-40f2-a9f4-5a9f27b4bfdd",  "id": "CVE-2019-12817",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12817"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel before 5.1.15 for powerpc has a bug where unrelated processes may be able to read/write to one another's virtual memory under certain conditions via an mmap above 512 TB. Only a subset of powerpc systems are affected.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c7a01916-97bb-4e3e-8983-adcfba6f4c66",  "id": "CVE-2023-33952",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33952"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to escalate privileges and execute code in the context of the kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32e772db-2741-4cfe-89a6-bf631374ca5c",  "id": "ALSA-2022:7288",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fa49a444-01a4-4830-8fbe-cf79dcdd2357",  "id": "CVE-2024-42289",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: During vport delete send async logout explicitly\n\nDuring vport delete, it is observed that during unload we hit a crash\nbecause of stale entries in outstanding command array.  For all these stale\nI/O entries, eh_abort was issued and aborted (fast_fail_io = 2009h) but\nI/Os could not complete while vport delete is in process of deleting.\n\n  BUG: kernel NULL pointer dereference, address: 000000000000001c\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\n  Workqueue: qla2xxx_wq qla_do_work [qla2xxx]\n  RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0\n  RSP: 0018:ffffa1e1e150fc68 EFLAGS: 00010046\n  RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000001\n  RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8ce208a7a0d0\n  RBP: ffff8ce208a7a0d0 R08: 0000000000000000 R09: ffff8ce378aac9c8\n  R10: ffff8ce378aac8a0 R11: ffffa1e1e150f9d8 R12: 0000000000000000\n  R13: 0000000000000000 R14: ffff8ce378aac9c8 R15: 0000000000000000\n  FS:  0000000000000000(0000) GS:ffff8d217f000000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 000000000000001c CR3: 0000002089acc000 CR4: 0000000000350ee0\n  Call Trace:\n  <TASK>\n  qla2xxx_qpair_sp_free_dma+0x417/0x4e0\n  ? qla2xxx_qpair_sp_compl+0x10d/0x1a0\n  ? qla2x00_status_entry+0x768/0x2830\n  ? newidle_balance+0x2f0/0x430\n  ? dequeue_entity+0x100/0x3c0\n  ? qla24xx_process_response_queue+0x6a1/0x19e0\n  ? __schedule+0x2d5/0x1140\n  ? qla_do_work+0x47/0x60\n  ? process_one_work+0x267/0x440\n  ? process_one_work+0x440/0x440\n  ? worker_thread+0x2d/0x3d0\n  ? process_one_work+0x440/0x440\n  ? kthread+0x156/0x180\n  ? set_kthread_struct+0x50/0x50\n  ? ret_from_fork+0x22/0x30\n  </TASK>\n\nSend out async logout explicitly for all the ports during vport delete.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aa28f099-e391-434a-98ea-515b783633b8",  "id": "CVE-2026-31407",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: add missing netlink policy validations\n\nHyunwoo Kim reports out-of-bounds access in sctp and ctnetlink.\n\nThese attributes are used by the kernel without any validation.\nExtend the netlink policies accordingly.\n\nQuoting the reporter:\n  nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE\n  value directly to ct->proto.sctp.state without checking that it is\n  within the valid range. [..]\n\n  and: ... with exp->dir = 100, the access at\n  ct->master->tuplehash[100] reads 5600 bytes past the start of a\n  320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by\n  UBSAN.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0ac4a21-d537-47dc-9bae-4338e1cd5241",  "id": "CVE-2020-12655",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12655"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10. Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka CID-d0c7feaf8767.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6aff111b-1f2c-4a51-bb31-4109e6c6cc81",  "id": "CVE-2019-12615",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12615"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup_const of node_info->vdev_port.name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "15a2d31a-aa5f-477a-922e-d7f43e99d402",  "id": "CVE-2023-53506",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Do not bother merging very long extents\n\nWhen merging very long extents we try to push as much length as possible\nto the first extent. However this is unnecessarily complicated and not\nreally worth the trouble. Furthermore there was a bug in the logic\nresulting in corrupting extents in the file as syzbot reproducer shows.\nSo just don't bother with the merging of extents that are too long\ntogether.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b12fb16-1046-40c1-9f8a-439cda732387",  "id": "CLSA-2022-1643727489",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "527d5ddd-6845-4dc5-9686-0eddacc4830e",  "id": "CVE-2024-27419",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetrom: Fix data-races around sysctl_net_busy_read\n\nWe need to protect the reader reading the sysctl value because the\nvalue can be changed concurrently.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f5743337-ae8a-4b36-a94f-06243aede8a5",  "id": "CVE-2017-2596",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2596"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    772  ],  "analysis": {    "state": "in_triage"  },  "description": "The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly emulates the VMXON instruction, which allows KVM L1 guest OS users to cause a denial of service (host OS memory consumption) by leveraging the mishandling of page references.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "13d117b1-92ec-4deb-bf33-6e6d06165084",  "id": "CVE-2022-4543",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4543"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200,    203  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw named \"EntryBleed\" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch side-channels based on TLB timing for Intel systems.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "131383c9-6ae8-4bdb-8872-9c372ad65f1b",  "id": "openSUSE-SU-2026:21192-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d01747ed-39d2-4990-aee9-4f5ca68435cc",  "id": "MGASA-2025-0069",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2b8550a9-6223-4eb1-b9e0-0452be5e25f7",  "id": "CVE-2024-50243",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Fix general protection fault in run_is_mapped_full\n\nFixed deleating of a non-resident attribute in ntfs_create_inode()\nrollback.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84824f36-318c-4082-91ee-495f1998bab2",  "id": "CVE-2024-46715",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver: iio: add missing checks on iio_info's callback access\n\nSome callbacks from iio_info structure are accessed without any check, so\nif a driver doesn't implement them trying to access the corresponding\nsysfs entries produce a kernel oops such as:\n\n[ 2203.527791] Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute\n[...]\n[ 2203.783416] Call trace:\n[ 2203.783429]  iio_read_channel_info_avail from dev_attr_show+0x18/0x48\n[ 2203.789807]  dev_attr_show from sysfs_kf_seq_show+0x90/0x120\n[ 2203.794181]  sysfs_kf_seq_show from seq_read_iter+0xd0/0x4e4\n[ 2203.798555]  seq_read_iter from vfs_read+0x238/0x2a0\n[ 2203.802236]  vfs_read from ksys_read+0xa4/0xd4\n[ 2203.805385]  ksys_read from ret_fast_syscall+0x0/0x54\n[ 2203.809135] Exception stack(0xe0badfa8 to 0xe0badff0)\n[ 2203.812880] dfa0:                   00000003 b6f10f80 00000003 b6eab000 00020000 00000000\n[ 2203.819746] dfc0: 00000003 b6f10f80 7ff00000 00000003 00000003 00000000 00020000 00000000\n[ 2203.826619] dfe0: b6e1bc88 bed80958 b6e1bc94 b6e1bcb0\n[ 2203.830363] Code: bad PC value\n[ 2203.832695] ---[ end trace 0000000000000000 ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b0edd492-a1f8-4538-9af2-543585e3064f",  "id": "CVE-2021-47632",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47632"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/set_memory: Avoid spinlock recursion in change_page_attr()\n\nCommit 1f9ad21c3b38 (\"powerpc/mm: Implement set_memory() routines\")\nincluded a spin_lock() to change_page_attr() in order to\nsafely perform the three step operations. But then\ncommit 9f7853d7609d (\"powerpc/mm: Fix set_memory_*() against\nconcurrent accesses\") modify it to use pte_update() and do\nthe operation safely against concurrent access.\n\nIn the meantime, Maxime reported some spinlock recursion.\n\n[   15.351649] BUG: spinlock recursion on CPU#0, kworker/0:2/217\n[   15.357540]  lock: init_mm+0x3c/0x420, .magic: dead4ead, .owner: kworker/0:2/217, .owner_cpu: 0\n[   15.366563] CPU: 0 PID: 217 Comm: kworker/0:2 Not tainted 5.15.0+ #523\n[   15.373350] Workqueue: events do_free_init\n[   15.377615] Call Trace:\n[   15.380232] [e4105ac0] [800946a4] do_raw_spin_lock+0xf8/0x120 (unreliable)\n[   15.387340] [e4105ae0] [8001f4ec] change_page_attr+0x40/0x1d4\n[   15.393413] [e4105b10] [801424e0] __apply_to_page_range+0x164/0x310\n[   15.400009] [e4105b60] [80169620] free_pcp_prepare+0x1e4/0x4a0\n[   15.406045] [e4105ba0] [8016c5a0] free_unref_page+0x40/0x2b8\n[   15.411979] [e4105be0] [8018724c] kasan_depopulate_vmalloc_pte+0x6c/0x94\n[   15.418989] [e4105c00] [801424e0] __apply_to_page_range+0x164/0x310\n[   15.425451] [e4105c50] [80187834] kasan_release_vmalloc+0xbc/0x134\n[   15.431898] [e4105c70] [8015f7a8] __purge_vmap_area_lazy+0x4e4/0xdd8\n[   15.438560] [e4105d30] [80160d10] _vm_unmap_aliases.part.0+0x17c/0x24c\n[   15.445283] [e4105d60] [801642d0] __vunmap+0x2f0/0x5c8\n[   15.450684] [e4105db0] [800e32d0] do_free_init+0x68/0x94\n[   15.456181] [e4105dd0] [8005d094] process_one_work+0x4bc/0x7b8\n[   15.462283] [e4105e90] [8005d614] worker_thread+0x284/0x6e8\n[   15.468227] [e4105f00] [8006aaec] kthread+0x1f0/0x210\n[   15.473489] [e4105f40] [80017148] ret_from_kernel_thread+0x14/0x1c\n\nRemove the read / modify / write sequence to make the operation atomic\nand remove the spin_lock() in change_page_attr().\n\nTo do the operation atomically, we can't use pte modification helpers\nanymore. Because all platforms have different combination of bits, it\nis not easy to use those bits directly. But all have the\n_PAGE_KERNEL_{RO/ROX/RW/RWX} set of flags. All we need it to compare\ntwo sets to know which bits are set or cleared.\n\nFor instance, by comparing _PAGE_KERNEL_ROX and _PAGE_KERNEL_RO you\nknow which bit gets cleared and which bit get set when changing exec\npermission.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "40381f13-bd2e-413d-a58a-541a5620a049",  "id": "CVE-2023-53569",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next2: Check block size validity during mount\n\nCheck that log of block size stored in the superblock has sensible\nvalue. Otherwise the shift computing the block size can overflow leading\nto undefined behavior.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5cb1003c-a741-4962-a2ed-6f915420f533",  "id": "CVE-2011-1495",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1495"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5b2cab45-370e-4424-b572-b72ae9c8fe4c",  "id": "CVE-2025-37749",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.199999999999999,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ppp: Add bound checking for skb data on ppp_sync_txmung\n\nEnsure we have enough data in linear buffer from skb before accessing\ninitial bytes. This prevents potential out-of-bounds accesses\nwhen processing short packets.\n\nWhen ppp_sync_txmung receives an incoming package with an empty\npayload:\n(remote) gef➤  p *(struct pppoe_hdr *) (skb->head + skb->network_header)\n$18 = {\n\ttype = 0x1,\n\tver = 0x1,\n\tcode = 0x0,\n\tsid = 0x2,\n        length = 0x0,\n\ttag = 0xffff8880371cdb96\n}\n\nfrom the skb struct (trimmed)\n      tail = 0x16,\n      end = 0x140,\n      head = 0xffff88803346f400 \"4\",\n      data = 0xffff88803346f416 \":\\377\",\n      truesize = 0x380,\n      len = 0x0,\n      data_len = 0x0,\n      mac_len = 0xe,\n      hdr_len = 0x0,\n\nit is not safe to access data[2].\n\n[pabeni@redhat.com: fixed subj typo]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e1557d3-d748-481a-9116-383da1bd104f",  "id": "CVE-2024-26726",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't drop extent_map for free space inode on write error\n\nWhile running the CI for an unrelated change I hit the following panic\nwith generic/648 on btrfs_holes_spacecache.\n\nassertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385\n------------[ cut here ]------------\nkernel BUG at fs/btrfs/extent_io.c:1385!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G        W          6.8.0-rc2+ #1\nRIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0\nCall Trace:\n <TASK>\n extent_write_cache_pages+0x2ac/0x8f0\n extent_writepages+0x87/0x110\n do_writepages+0xd5/0x1f0\n filemap_fdatawrite_wbc+0x63/0x90\n __filemap_fdatawrite_range+0x5c/0x80\n btrfs_fdatawrite_range+0x1f/0x50\n btrfs_write_out_cache+0x507/0x560\n btrfs_write_dirty_block_groups+0x32a/0x420\n commit_cowonly_roots+0x21b/0x290\n btrfs_commit_transaction+0x813/0x1360\n btrfs_sync_file+0x51a/0x640\n __x64_sys_fdatasync+0x52/0x90\n do_syscall_64+0x9c/0x190\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nThis happens because we fail to write out the free space cache in one\ninstance, come back around and attempt to write it again.  However on\nthe second pass through we go to call btrfs_get_extent() on the inode to\nget the extent mapping.  Because this is a new block group, and with the\nfree space inode we always search the commit root to avoid deadlocking\nwith the tree, we find nothing and return a EXTENT_MAP_HOLE for the\nrequested range.\n\nThis happens because the first time we try to write the space cache out\nwe hit an error, and on an error we drop the extent mapping.  This is\nnormal for normal files, but the free space cache inode is special.  We\nalways expect the extent map to be correct.  Thus the second time\nthrough we end up with a bogus extent map.\n\nSince we're deprecating this feature, the most straightforward way to\nfix this is to simply skip dropping the extent map range for this failed\nrange.\n\nI shortened the test by using error injection to stress the area to make\nit easier to reproduce.  With this patch in place we no longer panic\nwith my error injection test.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e858fa94-5074-4981-ba5f-3f33faacb115",  "id": "CVE-2024-35925",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: prevent division by zero in blk_rq_stat_sum()\n\nThe expression dst->nr_samples + src->nr_samples may\nhave zero value on overflow. It is necessary to add\na check to avoid division by zero.\n\nFound by Linux Verification Center (linuxtesting.org) with Svace.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7cf4ca57-95bf-4e3f-99bf-c9be83caa146",  "id": "CVE-2025-37802",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix WARNING \"do not call blocking ops when !TASK_RUNNING\"\n\nwait_event_timeout() will set the state of the current\ntask to TASK_UNINTERRUPTIBLE, before doing the condition check. This\nmeans that ksmbd_durable_scavenger_alive() will try to acquire the mutex\nwhile already in a sleeping state. The scheduler warns us by giving\nthe following warning:\n\ndo not call blocking ops when !TASK_RUNNING; state=2 set at\n [<0000000061515a6f>] prepare_to_wait_event+0x9f/0x6c0\nWARNING: CPU: 2 PID: 4147 at kernel/sched/core.c:10099 __might_sleep+0x12f/0x160\n\nmutex lock is not needed in ksmbd_durable_scavenger_alive().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17c69752-5454-4612-9473-eed3f4d0d400",  "id": "CVE-2024-46731",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: fix the Out-of-bounds read warning\n\nusing index i - 1U may beyond element index\nfor mc_data[] when i = 0.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b97ec15f-8b12-4bd0-b324-3113dcb12de4",  "id": "CVE-2024-35870",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix UAF in smb2_reconnect_server()\n\nThe UAF bug is due to smb2_reconnect_server() accessing a session that\nis already being teared down by another thread that is executing\n__cifs_put_smb_ses().  This can happen when (a) the client has\nconnection to the server but no session or (b) another thread ends up\nsetting @ses->ses_status again to something different than\nSES_EXITING.\n\nTo fix this, we need to make sure to unconditionally set\n@ses->ses_status to SES_EXITING and prevent any other threads from\nsetting a new status while we're still tearing it down.\n\nThe following can be reproduced by adding some delay to right after\nthe ipc is freed in __cifs_put_smb_ses() - which will give\nsmb2_reconnect_server() worker a chance to run and then accessing\n@ses->ipc:\n\nkinit ...\nmount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10\n[disconnect srv]\nls /mnt/1 &>/dev/null\nsleep 30\nkdestroy\n[reconnect srv]\nsleep 10\numount /mnt/1\n...\nCIFS: VFS: Verify user has a krb5 ticket and keyutils is installed\nCIFS: VFS: \\\\srv Send error in SessSetup = -126\nCIFS: VFS: Verify user has a krb5 ticket and keyutils is installed\nCIFS: VFS: \\\\srv Send error in SessSetup = -126\ngeneral protection fault, probably for non-canonical address\n0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39\n04/01/2014\nWorkqueue: cifsiod smb2_reconnect_server [cifs]\nRIP: 0010:__list_del_entry_valid_or_report+0x33/0xf0\nCode: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad\nde 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75\n7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8\nRSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83\nRAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b\nRDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800\nRBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000\nR13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000\nFS: 0000000000000000(0000) GS:ffff888157c00000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n <TASK>\n ? die_addr+0x36/0x90\n ? exc_general_protection+0x1c1/0x3f0\n ? asm_exc_general_protection+0x26/0x30\n ? __list_del_entry_valid_or_report+0x33/0xf0\n __cifs_put_smb_ses+0x1ae/0x500 [cifs]\n smb2_reconnect_server+0x4ed/0x710 [cifs]\n process_one_work+0x205/0x6b0\n worker_thread+0x191/0x360\n ? __pfx_worker_thread+0x10/0x10\n kthread+0xe2/0x110\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x34/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "30db7f4d-1e82-4e46-8847-53d088622891",  "id": "CVE-2025-39782",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: prevent softlockup in jbd2_log_do_checkpoint()\n\nBoth jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list()\nperiodically release j_list_lock after processing a batch of buffers to\navoid long hold times on the j_list_lock. However, since both functions\ncontend for j_list_lock, the combined time spent waiting and processing\ncan be significant.\n\njbd2_journal_shrink_checkpoint_list() explicitly calls cond_resched() when\nneed_resched() is true to avoid softlockups during prolonged operations.\nBut jbd2_log_do_checkpoint() only exits its loop when need_resched() is\ntrue, relying on potentially sleeping functions like __flush_batch() or\nwait_on_buffer() to trigger rescheduling. If those functions do not sleep,\nthe kernel may hit a softlockup.\n\nwatchdog: BUG: soft lockup - CPU#3 stuck for 156s! [kworker/u129:2:373]\nCPU: 3 PID: 373 Comm: kworker/u129:2 Kdump: loaded Not tainted 6.6.0+ #10\nHardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.27 06/13/2017\nWorkqueue: writeback wb_workfn (flush-7:2)\npstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : native_queued_spin_lock_slowpath+0x358/0x418\nlr : jbd2_log_do_checkpoint+0x31c/0x438 [jbd2]\nCall trace:\n native_queued_spin_lock_slowpath+0x358/0x418\n jbd2_log_do_checkpoint+0x31c/0x438 [jbd2]\n __jbd2_log_wait_for_space+0xfc/0x2f8 [jbd2]\n add_transaction_credits+0x3bc/0x418 [jbd2]\n start_this_handle+0xf8/0x560 [jbd2]\n jbd2__journal_start+0x118/0x228 [jbd2]\n __ext4_journal_start_sb+0x110/0x188 [ext4]\n ext4_do_writepages+0x3dc/0x740 [ext4]\n ext4_writepages+0xa4/0x190 [ext4]\n do_writepages+0x94/0x228\n __writeback_single_inode+0x48/0x318\n writeback_sb_inodes+0x204/0x590\n __writeback_inodes_wb+0x54/0xf8\n wb_writeback+0x2cc/0x3d8\n wb_do_writeback+0x2e0/0x2f8\n wb_workfn+0x80/0x2a8\n process_one_work+0x178/0x3e8\n worker_thread+0x234/0x3b8\n kthread+0xf0/0x108\n ret_from_fork+0x10/0x20\n\nSo explicitly call cond_resched() in jbd2_log_do_checkpoint() to avoid\nsoftlockup.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "601af9b2-3607-482b-8817-6bc3d3118931",  "id": "CVE-2013-2234",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2234"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a538241-d492-40d1-b080-26c1f52087a4",  "id": "CVE-2015-5697",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5697"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eedd02e5-6b3f-41d7-8993-47f8a5065f4e",  "id": "CVE-2019-19922",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19922"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b6688420-11da-4d7f-8131-e2cd0c1d8450",  "id": "CVE-2021-23133",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23133"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network service privileges to escalate to root or from the context of an unprivileged user directly if a BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b18b8381-0739-46d6-911e-8cf22b2f0a07",  "id": "AZL-86757",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a8c4b111-6d01-4621-9ac7-a23523afb135",  "id": "CVE-2023-46813",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46813"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b79b6af5-b846-4ce6-8f19-967b01384706",  "id": "SUSE-SU-2019:2413-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "61dbaaa7-c0b0-4ddc-9322-138b1a9a8f0b",  "id": "CVE-2013-1929",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1929"  },  "ratings": [    {      "score": 4.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital Product Data (VPD) data structure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "36257429-2c54-4820-8799-6097c31668fe",  "id": "CVE-2022-50409",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory\n\nFixes the below NULL pointer dereference:\n\n  [...]\n  [   14.471200] Call Trace:\n  [   14.471562]  <TASK>\n  [   14.471882]  lock_acquire+0x245/0x2e0\n  [   14.472416]  ? remove_wait_queue+0x12/0x50\n  [   14.473014]  ? _raw_spin_lock_irqsave+0x17/0x50\n  [   14.473681]  _raw_spin_lock_irqsave+0x3d/0x50\n  [   14.474318]  ? remove_wait_queue+0x12/0x50\n  [   14.474907]  remove_wait_queue+0x12/0x50\n  [   14.475480]  sk_stream_wait_memory+0x20d/0x340\n  [   14.476127]  ? do_wait_intr_irq+0x80/0x80\n  [   14.476704]  do_tcp_sendpages+0x287/0x600\n  [   14.477283]  tcp_bpf_push+0xab/0x260\n  [   14.477817]  tcp_bpf_sendmsg_redir+0x297/0x500\n  [   14.478461]  ? __local_bh_enable_ip+0x77/0xe0\n  [   14.479096]  tcp_bpf_send_verdict+0x105/0x470\n  [   14.479729]  tcp_bpf_sendmsg+0x318/0x4f0\n  [   14.480311]  sock_sendmsg+0x2d/0x40\n  [   14.480822]  ____sys_sendmsg+0x1b4/0x1c0\n  [   14.481390]  ? copy_msghdr_from_user+0x62/0x80\n  [   14.482048]  ___sys_sendmsg+0x78/0xb0\n  [   14.482580]  ? vmf_insert_pfn_prot+0x91/0x150\n  [   14.483215]  ? __do_fault+0x2a/0x1a0\n  [   14.483738]  ? do_fault+0x15e/0x5d0\n  [   14.484246]  ? __handle_mm_fault+0x56b/0x1040\n  [   14.484874]  ? lock_is_held_type+0xdf/0x130\n  [   14.485474]  ? find_held_lock+0x2d/0x90\n  [   14.486046]  ? __sys_sendmsg+0x41/0x70\n  [   14.486587]  __sys_sendmsg+0x41/0x70\n  [   14.487105]  ? intel_pmu_drain_pebs_core+0x350/0x350\n  [   14.487822]  do_syscall_64+0x34/0x80\n  [   14.488345]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n  [...]\n\nThe test scenario has the following flow:\n\nthread1                               thread2\n-----------                           ---------------\n tcp_bpf_sendmsg\n  tcp_bpf_send_verdict\n   tcp_bpf_sendmsg_redir              sock_close\n    tcp_bpf_push_locked                 __sock_release\n     tcp_bpf_push                         //inet_release\n      do_tcp_sendpages                    sock->ops->release\n       sk_stream_wait_memory          \t   // tcp_close\n          sk_wait_event                      sk->sk_prot->close\n           release_sock(__sk);\n            ***\n                                                lock_sock(sk);\n                                                  __tcp_close\n                                                    sock_orphan(sk)\n                                                      sk->sk_wq  = NULL\n                                                release_sock\n            ****\n           lock_sock(__sk);\n          remove_wait_queue(sk_sleep(sk), &wait);\n             sk_sleep(sk)\n             //NULL pointer dereference\n             &rcu_dereference_raw(sk->sk_wq)->wait\n\nWhile waiting for memory in thread1, the socket is released with its wait\nqueue because thread2 has closed it. This caused by tcp_bpf_send_verdict\ndidn't increase the f_count of psock->sk_redir->sk_socket->file in thread1.\n\nWe should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory\nbefore accessing the wait queue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "27fd12c4-6d94-419d-b4b4-c33f770f0d8a",  "id": "CVE-2021-47391",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47391"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests\n\nThe FSM can run in a circle allowing rdma_resolve_ip() to be called twice\non the same id_priv. While this cannot happen without going through the\nwork, it violates the invariant that the same address resolution\nbackground request cannot be active twice.\n\n       CPU 1                                  CPU 2\n\nrdma_resolve_addr():\n  RDMA_CM_IDLE -> RDMA_CM_ADDR_QUERY\n  rdma_resolve_ip(addr_handler)  #1\n\n\t\t\t process_one_req(): for #1\n                          addr_handler():\n                            RDMA_CM_ADDR_QUERY -> RDMA_CM_ADDR_BOUND\n                            mutex_unlock(&id_priv->handler_mutex);\n                            [.. handler still running ..]\n\nrdma_resolve_addr():\n  RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDR_QUERY\n  rdma_resolve_ip(addr_handler)\n    !! two requests are now on the req_list\n\nrdma_destroy_id():\n destroy_id_handler_unlock():\n  _destroy_id():\n   cma_cancel_operation():\n    rdma_addr_cancel()\n\n                          // process_one_req() self removes it\n\t\t          spin_lock_bh(&lock);\n                           cancel_delayed_work(&req->work);\n\t                   if (!list_empty(&req->list)) == true\n\n      ! rdma_addr_cancel() returns after process_on_req #1 is done\n\n   kfree(id_priv)\n\n\t\t\t process_one_req(): for #2\n                          addr_handler():\n\t                    mutex_lock(&id_priv->handler_mutex);\n                            !! Use after free on id_priv\n\nrdma_addr_cancel() expects there to be one req on the list and only\ncancels the first one. The self-removal behavior of the work only happens\nafter the handler has returned. This yields a situations where the\nreq_list can have two reqs for the same \"handle\" but rdma_addr_cancel()\nonly cancels the first one.\n\nThe second req remains active beyond rdma_destroy_id() and will\nuse-after-free id_priv once it inevitably triggers.\n\nFix this by remembering if the id_priv has called rdma_resolve_ip() and\nalways cancel before calling it again. This ensures the req_list never\ngets more than one item in it and doesn't cost anything in the normal flow\nthat never uses this strange error path.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9f3cbefb-e0ac-4b75-8a3b-79d58f2792ad",  "id": "CVE-2019-19059",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19059"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering iwl_pcie_init_fw_sec() or dma_alloc_coherent() failures, aka CID-0f4f199443fa.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8ec8b218-7b94-49af-804d-c5a1c685e02e",  "id": "CVE-2022-49072",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: Restrict usage of GPIO chip irq members before initialization\n\nGPIO chip irq members are exposed before they could be completely\ninitialized and this leads to race conditions.\n\nOne such issue was observed for the gc->irq.domain variable which\nwas accessed through the I2C interface in gpiochip_to_irq() before\nit could be initialized by gpiochip_add_irqchip(). This resulted in\nKernel NULL pointer dereference.\n\nFollowing are the logs for reference :-\n\nkernel: Call Trace:\nkernel:  gpiod_to_irq+0x53/0x70\nkernel:  acpi_dev_gpio_irq_get_by+0x113/0x1f0\nkernel:  i2c_acpi_get_irq+0xc0/0xd0\nkernel:  i2c_device_probe+0x28a/0x2a0\nkernel:  really_probe+0xf2/0x460\nkernel: RIP: 0010:gpiochip_to_irq+0x47/0xc0\n\nTo avoid such scenarios, restrict usage of GPIO chip irq members before\nthey are completely initialized.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5db6453b-3aba-48f9-adcf-c1d2a33232c5",  "id": "CVE-2024-38635",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoundwire: cadence: fix invalid PDI offset\n\nFor some reason, we add an offset to the PDI, presumably to skip the\nPDI0 and PDI1 which are reserved for BPT.\n\nThis code is however completely wrong and leads to an out-of-bounds\naccess. We were just lucky so far since we used only a couple of PDIs\nand remained within the PDI array bounds.\n\nA Fixes: tag is not provided since there are no known platforms where\nthe out-of-bounds would be accessed, and the initial code had problems\nas well.\n\nA follow-up patch completely removes this useless offset.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "577fa43c-6733-423f-990e-823511043694",  "id": "CVE-2025-21796",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: clear acl_access/acl_default after releasing them\n\nIf getting acl_default fails, acl_access and acl_default will be released\nsimultaneously. However, acl_access will still retain a pointer pointing\nto the released posix_acl, which will trigger a WARNING in\nnfs3svc_release_getacl like this:\n\n------------[ cut here ]------------\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 26 PID: 3199 at lib/refcount.c:28\nrefcount_warn_saturate+0xb5/0x170\nModules linked in:\nCPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted\n6.12.0-rc6-00079-g04ae226af01f-dirty #8\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nRIP: 0010:refcount_warn_saturate+0xb5/0x170\nCode: cc cc 0f b6 1d b3 20 a5 03 80 fb 01 0f 87 65 48 d8 00 83 e3 01 75\ne4 48 c7 c7 c0 3b 9b 85 c6 05 97 20 a5 03 01 e8 fb 3e 30 ff <0f> 0b eb\ncd 0f b6 1d 8a3\nRSP: 0018:ffffc90008637cd8 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff83904fde\nRDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88871ed36380\nRBP: ffff888158beeb40 R08: 0000000000000001 R09: fffff520010c6f56\nR10: ffffc90008637ab7 R11: 0000000000000001 R12: 0000000000000001\nR13: ffff888140e77400 R14: ffff888140e77408 R15: ffffffff858b42c0\nFS:  0000000000000000(0000) GS:ffff88871ed00000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000562384d32158 CR3: 000000055cc6a000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n ? refcount_warn_saturate+0xb5/0x170\n ? __warn+0xa5/0x140\n ? refcount_warn_saturate+0xb5/0x170\n ? report_bug+0x1b1/0x1e0\n ? handle_bug+0x53/0xa0\n ? exc_invalid_op+0x17/0x40\n ? asm_exc_invalid_op+0x1a/0x20\n ? tick_nohz_tick_stopped+0x1e/0x40\n ? refcount_warn_saturate+0xb5/0x170\n ? refcount_warn_saturate+0xb5/0x170\n nfs3svc_release_getacl+0xc9/0xe0\n svc_process_common+0x5db/0xb60\n ? __pfx_svc_process_common+0x10/0x10\n ? __rcu_read_unlock+0x69/0xa0\n ? __pfx_nfsd_dispatch+0x10/0x10\n ? svc_xprt_received+0xa1/0x120\n ? xdr_init_decode+0x11d/0x190\n svc_process+0x2a7/0x330\n svc_handle_xprt+0x69d/0x940\n svc_recv+0x180/0x2d0\n nfsd+0x168/0x200\n ? __pfx_nfsd+0x10/0x10\n kthread+0x1a2/0x1e0\n ? kthread+0xf4/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x34/0x60\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n </TASK>\nKernel panic - not syncing: kernel: panic_on_warn set ...\n\nClear acl_access/acl_default after posix_acl_release is called to prevent\nUAF from being triggered.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bb5968c3-2001-491d-b8d6-b5941a9ff27d",  "id": "CVE-2024-56591",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: Use disable_delayed_work_sync\n\nThis makes use of disable_delayed_work_sync instead\ncancel_delayed_work_sync as it not only cancel the ongoing work but also\ndisables new submit which is disarable since the object holding the work\nis about to be freed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d621242b-3ca1-49d0-ae78-05f17709a3e3",  "id": "CVE-2024-26689",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: prevent use-after-free in encode_cap_msg()\n\nIn fs/ceph/caps.c, in encode_cap_msg(), \"use after free\" error was\ncaught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This\nimplies before the refcount could be increment here, it was freed.\n\nIn same file, in \"handle_cap_grant()\" refcount is decremented by this\nline - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race\noccurred and resource was freed by the latter line before the former\nline could increment it.\n\nencode_cap_msg() is called by __send_cap() and __send_cap() is called by\nceph_check_caps() after calling __prep_cap(). __prep_cap() is where\narg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where\nthe refcount must be increased to prevent \"use after free\" error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "42953d78-523b-4db8-9eca-92ca6ac2f90b",  "id": "CVE-2025-38709",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nloop: Avoid updating block size under exclusive owner\n\nSyzbot came up with a reproducer where a loop device block size is\nchanged underneath a mounted filesystem. This causes a mismatch between\nthe block device block size and the block size stored in the superblock\ncausing confusion in various places such as fs/buffer.c. The particular\nissue triggered by syzbot was a warning in __getblk_slow() due to\nrequested buffer size not matching block device block size.\n\nFix the problem by getting exclusive hold of the loop device to change\nits block size. This fails if somebody (such as filesystem) has already\nan exclusive ownership of the block device and thus prevents modifying\nthe loop device under some exclusive owner which doesn't expect it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8326bbb4-97c8-4cee-82a5-ee50da0dbb62",  "id": "CVE-2014-4171",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4171"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "14080083-fc16-4c37-a252-f84d27b20aa5",  "id": "CVE-2025-39743",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: truncate good inode pages when hard link is 0\n\nThe fileset value of the inode copy from the disk by the reproducer is\nAGGR_RESERVED_I. When executing evict, its hard link number is 0, so its\ninode pages are not truncated. This causes the bugon to be triggered when\nexecuting clear_inode() because nrpages is greater than 0.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0edf7469-c97f-4e79-9310-e0d269c36f62",  "id": "CVE-2024-46720",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix dereference after null check\n\ncheck the pointer hive before use.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bb9ebe88-e84b-45bb-989c-cd58a743d045",  "id": "CVE-2022-50023",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: dw-axi-dmac: ignore interrupt if no descriptor\n\nIf the channel has no descriptor and the interrupt is raised then the\nkernel will OOPS. Check the result of vchan_next_desc() in the handler\naxi_chan_block_xfer_complete() to avoid the error happening.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2eb259d5-2a5b-45c0-8093-26b96aa18fae",  "id": "CVE-2016-10907",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10907"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "65899ca5-ecf5-4ac2-9401-27807551c71d",  "id": "CVE-2022-49294",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check if modulo is 0 before dividing.\n\n[How & Why]\nIf a value of 0 is read, then this will cause a divide-by-0 panic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "720db7b9-ca4a-4821-9086-5cfa02962e99",  "id": "CVE-2014-0206",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0206"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8065e569-e26f-4fcd-b8ff-c53d11a5a315",  "id": "CVE-2026-43363",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/apic: Disable x2apic on resume if the kernel expects so\n\nWhen resuming from s2ram, firmware may re-enable x2apic mode, which may have\nbeen disabled by the kernel during boot either because it doesn't support IRQ\nremapping or for other reasons. This causes the kernel to continue using the\nxapic interface, while the hardware is in x2apic mode, which causes hangs.\nThis happens on defconfig + bare metal + s2ram.\n\nFix this in lapic_resume() by disabling x2apic if the kernel expects it to be\ndisabled, i.e. when x2apic_mode = 0.\n\nThe ACPI v6.6 spec, Section 16.3 [1] says firmware restores either the\npre-sleep configuration or initial boot configuration for each CPU, including\nMSR state:\n\n  When executing from the power-on reset vector as a result of waking from an\n  S2 or S3 sleep state, the platform firmware performs only the hardware\n  initialization required to restore the system to either the state the\n  platform was in prior to the initial operating system boot, or to the\n  pre-sleep configuration state. In multiprocessor systems, non-boot\n  processors should be placed in the same state as prior to the initial\n  operating system boot.\n\n  (further ahead)\n\n  If this is an S2 or S3 wake, then the platform runtime firmware restores\n  minimum context of the system before jumping to the waking vector. This\n  includes:\n\n\tCPU configuration. Platform runtime firmware restores the pre-sleep\n\tconfiguration or initial boot configuration of each CPU (MSR, MTRR,\n\tfirmware update, SMBase, and so on). Interrupts must be disabled (for\n\tIA-32 processors, disabled by CLI instruction).\n\n\t(and other things)\n\nSo at least as per the spec, re-enablement of x2apic by the firmware is\nallowed if \"x2apic on\" is a part of the initial boot configuration.\n\n  [1] https://uefi.org/specs/ACPI/6.6/16_Waking_and_Sleeping.html#initialization\n\n  [ bp: Massage. ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "00f5ea95-36ad-4975-810c-54738a3b2490",  "id": "CVE-2017-17449",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17449"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d5cf4c1-8ce9-44ba-b80f-22d16c22fc3c",  "id": "CVE-2018-20976",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20976"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4738f5c5-d0c5-451d-b9bb-ffe293d01e3d",  "id": "CVE-2023-52516",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock\n\n__dma_entry_alloc_check_leak() calls into printk -> serial console\noutput (qcom geni) and grabs port->lock under free_entries_lock\nspin lock, which is a reverse locking dependency chain as qcom_geni\nIRQ handler can call into dma-debug code and grab free_entries_lock\nunder port->lock.\n\nMove __dma_entry_alloc_check_leak() call out of free_entries_lock\nscope so that we don't acquire serial console's port->lock under it.\n\nTrimmed-down lockdep splat:\n\n The existing dependency chain (in reverse order) is:\n\n               -> #2 (free_entries_lock){-.-.}-{2:2}:\n        _raw_spin_lock_irqsave+0x60/0x80\n        dma_entry_alloc+0x38/0x110\n        debug_dma_map_page+0x60/0xf8\n        dma_map_page_attrs+0x1e0/0x230\n        dma_map_single_attrs.constprop.0+0x6c/0xc8\n        geni_se_rx_dma_prep+0x40/0xcc\n        qcom_geni_serial_isr+0x310/0x510\n        __handle_irq_event_percpu+0x110/0x244\n        handle_irq_event_percpu+0x20/0x54\n        handle_irq_event+0x50/0x88\n        handle_fasteoi_irq+0xa4/0xcc\n        handle_irq_desc+0x28/0x40\n        generic_handle_domain_irq+0x24/0x30\n        gic_handle_irq+0xc4/0x148\n        do_interrupt_handler+0xa4/0xb0\n        el1_interrupt+0x34/0x64\n        el1h_64_irq_handler+0x18/0x24\n        el1h_64_irq+0x64/0x68\n        arch_local_irq_enable+0x4/0x8\n        ____do_softirq+0x18/0x24\n        ...\n\n               -> #1 (&port_lock_key){-.-.}-{2:2}:\n        _raw_spin_lock_irqsave+0x60/0x80\n        qcom_geni_serial_console_write+0x184/0x1dc\n        console_flush_all+0x344/0x454\n        console_unlock+0x94/0xf0\n        vprintk_emit+0x238/0x24c\n        vprintk_default+0x3c/0x48\n        vprintk+0xb4/0xbc\n        _printk+0x68/0x90\n        register_console+0x230/0x38c\n        uart_add_one_port+0x338/0x494\n        qcom_geni_serial_probe+0x390/0x424\n        platform_probe+0x70/0xc0\n        really_probe+0x148/0x280\n        __driver_probe_device+0xfc/0x114\n        driver_probe_device+0x44/0x100\n        __device_attach_driver+0x64/0xdc\n        bus_for_each_drv+0xb0/0xd8\n        __device_attach+0xe4/0x140\n        device_initial_probe+0x1c/0x28\n        bus_probe_device+0x44/0xb0\n        device_add+0x538/0x668\n        of_device_add+0x44/0x50\n        of_platform_device_create_pdata+0x94/0xc8\n        of_platform_bus_create+0x270/0x304\n        of_platform_populate+0xac/0xc4\n        devm_of_platform_populate+0x60/0xac\n        geni_se_probe+0x154/0x160\n        platform_probe+0x70/0xc0\n        ...\n\n               -> #0 (console_owner){-...}-{0:0}:\n        __lock_acquire+0xdf8/0x109c\n        lock_acquire+0x234/0x284\n        console_flush_all+0x330/0x454\n        console_unlock+0x94/0xf0\n        vprintk_emit+0x238/0x24c\n        vprintk_default+0x3c/0x48\n        vprintk+0xb4/0xbc\n        _printk+0x68/0x90\n        dma_entry_alloc+0xb4/0x110\n        debug_dma_map_sg+0xdc/0x2f8\n        __dma_map_sg_attrs+0xac/0xe4\n        dma_map_sgtable+0x30/0x4c\n        get_pages+0x1d4/0x1e4 [msm]\n        msm_gem_pin_pages_locked+0x38/0xac [msm]\n        msm_gem_pin_vma_locked+0x58/0x88 [msm]\n        msm_ioctl_gem_submit+0xde4/0x13ac [msm]\n        drm_ioctl_kernel+0xe0/0x15c\n        drm_ioctl+0x2e8/0x3f4\n        vfs_ioctl+0x30/0x50\n        ...\n\n Chain exists of:\n   console_owner --> &port_lock_key --> free_entries_lock\n\n  Possible unsafe locking scenario:\n\n        CPU0                    CPU1\n        ----                    ----\n   lock(free_entries_lock);\n                                lock(&port_lock_key);\n                                lock(free_entries_lock);\n   lock(console_owner);\n\n                *** DEADLOCK ***\n\n Call trace:\n  dump_backtrace+0xb4/0xf0\n  show_stack+0x20/0x30\n  dump_stack_lvl+0x60/0x84\n  dump_stack+0x18/0x24\n  print_circular_bug+0x1cc/0x234\n  check_noncircular+0x78/0xac\n  __lock_acquire+0xdf8/0x109c\n  lock_acquire+0x234/0x284\n  console_flush_all+0x330/0x454\n  consol\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7b9d35d3-282f-43ce-bfdf-3437bea69d47",  "id": "CVE-2024-49899",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Initialize denominators' default to 1\n\n[WHAT & HOW]\nVariables used as denominators and maybe not assigned to other values,\nshould not be 0. Change their default to 1 so they are never 0.\n\nThis fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45e13e8b-5e00-481a-b277-8954bb5a0000",  "id": "CVE-2024-26981",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix OOB in nilfs_set_de_type\n\nThe size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is\ndefined as \"S_IFMT >> S_SHIFT\", but the nilfs_set_de_type() function,\nwhich uses this array, specifies the index to read from the array in the\nsame way as \"(mode & S_IFMT) >> S_SHIFT\".\n\nstatic void nilfs_set_de_type(struct nilfs_dir_entry *de, struct inode\n *inode)\n{\n\tumode_t mode = inode->i_mode;\n\n\tde->file_type = nilfs_type_by_mode[(mode & S_IFMT)>>S_SHIFT]; // oob\n}\n\nHowever, when the index is determined this way, an out-of-bounds (OOB)\nerror occurs by referring to an index that is 1 larger than the array size\nwhen the condition \"mode & S_IFMT == S_IFMT\" is satisfied.  Therefore, a\npatch to resize the nilfs_type_by_mode array should be applied to prevent\nOOB errors.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "20606665-97d6-414e-a5c4-df1883be998b",  "id": "AZL-42955",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "92ff3742-b281-4220-94eb-87e73c4bf111",  "id": "CVE-2014-9728",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9728"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths, which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem image, related to fs/udf/inode.c and fs/udf/symlink.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3bcaa07f-3fd7-4afb-aa3a-f0071d14538a",  "id": "CVE-2006-3738",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-3738"  },  "ratings": [    {      "score": 10,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions has unspecified impact and remote attack vectors involving a long list of ciphers.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e360e88-9569-4645-8785-a85bad3fc14d",  "id": "OESA-2026-1411",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc27e9e5-7375-44a9-aa5a-81b244a5a6d8",  "id": "CLSA-2021-1634922862",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0b65ae9-b674-4f01-aaad-8fc1aac03869",  "id": "CVE-2024-38618",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Set lower bound of start tick time\n\nCurrently ALSA timer doesn't have the lower limit of the start tick\ntime, and it allows a very small size, e.g. 1 tick with 1ns resolution\nfor hrtimer.  Such a situation may lead to an unexpected RCU stall,\nwhere  the callback repeatedly queuing the expire update, as reported\nby fuzzer.\n\nThis patch introduces a sanity check of the timer start tick time, so\nthat the system returns an error when a too small start size is set.\nAs of this patch, the lower limit is hard-coded to 100us, which is\nsmall enough but can still work somehow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1f770e51-e6bc-4fc2-a813-896e121df3b0",  "id": "OESA-2026-2045",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2619283d-28a0-450c-8d64-8b47973966a3",  "id": "AZL-6348",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.2,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "28ebc946-99af-46ce-b2c6-1920cf84f199",  "id": "CVE-2012-2127",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2127"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/proc/root.c in the procfs implementation in the Linux kernel before 3.2 does not properly interact with CLONE_NEWPID clone system calls, which allows remote attackers to cause a denial of service (reference leak and memory consumption) by making many connections to a daemon that uses PID namespaces to isolate clients, as demonstrated by vsftpd.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b36b1ef-297a-4d00-ab3e-d2c158649236",  "id": "CVE-2022-49305",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()\n\nThere is a deadlock in ieee80211_beacons_stop(), which is shown below:\n\n   (Thread 1)              |      (Thread 2)\n                           | ieee80211_send_beacon()\nieee80211_beacons_stop()   |  mod_timer()\n spin_lock_irqsave() //(1) |  (wait a time)\n ...                       | ieee80211_send_beacon_cb()\n del_timer_sync()          |  spin_lock_irqsave() //(2)\n (wait timer to stop)      |  ...\n\nWe hold ieee->beacon_lock in position (1) of thread 1 and use\ndel_timer_sync() to wait timer to stop, but timer handler\nalso need ieee->beacon_lock in position (2) of thread 2.\nAs a result, ieee80211_beacons_stop() will block forever.\n\nThis patch extracts del_timer_sync() from the protection of\nspin_lock_irqsave(), which could let timer handler to obtain\nthe needed lock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f0ad936b-f9b8-4f93-9453-2e63de53ff44",  "id": "CVE-2013-1858",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1858"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The clone system-call implementation in the Linux kernel before 3.8.3 does not properly handle a combination of the CLONE_NEWUSER and CLONE_FS flags, which allows local users to gain privileges by calling chroot and leveraging the sharing of the / directory between a parent process and a child process.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10f30644-e63a-45f7-bb9f-ac53190ede36",  "id": "ROOT-OS-ALPINE-315-CVE-2026-7383",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fd3d255c-450d-49af-bbfa-28765e346b3e",  "id": "CVE-2024-47683",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Skip Recompute DSC Params if no Stream on Link\n\n[why]\nEncounter NULL pointer dereference uner mst + dsc setup.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\n    PGD 0 P4D 0\n    Oops: 0000 [#1] PREEMPT SMP NOPTI\n    CPU: 4 PID: 917 Comm: sway Not tainted 6.3.9-arch1-1 #1 124dc55df4f5272ccb409f39ef4872fc2b3376a2\n    Hardware name: LENOVO 20NKS01Y00/20NKS01Y00, BIOS R12ET61W(1.31 ) 07/28/2022\n    RIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper]\n    Code: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 <48> 8>\n    RSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293\n    RAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224\n    RDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280\n    RBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850\n    R10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000\n    R13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224\n    FS:  00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000) knlGS:0000000000000000\n    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n    CR2: 0000000000000008 CR3: 000000010ddc6000 CR4: 00000000003506e0\n    Call Trace:\n<TASK>\n     ? __die+0x23/0x70\n     ? page_fault_oops+0x171/0x4e0\n     ? plist_add+0xbe/0x100\n     ? exc_page_fault+0x7c/0x180\n     ? asm_exc_page_fault+0x26/0x30\n     ? drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]\n     ? drm_dp_atomic_find_time_slots+0x28/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]\n     compute_mst_dsc_configs_for_link+0x2ff/0xa40 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n     ? fill_plane_buffer_attributes+0x419/0x510 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n     compute_mst_dsc_configs_for_state+0x1e1/0x250 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n     amdgpu_dm_atomic_check+0xecd/0x1190 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n     drm_atomic_check_only+0x5c5/0xa40\n     drm_mode_atomic_ioctl+0x76e/0xbc0\n\n[how]\ndsc recompute should be skipped if no mode change detected on the new\nrequest. If detected, keep checking whether the stream is already on\ncurrent state or not.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d63f8b2b-0579-4750-baf6-b52f7d3ddc73",  "id": "OESA-2026-2781",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4ed923ed-0ddc-4138-ba8f-410215040760",  "id": "CVE-2016-2148",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2148"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d4e77bb-d97b-4e73-a368-7d54786ba604",  "id": "CVE-2018-14656",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14656"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "A missing address check in the callers of the show_opcodes() in the Linux kernel allows an attacker to dump the kernel memory at an arbitrary kernel address into the dmesg log.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c14ae202-64dc-4692-b03b-39d82afa6df8",  "id": "CVE-2021-47495",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47495"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: sanity check for maxpacket\n\nmaxpacket of 0 makes no sense and oopses as we need to divide\nby it. Give up.\n\nV2: fixed typo in log and stylistic issues",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9bef86e4-9365-484c-b58d-406722c3b62e",  "id": "CVE-2024-42265",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nprotect the fetch of ->fd[fd] in do_dup2() from mispredictions\n\nboth callers have verified that fd is not greater than ->max_fds;\nhowever, misprediction might end up with\n        tofree = fdt->fd[fd];\nbeing speculatively executed.  That's wrong for the same reasons\nwhy it's wrong in close_fd()/file_close_fd_locked(); the same\nsolution applies - array_index_nospec(fd, fdt->max_fds) could differ\nfrom fd only in case of speculative execution on mispredicted path.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f203b70f-b90b-4b19-8593-bd44e395a41a",  "id": "OESA-2021-1162",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04fb5461-5812-4d67-bf76-6c2e6575ceff",  "id": "CVE-2023-52989",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region\n\nThis patch is fix for Linux kernel v2.6.33 or later.\n\nFor request subaction to IEC 61883-1 FCP region, Linux FireWire subsystem\nhave had an issue of use-after-free. The subsystem allows multiple\nuser space listeners to the region, while data of the payload was likely\nreleased before the listeners execute read(2) to access to it for copying\nto user space.\n\nThe issue was fixed by a commit 281e20323ab7 (\"firewire: core: fix\nuse-after-free regression in FCP handler\"). The object of payload is\nduplicated in kernel space for each listener. When the listener executes\nioctl(2) with FW_CDEV_IOC_SEND_RESPONSE request, the object is going to\nbe released.\n\nHowever, it causes memory leak since the commit relies on call of\nrelease_request() in drivers/firewire/core-cdev.c. Against the\nexpectation, the function is never called due to the design of\nrelease_client_resource(). The function delegates release task\nto caller when called with non-NULL fourth argument. The implementation\nof ioctl_send_response() is the case. It should release the object\nexplicitly.\n\nThis commit fixes the bug.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bdf9cac1-5287-4b60-a653-65e416e2eeed",  "id": "CVE-2022-49412",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbfq: Avoid merging queues with different parents\n\nIt can happen that the parent of a bfqq changes between the moment we\ndecide two queues are worth to merge (and set bic->stable_merge_bfqq)\nand the moment bfq_setup_merge() is called. This can happen e.g. because\nthe process submitted IO for a different cgroup and thus bfqq got\nreparented. It can even happen that the bfqq we are merging with has\nparent cgroup that is already offline and going to be destroyed in which\ncase the merge can lead to use-after-free issues such as:\n\nBUG: KASAN: use-after-free in __bfq_deactivate_entity+0x9cb/0xa50\nRead of size 8 at addr ffff88800693c0c0 by task runc:[2:INIT]/10544\n\nCPU: 0 PID: 10544 Comm: runc:[2:INIT] Tainted: G            E     5.15.2-0.g5fb85fd-default #1 openSUSE Tumbleweed (unreleased) f1f3b891c72369aebecd2e43e4641a6358867c70\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a-rebuilt.opensuse.org 04/01/2014\nCall Trace:\n <IRQ>\n dump_stack_lvl+0x46/0x5a\n print_address_description.constprop.0+0x1f/0x140\n ? __bfq_deactivate_entity+0x9cb/0xa50\n kasan_report.cold+0x7f/0x11b\n ? __bfq_deactivate_entity+0x9cb/0xa50\n __bfq_deactivate_entity+0x9cb/0xa50\n ? update_curr+0x32f/0x5d0\n bfq_deactivate_entity+0xa0/0x1d0\n bfq_del_bfqq_busy+0x28a/0x420\n ? resched_curr+0x116/0x1d0\n ? bfq_requeue_bfqq+0x70/0x70\n ? check_preempt_wakeup+0x52b/0xbc0\n __bfq_bfqq_expire+0x1a2/0x270\n bfq_bfqq_expire+0xd16/0x2160\n ? try_to_wake_up+0x4ee/0x1260\n ? bfq_end_wr_async_queues+0xe0/0xe0\n ? _raw_write_unlock_bh+0x60/0x60\n ? _raw_spin_lock_irq+0x81/0xe0\n bfq_idle_slice_timer+0x109/0x280\n ? bfq_dispatch_request+0x4870/0x4870\n __hrtimer_run_queues+0x37d/0x700\n ? enqueue_hrtimer+0x1b0/0x1b0\n ? kvm_clock_get_cycles+0xd/0x10\n ? ktime_get_update_offsets_now+0x6f/0x280\n hrtimer_interrupt+0x2c8/0x740\n\nFix the problem by checking that the parent of the two bfqqs we are\nmerging in bfq_setup_merge() is the same.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c951e87-91fc-45ea-be85-7b2ff1a074a6",  "id": "CVE-2022-48992",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: soc-pcm: Add NULL check in BE reparenting\n\nAdd NULL check in dpcm_be_reparent API, to handle\nkernel NULL pointer dereference error.\nThe issue occurred in fuzzing test.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "92508739-8f56-47f4-9e81-eb7effc3b385",  "id": "CVE-2023-52629",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsh: push-switch: Reorder cleanup operations to avoid use-after-free bug\n\nThe original code puts flush_work() before timer_shutdown_sync()\nin switch_drv_remove(). Although we use flush_work() to stop\nthe worker, it could be rescheduled in switch_timer(). As a result,\na use-after-free bug can occur. The details are shown below:\n\n      (cpu 0)                    |      (cpu 1)\nswitch_drv_remove()              |\n flush_work()                    |\n  ...                            |  switch_timer // timer\n                                 |   schedule_work(&psw->work)\n timer_shutdown_sync()           |\n ...                             |  switch_work_handler // worker\n kfree(psw) // free              |\n                                 |   psw->state = 0 // use\n\nThis patch puts timer_shutdown_sync() before flush_work() to\nmitigate the bugs. As a result, the worker and timer will be\nstopped safely before the deallocate operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "68f213d1-e475-4a16-b663-d7dfd1df0552",  "id": "CVE-2024-43858",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: Fix array-index-out-of-bounds in diFree",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fa452685-4e0e-4a74-b05e-f295b9f6b88b",  "id": "CVE-2013-2546",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2546"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect C library function for copying strings, which allows local users to obtain sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3630b60-8e22-4474-90a5-8820c17bb13e",  "id": "CVE-2013-3228",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3228"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The irda_recvmsg_dgram function in net/irda/af_irda.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d2c80e7-c335-427b-9784-4a57fe5a7671",  "id": "CVE-2025-39800",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: abort transaction on unexpected eb generation at btrfs_copy_root()\n\nIf we find an unexpected generation for the extent buffer we are cloning\nat btrfs_copy_root(), we just WARN_ON() and don't error out and abort the\ntransaction, meaning we allow to persist metadata with an unexpected\ngeneration. Instead of warning only, abort the transaction and return\n-EUCLEAN.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "00d6ced7-dd9a-4fcc-b50f-6078f6b18cd2",  "id": "CVE-2024-50246",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Add rough attr alloc_size check",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "154c9cdb-7fa9-4a1b-b7fb-1289614c4c2f",  "id": "RLSA-2025:21255",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2ea0fe1-6968-4bd2-b94b-47ca22867fd0",  "id": "CVE-2025-22041",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in ksmbd_sessions_deregister()\n\nIn multichannel mode, UAF issue can occur in session_deregister\nwhen the second channel sets up a session through the connection of\nthe first channel. session that is freed through the global session\ntable can be accessed again through ->sessions of connection.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2118511b-ffc3-49da-8ab1-116df1e3a245",  "id": "CVE-2023-53146",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()\n\nIn dw2102_i2c_transfer, msg is controlled by user. When msg[i].buf\nis null and msg[i].len is zero, former checks on msg[i].buf would be\npassed. Malicious data finally reach dw2102_i2c_transfer. If accessing\nmsg[i].buf[0] without sanity check, null ptr deref would happen.\nWe add check on msg[i].len to prevent crash.\n\nSimilar commit:\ncommit 950e252cb469\n(\"[media] dw2102: limit messages to buffer size\")",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b4be8dc9-1de0-4714-aa03-5069a8f147b3",  "id": "CVE-2025-39684",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()\n\nsyzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`.  A kernel\nbuffer is allocated to hold `insn->n` samples (each of which is an\n`unsigned int`).  For some instruction types, `insn->n` samples are\ncopied back to user-space, unless an error code is being returned.  The\nproblem is that not all the instruction handlers that need to return\ndata to userspace fill in the whole `insn->n` samples, so that there is\nan information leak.  There is a similar syzbot report for\n`do_insnlist_ioctl()`, although it does not have a reproducer for it at\nthe time of writing.\n\nOne culprit is `insn_rw_emulate_bits()` which is used as the handler for\n`INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have\na specific handler for that instruction, but do have an `INSN_BITS`\nhandler.  For `INSN_READ` it only fills in at most 1 sample, so if\n`insn->n` is greater than 1, the remaining `insn->n - 1` samples copied\nto userspace will be uninitialized kernel data.\n\nAnother culprit is `vm80xx_ai_insn_read()` in the \"vm80xx\" driver.  It\nnever returns an error, even if it fails to fill the buffer.\n\nFix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making sure\nthat uninitialized parts of the allocated buffer are zeroed before\nhandling each instruction.\n\nThanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`.  That fix\nreplaced the call to `kmalloc_array()` with `kcalloc()`, but it is not\nalways necessary to clear the whole buffer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eb311cd0-a247-42a6-b05d-1eb649260ce5",  "id": "CVE-2022-49620",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tipc: fix possible refcount leak in tipc_sk_create()\n\nFree sk in case tipc_sk_insert() fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae1e0f92-9048-45ca-8882-ca6dafcd458f",  "id": "CVE-2013-6282",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6282"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:40975'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'MSF:put_user_vroot'"    }  ]},{  "bom-ref": "dfb6c4bf-4f82-4934-89fb-7e30ae6202b5",  "id": "DSA-2392-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "773b81f8-39a7-48d5-aa7b-d9b012d64a38",  "id": "CVE-2024-0340",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0340"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c37f8893-c72c-4df1-8d06-a92b61aa10d4",  "id": "CVE-2021-30002",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30002"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aa3f981a-9c41-4fc6-afda-b98caa95f574",  "id": "CVE-2018-1066",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1066"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allows an attacker controlling a CIFS server to kernel panic a client that has this server mounted, because an empty TargetInfo field in an NTLMSSP setup negotiation response is mishandled during session recovery.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f2eef8d0-f64c-49d8-bb2f-d0f63bd30a88",  "id": "DLA-1445-3",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "291d6f2f-bb32-45f4-88b4-cf51b4fb1557",  "id": "OESA-2026-2784",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "458d51cf-9a6a-4f88-9048-0b910b0cd589",  "id": "CVE-2023-23039",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23039"  },  "ratings": [    {      "score": 5.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b4263e44-935f-4120-90df-e7cb09aa16a7",  "id": "RLSA-2026:22312",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1f74c567-fe3f-4b26-8120-436fab8565d1",  "id": "CVE-2021-0920",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0920"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f980bd6c-e24c-4be6-9c86-e1ac8b1549d5",  "id": "CVE-2010-4169",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4169"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Use-after-free vulnerability in mm/mprotect.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors involving an mprotect system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ddded66d-586d-45f1-b66b-015cec081050",  "id": "DSA-4875-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "980082b6-e457-402b-a300-0f78626801c9",  "id": "CVE-2023-52598",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ptrace: handle setting of fpc register correctly\n\nIf the content of the floating point control (fpc) register of a traced\nprocess is modified with the ptrace interface the new value is tested for\nvalidity by temporarily loading it into the fpc register.\n\nThis may lead to corruption of the fpc register of the tracing process:\nif an interrupt happens while the value is temporarily loaded into the\nfpc register, and within interrupt context floating point or vector\nregisters are used, the current fp/vx registers are saved with\nsave_fpu_regs() assuming they belong to user space and will be loaded into\nfp/vx registers when returning to user space.\n\ntest_fp_ctl() restores the original user space fpc register value, however\nit will be discarded, when returning to user space.\n\nIn result the tracer will incorrectly continue to run with the value that\nwas supposed to be used for the traced process.\n\nFix this by saving fpu register contents with save_fpu_regs() before using\ntest_fp_ctl().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2b809857-d7a7-4fed-ac89-ca0ebebbb61e",  "id": "CVE-2013-2141",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2141"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dda646fa-0a7e-4ebc-9e64-08f17e56db44",  "id": "CVE-2024-53112",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: uncache inode which has failed entering the group\n\nSyzbot has reported the following BUG:\n\nkernel BUG at fs/ocfs2/uptodate.c:509!\n...\nCall Trace:\n <TASK>\n ? __die_body+0x5f/0xb0\n ? die+0x9e/0xc0\n ? do_trap+0x15a/0x3a0\n ? ocfs2_set_new_buffer_uptodate+0x145/0x160\n ? do_error_trap+0x1dc/0x2c0\n ? ocfs2_set_new_buffer_uptodate+0x145/0x160\n ? __pfx_do_error_trap+0x10/0x10\n ? handle_invalid_op+0x34/0x40\n ? ocfs2_set_new_buffer_uptodate+0x145/0x160\n ? exc_invalid_op+0x38/0x50\n ? asm_exc_invalid_op+0x1a/0x20\n ? ocfs2_set_new_buffer_uptodate+0x2e/0x160\n ? ocfs2_set_new_buffer_uptodate+0x144/0x160\n ? ocfs2_set_new_buffer_uptodate+0x145/0x160\n ocfs2_group_add+0x39f/0x15a0\n ? __pfx_ocfs2_group_add+0x10/0x10\n ? __pfx_lock_acquire+0x10/0x10\n ? mnt_get_write_access+0x68/0x2b0\n ? __pfx_lock_release+0x10/0x10\n ? rcu_read_lock_any_held+0xb7/0x160\n ? __pfx_rcu_read_lock_any_held+0x10/0x10\n ? smack_log+0x123/0x540\n ? mnt_get_write_access+0x68/0x2b0\n ? mnt_get_write_access+0x68/0x2b0\n ? mnt_get_write_access+0x226/0x2b0\n ocfs2_ioctl+0x65e/0x7d0\n ? __pfx_ocfs2_ioctl+0x10/0x10\n ? smack_file_ioctl+0x29e/0x3a0\n ? __pfx_smack_file_ioctl+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\n ? __pfx_ocfs2_ioctl+0x10/0x10\n __se_sys_ioctl+0xfb/0x170\n do_syscall_64+0xf3/0x230\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n </TASK>\n\nWhen 'ioctl(OCFS2_IOC_GROUP_ADD, ...)' has failed for the particular\ninode in 'ocfs2_verify_group_and_input()', corresponding buffer head\nremains cached and subsequent call to the same 'ioctl()' for the same\ninode issues the BUG() in 'ocfs2_set_new_buffer_uptodate()' (trying\nto cache the same buffer head of that inode). Fix this by uncaching\nthe buffer head with 'ocfs2_remove_from_cache()' on error path in\n'ocfs2_group_add()'.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "16998af2-3316-49ac-89c1-e2790f14e323",  "id": "CVE-2012-0957",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0957"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    16  ],  "analysis": {    "state": "in_triage"  },  "description": "The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:37937'"    }  ]},{  "bom-ref": "7551f453-5da9-49de-ba19-e763859ceb22",  "id": "CVE-2017-14106",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14106"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel before 4.12 allows local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef29ce95-ebce-42ab-8dfe-02d5b8a7f143",  "id": "CVE-2018-1095",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1095"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_acl NULL pointer dereference and system crash) via a crafted ext4 image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c44222fa-1f58-48d1-8802-76b535452ceb",  "id": "OESA-2026-2281",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "e52e445b-24d0-4150-822b-d76563b46e68",      "versions": [        {          "component": "sed",          "version": "4.0"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ec4920a-9bd0-44c4-a3c7-0fcc1668f8f9",  "id": "CVE-2024-25740",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25740"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBI_IOCATT, because kobj->name is not released.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "583b6474-644a-412b-9f42-4509f5b6d4d9",  "id": "CVE-2017-14051",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14051"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1706e763-77bd-43c5-b238-42d8eb6a46df",  "id": "CVE-2013-3235",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3235"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "net/tipc/socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure and a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1cea3950-751d-48eb-9aa3-05cf35eb36a6",  "id": "CVE-2025-37932",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsch_htb: make htb_qlen_notify() idempotent\n\nhtb_qlen_notify() always deactivates the HTB class and in fact could\ntrigger a warning if it is already deactivated. Therefore, it is not\nidempotent and not friendly to its callers, like fq_codel_dequeue().\n\nLet's make it idempotent to ease qdisc_tree_reduce_backlog() callers'\nlife.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4935af8e-cf45-4122-8100-fafb317ceb19",  "id": "CVE-2019-3701",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3701"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field. The privileged user \"root\" with CAP_NET_ADMIN can create a CAN frame modification rule that makes the data length code a higher value than the available CAN frame data size. In combination with a configured checksum calculation where the result is stored relatively to the end of the data (e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in skb_shared_info) can be rewritten which finally can cause a system crash. Because of a missing check, the CAN drivers may write arbitrary content beyond the data registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e7a7bb1a-cdb8-44ee-8a02-de5efcbe5686",  "id": "AZL-77610",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cde4d530-abe2-4802-aaae-d24c5994a36f",  "id": "CVE-2025-21765",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: use RCU protection in ip6_default_advmss()\n\nip6_default_advmss() needs rcu protection to make\nsure the net structure it reads does not disappear.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "defc9f11-b955-47fa-b15d-77c3e0c60eb9",  "id": "SUSE-SU-2021:0939-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "510c55f4-984e-49c4-8666-63b3efd55850",  "id": "CVE-2024-49957",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix null-ptr-deref when journal load failed.\n\nDuring the mounting process, if journal_reset() fails because of too short\njournal, then lead to jbd2_journal_load() fails with NULL j_sb_buffer. \nSubsequently, ocfs2_journal_shutdown() calls\njbd2_journal_flush()->jbd2_cleanup_journal_tail()->\n__jbd2_update_log_tail()->jbd2_journal_update_sb_log_tail()\n->lock_buffer(journal->j_sb_buffer), resulting in a null-pointer\ndereference error.\n\nTo resolve this issue, we should check the JBD2_LOADED flag to ensure the\njournal was properly loaded.  Additionally, use journal instead of\nosb->journal directly to simplify the code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c20773fc-45ba-422b-9dde-ec0c2efcf23f",  "id": "CVE-2019-12379",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12379"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in con_insert_unipair in drivers/tty/vt/consolemap.c in the Linux kernel through 5.1.5. There is a memory leak in a certain case of an ENOMEM outcome of kmalloc. NOTE: This id is disputed as not being an issue",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6dfc3203-8937-4cbd-9f63-24f7228220c4",  "id": "CVE-2022-49152",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nXArray: Fix xas_create_range() when multi-order entry present\n\nIf there is already an entry present that is of order >= XA_CHUNK_SHIFT\nwhen we call xas_create_range(), xas_create_range() will misinterpret\nthat entry as a node and dereference xa_node->parent, generally leading\nto a crash that looks something like this:\n\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000001:\n0000 [#1] PREEMPT SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 0 PID: 32 Comm: khugepaged Not tainted 5.17.0-rc8-syzkaller-00003-g56e337f2cf13 #0\nRIP: 0010:xa_parent_locked include/linux/xarray.h:1207 [inline]\nRIP: 0010:xas_create_range+0x2d9/0x6e0 lib/xarray.c:725\n\nIt's deterministically reproducable once you know what the problem is,\nbut producing it in a live kernel requires khugepaged to hit a race.\nWhile the problem has been present since xas_create_range() was\nintroduced, I'm not aware of a way to hit it before the page cache was\nconverted to use multi-index entries.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "703b15cb-4897-4cfb-b522-8f633862a0af",  "id": "CVE-2013-4587",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4587"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "Array index error in the kvm_vm_ioctl_create_vcpu function in virt/kvm/kvm_main.c in the KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges via a large id value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "71c2f69e-fc29-48e4-a409-c65dd874d8ba",  "id": "CVE-2022-1508",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1508"  },  "ratings": [    {      "score": 6.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds read flaw was found in the Linux kernel’s io_uring module in the way a user triggers the io_read() function with some special parameters. This flaw allows a local user to read some memory out of bounds.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8e03faa8-9402-412b-9b5b-1eac80eabd3b",  "id": "CVE-2018-6555",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6555"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The irda_setsockopt function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "34f38960-9686-4925-848e-fa74865b533a",  "id": "CVE-2024-50134",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA\n\nReplace the fake VLA at end of the vbva_mouse_pointer_shape shape with\na real VLA to fix a \"memcpy: detected field-spanning write error\" warning:\n\n[   13.319813] memcpy: detected field-spanning write (size 16896) of single field \"p->data\" at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 (size 4)\n[   13.319841] WARNING: CPU: 0 PID: 1105 at drivers/gpu/drm/vboxvideo/hgsmi_base.c:154 hgsmi_update_pointer_shape+0x192/0x1c0 [vboxvideo]\n[   13.320038] Call Trace:\n[   13.320173]  hgsmi_update_pointer_shape [vboxvideo]\n[   13.320184]  vbox_cursor_atomic_update [vboxvideo]\n\nNote as mentioned in the added comment it seems the original length\ncalculation for the allocated and send hgsmi buffer is 4 bytes too large.\nChanging this is not the goal of this patch, so this behavior is kept.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "015bfac8-0437-4016-9e5c-95f080050d2b",  "id": "CVE-2022-50286",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline\n\nWhen converting files with inline data to extents, delayed allocations\nmade on a file system created with both the bigalloc and inline options\ncan result in invalid extent status cache content, incorrect reserved\ncluster counts, kernel memory leaks, and potential kernel panics.\n\nWith bigalloc, the code that determines whether a block must be\ndelayed allocated searches the extent tree to see if that block maps\nto a previously allocated cluster.  If not, the block is delayed\nallocated, and otherwise, it isn't.  However, if the inline option is\nalso used, and if the file containing the block is marked as able to\nstore data inline, there isn't a valid extent tree associated with\nthe file.  The current code in ext4_clu_mapped() calls\next4_find_extent() to search the non-existent tree for a previously\nallocated cluster anyway, which typically finds nothing, as desired.\nHowever, a side effect of the search can be to cache invalid content\nfrom the non-existent tree (garbage) in the extent status tree,\nincluding bogus entries in the pending reservation tree.\n\nTo fix this, avoid searching the extent tree when allocating blocks\nfor bigalloc + inline files that are being converted from inline to\nextent mapped.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "abd10aa3-3e7d-41fd-b82f-5fdd43a8c911",  "id": "CVE-2022-0330",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0330"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    281  ],  "analysis": {    "state": "in_triage"  },  "description": "A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c52957eb-614d-42ad-9812-4ce1f994a005",  "id": "CVE-2022-49839",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_transport_sas: Fix error handling in sas_phy_add()\n\nIf transport_add_device() fails in sas_phy_add(), the kernel will crash\ntrying to delete the device in transport_remove_device() called from\nsas_remove_host().\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000108\nCPU: 61 PID: 42829 Comm: rmmod Kdump: loaded Tainted: G        W          6.1.0-rc1+ #173\npstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : device_del+0x54/0x3d0\nlr : device_del+0x37c/0x3d0\nCall trace:\n device_del+0x54/0x3d0\n attribute_container_class_device_del+0x28/0x38\n transport_remove_classdev+0x6c/0x80\n attribute_container_device_trigger+0x108/0x110\n transport_remove_device+0x28/0x38\n sas_phy_delete+0x30/0x60 [scsi_transport_sas]\n do_sas_phy_delete+0x6c/0x80 [scsi_transport_sas]\n device_for_each_child+0x68/0xb0\n sas_remove_children+0x40/0x50 [scsi_transport_sas]\n sas_remove_host+0x20/0x38 [scsi_transport_sas]\n hisi_sas_remove+0x40/0x68 [hisi_sas_main]\n hisi_sas_v2_remove+0x20/0x30 [hisi_sas_v2_hw]\n platform_remove+0x2c/0x60\n\nFix this by checking and handling return value of transport_add_device()\nin sas_phy_add().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2b8a76f2-26b8-497d-b094-e45284ceeebd",  "id": "MGASA-2019-0106",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d133458-57e6-4ce5-8492-e021a2d1a346",  "id": "AZL-34575",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e4300338-1967-4603-b59d-07fefeefab59",  "id": "CVE-2026-64252",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: DEC: Prevent initial console buffer from landing in XKPHYS\n\nIn 64-bit configurations calling the initial console output handler from\na kernel thread other than the initial one will result in a situation\nwhere the stack has been placed in the XKPHYS 64-bit memory segment and\nconsequently so has been the buffer allocated there that is used as the\nargument corresponding to the `%s' output conversion specifier for the\nfirmware's printf() entry point.\n\nThis 64-bit address will then be truncated by 32-bit firmware, resulting\nin an attempt to access the wrong memory location, which in turn will\ncause all kinds of unpredictable behaviour, such as a kernel crash:\n\n  Console: colour dummy device 160x64\n  Calibrating delay loop... 49.36 BogoMIPS (lpj=192512)\n  pid_max: default: 32768 minimum: 301\n  CPU 0 Unable to handle kernel paging request at virtual address 000000000203bd00, epc == ffffffffbfc08364, ra == ffffffffbfc08800\n  Oops[#1]:\n  CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0-rc2-00254-gfb649bda6f56-dirty #121\n  $ 0   : 0000000000000000 0000000000000001 0000000000000023 ffffffff80684ba0\n  $ 4   : 000000000203bd00 ffffffffbfc0f3b4 ffffffffffffffff 0000000000000073\n  $ 8   : 0a303d7469000000 0000000000000000 0000000000000073 ffffffffbfc0f473\n  $12   : 0000000000000002 0000000000000000 ffffffff80684c1c 0000000000000000\n  $16   : 0000000000000000 ffffffff80596dc9 0000000000000000 ffffffffbfc09240\n  $20   : ffffffff80684c40 ffffffffbfc0f400 000000000000002d 000000000000002b\n  $24   : ffffffffffffffbf 000000000203bd00\n  $28   : ffffffff805f0000 ffffffff80684b58 0000000000000030 ffffffffbfc08800\n  Hi    : 0000000000000000\n  Lo    : 0000000000000aa8\n  epc   : ffffffffbfc08364 0xffffffffbfc08364\n  ra    : ffffffffbfc08800 0xffffffffbfc08800\n  Status: 140120e2        KX SX UX KERNEL EXL\n  Cause : 00000008 (ExcCode 02)\n  BadVA : 000000000203bd00\n  PrId  : 00000430 (R4000SC)\n  Modules linked in:\n  Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____), tls=0000000000000000)\n  Stack : 0000000000000000 0000000000000000 0000000000000000 0000004d0000004d\n          80684cc0806a2a40 80596dc80000004d 8061000000000000 bfc0850c80684c38\n          0000000000000000 000000000203bd00 0000000000000000 0000000000000000\n          0000000000000000 00000000bfc0f3b4 0000000000000000 0000000000000000\n          0000000000000000 0000000000000000 0000000000000000 0000000000000000\n          0000000000000000 0000000000000000 0000000000000000 0000000000000000\n          0000002500000000 0000000000000000 0000000000000000 802c1a7400000000\n          0203bd0080596dc8 0203bd4d69000000 6c61632000000018 5f746567646e6172\n          6c616320625f6d6f 5f736e5f6d6f7266 206361323778302b 303d74696e726320\n          806a0a38806b0000 806a0a38806b0000 00000000806b0000 80683c58806b0000\n          ...\n  Call Trace:\n\n  Code: a082ffff  03e00008  00601021 <80820000> 00001821  10400005  24840001  80820000  24630001\n\n  ---[ end trace 0000000000000000 ]---\n  Kernel panic - not syncing: Fatal exception in interrupt\n\n  KN04 V2.1k    (PC: 0xa0026768, SP: 0x806848e8)\n  >>\n\nIn this case the pointer in $4 was truncated from 0x980000000203bd00 to\n0x000000000203bd00.\n\nThis may happen when no final console driver has been enabled in the\nconfiguration and consequently the initial console continues being used\nlate into bootstrap or with an upcoming change that will switch the zs\ndriver to use a platform device, which in turn will make the console\nhandover happen only after other kernel threads have already been\nstarted.\n\nFix the issue by making the buffer static and initdata, and therefore\nplaced in the CKSEG0 32-bit compatibility segment, observing that the\nconsole output handler is called with the console lock held, implying\nno need for this code to be reentrant.  Add an assertion to verify the\nbuffer actually has been placed in a compatibility segment.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a59ee8e-7fb7-4ff8-a756-22b3b5919a65",  "id": "CVE-2017-6214",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6214"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fd73c9e4-fe52-45c9-a8b9-800776f3e7d8",  "id": "CVE-2022-3113",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3113"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b125242-0e49-4d4a-a12d-294b5606a0e6",  "id": "CVE-2021-47275",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47275"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: avoid oversized read request in cache missing code path\n\nIn the cache missing code path of cached device, if a proper location\nfrom the internal B+ tree is matched for a cache miss range, function\ncached_dev_cache_miss() will be called in cache_lookup_fn() in the\nfollowing code block,\n[code block 1]\n  526         unsigned int sectors = KEY_INODE(k) == s->iop.inode\n  527                 ? min_t(uint64_t, INT_MAX,\n  528                         KEY_START(k) - bio->bi_iter.bi_sector)\n  529                 : INT_MAX;\n  530         int ret = s->d->cache_miss(b, s, bio, sectors);\n\nHere s->d->cache_miss() is the call backfunction pointer initialized as\ncached_dev_cache_miss(), the last parameter 'sectors' is an important\nhint to calculate the size of read request to backing device of the\nmissing cache data.\n\nCurrent calculation in above code block may generate oversized value of\n'sectors', which consequently may trigger 2 different potential kernel\npanics by BUG() or BUG_ON() as listed below,\n\n1) BUG_ON() inside bch_btree_insert_key(),\n[code block 2]\n   886         BUG_ON(b->ops->is_extents && !KEY_SIZE(k));\n2) BUG() inside biovec_slab(),\n[code block 3]\n   51         default:\n   52                 BUG();\n   53                 return NULL;\n\nAll the above panics are original from cached_dev_cache_miss() by the\noversized parameter 'sectors'.\n\nInside cached_dev_cache_miss(), parameter 'sectors' is used to calculate\nthe size of data read from backing device for the cache missing. This\nsize is stored in s->insert_bio_sectors by the following lines of code,\n[code block 4]\n  909    s->insert_bio_sectors = min(sectors, bio_sectors(bio) + reada);\n\nThen the actual key inserting to the internal B+ tree is generated and\nstored in s->iop.replace_key by the following lines of code,\n[code block 5]\n  911   s->iop.replace_key = KEY(s->iop.inode,\n  912                    bio->bi_iter.bi_sector + s->insert_bio_sectors,\n  913                    s->insert_bio_sectors);\nThe oversized parameter 'sectors' may trigger panic 1) by BUG_ON() from\nthe above code block.\n\nAnd the bio sending to backing device for the missing data is allocated\nwith hint from s->insert_bio_sectors by the following lines of code,\n[code block 6]\n  926    cache_bio = bio_alloc_bioset(GFP_NOWAIT,\n  927                 DIV_ROUND_UP(s->insert_bio_sectors, PAGE_SECTORS),\n  928                 &dc->disk.bio_split);\nThe oversized parameter 'sectors' may trigger panic 2) by BUG() from the\nagove code block.\n\nNow let me explain how the panics happen with the oversized 'sectors'.\nIn code block 5, replace_key is generated by macro KEY(). From the\ndefinition of macro KEY(),\n[code block 7]\n  71 #define KEY(inode, offset, size)                                  \\\n  72 ((struct bkey) {                                                  \\\n  73      .high = (1ULL << 63) | ((__u64) (size) << 20) | (inode),     \\\n  74      .low = (offset)                                              \\\n  75 })\n\nHere 'size' is 16bits width embedded in 64bits member 'high' of struct\nbkey. But in code block 1, if \"KEY_START(k) - bio->bi_iter.bi_sector\" is\nvery probably to be larger than (1<<16) - 1, which makes the bkey size\ncalculation in code block 5 is overflowed. In one bug report the value\nof parameter 'sectors' is 131072 (= 1 << 17), the overflowed 'sectors'\nresults the overflowed s->insert_bio_sectors in code block 4, then makes\nsize field of s->iop.replace_key to be 0 in code block 5. Then the 0-\nsized s->iop.replace_key is inserted into the internal B+ tree as cache\nmissing check key (a special key to detect and avoid a racing between\nnormal write request and cache missing read request) as,\n[code block 8]\n  915   ret = bch_btree_insert_check_key(b, &s->op, &s->iop.replace_key);\n\nThen the 0-sized s->iop.replace_key as 3rd parameter triggers the bkey\nsize check BUG_ON() in code block 2, and causes the kernel panic 1).\n\nAnother ke\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7edf936a-bfdb-430a-87ed-4f57b2dc64e4",  "id": "CVE-2011-0710",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0710"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The task_show_regs function in arch/s390/kernel/traps.c in the Linux kernel before 2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of an arbitrary process by reading a status file under /proc/.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6fc0d2b1-7c54-482b-815c-ec74793593c0",  "id": "CVE-2021-47191",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47191"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix out-of-bound read in resp_readcap16()\n\nThe following warning was observed running syzkaller:\n\n[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in;\n[ 3813.830724]    program syz-executor not setting count and/or reply_len properly\n[ 3813.836956] ==================================================================\n[ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0\n[ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549\n[ 3813.846612] Call Trace:\n[ 3813.846995]  dump_stack+0x108/0x15f\n[ 3813.847524]  print_address_description+0xa5/0x372\n[ 3813.848243]  kasan_report.cold+0x236/0x2a8\n[ 3813.849439]  check_memory_region+0x240/0x270\n[ 3813.850094]  memcpy+0x30/0x80\n[ 3813.850553]  sg_copy_buffer+0x157/0x1e0\n[ 3813.853032]  sg_copy_from_buffer+0x13/0x20\n[ 3813.853660]  fill_from_dev_buffer+0x135/0x370\n[ 3813.854329]  resp_readcap16+0x1ac/0x280\n[ 3813.856917]  schedule_resp+0x41f/0x1630\n[ 3813.858203]  scsi_debug_queuecommand+0xb32/0x17e0\n[ 3813.862699]  scsi_dispatch_cmd+0x330/0x950\n[ 3813.863329]  scsi_request_fn+0xd8e/0x1710\n[ 3813.863946]  __blk_run_queue+0x10b/0x230\n[ 3813.864544]  blk_execute_rq_nowait+0x1d8/0x400\n[ 3813.865220]  sg_common_write.isra.0+0xe61/0x2420\n[ 3813.871637]  sg_write+0x6c8/0xef0\n[ 3813.878853]  __vfs_write+0xe4/0x800\n[ 3813.883487]  vfs_write+0x17b/0x530\n[ 3813.884008]  ksys_write+0x103/0x270\n[ 3813.886268]  __x64_sys_write+0x77/0xc0\n[ 3813.886841]  do_syscall_64+0x106/0x360\n[ 3813.887415]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nThis issue can be reproduced with the following syzkaller log:\n\nr0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\\x00', 0x26e1, 0x0)\nr1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\\x00')\nopen_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000)\nr2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782)\nwrite$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB=\"00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d\"], 0x126)\n\nIn resp_readcap16() we get \"int alloc_len\" value -1104926854, and then pass\nthe huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This\nleads to OOB in sg_copy_buffer().\n\nTo solve this issue, define alloc_len as u32.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31642173-5447-473d-b285-7b9407bbe30d",  "id": "CVE-2019-19527",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19527"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver, aka CID-9c09b214f30e.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "19265553-60e0-4589-bc17-829bae41e96e",  "id": "CVE-2022-48941",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix concurrent reset and removal of VFs\n\nCommit c503e63200c6 (\"ice: Stop processing VF messages during teardown\")\nintroduced a driver state flag, ICE_VF_DEINIT_IN_PROGRESS, which is\nintended to prevent some issues with concurrently handling messages from\nVFs while tearing down the VFs.\n\nThis change was motivated by crashes caused while tearing down and\nbringing up VFs in rapid succession.\n\nIt turns out that the fix actually introduces issues with the VF driver\ncaused because the PF no longer responds to any messages sent by the VF\nduring its .remove routine. This results in the VF potentially removing\nits DMA memory before the PF has shut down the device queues.\n\nAdditionally, the fix doesn't actually resolve concurrency issues within\nthe ice driver. It is possible for a VF to initiate a reset just prior\nto the ice driver removing VFs. This can result in the remove task\nconcurrently operating while the VF is being reset. This results in\nsimilar memory corruption and panics purportedly fixed by that commit.\n\nFix this concurrency at its root by protecting both the reset and\nremoval flows using the existing VF cfg_lock. This ensures that we\ncannot remove the VF while any outstanding critical tasks such as a\nvirtchnl message or a reset are occurring.\n\nThis locking change also fixes the root cause originally fixed by commit\nc503e63200c6 (\"ice: Stop processing VF messages during teardown\"), so we\ncan simply revert it.\n\nNote that I kept these two changes together because simply reverting the\noriginal commit alone would leave the driver vulnerable to worse race\nconditions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6f68a0b5-4b0f-4ed5-9df1-2af8471c62b3",  "id": "AZL-91167",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fe93313f-fa60-4d54-b3e5-f7cfafaf0dc2",  "id": "DSA-2141-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3c84464-03a3-4627-a7d5-c98941205a91",  "id": "CVE-2022-33740",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33740"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    212  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8bc80c72-eb26-424a-b1fa-f80de4916193",  "id": "RHSA-2023:0946",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "70122f06-37df-4f7f-9031-930f273f0994",  "id": "CVE-2024-42067",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    252  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()\n\nset_memory_rox() can fail, leaving memory unprotected.\n\nCheck return and bail out when bpf_jit_binary_lock_ro() returns\nan error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb1a50b1-586c-4d78-bb6d-b0d18c02c359",  "id": "SUSE-SU-2018:3864-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "345e91f3-07a8-4ce0-882b-e8b3684ba51c",  "id": "CVE-2022-49335",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/cs: make commands with 0 chunks illegal behaviour.\n\nSubmitting a cs with 0 chunks, causes an oops later, found trying\nto execute the wrong userspace driver.\n\nMESA_LOADER_DRIVER_OVERRIDE=v3d glxinfo\n\n[172536.665184] BUG: kernel NULL pointer dereference, address: 00000000000001d8\n[172536.665188] #PF: supervisor read access in kernel mode\n[172536.665189] #PF: error_code(0x0000) - not-present page\n[172536.665191] PGD 6712a0067 P4D 6712a0067 PUD 5af9ff067 PMD 0\n[172536.665195] Oops: 0000 [#1] SMP NOPTI\n[172536.665197] CPU: 7 PID: 2769838 Comm: glxinfo Tainted: P           O      5.10.81 #1-NixOS\n[172536.665199] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CROSSHAIR V FORMULA-Z, BIOS 2201 03/23/2015\n[172536.665272] RIP: 0010:amdgpu_cs_ioctl+0x96/0x1ce0 [amdgpu]\n[172536.665274] Code: 75 18 00 00 4c 8b b2 88 00 00 00 8b 46 08 48 89 54 24 68 49 89 f7 4c 89 5c 24 60 31 d2 4c 89 74 24 30 85 c0 0f 85 c0 01 00 00 <48> 83 ba d8 01 00 00 00 48 8b b4 24 90 00 00 00 74 16 48 8b 46 10\n[172536.665276] RSP: 0018:ffffb47c0e81bbe0 EFLAGS: 00010246\n[172536.665277] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[172536.665278] RDX: 0000000000000000 RSI: ffffb47c0e81be28 RDI: ffffb47c0e81bd68\n[172536.665279] RBP: ffff936524080010 R08: 0000000000000000 R09: ffffb47c0e81be38\n[172536.665281] R10: ffff936524080010 R11: ffff936524080000 R12: ffffb47c0e81bc40\n[172536.665282] R13: ffffb47c0e81be28 R14: ffff9367bc410000 R15: ffffb47c0e81be28\n[172536.665283] FS:  00007fe35e05d740(0000) GS:ffff936c1edc0000(0000) knlGS:0000000000000000\n[172536.665284] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[172536.665286] CR2: 00000000000001d8 CR3: 0000000532e46000 CR4: 00000000000406e0\n[172536.665287] Call Trace:\n[172536.665322]  ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu]\n[172536.665332]  drm_ioctl_kernel+0xaa/0xf0 [drm]\n[172536.665338]  drm_ioctl+0x201/0x3b0 [drm]\n[172536.665369]  ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu]\n[172536.665372]  ? selinux_file_ioctl+0x135/0x230\n[172536.665399]  amdgpu_drm_ioctl+0x49/0x80 [amdgpu]\n[172536.665403]  __x64_sys_ioctl+0x83/0xb0\n[172536.665406]  do_syscall_64+0x33/0x40\n[172536.665409]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nBug: https://gitlab.freedesktop.org/drm/amd/-/issues/2018",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "303e2c42-863f-4fc8-a9f5-0bd3bcf3b72d",  "id": "CVE-2019-12381",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12381"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in ip_ra_control in net/ipv4/ip_sockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of new_ra, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: this is disputed because new_ra is never used if it is NULL",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0a610e7e-7fa1-4d68-ab00-1f6a0db302c3",  "id": "CVE-2017-7889",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7889"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    732  ],  "analysis": {    "state": "in_triage"  },  "description": "The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file, related to arch/x86/mm/init.c and drivers/char/mem.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c877769c-68f8-43bf-82ab-d18834bcec81",  "id": "CVE-2026-46113",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Fix shadow paging use-after-free due to unexpected GFN\n\nThe shadow MMU computes GFNs for direct shadow pages using sp->gfn plus\nthe SPTE index. This assumption breaks for shadow paging if the guest\npage tables are modified between VM entries (similar to commit\naad885e77496, \"KVM: x86/mmu: Drop/zap existing present SPTE even\nwhen creating an MMIO SPTE\", 2026-03-27).  The flow is as follows:\n\n- a PDE is installed for a 2MB mapping, and a page in that area is\n  accessed.  KVM creates a kvm_mmu_page consisting of 512 4KB pages;\n  the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because\n  the guest's mapping is a huge page (and thus contiguous).\n\n- the PDE mapping is changed from outside the guest.\n\n- the guest accesses another page in the same 2MB area.  KVM installs\n  a new leaf SPTE and rmap entry; the SPTE uses the \"correct\" GFN\n  (i.e. based on the new mapping, as changed in the previous step) but\n  that GFN is outside of the [sp->gfn, sp->gfn + 511] range; therefore\n  the rmap entry cannot be found and removed when the kvm_mmu_page\n  is zapped.\n\n- the memslot that covers the first 2MB mapping is deleted, and the\n  kvm_mmu_page for the now-invalid GPA is zapped.  However, rmap_remove()\n  only looks at the [sp->gfn, sp->gfn + 511] range established in step 1,\n  and fails to find the rmap entry that was recorded by step 3.\n\n- any operation that causes an rmap walk for the same page accessed\n  by step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page.\n  This includes dirty logging or MMU notifier invalidations (e.g., from\n  MADV_DONTNEED).\n\nThe underlying issue is that KVM's walking of shadow PTEs assumes that\nif a SPTE is present when KVM wants to install a non-leaf SPTE, then the\nexisting kvm_mmu_page must be for the correct gfn.  Because the only way\nfor the gfn to be wrong is if KVM messed up and failed to zap a SPTE...\nwhich shouldn't happen, but *actually* only happens in response to a\nguest write.\n\nThat bug dates back literally forever, as even the first version of KVM\nassumes that the GFN matches and walks into the \"wrong\" shadow page.\nHowever, that was only an imprecision until 2032a93d66fa (\"KVM: MMU:\nDon't allocate gfns page for direct mmu pages\") came along.\n\nFix it by checking for a target gfn mismatch and zapping the existing\nSPTE.  That way the old SP and rmap entries are gone, KVM installs\nthe rmap in the right location, and everyone is happy.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4806c76f-75b0-4a11-89bc-61478ac9f4b9",  "id": "AZL-6780",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a4cd0bf0-375d-4457-87a7-41ced0bfb6e5",  "id": "SUSE-SU-2023:2123-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "27087b3c-98e9-4b3a-a8b2-1f4f7c8cbc88",  "id": "CVE-2021-38207",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38207"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/net/ethernet/xilinx/ll_temac_main.c in the Linux kernel before 5.12.13 allows remote attackers to cause a denial of service (buffer overflow and lockup) by sending heavy network traffic for about ten minutes.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9ad5734b-b448-4a31-9fe0-730abe910a4f",  "id": "CVE-2022-50296",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK\n\nWhen CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected,\ncpu_max_bits_warn() generates a runtime warning similar as below while\nwe show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit)\ninstead of NR_CPUS to iterate CPUs.\n\n[    3.052463] ------------[ cut here ]------------\n[    3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0\n[    3.070072] Modules linked in: efivarfs autofs4\n[    3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052\n[    3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000\n[    3.109127]         9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430\n[    3.118774]         90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff\n[    3.128412]         0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890\n[    3.138056]         0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa\n[    3.147711]         ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000\n[    3.157364]         900000000101c998 0000000000000004 9000000000ef7430 0000000000000000\n[    3.167012]         0000000000000009 000000000000006c 0000000000000000 0000000000000000\n[    3.176641]         9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286\n[    3.186260]         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c\n[    3.195868]         ...\n[    3.199917] Call Trace:\n[    3.203941] [<90000000002086d8>] show_stack+0x38/0x14c\n[    3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88\n[    3.217625] [<900000000023d268>] __warn+0xd0/0x100\n[    3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc\n[    3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0\n[    3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4\n[    3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4\n[    3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0\n[    3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100\n[    3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94\n[    3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160\n[    3.281824] ---[ end trace 8b484262b4b8c24c ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "057493dc-65e0-41ef-9f3b-a4ab2ade84c4",  "id": "CVE-2015-3195",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3195"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "575df421-b6f0-4a6f-b1bc-8d5f323ba161",  "id": "CVE-2022-48852",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: hdmi: Unregister codec device on unbind\n\nOn bind we will register the HDMI codec device but we don't unregister\nit on unbind, leading to a device leakage. Unregister our device at\nunbind.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9fe554f3-32ed-45a0-b4c2-8cfe900ee87e",  "id": "CVE-2018-18386",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18386"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    704  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8e91561b-11d1-4ac7-9c36-00f2bc2b88b7",  "id": "RHSA-2024:2447",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e39c28d0-8fc3-4652-a7be-922275067cf2",  "id": "SUSE-SU-2025:03271-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0d71c8e-8abd-4d29-92d5-3a07aa263350",  "id": "CLEANSTART-2026-SU97582",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6020cb7c-3322-4bee-b695-13a341988873",  "id": "CVE-2024-21803",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21803"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associated with program files https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetooth.C.\n\nThis issue affects Linux kernel: from v2.6.12-rc2 before v6.8-rc1.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "137eb48a-ca5e-4fd3-bb29-12df92a59945",  "id": "CVE-2010-2798",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2798"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact by renaming a file in a GFS2 filesystem, related to the gfs2_rename function in fs/gfs2/ops_inode.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "00d85198-503c-4a2e-93af-0f1ce45088eb",  "id": "CVE-2023-2513",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2513"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "66fe3d91-1502-43af-bf2c-cb2bcbe3181c",  "id": "CVE-2015-9004",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9004"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/events/core.c in the Linux kernel before 3.19 mishandles counter grouping, which allows local users to gain privileges via a crafted application, related to the perf_pmu_register and perf_event_open functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eacc4bed-5c89-4a6e-b698-46f23d02107a",  "id": "CVE-2023-53091",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: update s_journal_inum if it changes after journal replay\n\nWhen mounting a crafted ext4 image, s_journal_inum may change after journal\nreplay, which is obviously unreasonable because we have successfully loaded\nand replayed the journal through the old s_journal_inum. And the new\ns_journal_inum bypasses some of the checks in ext4_get_journal(), which\nmay trigger a null pointer dereference problem. So if s_journal_inum\nchanges after the journal replay, we ignore the change, and rewrite the\ncurrent journal_inum to the superblock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ed944d4-1a25-441a-905f-035a3fb0c597",  "id": "CLSA-2022-1657816312",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a691176a-adbe-4a21-a990-4ed8e07d9da9",  "id": "CVE-2025-37800",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: fix potential NULL pointer dereference in dev_uevent()\n\nIf userspace reads \"uevent\" device attribute at the same time as another\nthreads unbinds the device from its driver, change to dev->driver from a\nvalid pointer to NULL may result in crash. Fix this by using READ_ONCE()\nwhen fetching the pointer, and take bus' drivers klist lock to make sure\ndriver instance will not disappear while we access it.\n\nUse WRITE_ONCE() when setting the driver pointer to ensure there is no\ntearing.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "129d9fed-a8de-4094-8a8e-018c070c3fd5",  "id": "CVE-2017-14156",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14156"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The atyfb_ioctl function in drivers/video/fbdev/aty/atyfb_base.c in the Linux kernel through 4.12.10 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading locations associated with padding bytes.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10137bfc-3032-4fab-bfe1-3733b74a60bd",  "id": "CVE-2017-5967",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5967"  },  "ratings": [    {      "score": 4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local users to discover real PID values (as distinguished from PID values inside a PID namespace) by reading the /proc/timer_list file, related to the print_timer function in kernel/time/timer_list.c and the __timer_stats_timer_set_start_info function in kernel/time/timer.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b374b33-771f-4dd2-8bf0-67ed93c184f0",  "id": "CVE-2023-53313",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix wrong setting of max_corr_read_errors\n\nThere is no input check when echo md/max_read_errors and overflow might\noccur. Add check of input number.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a168c5a5-96ed-482f-aea5-65c1d5b1d085",  "id": "CVE-2017-9074",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9074"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef5199ae-8185-48bc-9879-9a400088324d",  "id": "CVE-2024-49921",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before used\n\n[WHAT & HOW]\nPoniters, such as dc->clk_mgr, are null checked previously in the same\nfunction, so Coverity warns \"implies that \"dc->clk_mgr\" might be null\".\nAs a result, these pointers need to be checked when used again.\n\nThis fixes 10 FORWARD_NULL issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6a8c30e5-8d68-4962-9f31-231c6d99cb1b",  "id": "openSUSE-SU-2026:11278-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4a2a2d00-56fc-4b62-8bdf-38b93d2eabd6",  "id": "CVE-2011-2496",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2496"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the vma_to_resize function in mm/mremap.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (BUG_ON and system crash) via a crafted mremap system call that expands a memory mapping.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5b79a8d-7517-499b-be7b-84f1f01e6a8e",  "id": "DLA-225-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ec27498-f0a6-4134-9054-de0b4797ef21",  "id": "CVE-2018-14615",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14615"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 4.17.10. There is a buffer overflow in truncate_inline_inode() in fs/f2fs/inline.c when umounting an f2fs image, because a length value may be negative.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a1f9b97a-b72e-4231-a182-783df46a873f",  "id": "CVE-2014-3646",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3646"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6460239c-ced7-4ce3-9f2e-82fbdb7f0bf0",  "id": "CVE-2011-4109",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4109"  },  "ratings": [    {      "score": 9.300000000000001,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "56d2ab95-aa1e-4a26-98c5-ab436acca2d4",  "id": "CVE-2020-10690",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10690"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the inode.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a5608154-564b-4fa5-95e3-4ba9e51e6ab8",  "id": "CVE-2024-25739",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25739"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    754  ],  "analysis": {    "state": "in_triage"  },  "description": "create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi->leb_size.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "16a0420f-30f8-473f-8570-18beb7a52011",  "id": "CVE-2019-14834",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14834"  },  "ratings": [    {      "score": 3.7,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory consumption) via vectors involving DHCP response creation.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6a4e0958-5916-46df-bb91-ef4de9fb50e6",  "id": "CVE-2023-22995",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22995"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04ec7fee-5414-43b9-9d4f-e1dc7ae58507",  "id": "CVE-2022-45884",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45884"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b6df4a6-3553-48ca-86c9-35acfa1e2349",  "id": "RLSA-2026:38503",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e7962bd2-ec6b-433f-a7bd-2dfafa3d4cdd",  "id": "CVE-2022-39188",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39188"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "63d71595-3a37-4413-a3ee-63dbdfe4c4c1",  "id": "CVE-2024-57946",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-blk: don't keep queue frozen during system suspend\n\nCommit 4ce6e2db00de (\"virtio-blk: Ensure no requests in virtqueues before\ndeleting vqs.\") replaces queue quiesce with queue freeze in virtio-blk's\nPM callbacks. And the motivation is to drain inflight IOs before suspending.\n\nblock layer's queue freeze looks very handy, but it is also easy to cause\ndeadlock, such as, any attempt to call into bio_queue_enter() may run into\ndeadlock if the queue is frozen in current context. There are all kinds\nof ->suspend() called in suspend context, so keeping queue frozen in the\nwhole suspend context isn't one good idea. And Marek reported lockdep\nwarning[1] caused by virtio-blk's freeze queue in virtblk_freeze().\n\n[1] https://lore.kernel.org/linux-block/ca16370e-d646-4eee-b9cc-87277c89c43c@samsung.com/\n\nGiven the motivation is to drain in-flight IOs, it can be done by calling\nfreeze & unfreeze, meantime restore to previous behavior by keeping queue\nquiesced during suspend.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0e87926f-f16b-440f-9c57-505bbf00b580",  "id": "CVE-2023-52764",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: gspca: cpia1: shift-out-of-bounds in set_flicker\n\nSyzkaller reported the following issue:\nUBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27\nshift exponent 245 is too large for 32-bit type 'int'\n\nWhen the value of the variable \"sd->params.exposure.gain\" exceeds the\nnumber of bits in an integer, a shift-out-of-bounds error is reported. It\nis triggered because the variable \"currentexp\" cannot be left-shifted by\nmore than the number of bits in an integer. In order to avoid invalid\nrange during left-shift, the conditional expression is added.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7481f342-109b-4fc5-81c3-c50e4aab6154",  "id": "CVE-2021-47112",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47112"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kvm: Teardown PV features on boot CPU as well\n\nVarious PV features (Async PF, PV EOI, steal time) work through memory\nshared with hypervisor and when we restore from hibernation we must\nproperly teardown all these features to make sure hypervisor doesn't\nwrite to stale locations after we jump to the previously hibernated kernel\n(which can try to place anything there). For secondary CPUs the job is\nalready done by kvm_cpu_down_prepare(), register syscore ops to do\nthe same for boot CPU.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eae72339-7d08-489e-809f-fa538a7a615a",  "id": "CVE-2011-2905",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2905"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    426  ],  "analysis": {    "state": "in_triage"  },  "description": "Untrusted search path vulnerability in the perf_config function in tools/perf/util/config.c in perf, as distributed in the Linux kernel before 3.1, allows local users to overwrite arbitrary files via a crafted config file in the current working directory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee538c19-ebae-468b-bca8-9b619943f286",  "id": "CVE-2024-49991",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer\n\nPass pointer reference to amdgpu_bo_unref to clear the correct pointer,\notherwise amdgpu_bo_unref clear the local variable, the original pointer\nnot set to NULL, this could cause use-after-free bug.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d184f70c-85ba-42a5-8220-b2008ad7bd89",  "id": "CVE-2024-38780",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/sw-sync: don't enable IRQ from sync_print_obj()\n\nSince commit a6aa8fca4d79 (\"dma-buf/sw-sync: Reduce irqsave/irqrestore from\nknown context\") by error replaced spin_unlock_irqrestore() with\nspin_unlock_irq() for both sync_debugfs_show() and sync_print_obj() despite\nsync_print_obj() is called from sync_debugfs_show(), lockdep complains\ninconsistent lock state warning.\n\nUse plain spin_{lock,unlock}() for sync_print_obj(), for\nsync_debugfs_show() is already using spin_{lock,unlock}_irq().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a7199d4b-c7cc-4fd0-a36a-12eda802195b",  "id": "CVE-2024-41020",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfilelock: Fix fcntl/close race recovery compat path\n\nWhen I wrote commit 3cad1bc01041 (\"filelock: Remove locks reliably when\nfcntl/close race is detected\"), I missed that there are two copies of the\ncode I was patching: The normal version, and the version for 64-bit offsets\non 32-bit kernels.\nThanks to Greg KH for stumbling over this while doing the stable\nbackport...\n\nApply exactly the same fix to the compat path for 32-bit kernels.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:180403/Linux-lock_get_status-Use-After-Free.html'"    }  ]},{  "bom-ref": "74b47d7e-2fbe-4f59-8d10-9b92eccb8d15",  "id": "CVE-2021-47412",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47412"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don't call rq_qos_ops->done_bio if the bio isn't tracked\n\nrq_qos framework is only applied on request based driver, so:\n\n1) rq_qos_done_bio() needn't to be called for bio based driver\n\n2) rq_qos_done_bio() needn't to be called for bio which isn't tracked,\nsuch as bios ended from error handling code.\n\nEspecially in bio_endio():\n\n1) request queue is referred via bio->bi_bdev->bd_disk->queue, which\nmay be gone since request queue refcount may not be held in above two\ncases\n\n2) q->rq_qos may be freed in blk_cleanup_queue() when calling into\n__rq_qos_done_bio()\n\nFix the potential kernel panic by not calling rq_qos_ops->done_bio if\nthe bio isn't tracked. This way is safe because both ioc_rqos_done_bio()\nand blkcg_iolatency_done_bio() are nop if the bio isn't tracked.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9021a96d-690e-44d2-83b1-9b1cf875fb7e",  "id": "CVE-2019-15222",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15222"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.2.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/helper.c (motu_microbookii) driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "330fab43-ce31-4720-a296-a92e92d5cd31",  "id": "CVE-2024-26594",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate mech token in session setup\n\nIf client send invalid mech token in session setup request, ksmbd\nvalidate and make the error if it is invalid.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a48dd304-51f3-4944-8a49-15f3243d80ab",  "id": "CLSA-2022-1654011190",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ab0c2d65-b4eb-4fa9-a48f-522549ef0538",  "id": "MGASA-2026-0288",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a729bcc2-f922-47c4-bd50-f8cbc13ed782",  "id": "CVE-2020-36694",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36694"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace. NOTE: cc00bca was reverted in 5.12.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf69600e-9582-4115-86a1-747f3df17ec3",  "id": "CVE-2017-15115",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15115"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c095d2a8-83e1-455d-bd1a-65947294c7fd",  "id": "CVE-2016-9084",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9084"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which allows local users to cause a denial of service (integer overflow) or have unspecified other impact by leveraging access to a vfio PCI device file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f567e015-0844-4715-a690-cbe3c8416650",  "id": "CVE-2022-49131",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath11k: fix kernel panic during unload/load ath11k modules\n\nCall netif_napi_del() from ath11k_ahb_free_ext_irq() to fix\nthe following kernel panic when unload/load ath11k modules\nfor few iterations.\n\n[  971.201365] Unable to handle kernel paging request at virtual address 6d97a208\n[  971.204227] pgd = 594c2919\n[  971.211478] [6d97a208] *pgd=00000000\n[  971.214120] Internal error: Oops: 5 [#1] PREEMPT SMP ARM\n[  971.412024] CPU: 2 PID: 4435 Comm: insmod Not tainted 5.4.89 #0\n[  971.434256] Hardware name: Generic DT based system\n[  971.440165] PC is at napi_by_id+0x10/0x40\n[  971.445019] LR is at netif_napi_add+0x160/0x1dc\n\n[  971.743127] (napi_by_id) from [<807d89a0>] (netif_napi_add+0x160/0x1dc)\n[  971.751295] (netif_napi_add) from [<7f1209ac>] (ath11k_ahb_config_irq+0xf8/0x414 [ath11k_ahb])\n[  971.759164] (ath11k_ahb_config_irq [ath11k_ahb]) from [<7f12135c>] (ath11k_ahb_probe+0x40c/0x51c [ath11k_ahb])\n[  971.768567] (ath11k_ahb_probe [ath11k_ahb]) from [<80666864>] (platform_drv_probe+0x48/0x94)\n[  971.779670] (platform_drv_probe) from [<80664718>] (really_probe+0x1c8/0x450)\n[  971.789389] (really_probe) from [<80664cc4>] (driver_probe_device+0x15c/0x1b8)\n[  971.797547] (driver_probe_device) from [<80664f60>] (device_driver_attach+0x44/0x60)\n[  971.805795] (device_driver_attach) from [<806650a0>] (__driver_attach+0x124/0x140)\n[  971.814822] (__driver_attach) from [<80662adc>] (bus_for_each_dev+0x58/0xa4)\n[  971.823328] (bus_for_each_dev) from [<80663a2c>] (bus_add_driver+0xf0/0x1e8)\n[  971.831662] (bus_add_driver) from [<806658a4>] (driver_register+0xa8/0xf0)\n[  971.839822] (driver_register) from [<8030269c>] (do_one_initcall+0x78/0x1ac)\n[  971.847638] (do_one_initcall) from [<80392524>] (do_init_module+0x54/0x200)\n[  971.855968] (do_init_module) from [<803945b0>] (load_module+0x1e30/0x1ffc)\n[  971.864126] (load_module) from [<803948b0>] (sys_init_module+0x134/0x17c)\n[  971.871852] (sys_init_module) from [<80301000>] (ret_fast_syscall+0x0/0x50)\n\nTested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.6.0.1-00760-QCAHKSWPL_SILICONZ-1",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3eee6ef8-af2b-4f0d-996d-69ea659a852c",  "id": "CVE-2019-17133",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17133"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f4c4671b-cadd-4f1f-9f5d-443a8e35283d",  "id": "ALSA-2022:1065",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "09f9abaf-afd4-43f0-9f24-6b552f968ea7",  "id": "CVE-2022-3114",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3114"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.16-rc6. imx_register_uart_clocks in drivers/clk/imx/clk.c lacks check of the return value of kcalloc() and will cause the null pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ba9f9bec-2be7-4b1b-91af-182ca119d6b8",  "id": "CVE-2024-58011",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: int3472: Check for adev == NULL\n\nNot all devices have an ACPI companion fwnode, so adev might be NULL. This\ncan e.g. (theoretically) happen when a user manually binds one of\nthe int3472 drivers to another i2c/platform device through sysfs.\n\nAdd a check for adev not being set and return -ENODEV in that case to\navoid a possible NULL pointer deref in skl_int3472_get_acpi_buffer().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "119ce8bb-6035-4aaf-84d7-8789037bb240",  "id": "CVE-2022-49885",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()\n\nChange num_ghes from int to unsigned int, preventing an overflow\nand causing subsequent vmalloc() to fail.\n\nThe overflow happens in ghes_estatus_pool_init() when calculating\nlen during execution of the statement below as both multiplication\noperands here are signed int:\n\nlen += (num_ghes * GHES_ESOURCE_PREALLOC_MAX_SIZE);\n\nThe following call trace is observed because of this bug:\n\n[    9.317108] swapper/0: vmalloc error: size 18446744071562596352, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1\n[    9.317131] Call Trace:\n[    9.317134]  <TASK>\n[    9.317137]  dump_stack_lvl+0x49/0x5f\n[    9.317145]  dump_stack+0x10/0x12\n[    9.317146]  warn_alloc.cold+0x7b/0xdf\n[    9.317150]  ? __device_attach+0x16a/0x1b0\n[    9.317155]  __vmalloc_node_range+0x702/0x740\n[    9.317160]  ? device_add+0x17f/0x920\n[    9.317164]  ? dev_set_name+0x53/0x70\n[    9.317166]  ? platform_device_add+0xf9/0x240\n[    9.317168]  __vmalloc_node+0x49/0x50\n[    9.317170]  ? ghes_estatus_pool_init+0x43/0xa0\n[    9.317176]  vmalloc+0x21/0x30\n[    9.317177]  ghes_estatus_pool_init+0x43/0xa0\n[    9.317179]  acpi_hest_init+0x129/0x19c\n[    9.317185]  acpi_init+0x434/0x4a4\n[    9.317188]  ? acpi_sleep_proc_init+0x2a/0x2a\n[    9.317190]  do_one_initcall+0x48/0x200\n[    9.317195]  kernel_init_freeable+0x221/0x284\n[    9.317200]  ? rest_init+0xe0/0xe0\n[    9.317204]  kernel_init+0x1a/0x130\n[    9.317205]  ret_from_fork+0x22/0x30\n[    9.317208]  </TASK>\n\n[ rjw: Subject and changelog edits ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd1a3630-fd1d-47a6-835f-6e45a306a4a8",  "id": "CVE-2017-8925",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8925"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    404  ],  "analysis": {    "state": "in_triage"  },  "description": "The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2a082c6b-9c64-43f8-9956-62df6d43ec20",  "id": "CVE-2024-49916",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn401_init_hw` function. The issue could occur when `dc->clk_mgr` or\n`dc->clk_mgr->funcs` is null.\n\nThe fix adds a check to ensure `dc->clk_mgr` and `dc->clk_mgr->funcs` is\nnot null before accessing its functions. This prevents a potential null\npointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn401/dcn401_hwseq.c:416 dcn401_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 225)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7f74cb8e-691d-41b2-a10d-cbf5838de3d8",  "id": "CVE-2021-4023",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4023"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the io-workqueue implementation in the Linux kernel versions prior to 5.15-rc1. The kernel can panic when an improper cancellation operation triggers the submission of new io-uring operations during a shortage of free space. This flaw allows a local user with permissions to execute io-uring requests to possibly crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c3d9bbdd-3b43-4c23-82b2-a769390b45e1",  "id": "CLSA-2022-1647550873",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9cc94829-f0a2-488d-aed1-14004a8afe08",  "id": "CVE-2025-39848",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nax25: properly unshare skbs in ax25_kiss_rcv()\n\nBernard Pidoux reported a regression apparently caused by commit\nc353e8983e0d (\"net: introduce per netns packet chains\").\n\nskb->dev becomes NULL and we crash in __netif_receive_skb_core().\n\nBefore above commit, different kind of bugs or corruptions could happen\nwithout a major crash.\n\nBut the root cause is that ax25_kiss_rcv() can queue/mangle input skb\nwithout checking if this skb is shared or not.\n\nMany thanks to Bernard Pidoux for his help, diagnosis and tests.\n\nWe had a similar issue years ago fixed with commit 7aaed57c5c28\n(\"phonet: properly unshare skbs in phonet_rcv()\").",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e5f197c8-0e5a-4b11-9980-0c3ba82d9b4f",  "id": "CVE-2024-26982",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check the inode number is not the invalid value of zero\n\nSyskiller has produced an out of bounds access in fill_meta_index().\n\nThat out of bounds access is ultimately caused because the inode\nhas an inode number with the invalid value of zero, which was not checked.\n\nThe reason this causes the out of bounds access is due to following\nsequence of events:\n\n1. Fill_meta_index() is called to allocate (via empty_meta_index())\n   and fill a metadata index.  It however suffers a data read error\n   and aborts, invalidating the newly returned empty metadata index.\n   It does this by setting the inode number of the index to zero,\n   which means unused (zero is not a valid inode number).\n\n2. When fill_meta_index() is subsequently called again on another\n   read operation, locate_meta_index() returns the previous index\n   because it matches the inode number of 0.  Because this index\n   has been returned it is expected to have been filled, and because\n   it hasn't been, an out of bounds access is performed.\n\nThis patch adds a sanity check which checks that the inode number\nis not zero when the inode is created and returns -EINVAL if it is.\n\n[phillip@squashfs.org.uk: whitespace fix]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ac8793d0-bc00-47fa-ba93-4ae29610f4a2",  "id": "RHSA-2024:7847",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e0f6afb-d664-46e4-bd5d-43888bdb4c08",  "id": "openSUSE-SU-2021:0545-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d2dc5ad-05ca-49bf-b109-c3af6970892a",  "id": "CVE-2023-0615",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0615"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190,    20,    369,    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "535d1d74-ad46-4b30-bbe0-b87307412ea2",  "id": "CVE-2024-57802",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.4,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetrom: check buffer length before accessing it\n\nSyzkaller reports an uninit value read from ax25cmp when sending raw message\nthrough ieee802154 implementation.\n\n=====================================================\nBUG: KMSAN: uninit-value in ax25cmp+0x3a5/0x460 net/ax25/ax25_addr.c:119\n ax25cmp+0x3a5/0x460 net/ax25/ax25_addr.c:119\n nr_dev_get+0x20e/0x450 net/netrom/nr_route.c:601\n nr_route_frame+0x1a2/0xfc0 net/netrom/nr_route.c:774\n nr_xmit+0x5a/0x1c0 net/netrom/nr_dev.c:144\n __netdev_start_xmit include/linux/netdevice.h:4940 [inline]\n netdev_start_xmit include/linux/netdevice.h:4954 [inline]\n xmit_one net/core/dev.c:3548 [inline]\n dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\n dev_queue_xmit include/linux/netdevice.h:3134 [inline]\n raw_sendmsg+0x654/0xc10 net/ieee802154/socket.c:299\n ieee802154_sock_sendmsg+0x91/0xc0 net/ieee802154/socket.c:96\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n __sys_sendmsg net/socket.c:2667 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was created at:\n slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\n slab_alloc_node mm/slub.c:3478 [inline]\n kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560\n __alloc_skb+0x318/0x740 net/core/skbuff.c:651\n alloc_skb include/linux/skbuff.h:1286 [inline]\n alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334\n sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2780\n sock_alloc_send_skb include/net/sock.h:1884 [inline]\n raw_sendmsg+0x36d/0xc10 net/ieee802154/socket.c:282\n ieee802154_sock_sendmsg+0x91/0xc0 net/ieee802154/socket.c:96\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg net/socket.c:745 [inline]\n ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n __sys_sendmsg net/socket.c:2667 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nCPU: 0 PID: 5037 Comm: syz-executor166 Not tainted 6.7.0-rc7-syzkaller-00003-gfbafc3e621c3 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\n=====================================================\n\nThis issue occurs because the skb buffer is too small, and it's actual\nallocation is aligned. This hides an actual issue, which is that nr_route_frame\ndoes not validate the buffer size before using it.\n\nFix this issue by checking skb->len before accessing any fields in skb->data.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "22bd531b-1111-45fa-8317-c7ca83fdaaad",  "id": "CVE-2021-3444",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3444"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125,    681  ],  "analysis": {    "state": "in_triage"  },  "description": "The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 (\"bpf: Fix truncation handling for mod32 dst reg wrt zero\") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d05c2ae9-fa09-476a-a046-338d3b23c193",  "id": "ALSA-2026:1473",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "76f06e52-efe5-4714-888d-0b29d87c516f",  "id": "CVE-2022-49271",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: prevent bad output lengths in smb2_ioctl_query_info()\n\nWhen calling smb2_ioctl_query_info() with\nsmb_query_info::flags=PASSTHRU_FSCTL and\nsmb_query_info::output_buffer_length=0, the following would return\n0x10\n\n\tbuffer = memdup_user(arg + sizeof(struct smb_query_info),\n\t\t\t     qi.output_buffer_length);\n\tif (IS_ERR(buffer)) {\n\t\tkfree(vars);\n\t\treturn PTR_ERR(buffer);\n\t}\n\nrather than a valid pointer thus making IS_ERR() check fail.  This\nwould then cause a NULL ptr deference in @buffer when accessing it\nlater in smb2_ioctl_query_ioctl().  While at it, prevent having a\n@buffer smaller than 8 bytes to correctly handle SMB2_SET_INFO\nFileEndOfFileInformation requests when\nsmb_query_info::flags=PASSTHRU_SET_INFO.\n\nHere is a small C reproducer which triggers a NULL ptr in @buffer when\npassing an invalid smb_query_info::flags\n\n\t#include <stdio.h>\n\t#include <stdlib.h>\n\t#include <stdint.h>\n\t#include <unistd.h>\n\t#include <fcntl.h>\n\t#include <sys/ioctl.h>\n\n\t#define die(s) perror(s), exit(1)\n\t#define QUERY_INFO 0xc018cf07\n\n\tint main(int argc, char *argv[])\n\t{\n\t\tint fd;\n\n\t\tif (argc < 2)\n\t\t\texit(1);\n\t\tfd = open(argv[1], O_RDONLY);\n\t\tif (fd == -1)\n\t\t\tdie(\"open\");\n\t\tif (ioctl(fd, QUERY_INFO, (uint32_t[]) { 0, 0, 0, 4, 0, 0}) == -1)\n\t\t\tdie(\"ioctl\");\n\t\tclose(fd);\n\t\treturn 0;\n\t}\n\n\tmount.cifs //srv/share /mnt -o ...\n\tgcc repro.c && ./a.out /mnt/f0\n\n\t[  114.138620] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI\n\t[  114.139310] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n\t[  114.139775] CPU: 2 PID: 995 Comm: a.out Not tainted 5.17.0-rc8 #1\n\t[  114.140148] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014\n\t[  114.140818] RIP: 0010:smb2_ioctl_query_info+0x206/0x410 [cifs]\n\t[  114.141221] Code: 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 c8 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 7b 28 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9c 01 00 00 49 8b 3f e8 58 02 fb ff 48 8b 14 24\n\t[  114.142348] RSP: 0018:ffffc90000b47b00 EFLAGS: 00010256\n\t[  114.142692] RAX: dffffc0000000000 RBX: ffff888115503200 RCX: ffffffffa020580d\n\t[  114.143119] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffffa043a380\n\t[  114.143544] RBP: ffff888115503278 R08: 0000000000000001 R09: 0000000000000003\n\t[  114.143983] R10: fffffbfff4087470 R11: 0000000000000001 R12: ffff888115503288\n\t[  114.144424] R13: 00000000ffffffea R14: ffff888115503228 R15: 0000000000000000\n\t[  114.144852] FS:  00007f7aeabdf740(0000) GS:ffff888151600000(0000) knlGS:0000000000000000\n\t[  114.145338] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n\t[  114.145692] CR2: 00007f7aeacfdf5e CR3: 000000012000e000 CR4: 0000000000350ee0\n\t[  114.146131] Call Trace:\n\t[  114.146291]  <TASK>\n\t[  114.146432]  ? smb2_query_reparse_tag+0x890/0x890 [cifs]\n\t[  114.146800]  ? cifs_mapchar+0x460/0x460 [cifs]\n\t[  114.147121]  ? rcu_read_lock_sched_held+0x3f/0x70\n\t[  114.147412]  ? cifs_strndup_to_utf16+0x15b/0x250 [cifs]\n\t[  114.147775]  ? dentry_path_raw+0xa6/0xf0\n\t[  114.148024]  ? cifs_convert_path_to_utf16+0x198/0x220 [cifs]\n\t[  114.148413]  ? smb2_check_message+0x1080/0x1080 [cifs]\n\t[  114.148766]  ? rcu_read_lock_sched_held+0x3f/0x70\n\t[  114.149065]  cifs_ioctl+0x1577/0x3320 [cifs]\n\t[  114.149371]  ? lock_downgrade+0x6f0/0x6f0\n\t[  114.149631]  ? cifs_readdir+0x2e60/0x2e60 [cifs]\n\t[  114.149956]  ? rcu_read_lock_sched_held+0x3f/0x70\n\t[  114.150250]  ? __rseq_handle_notify_resume+0x80b/0xbe0\n\t[  114.150562]  ? __up_read+0x192/0x710\n\t[  114.150791]  ? __ia32_sys_rseq+0xf0/0xf0\n\t[  114.151025]  ? __x64_sys_openat+0x11f/0x1d0\n\t[  114.151296]  __x64_sys_ioctl+0x127/0x190\n\t[  114.151549]  do_syscall_64+0x3b/0x90\n\t[  114.151768]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n\t[  114.152079] RIP: 0033:0x7f7aead043df\n\t[  114.152306] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1e2263a1-3f79-4dc9-a5ad-533ae3ae94b7",  "id": "ROOT-OS-ALPINE-317-CVE-2026-28387",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9eec4954-9777-4134-8b50-afe9d798f017",  "id": "CVE-2013-6381",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6381"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the qeth_snmp_command function in drivers/s390/net/qeth_core_main.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service or possibly have unspecified other impact via an SNMP ioctl call with a length value that is incompatible with the command-buffer size.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1995cfaa-25f6-4e15-be72-a6491be0417e",  "id": "CVE-2023-53197",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: uhci: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "774f361b-1c06-4995-afab-fd4d7aabebd5",  "id": "CLSA-2026-1777566580",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b34a5e3e-a189-4b81-bffa-02cf0faadca8",  "id": "CVE-2026-53287",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix incorrect inheritable capability in CAPSET records\n\n__audit_log_capset() records the effective capability set into the\ninheritable field due to a copy-paste error. Every CAPSET audit\nrecord therefore reports cap_pi (process inheritable) with the value\nof cap_effective instead of cap_inheritable.\n\nThis silently corrupts audit data used for compliance and forensic\nanalysis: an attacker who modifies inheritable capabilities to\nprepare for a privilege-escalating exec would have the change masked\nin the audit trail.\n\nThe bug has been present since the original introduction of CAPSET\naudit records in 2008.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9237a4bd-c55a-4a55-947e-1f75bfaaa659",  "id": "CVE-2021-4155",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4155"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    131  ],  "analysis": {    "state": "in_triage"  },  "description": "A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b0c11d78-37ff-443b-b203-e3c3e4f8abc3",  "id": "CVE-2020-10766",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10766"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    440  ],  "analysis": {    "state": "in_triage"  },  "description": "A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d41faceb-e684-4131-87bc-8fb82af6c7da",  "id": "AZL-75272",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5c9dc0a3-e453-4436-ac76-67fc3099920d",  "id": "MGASA-2015-0274",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "42ad5a54-d059-4c8f-b0d8-490e9be9b033",  "id": "CVE-2022-2873",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2873"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    131  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9a801a18-4583-498b-b048-4a836a3e10f7",  "id": "CVE-2024-26962",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape\n\nFor raid456, if reshape is still in progress, then IO across reshape\nposition will wait for reshape to make progress. However, for dm-raid,\nin following cases reshape will never make progress hence IO will hang:\n\n1) the array is read-only;\n2) MD_RECOVERY_WAIT is set;\n3) MD_RECOVERY_FROZEN is set;\n\nAfter commit c467e97f079f (\"md/raid6: use valid sector values to determine\nif an I/O should wait on the reshape\") fix the problem that IO across\nreshape position doesn't wait for reshape, the dm-raid test\nshell/lvconvert-raid-reshape.sh start to hang:\n\n[root@fedora ~]# cat /proc/979/stack\n[<0>] wait_woken+0x7d/0x90\n[<0>] raid5_make_request+0x929/0x1d70 [raid456]\n[<0>] md_handle_request+0xc2/0x3b0 [md_mod]\n[<0>] raid_map+0x2c/0x50 [dm_raid]\n[<0>] __map_bio+0x251/0x380 [dm_mod]\n[<0>] dm_submit_bio+0x1f0/0x760 [dm_mod]\n[<0>] __submit_bio+0xc2/0x1c0\n[<0>] submit_bio_noacct_nocheck+0x17f/0x450\n[<0>] submit_bio_noacct+0x2bc/0x780\n[<0>] submit_bio+0x70/0xc0\n[<0>] mpage_readahead+0x169/0x1f0\n[<0>] blkdev_readahead+0x18/0x30\n[<0>] read_pages+0x7c/0x3b0\n[<0>] page_cache_ra_unbounded+0x1ab/0x280\n[<0>] force_page_cache_ra+0x9e/0x130\n[<0>] page_cache_sync_ra+0x3b/0x110\n[<0>] filemap_get_pages+0x143/0xa30\n[<0>] filemap_read+0xdc/0x4b0\n[<0>] blkdev_read_iter+0x75/0x200\n[<0>] vfs_read+0x272/0x460\n[<0>] ksys_read+0x7a/0x170\n[<0>] __x64_sys_read+0x1c/0x30\n[<0>] do_syscall_64+0xc6/0x230\n[<0>] entry_SYSCALL_64_after_hwframe+0x6c/0x74\n\nThis is because reshape can't make progress.\n\nFor md/raid, the problem doesn't exist because register new sync_thread\ndoesn't rely on the IO to be done any more:\n\n1) If array is read-only, it can switch to read-write by ioctl/sysfs;\n2) md/raid never set MD_RECOVERY_WAIT;\n3) If MD_RECOVERY_FROZEN is set, mddev_suspend() doesn't hold\n   'reconfig_mutex', hence it can be cleared and reshape can continue by\n   sysfs api 'sync_action'.\n\nHowever, I'm not sure yet how to avoid the problem in dm-raid yet. This\npatch on the one hand make sure raid_message() can't change\nsync_thread() through raid_message() after presuspend(), on the other\nhand detect the above 3 cases before wait for IO do be done in\ndm_suspend(), and let dm-raid requeue those IO.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8396af69-f30e-4d82-b259-3d1ef9d55a41",  "id": "SUSE-SU-2017:0585-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9461353f-b834-4f71-80c8-4b98898815a9",  "id": "CVE-2017-17741",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17741"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed248030-c117-4953-a523-253eacef63e8",  "id": "CVE-2014-3570",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3570"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "74087335-4c5e-4d73-a300-58ff96eed621",  "id": "CVE-2020-36691",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36691"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    674  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unbounded recursion) via a nested Netlink policy with a back reference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "624a54cc-fe89-43ce-8514-fbf747159010",  "id": "AZL-41054",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "39cb2ba0-0f6e-46a5-b5ba-3e5535fe10c8",  "id": "CVE-2017-11600",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11600"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d20f3182-74ee-41cf-9e19-b59b066ff505",  "id": "AZL-35084",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c36aa13d-3bc5-4c4b-b162-1a270625d9fc",  "id": "CVE-2024-49893",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check stream_status before it is used\n\n[WHAT & HOW]\ndc_state_get_stream_status can return null, and therefore null must be\nchecked before stream_status is used.\n\nThis fixes 1 NULL_RETURNS issue reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b79b242-ab07-426e-8df4-7755aff50042",  "id": "CVE-2026-45841",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO\n\nnf_osf_match_one() computes ctx->window % f->wss.val in the\nOSF_WSS_MODULO branch with no guard for f->wss.val == 0. A\nCAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a\nsubsequent matching TCP SYN divides by zero and panics the kernel.\n\nReject the bogus fingerprint in nfnl_osf_add_callback() above the\nper-option for-loop. f->wss is per-fingerprint, not per-option, so\nthe check must run regardless of f->opt_num (including 0). Also\nreject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that\nas \"should not happen\".\n\nCrash:\n Oops: divide error: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)\n Call Trace:\n <IRQ>\n  nf_osf_match (net/netfilter/nfnetlink_osf.c:220)\n  xt_osf_match_packet (net/netfilter/xt_osf.c:32)\n  ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)\n  nf_hook_slow (net/netfilter/core.c:622)\n  ip_local_deliver (net/ipv4/ip_input.c:265)\n  ip_rcv (include/linux/skbuff.h:1162)\n  __netif_receive_skb_one_core (net/core/dev.c:6181)\n  process_backlog (net/core/dev.c:6642)\n  __napi_poll (net/core/dev.c:7710)\n  net_rx_action (net/core/dev.c:7945)\n  handle_softirqs (kernel/softirq.c:622)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "93fb194f-d1de-4684-bebf-8708408cb380",  "id": "AZL-6779",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "af677f5c-4836-4c27-984c-e7e1faa48efd",  "id": "CVE-2019-19074",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19074"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "41e559ba-b81e-4af3-a075-0252f950ff05",  "id": "CVE-2026-53130",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START\n\nomfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE),\nbut it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440).\n\nLater, omfs_make_empty() uses\n\n    sbi->s_sys_blocksize - OMFS_DIR_START\n\nas the length argument to memset().  Since s_sys_blocksize is u32,\na crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes\nan unsigned underflow there, wrapping to a value near 2^32.  That drives\na ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel\nmemory far beyond the backing block buffer.\n\nAdd the corresponding lower-bound check alongside the existing upper-bound\ncheck in omfs_fill_super(), so that malformed images are rejected during\nsuperblock validation before any filesystem data is processed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b611e78-e142-479f-8946-a0d3a041848c",  "id": "CVE-2012-6544",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6544"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The Bluetooth protocol stack in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that targets the (1) L2CAP or (2) HCI implementation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8958f9ac-8754-43b5-9e9b-717cb969adcc",  "id": "CVE-2014-5077",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5077"  },  "ratings": [    {      "score": 7.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f331a6f4-ffa9-4322-ad58-b963ecb0d2d4",  "id": "CVE-2014-0196",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0196"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the \"LECHO & !OPOST\" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:33516'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:126603/Linux-Kernel-3.15-rc4-PTY-Race-Condition.html'"    }  ]},{  "bom-ref": "b32ca260-df6d-4d6e-a088-c08be4cf2baf",  "id": "CVE-2017-1000380",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000380"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "59317f45-aba6-4787-89fd-36a18414fa4d",  "id": "OESA-2026-3624",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "350d3607-96f6-432f-b6cb-b8c2ddd4e629",  "id": "CVE-2023-53288",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: Fix memory leak in drm_client_modeset_probe\n\nWhen a new mode is set to modeset->mode, the previous mode should be freed.\nThis fixes the following kmemleak report:\n\ndrm_mode_duplicate+0x45/0x220 [drm]\ndrm_client_modeset_probe+0x944/0xf50 [drm]\n__drm_fb_helper_initial_config_and_unlock+0xb4/0x2c0 [drm_kms_helper]\ndrm_fbdev_client_hotplug+0x2bc/0x4d0 [drm_kms_helper]\ndrm_client_register+0x169/0x240 [drm]\nast_pci_probe+0x142/0x190 [ast]\nlocal_pci_probe+0xdc/0x180\nwork_for_cpu_fn+0x4e/0xa0\nprocess_one_work+0x8b7/0x1540\nworker_thread+0x70a/0xed0\nkthread+0x29f/0x340\nret_from_fork+0x1f/0x30",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8447b0f7-f0cd-49ea-b25c-238dfe3ca37a",  "id": "CVE-2009-1386",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1386"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:8873'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'MSF:dtls_changecipherspec'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'PSS:78064/OpenSSL-0.9.8.h-DTLS-Denial-Of-Service.html'"    }  ]},{  "bom-ref": "f8868d53-208d-4b98-a9df-b0318c10675d",  "id": "CVE-2024-23196",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23196"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was found in the Linux kernel's sound/hda  device driver in snd_hdac_regmap_sync() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a2b53e50-b062-49a6-8fcc-b9bd93d16a84",  "id": "CVE-2023-4459",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4459"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "40426496-f1be-458f-a860-00207790b8cf",  "id": "CVE-2026-43152",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hid-pl: handle probe errors\n\nErrors in init must be reported back or we'll\nfollow a NULL pointer the first time FF is used.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4f6d5b13-e7a4-4342-b885-64a3e59be429",  "id": "RUSTSEC-2024-0357",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fbe00fe7-3c72-473b-a37a-4e3e639ca68a",  "id": "CVE-2013-3223",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3223"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The ax25_recvmsg function in net/ax25/af_ax25.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2aa3737c-82f2-4a19-8e1d-107b779c4a61",  "id": "CVE-2026-53236",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: restrict SO_ATTACH_FILTER to priv users\n\nThis patch restricts the use of SO_ATTACH_FILTER (cBPF) on TCP sockets\nto users with CAP_NET_ADMIN capability.\n\nThis blocks potential side-channel attack where an unprivileged application\nattaches a filter to leak TCP sequence/acknowledgment numbers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84583af7-0278-40ed-b4e0-e639133411a6",  "id": "CVE-2024-50290",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx24116: prevent overflows on SNR calculus\n\nas reported by Coverity, if reading SNR registers fail, a negative\nnumber will be returned, causing an underflow when reading SNR\nregisters.\n\nPrevent that.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf6ddab7-0e8e-4f3b-9e66-d079cb74cdfa",  "id": "CVE-2022-48706",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: ifcvf: Do proper cleanup if IFCVF init fails\n\nifcvf_mgmt_dev leaks memory if it is not freed before\nreturning. Call is made to correct return statement\nso memory does not leak. ifcvf_init_hw does not take\ncare of this so it is needed to do it here.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "09f0bf48-269c-4279-8e26-3bc6631dfc00",  "id": "CVE-2019-11190",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11190"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7b949993-4a41-43a1-bff6-379961c46d80",  "id": "CVE-2010-3858",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3858"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The setup_arg_pages function in fs/exec.c in the Linux kernel before 2.6.36, when CONFIG_STACK_GROWSDOWN is used, does not properly restrict the stack memory consumption of the (1) arguments and (2) environment for a 32-bit application on a 64-bit platform, which allows local users to cause a denial of service (system crash) via a crafted exec system call, a related issue to CVE-2010-2240.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:15619'"    }  ]},{  "bom-ref": "89663f57-0fa7-4e05-8811-614c047a45c6",  "id": "CVE-2024-46781",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix missing cleanup on rollforward recovery error\n\nIn an error injection test of a routine for mount-time recovery, KASAN\nfound a use-after-free bug.\n\nIt turned out that if data recovery was performed using partial logs\ncreated by dsync writes, but an error occurred before starting the log\nwriter to create a recovered checkpoint, the inodes whose data had been\nrecovered were left in the ns_dirty_files list of the nilfs object and\nwere not freed.\n\nFix this issue by cleaning up inodes that have read the recovery data if\nthe recovery routine fails midway before the log writer starts.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4748c927-c751-4a7d-b3bd-4c74a777aa5b",  "id": "CVE-2025-22038",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.300000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate zero num_subauth before sub_auth is accessed\n\nAccess psid->sub_auth[psid->num_subauth - 1] without checking\nif num_subauth is non-zero leads to an out-of-bounds read.\nThis patch adds a validation step to ensure num_subauth != 0\nbefore sub_auth is accessed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d27fc165-15e6-4c09-8dc2-eab2ba7791c9",  "id": "OESA-2024-2127",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5adfeb31-3352-420c-8fc1-b60a12249580",  "id": "CVE-2026-53304",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sg: Resolve soft lockup issue when opening /dev/sgX\n\nThe parameter def_reserved_size defines the default buffer size reserved\nfor each Sg_fd and should be restricted to a range between 0 and 1,048,576\n(see https://tldp.org/HOWTO/SCSI-Generic-HOWTO/proc.html).  Although the\nfunction sg_proc_write_dressz enforces this limit, it is possible to bypass\nit by directly modifying the module parameter as shown below, which then\ncauses a soft lockup:\n\necho -1 > /sys/module/sg/parameters/def_reserved_size\nexec 4<> /dev/sg0\n\nwatchdog: BUG: soft lockup - CPU#5 stuck for 26 seconds! [bash:537]\nModules loaded:\nCPU: 5 UID: 0 PID: 537 Command: bash, kernel version 6.19.0-rc3+ #134,\nPREEMPT disabled\nHardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS version\n1.16.1-2.fc37 dated 04/01/2014\n...\nCall Trace:\n\n  sg_build_reserve+0x5c/0xa0\n  sg_add_sfp+0x168/0x270\n  sg_open+0x16e/0x340\n  chrdev_open+0xbe/0x230\n  do_dentry_open+0x175/0x480\n  vfs_open+0x34/0xf0\n  do_open+0x265/0x3d0\n  path_openat+0x110/0x290\n  do_filp_open+0xc3/0x170\n  do_sys_openat2+0x71/0xe0\n  __x64_sys_openat+0x6d/0xa0\n  do_syscall_64+0x62/0x310\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe fix is to use module_param_cb to validate and reject invalid values\nassigned to def_reserved_size.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "35579936-25bf-4672-bace-ede85f00f078",  "id": "CVE-2018-7273",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7273"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function show_floppy in drivers/block/floppy.c. An attacker can read this information from dmesg and use the addresses to find the locations of kernel code and data and bypass kernel security protections such as KASLR.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:44325'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:146863/Linux-Kernel-show_floppy-KASLR-Address-Leak.html'"    }  ]},{  "bom-ref": "8da868ff-3b31-4d12-a962-60afc8710049",  "id": "CVE-2021-47383",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47383"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: Fix out-of-bound vmalloc access in imageblit\n\nThis issue happens when a userspace program does an ioctl\nFBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct\ncontaining only the fields xres, yres, and bits_per_pixel\nwith values.\n\nIf this struct is the same as the previous ioctl, the\nvc_resize() detects it and doesn't call the resize_screen(),\nleaving the fb_var_screeninfo incomplete. And this leads to\nthe updatescrollmode() calculates a wrong value to\nfbcon_display->vrows, which makes the real_y() return a\nwrong value of y, and that value, eventually, causes\nthe imageblit to access an out-of-bound address value.\n\nTo solve this issue I made the resize_screen() be called\neven if the screen does not need any resizing, so it will\n\"fix and fill\" the fb_var_screeninfo independently.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "98019a9f-2277-4606-b0ca-9b9b088c81bd",  "id": "CVE-2021-3640",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3640"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cf66d9d2-8abd-4b36-9deb-3239ceac454f",  "id": "CVE-2024-46681",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npktgen: use cpus_read_lock() in pg_net_init()\n\nI have seen the WARN_ON(smp_processor_id() != cpu) firing\nin pktgen_thread_worker() during tests.\n\nWe must use cpus_read_lock()/cpus_read_unlock()\naround the for_each_online_cpu(cpu) loop.\n\nWhile we are at it use WARN_ON_ONCE() to avoid a possible syslog flood.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8885be0-4295-4021-88de-729a9d3c9fdd",  "id": "CVE-2015-8950",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8950"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory by triggering a dma_mmap call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee321f6e-cc63-4812-a9b8-4a8b214d24e0",  "id": "CVE-2021-47475",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47475"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: vmk80xx: fix transfer-buffer overflows\n\nThe driver uses endpoint-sized USB transfer buffers but up until\nrecently had no sanity checks on the sizes.\n\nCommit e1f13c879a7c (\"staging: comedi: check validity of wMaxPacketSize\nof usb endpoints found\") inadvertently fixed NULL-pointer dereferences\nwhen accessing the transfer buffers in case a malicious device has a\nzero wMaxPacketSize.\n\nMake sure to allocate buffers large enough to handle also the other\naccesses that are done without a size check (e.g. byte 18 in\nvmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond\nthe buffers, for example, when doing descriptor fuzzing.\n\nThe original driver was for a low-speed device with 8-byte buffers.\nSupport was later added for a device that uses bulk transfers and is\npresumably a full-speed device with a maximum 64-byte wMaxPacketSize.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2dc33d7f-e3b5-441f-bf4d-d37962edde71",  "id": "CVE-2012-6536",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6536"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not verify that the actual Netlink message length is consistent with a certain header field, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability and providing a (1) new or (2) updated state.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "24d5f2a4-789e-4f66-8493-137949d6b2b1",  "id": "CVE-2020-36312",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36312"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.8.10. virt/kvm/kvm_main.c has a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure, aka CID-f65886606c2d.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d7c06fe5-e4c8-416e-8d01-fbee5fa50d52",  "id": "CVE-2023-53321",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: drop short frames\n\nWhile technically some control frames like ACK are shorter and\nend after Address 1, such frames shouldn't be forwarded through\nwmediumd or similar userspace, so require the full 3-address\nheader to avoid accessing invalid memory if shorter frames are\npassed in.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "38130178-928f-42b4-ba38-d5e3ff54a279",  "id": "CVE-2024-26697",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix data corruption in dsync block recovery for small block sizes\n\nThe helper function nilfs_recovery_copy_block() of\nnilfs_recovery_dsync_blocks(), which recovers data from logs created by\ndata sync writes during a mount after an unclean shutdown, incorrectly\ncalculates the on-page offset when copying repair data to the file's page\ncache.  In environments where the block size is smaller than the page\nsize, this flaw can cause data corruption and leak uninitialized memory\nbytes during the recovery process.\n\nFix these issues by correcting this byte offset calculation on the page.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d477bf58-7d68-48d2-8473-1692a4636b57",  "id": "CLSA-2026-1770820922",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51117c9f-8709-4b51-b050-37cfe7fb0c6a",  "id": "CVE-2023-23005",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23005"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case, whereas it is actually an error pointer). NOTE: this is disputed by third parties because there are no realistic cases in which a user can cause the alloc_memory_type error case to be reached.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "510c925d-9151-48d1-ba40-85d5410bbb3e",  "id": "CVE-2023-52435",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: prevent mss overflow in skb_segment()\n\nOnce again syzbot is able to crash the kernel in skb_segment() [1]\n\nGSO_BY_FRAGS is a forbidden value, but unfortunately the following\ncomputation in skb_segment() can reach it quite easily :\n\n\tmss = mss * partial_segs;\n\n65535 = 3 * 5 * 17 * 257, so many initial values of mss can lead to\na bad final result.\n\nMake sure to limit segmentation so that the new mss value is smaller\nthan GSO_BY_FRAGS.\n\n[1]\n\ngeneral protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]\nCPU: 1 PID: 5079 Comm: syz-executor993 Not tainted 6.7.0-rc4-syzkaller-00141-g1ae4cd3cbdd0 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023\nRIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551\nCode: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00\nRSP: 0018:ffffc900043473d0 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597\nRDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070\nRBP: ffffc90004347578 R08: 0000000000000005 R09: 000000000000ffff\nR10: 000000000000ffff R11: 0000000000000002 R12: ffff888063202ac0\nR13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046\nFS: 0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n<TASK>\nudp6_ufo_fragment+0xa0e/0xd00 net/ipv6/udp_offload.c:109\nipv6_gso_segment+0x534/0x17e0 net/ipv6/ip6_offload.c:120\nskb_mac_gso_segment+0x290/0x610 net/core/gso.c:53\n__skb_gso_segment+0x339/0x710 net/core/gso.c:124\nskb_gso_segment include/net/gso.h:83 [inline]\nvalidate_xmit_skb+0x36c/0xeb0 net/core/dev.c:3626\n__dev_queue_xmit+0x6f3/0x3d60 net/core/dev.c:4338\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\npacket_xmit+0x257/0x380 net/packet/af_packet.c:276\npacket_snd net/packet/af_packet.c:3087 [inline]\npacket_sendmsg+0x24c6/0x5220 net/packet/af_packet.c:3119\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg+0xd5/0x180 net/socket.c:745\n__sys_sendto+0x255/0x340 net/socket.c:2190\n__do_sys_sendto net/socket.c:2202 [inline]\n__se_sys_sendto net/socket.c:2198 [inline]\n__x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0x40/0x110 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\nRIP: 0033:0x7f8692032aa9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fff8d685418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8692032aa9\nRDX: 0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003\nRBP: 00000000000f4240 R08: 0000000020000540 R09: 0000000000000014\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007fff8d685480\nR13: 0000000000000001 R14: 00007fff8d685480 R15: 0000000000000003\n</TASK>\nModules linked in:\n---[ end trace 0000000000000000 ]---\nRIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551\nCode: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00\nRSP: 0018:ffffc900043473d0 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597\nRDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070\nRBP: ffffc90004347578 R0\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "adc4ef10-5726-420c-91b6-a0158eeaf98a",  "id": "MGASA-2025-0113",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5ca71334-a227-49ba-a433-c838a5e76cab",  "id": "CVE-2022-49280",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: prevent underflow in nfssvc_decode_writeargs()\n\nSmatch complains:\n\n\tfs/nfsd/nfsxdr.c:341 nfssvc_decode_writeargs()\n\twarn: no lower bound on 'args->len'\n\nChange the type to unsigned to prevent this issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6bbd9949-f307-4670-8312-c56c058b14bc",  "id": "CVE-2014-3566",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3566"  },  "ratings": [    {      "score": 3.4,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"    }  ],  "cwes": [    310,    329  ],  "analysis": {    "state": "in_triage"  },  "description": "The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the \"POODLE\" issue.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'MSF:ssl_version'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'SNYK:SNYK-UNMANAGED-OPENSSL-2318690'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'SNYK:SNYK-UBUNTU2510-OPENSSL-15027974'"    },    {      "name": "EMBA:sbom:4:exploit",      "value": "'SNYK:SNYK-UBUNTU2504-OPENSSL-9827255'"    },    {      "name": "EMBA:sbom:5:exploit",      "value": "'SNYK:SNYK-UBUNTU2410-OPENSSL-8218669'"    },    {      "name": "EMBA:sbom:6:exploit",      "value": "'SNYK:SNYK-CONAN-OPENSSL-10078017'"    },    {      "name": "EMBA:sbom:7:exploit",      "value": "'SNYK:SNYK-COCOAPODS-OPENSSL-471269'"    },    {      "name": "EMBA:sbom:8:exploit",      "value": "'SNYK:SNYK-CENTOS7-NSSSOFTOKNDEVEL-9508950'"    }  ]},{  "bom-ref": "69dd0a4e-5c2f-424d-ab06-18a8e29e5042",  "id": "CVE-2020-28974",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28974"  },  "ratings": [    {      "score": 5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5f867205-6574-4a5d-a6ae-1e550b53a57c",  "id": "DLA-456-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "295c7fb1-b556-4ec6-a70e-43c042614c47",  "id": "CVE-2023-4458",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4458"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "37db7aaf-c063-4ba9-ae2e-c055ff72928b",  "id": "DSA-3053-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "14da3a5a-c849-4efa-9c24-4250cafbca54",  "id": "CVE-2021-28714",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28714"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8714593c-3fb9-4155-93a9-19a514415795",  "id": "CVE-2024-47713",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()\n\nSince '__dev_queue_xmit()' should be called with interrupts enabled,\nthe following backtrace:\n\nieee80211_do_stop()\n ...\n spin_lock_irqsave(&local->queue_stop_reason_lock, flags)\n ...\n ieee80211_free_txskb()\n  ieee80211_report_used_skb()\n   ieee80211_report_ack_skb()\n    cfg80211_mgmt_tx_status_ext()\n     nl80211_frame_tx_status()\n      genlmsg_multicast_netns()\n       genlmsg_multicast_netns_filtered()\n        nlmsg_multicast_filtered()\n\t netlink_broadcast_filtered()\n\t  do_one_broadcast()\n\t   netlink_broadcast_deliver()\n\t    __netlink_sendskb()\n\t     netlink_deliver_tap()\n\t      __netlink_deliver_tap_skb()\n\t       dev_queue_xmit()\n\t        __dev_queue_xmit() ; with IRQS disabled\n ...\n spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags)\n\nissues the warning (as reported by syzbot reproducer):\n\nWARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120\n\nFix this by implementing a two-phase skb reclamation in\n'ieee80211_do_stop()', where actual work is performed\noutside of a section with interrupts disabled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8d90388c-445f-40c1-8c0f-bb6963fa1ada",  "id": "CVE-2022-3565",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3565"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119,    662  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae6bd094-68d4-44f9-a0ff-bf105e029d94",  "id": "CVE-2011-2182",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2182"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The ldm_frag_add function in fs/partitions/ldm.c in the Linux kernel before 2.6.39.1 does not properly handle memory allocation for non-initial fragments, which might allow local users to conduct buffer overflow attacks, and gain privileges or obtain sensitive information, via a crafted LDM partition table.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1017.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e1c89486-9bb2-4ee6-9b13-4d639adf2ebb",  "id": "CVE-2025-38041",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: sunxi-ng: h616: Reparent GPU clock during frequency changes\n\nThe H616 manual does not state that the GPU PLL supports\ndynamic frequency configuration, so we must take extra care when changing\nthe frequency. Currently any attempt to do device DVFS on the GPU lead\nto panfrost various ooops, and GPU hangs.\n\nThe manual describes the algorithm for changing the PLL\nfrequency, which the CPU PLL notifier code already support, so we reuse\nthat to reparent the GPU clock to GPU1 clock during frequency\nchanges.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "82681d8c-da6f-4f21-903e-074f91b114b8",  "id": "CLSA-2025-1760023124",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e39771bf-f5eb-4ffe-ba13-057ad84f1ce5",  "id": "CVE-2016-0821",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0821"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialized list entry, aka Android internal bug 26186802, a different vulnerability than CVE-2015-3636.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d19835a0-d8fa-4566-8efd-6c395bcc3820",  "id": "CVE-2026-43126",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: mixer: oss: Add card disconnect checkpoints\n\nALSA OSS mixer layer calls the kcontrol ops rather individually, and\npending calls might be not always caught at disconnecting the device.\n\nFor avoiding the potential UAF scenarios, add sanity checks of the\ncard disconnection at each entry point of OSS mixer accesses.  The\nrwsem is taken just before that check, hence the rest context should\nbe covered by that properly.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f8ce40a0-499c-488d-97e0-88ae8036712d",  "id": "CVE-2026-12969",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12969"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e57cd236-44d3-4d8e-97df-a06a7b67eef2",  "id": "OESA-2026-2283",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "e52e445b-24d0-4150-822b-d76563b46e68",      "versions": [        {          "component": "sed",          "version": "4.0"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "54e05381-07de-40fa-bb7a-c8c6d8ab9f2f",  "id": "CVE-2024-56692",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    754  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to do sanity check on node blkaddr in truncate_node()\n\nsyzbot reports a f2fs bug as below:\n\n------------[ cut here ]------------\nkernel BUG at fs/f2fs/segment.c:2534!\nRIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534\nCall Trace:\n truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909\n f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288\n f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856\n evict+0x4e8/0x9b0 fs/inode.c:723\n f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986\n f2fs_create+0x357/0x530 fs/f2fs/namei.c:394\n lookup_open fs/namei.c:3595 [inline]\n open_last_lookups fs/namei.c:3694 [inline]\n path_openat+0x1c03/0x3590 fs/namei.c:3930\n do_filp_open+0x235/0x490 fs/namei.c:3960\n do_sys_openat2+0x13e/0x1d0 fs/open.c:1415\n do_sys_open fs/open.c:1430 [inline]\n __do_sys_openat fs/open.c:1446 [inline]\n __se_sys_openat fs/open.c:1441 [inline]\n __x64_sys_openat+0x247/0x2a0 fs/open.c:1441\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534\n\nThe root cause is: on a fuzzed image, blkaddr in nat entry may be\ncorrupted, then it will cause system panic when using it in\nf2fs_invalidate_blocks(), to avoid this, let's add sanity check on\nnat blkaddr in truncate_node().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "41db700e-bdcf-4334-ac3c-9046ffa55d24",  "id": "CVE-2020-25656",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25656"  },  "ratings": [    {      "score": 4.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c7c4b2fa-b6ee-4a91-a429-b9382cf285ae",  "id": "ROOT-OS-ALPINE-317-CVE-2026-34180",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6319d9b0-bd0f-4a07-b6b2-85c6e3df76e7",  "id": "MGASA-2016-0169",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "30eaa6c9-ee64-4be7-8772-0ebf092c8da1",  "id": "CVE-2024-35947",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndyndbg: fix old BUG_ON in >control parser\n\nFix a BUG_ON from 2009.  Even if it looks \"unreachable\" (I didn't\nreally look), lets make sure by removing it, doing pr_err and return\n-EINVAL instead.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "711d84ac-6b7c-4225-9147-d0e61c2021a2",  "id": "CVE-2020-29374",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29374"  },  "ratings": [    {      "score": 3.6,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    362,    863  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8ea7969b-7c07-4844-a3ec-6d259380b323",  "id": "CVE-2024-57898",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: clear link ID from bitmap during link delete after clean up\n\nCurrently, during link deletion, the link ID is first removed from the\nvalid_links bitmap before performing any clean-up operations. However, some\nfunctions require the link ID to remain in the valid_links bitmap. One\nsuch example is cfg80211_cac_event(). The flow is -\n\nnl80211_remove_link()\n    cfg80211_remove_link()\n        ieee80211_del_intf_link()\n            ieee80211_vif_set_links()\n                ieee80211_vif_update_links()\n                    ieee80211_link_stop()\n                        cfg80211_cac_event()\n\ncfg80211_cac_event() requires link ID to be present but it is cleared\nalready in cfg80211_remove_link(). Ultimately, WARN_ON() is hit.\n\nTherefore, clear the link ID from the bitmap only after completing the link\nclean-up.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e4e9ed07-3b94-47f3-8e11-82ae98c91377",  "id": "CVE-2020-36311",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36311"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a denial of service (soft lockup) by triggering destruction of a large SEV VM (which requires unregistering many encrypted regions), aka CID-7be74942f184.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "434b42ca-fa9c-4949-8b61-dedb48eec944",  "id": "CVE-2021-46904",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46904"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hso: fix null-ptr-deref during tty device unregistration\n\nMultiple ttys try to claim the same the minor number causing a double\nunregistration of the same device. The first unregistration succeeds\nbut the next one results in a null-ptr-deref.\n\nThe get_free_serial_index() function returns an available minor number\nbut doesn't assign it immediately. The assignment is done by the caller\nlater. But before this assignment, calls to get_free_serial_index()\nwould return the same minor number.\n\nFix this by modifying get_free_serial_index to assign the minor number\nimmediately after one is found to be and rename it to obtain_minor()\nto better reflect what it does. Similary, rename set_serial_by_index()\nto release_minor() and modify it to free up the minor number of the\ngiven hso_serial. Every obtain_minor() should have corresponding\nrelease_minor() call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f038871b-ecf5-42f7-b357-1ea9c47453a7",  "id": "CVE-2019-10140",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10140"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local access can create a denial of service situation via NULL pointer dereference in ovl_posix_acl_create function in fs/overlayfs/dir.c. This can allow attackers with ability to create directories on overlayfs to crash the kernel creating a denial of service (DOS).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "992f3577-a08c-4abe-89e7-cd7d807afaa5",  "id": "CVE-2016-4470",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4470"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a814c37-4532-4445-9654-41b35b9eda9d",  "id": "MGASA-2016-0093",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4faf2e69-5512-4fb4-b5b1-7aea04d861f2",  "id": "CVE-2016-6828",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6828"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service (tcp_xmit_retransmit_queue use-after-free and system crash) via a crafted SACK option.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:40731'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:139642/Linux-Kernel-TCP-Related-Read-Use-After-Free.html'"    }  ]},{  "bom-ref": "7e5d066c-d681-4ab9-a7e2-116c9b1dbbc6",  "id": "DLA-1157-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2464fcd5-315d-4e2d-8c76-59ad15b8a98f",  "id": "CVE-2024-42063",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode\n\nsyzbot reported uninit memory usages during map_{lookup,delete}_elem.\n\n==========\nBUG: KMSAN: uninit-value in __dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline]\nBUG: KMSAN: uninit-value in dev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796\n__dev_map_lookup_elem kernel/bpf/devmap.c:441 [inline]\ndev_map_lookup_elem+0xf3/0x170 kernel/bpf/devmap.c:796\n____bpf_map_lookup_elem kernel/bpf/helpers.c:42 [inline]\nbpf_map_lookup_elem+0x5c/0x80 kernel/bpf/helpers.c:38\n___bpf_prog_run+0x13fe/0xe0f0 kernel/bpf/core.c:1997\n__bpf_prog_run256+0xb5/0xe0 kernel/bpf/core.c:2237\n==========\n\nThe reproducer should be in the interpreter mode.\n\nThe C reproducer is trying to run the following bpf prog:\n\n    0: (18) r0 = 0x0\n    2: (18) r1 = map[id:49]\n    4: (b7) r8 = 16777216\n    5: (7b) *(u64 *)(r10 -8) = r8\n    6: (bf) r2 = r10\n    7: (07) r2 += -229\n            ^^^^^^^^^^\n\n    8: (b7) r3 = 8\n    9: (b7) r4 = 0\n   10: (85) call dev_map_lookup_elem#1543472\n   11: (95) exit\n\nIt is due to the \"void *key\" (r2) passed to the helper. bpf allows uninit\nstack memory access for bpf prog with the right privileges. This patch\nuses kmsan_unpoison_memory() to mark the stack as initialized.\n\nThis should address different syzbot reports on the uninit \"void *key\"\nargument during map_{lookup,delete}_elem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5af10444-4990-4d7a-8729-0d882d151e47",  "id": "CVE-2014-1445",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1445"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The wanxl_ioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "94f07281-1115-4500-91af-2415cd116fd2",  "id": "SUSE-SU-2016:1228-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f9c6b6e-cf8d-4a2a-ab29-f49f245b1178",  "id": "CVE-2022-49834",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix use-after-free bug of ns_writer on remount\n\nIf a nilfs2 filesystem is downgraded to read-only due to metadata\ncorruption on disk and is remounted read/write, or if emergency read-only\nremount is performed, detaching a log writer and synchronizing the\nfilesystem can be done at the same time.\n\nIn these cases, use-after-free of the log writer (hereinafter\nnilfs->ns_writer) can happen as shown in the scenario below:\n\n Task1                               Task2\n --------------------------------    ------------------------------\n nilfs_construct_segment\n   nilfs_segctor_sync\n     init_wait\n     init_waitqueue_entry\n     add_wait_queue\n     schedule\n                                     nilfs_remount (R/W remount case)\n\t\t\t\t       nilfs_attach_log_writer\n                                         nilfs_detach_log_writer\n                                           nilfs_segctor_destroy\n                                             kfree\n     finish_wait\n       _raw_spin_lock_irqsave\n         __raw_spin_lock_irqsave\n           do_raw_spin_lock\n             debug_spin_lock_before  <-- use-after-free\n\nWhile Task1 is sleeping, nilfs->ns_writer is freed by Task2.  After Task1\nwaked up, Task1 accesses nilfs->ns_writer which is already freed.  This\nscenario diagram is based on the Shigeru Yoshida's post [1].\n\nThis patch fixes the issue by not detaching nilfs->ns_writer on remount so\nthat this UAF race doesn't happen.  Along with this change, this patch\nalso inserts a few necessary read-only checks with superblock instance\nwhere only the ns_writer pointer was used to check if the filesystem is\nread-only.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d6008845-a117-46d2-8ae2-512f94c0b1b3",  "id": "CVE-2021-34693",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34693"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1083639b-6124-40c0-9185-731adcb88289",  "id": "CVE-2011-4086",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4086"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The journal_unmap_buffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not properly handle the _Delay and _Unwritten buffer head states, which allows local users to cause a denial of service (system crash) by leveraging the presence of an ext4 filesystem that was mounted with a journal.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3fdac36e-1470-4d08-bcc5-642ca61be645",  "id": "CVE-2024-56644",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ipv6: release expired exception dst cached in socket\n\nDst objects get leaked in ip6_negative_advice() when this function is\nexecuted for an expired IPv6 route located in the exception table. There\nare several conditions that must be fulfilled for the leak to occur:\n* an ICMPv6 packet indicating a change of the MTU for the path is received,\n  resulting in an exception dst being created\n* a TCP connection that uses the exception dst for routing packets must\n  start timing out so that TCP begins retransmissions\n* after the exception dst expires, the FIB6 garbage collector must not run\n  before TCP executes ip6_negative_advice() for the expired exception dst\n\nWhen TCP executes ip6_negative_advice() for an exception dst that has\nexpired and if no other socket holds a reference to the exception dst, the\nrefcount of the exception dst is 2, which corresponds to the increment\nmade by dst_init() and the increment made by the TCP socket for which the\nconnection is timing out. The refcount made by the socket is never\nreleased. The refcount of the dst is decremented in sk_dst_reset() but\nthat decrement is counteracted by a dst_hold() intentionally placed just\nbefore the sk_dst_reset() in ip6_negative_advice(). After\nip6_negative_advice() has finished, there is no other object tied to the\ndst. The socket lost its reference stored in sk_dst_cache and the dst is\nno longer in the exception table. The exception dst becomes a leaked\nobject.\n\nAs a result of this dst leak, an unbalanced refcount is reported for the\nloopback device of a net namespace being destroyed under kernels that do\nnot contain e5f80fcf869a (\"ipv6: give an IPv6 dev to blackhole_netdev\"):\nunregister_netdevice: waiting for lo to become free. Usage count = 2\n\nFix the dst leak by removing the dst_hold() in ip6_negative_advice(). The\npatch that introduced the dst_hold() in ip6_negative_advice() was\n92f1655aa2b22 (\"net: fix __dst_negative_advice() race\"). But 92f1655aa2b22\nmerely refactored the code with regards to the dst refcount so the issue\nwas present even before 92f1655aa2b22. The bug was introduced in\n54c1a859efd9f (\"ipv6: Don't drop cache route entry unless timer actually\nexpired.\") where the expired cached route is deleted and the sk_dst_cache\nmember of the socket is set to NULL by calling dst_negative_advice() but\nthe refcount belonging to the socket is left unbalanced.\n\nThe IPv4 version - ipv4_negative_advice() - is not affected by this bug.\nWhen the TCP connection times out ipv4_negative_advice() merely resets the\nsk_dst_cache of the socket while decrementing the refcount of the\nexception dst.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "009e8676-2bc0-4008-b350-f95785f47054",  "id": "CVE-2026-43428",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Limit the length of unkillable synchronous timeouts\n\nThe usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in\nusbcore allow unlimited timeout durations.  And since they use\nuninterruptible waits, this leaves open the possibility of hanging a\ntask for an indefinitely long time, with no way to kill it short of\nunplugging the target device.\n\nTo prevent this sort of problem, enforce a maximum limit on the length\nof these unkillable timeouts.  The limit chosen here, somewhat\narbitrarily, is 60 seconds.  On many systems (although not all) this\nis short enough to avoid triggering the kernel's hung-task detector.\n\nIn addition, clear up the ambiguity of negative timeout values by\ntreating them the same as 0, i.e., using the maximum allowed timeout.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "03e3c007-e799-454d-bfab-c1f0ee826f6b",  "id": "CVE-2026-46241",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: mpc52xx: fix use-after-free on registration failure\n\nMake sure to disable and free the interrupts in case controller\nregistration fails to avoid a potential use-after-free and resource\nleak.\n\nThis issue was flagged by Sashiko when reviewing a controller\nderegistration fix.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cf511689-6e91-4ca5-81a7-cfe9dd6df17d",  "id": "CVE-2022-50306",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix potential out of bound read in ext4_fc_replay_scan()\n\nFor scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain\nspace less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read\nwhen mounting corrupt file system image.\nADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this\nthree tags will read data during scan, tag length couldn't less than data length\nwhich will read.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "884d6e09-7583-4b66-835f-9a882d38f373",  "id": "CVE-2026-45942",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix e4b bitmap inconsistency reports\n\nA bitmap inconsistency issue was observed during stress tests under\nmixed huge-page workloads. Ext4 reported multiple e4b bitmap check\nfailures like:\n\next4_mb_complex_scan_group:2508: group 350, 8179 free clusters as\nper group info. But got 8192 blocks\n\nAnalysis and experimentation confirmed that the issue is caused by a\nrace condition between page migration and bitmap modification. Although\nthis timing window is extremely narrow, it is still hit in practice:\n\nfolio_lock                        ext4_mb_load_buddy\n__migrate_folio\n  check ref count\n  folio_mc_copy                     __filemap_get_folio\n                                      folio_try_get(folio)\n                                  ......\n                                  mb_mark_used\n                                  ext4_mb_unload_buddy\n  __folio_migrate_mapping\n    folio_ref_freeze\nfolio_unlock\n\nThe root cause of this issue is that the fast path of load_buddy only\nincrements the folio's reference count, which is insufficient to prevent\nconcurrent folio migration. We observed that the folio migration process\nacquires the folio lock. Therefore, we can determine whether to take the\nfast path in load_buddy by checking the lock status. If the folio is\nlocked, we opt for the slow path (which acquires the lock) to close this\nconcurrency window.\n\nAdditionally, this change addresses the following issues:\n\nWhen the DOUBLE_CHECK macro is enabled to inspect bitmap-related\nissues, the following error may be triggered:\n\ncorruption in group 324 at byte 784(6272): f in copy != ff on\ndisk/prealloc\n\nAnalysis reveals that this is a false positive. There is a specific race\nwindow where the bitmap and the group descriptor become momentarily\ninconsistent, leading to this error report:\n\next4_mb_load_buddy                   ext4_mb_load_buddy\n  __filemap_get_folio(create|lock)\n    folio_lock\n  ext4_mb_init_cache\n    folio_mark_uptodate\n                                     __filemap_get_folio(no lock)\n                                     ......\n                                     mb_mark_used\n                                       mb_mark_used_double\n  mb_cmp_bitmaps\n                                       mb_set_bits(e4b->bd_bitmap)\n  folio_unlock\n\nThe original logic assumed that since mb_cmp_bitmaps is called when the\nbitmap is newly loaded from disk, the folio lock would be sufficient to\nprevent concurrent access. However, this overlooks a specific race\ncondition: if another process attempts to load buddy and finds the folio\nis already in an uptodate state, it will immediately begin using it without\nholding folio lock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6e9e057d-bb8c-484b-8c52-573f445c060f",  "id": "CVE-2025-38406",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: remove WARN on bad firmware input\n\nIf the firmware gives bad input, that's nothing to do with\nthe driver's stack at this point etc., so the WARN_ON()\ndoesn't add any value. Additionally, this is one of the\ntop syzbot reports now. Just print a message, and as an\nadded bonus, print the sizes too.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51f8e48b-fed9-4eaf-8bef-54355b8aa2e6",  "id": "CVE-2013-4254",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4254"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The validate_event function in arch/arm/kernel/perf_event.c in the Linux kernel before 3.10.8 on the ARM platform allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by adding a hardware event to an event group led by a software event.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b90fe582-192a-4118-9c84-526baeb78e76",  "id": "SUSE-SU-2021:14604-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2aa1fa81-dc94-4fec-aac0-3b92378fb39b",  "id": "CVE-2022-49746",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init\n\nIf the function sdma_load_context() fails, the sdma_desc will be\nfreed, but the allocated desc->bd is forgot to be freed.\n\nWe already met the sdma_load_context() failure case and the log as\nbelow:\n[ 450.699064] imx-sdma 30bd0000.dma-controller: Timeout waiting for CH0 ready\n...\n\nIn this case, the desc->bd will not be freed without this change.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c34f8cf6-12c7-4999-b638-16951eceabf0",  "id": "CVE-2026-23396",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix NULL deref in mesh_matches_local()\n\nmesh_matches_local() unconditionally dereferences ie->mesh_config to\ncompare mesh configuration parameters. When called from\nmesh_rx_csa_frame(), the parsed action-frame elements may not contain a\nMesh Configuration IE, leaving ie->mesh_config NULL and triggering a\nkernel NULL pointer dereference.\n\nThe other two callers are already safe:\n  - ieee80211_mesh_rx_bcn_presp() checks !elems->mesh_config before\n    calling mesh_matches_local()\n  - mesh_plink_get_event() is only reached through\n    mesh_process_plink_frame(), which checks !elems->mesh_config, too\n\nmesh_rx_csa_frame() is the only caller that passes raw parsed elements\nto mesh_matches_local() without guarding mesh_config. An adjacent\nattacker can exploit this by sending a crafted CSA action frame that\nincludes a valid Mesh ID IE but omits the Mesh Configuration IE,\ncrashing the kernel.\n\nThe captured crash log:\n\nOops: general protection fault, probably for non-canonical address ...\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nWorkqueue: events_unbound cfg80211_wiphy_work\n[...]\nCall Trace:\n <TASK>\n ? __pfx_mesh_matches_local (net/mac80211/mesh.c:65)\n ieee80211_mesh_rx_queued_mgmt (net/mac80211/mesh.c:1686)\n [...]\n ieee80211_iface_work (net/mac80211/iface.c:1754 net/mac80211/iface.c:1802)\n [...]\n cfg80211_wiphy_work (net/wireless/core.c:426)\n process_one_work (net/kernel/workqueue.c:3280)\n ? assign_work (net/kernel/workqueue.c:1219)\n worker_thread (net/kernel/workqueue.c:3352)\n ? __pfx_worker_thread (net/kernel/workqueue.c:3385)\n kthread (net/kernel/kthread.c:436)\n [...]\n ret_from_fork_asm (net/arch/x86/entry/entry_64.S:255)\n </TASK>\n\nThis patch adds a NULL check for ie->mesh_config at the top of\nmesh_matches_local() to return false early when the Mesh Configuration\nIE is absent.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e3cbc9d8-508c-4c85-8cb2-aa4c96e52d06",  "id": "CVE-2023-53365",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6mr: Fix skb_under_panic in ip6mr_cache_report()\n\nskbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4\n head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg\n ------------[ cut here ]------------\n kernel BUG at net/core/skbuff.c:192!\n invalid opcode: 0000 [#1] PREEMPT SMP KASAN\n CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n Workqueue: ipv6_addrconf addrconf_dad_work\n RIP: 0010:skb_panic+0x152/0x1d0\n Call Trace:\n  <TASK>\n  skb_push+0xc4/0xe0\n  ip6mr_cache_report+0xd69/0x19b0\n  reg_vif_xmit+0x406/0x690\n  dev_hard_start_xmit+0x17e/0x6e0\n  __dev_queue_xmit+0x2d6a/0x3d20\n  vlan_dev_hard_start_xmit+0x3ab/0x5c0\n  dev_hard_start_xmit+0x17e/0x6e0\n  __dev_queue_xmit+0x2d6a/0x3d20\n  neigh_connected_output+0x3ed/0x570\n  ip6_finish_output2+0x5b5/0x1950\n  ip6_finish_output+0x693/0x11c0\n  ip6_output+0x24b/0x880\n  NF_HOOK.constprop.0+0xfd/0x530\n  ndisc_send_skb+0x9db/0x1400\n  ndisc_send_rs+0x12a/0x6c0\n  addrconf_dad_completed+0x3c9/0xea0\n  addrconf_dad_work+0x849/0x1420\n  process_one_work+0xa22/0x16e0\n  worker_thread+0x679/0x10c0\n  ret_from_fork+0x28/0x60\n  ret_from_fork_asm+0x11/0x20\n\nWhen setup a vlan device on dev pim6reg, DAD ns packet may sent on reg_vif_xmit().\nreg_vif_xmit()\n    ip6mr_cache_report()\n        skb_push(skb, -skb_network_offset(pkt));//skb_network_offset(pkt) is 4\nAnd skb_push declared as:\n\tvoid *skb_push(struct sk_buff *skb, unsigned int len);\n\t\tskb->data -= len;\n\t\t//0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850\nskb->data is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e831a452-a88d-4db3-831e-2c9db590728d",  "id": "CVE-2026-31584",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: fix use-after-free in encoder release path\n\nThe fops_vcodec_release() function frees the context structure (ctx)\nwithout first cancelling any pending or running work in ctx->encode_work.\nThis creates a race window where the workqueue handler (mtk_venc_worker)\nmay still be accessing the context memory after it has been freed.\n\nRace condition:\n\n    CPU 0 (release path)               CPU 1 (workqueue)\n    ---------------------               ------------------\n    fops_vcodec_release()\n      v4l2_m2m_ctx_release()\n        v4l2_m2m_cancel_job()\n        // waits for m2m job \"done\"\n                                        mtk_venc_worker()\n                                          v4l2_m2m_job_finish()\n                                          // m2m job \"done\"\n                                          // BUT worker still running!\n                                          // post-job_finish access:\n                                        other ctx dereferences\n                                          // UAF if ctx already freed\n        // returns (job \"done\")\n      kfree(ctx)  // ctx freed\n\nRoot cause: The v4l2_m2m_ctx_release() only waits for the m2m job\nlifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle.\nAfter v4l2_m2m_job_finish() is called, the m2m framework considers\nthe job complete and v4l2_m2m_ctx_release() returns, but the worker\nfunction continues executing and may still access ctx.\n\nThe work is queued during encode operations via:\n  queue_work(ctx->dev->encode_workqueue, &ctx->encode_work)\nThe worker function accesses ctx->m2m_ctx, ctx->dev, and other ctx\nfields even after calling v4l2_m2m_job_finish().\n\nThis vulnerability was confirmed with KASAN by running an instrumented\ntest module that widens the post-job_finish race window. KASAN detected:\n\n  BUG: KASAN: slab-use-after-free in mtk_venc_worker+0x159/0x180\n  Read of size 4 at addr ffff88800326e000 by task kworker/u8:0/12\n\n  Workqueue: mtk_vcodec_enc_wq mtk_venc_worker\n\n  Allocated by task 47:\n    __kasan_kmalloc+0x7f/0x90\n    fops_vcodec_open+0x85/0x1a0\n\n  Freed by task 47:\n    __kasan_slab_free+0x43/0x70\n    kfree+0xee/0x3a0\n    fops_vcodec_release+0xb7/0x190\n\nFix this by calling cancel_work_sync(&ctx->encode_work) before kfree(ctx).\nThis ensures the workqueue handler is both cancelled (if pending) and\nsynchronized (waits for any running handler to complete) before the\ncontext is freed.\n\nPlacement rationale: The fix is placed after v4l2_ctrl_handler_free()\nand before list_del_init(&ctx->list). At this point, all m2m operations\nare done (v4l2_m2m_ctx_release() has returned), and we need to ensure\nthe workqueue is synchronized before removing ctx from the list and\nfreeing it.\n\nNote: The open error path does NOT need cancel_work_sync() because\nINIT_WORK() only initializes the work structure - it does not schedule\nit. Work is only scheduled later during device_run() operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee205789-0c0f-4e6c-9346-1a14a5de93ca",  "id": "CVE-2014-3611",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3611"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "582abc7c-2a7c-4ccc-adbc-f412414f9de1",  "id": "CVE-2019-11833",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11833"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "559353b9-a3c2-48e5-b92c-5f101c182843",  "id": "CVE-2023-1829",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1829"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root.\n\n\nWe recommend upgrading past commit   8c710f75256bb3cf05ac7b1672c82b92c43f3d28 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/ .",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9589975d-6dd0-4629-b866-aa6137d8ee35",  "id": "DSA-4539-3",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bc273d71-d309-40d9-92c1-653edc82e00b",  "id": "CVE-2025-21653",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute\n\nsyzbot found that TCA_FLOW_RSHIFT attribute was not validated.\nRight shitfing a 32bit integer is undefined for large shift values.\n\nUBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23\nshift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int')\nCPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nWorkqueue: ipv6_addrconf addrconf_dad_work\nCall Trace:\n <TASK>\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n  ubsan_epilogue lib/ubsan.c:231 [inline]\n  __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468\n  flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329\n  tc_classify include/net/tc_wrapper.h:197 [inline]\n  __tcf_classify net/sched/cls_api.c:1771 [inline]\n  tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867\n  sfb_classify net/sched/sch_sfb.c:260 [inline]\n  sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318\n  dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793\n  __dev_xmit_skb net/core/dev.c:3889 [inline]\n  __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400\n  dev_queue_xmit include/linux/netdevice.h:3168 [inline]\n  neigh_hh_output include/net/neighbour.h:523 [inline]\n  neigh_output include/net/neighbour.h:537 [inline]\n  ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236\n  iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82\n  udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173\n  geneve_xmit_skb drivers/net/geneve.c:916 [inline]\n  geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039\n  __netdev_start_xmit include/linux/netdevice.h:5002 [inline]\n  netdev_start_xmit include/linux/netdevice.h:5011 [inline]\n  xmit_one net/core/dev.c:3590 [inline]\n  dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606\n  __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "21e1c48c-b3d1-493f-8192-6ed102915efa",  "id": "CVE-2026-31624",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: clamp report_size in s32ton() to avoid undefined shift\n\ns32ton() shifts by n-1 where n is the field's report_size, a value that\ncomes directly from a HID device.  The HID parser bounds report_size\nonly to <= 256, so a broken HID device can supply a report descriptor\nwith a wide field that triggers shift exponents up to 256 on a 32-bit\ntype when an output report is built via hid_output_field() or\nhid_set_field().\n\nCommit ec61b41918587 (\"HID: core: fix shift-out-of-bounds in\nhid_report_raw_event\") added the same n > 32 clamp to the function\nsnto32(), but s32ton() was never given the same fix as I guess syzbot\nhadn't figured out how to fuzz a device the same way.\n\nFix this up by just clamping the max value of n, just like snto32()\ndoes.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ff00700-55ff-4eac-a9e5-ce8271a0bc5c",  "id": "CVE-2024-50191",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: don't set SB_RDONLY after filesystem errors\n\nWhen the filesystem is mounted with errors=remount-ro, we were setting\nSB_RDONLY flag to stop all filesystem modifications. We knew this misses\nproper locking (sb->s_umount) and does not go through proper filesystem\nremount procedure but it has been the way this worked since early ext2\ndays and it was good enough for catastrophic situation damage\nmitigation. Recently, syzbot has found a way (see link) to trigger\nwarnings in filesystem freezing because the code got confused by\nSB_RDONLY changing under its hands. Since these days we set\nEXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all\nfilesystem modifications, modifying SB_RDONLY shouldn't be needed. So\nstop doing that.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e0a964c-3836-4f6d-b0c6-44ceef54060e",  "id": "SUSE-SU-2023:3529-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "811a53f4-0654-44fc-b8bb-cb3328a79bc0",  "id": "CVE-2022-48789",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix possible use-after-free in transport error_recovery work\n\nWhile nvme_tcp_submit_async_event_work is checking the ctrl and queue\nstate before preparing the AER command and scheduling io_work, in order\nto fully prevent a race where this check is not reliable the error\nrecovery work must flush async_event_work before continuing to destroy\nthe admin queue after setting the ctrl state to RESETTING such that\nthere is no race .submit_async_event and the error recovery handler\nitself changing the ctrl state.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b4937fb-b281-42dd-8082-3551c94447df",  "id": "RHSA-2022:5818",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "96067e2e-1a0a-4ad1-8fe2-e50346cee872",  "id": "CVE-2024-44962",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading\n\nWhen unload the btnxpuart driver, its associated timer will be deleted.\nIf the timer happens to be modified at this moment, it leads to the\nkernel call this timer even after the driver unloaded, resulting in\nkernel panic.\nUse timer_shutdown_sync() instead of del_timer_sync() to prevent rearming.\n\npanic log:\n  Internal error: Oops: 0000000086000007 [#1] PREEMPT SMP\n  Modules linked in: algif_hash algif_skcipher af_alg moal(O) mlan(O) crct10dif_ce polyval_ce polyval_generic   snd_soc_imx_card snd_soc_fsl_asoc_card snd_soc_imx_audmux mxc_jpeg_encdec v4l2_jpeg snd_soc_wm8962 snd_soc_fsl_micfil   snd_soc_fsl_sai flexcan snd_soc_fsl_utils ap130x rpmsg_ctrl imx_pcm_dma can_dev rpmsg_char pwm_fan fuse [last unloaded:   btnxpuart]\n  CPU: 5 PID: 723 Comm: memtester Tainted: G           O       6.6.23-lts-next-06207-g4aef2658ac28 #1\n  Hardware name: NXP i.MX95 19X19 board (DT)\n  pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : 0xffff80007a2cf464\n  lr : call_timer_fn.isra.0+0x24/0x80\n...\n  Call trace:\n   0xffff80007a2cf464\n   __run_timers+0x234/0x280\n   run_timer_softirq+0x20/0x40\n   __do_softirq+0x100/0x26c\n   ____do_softirq+0x10/0x1c\n   call_on_irq_stack+0x24/0x4c\n   do_softirq_own_stack+0x1c/0x2c\n   irq_exit_rcu+0xc0/0xdc\n   el0_interrupt+0x54/0xd8\n   __el0_irq_handler_common+0x18/0x24\n   el0t_64_irq_handler+0x10/0x1c\n   el0t_64_irq+0x190/0x194\n  Code: ???????? ???????? ???????? ???????? (????????)\n  ---[ end trace 0000000000000000 ]---\n  Kernel panic - not syncing: Oops: Fatal exception in interrupt\n  SMP: stopping secondary CPUs\n  Kernel Offset: disabled\n  CPU features: 0x0,c0000000,40028143,1000721b\n  Memory Limit: none\n  ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ea21e07f-cb94-489d-b739-c7ca903c3fd2",  "id": "ROOT-OS-ALPINE-315-CVE-2026-45447",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3883acb4-004d-4e8f-8f51-97d89569a3d3",  "id": "CVE-2026-52998",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_osf: fix potential NULL dereference in ttl check\n\nThe nf_osf_ttl() function accessed skb->dev to perform a local interface\naddress lookup without verifying that the device pointer was valid.\n\nAdditionally, the implementation utilized an in_dev_for_each_ifa_rcu\nloop to match the packet source address against local interface\naddresses. It assumed that packets from the same subnet should not see a\ndecrement on the initial TTL. A packet might appear it is from the same\nsubnet but it actually isn't especially in modern environments with\ncontainers and virtual switching.\n\nRemove the device dereference and interface loop. Replace the logic with\na switch statement that evaluates the TTL according to the ttl_check.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7f877c51-3834-4cc3-a679-c9843f664bb6",  "id": "CVE-2022-48935",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unregister flowtable hooks on netns exit\n\nUnregister flowtable hooks before they are releases via\nnf_tables_flowtable_destroy() otherwise hook core reports UAF.\n\nBUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\nRead of size 4 at addr ffff8880736f7438 by task syz-executor579/3666\n\nCPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106\n dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106\n print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247\n __kasan_report mm/kasan/report.c:433 [inline]\n __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450\n kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450\n nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\n __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429\n nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571\n nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232\n nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652\n\n__nft_release_hook() calls nft_unregister_flowtable_net_hooks() which\nonly unregisters the hooks, then after RCU grace period, it is\nguaranteed that no packets add new entries to the flowtable (no flow\noffload rules and flowtable hooks are reachable from packet path), so it\nis safe to call nf_flow_table_free() which cleans up the remaining\nentries from the flowtable (both software and hardware) and it unbinds\nthe flow_block.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e4b7a02-2a0a-46d6-b068-ac3ee2a97018",  "id": "DSA-2475-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "11056c8d-c707-4561-acd3-64346dd5e0e3",  "id": "CVE-2018-14611",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14611"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 4.17.10. There is a use-after-free in try_merge_free_space() when mounting a crafted btrfs image, because of a lack of chunk type flag checks in btrfs_check_chunk_valid in fs/btrfs/volumes.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "21eb9829-e55f-4a5e-b30b-37c98db3aaf6",  "id": "CVE-2023-0030",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0030"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in the Linux kernel’s nouveau driver in how a user triggers a memory overflow that causes the nvkm_vma_tail function to fail. This flaw allows a local user to crash or potentially escalate their privileges on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "acc7d131-850b-459c-8186-830533feffc7",  "id": "CVE-2016-5195",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5195"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka \"Dirty COW.\"",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:40616'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:139286/DirtyCow-Linux-Kernel-Race-Condition.html'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'PSS:139287/DirtyCow-Local-Root-Proof-Of-Concept.html'"    },    {      "name": "EMBA:sbom:4:exploit",      "value": "'PSS:139922/Linux-Kernel-Dirty-COW-PTRACE_POKEDATA-Privilege-Escalation.html'"    },    {      "name": "EMBA:sbom:5:exploit",      "value": "'PSS:139923/Linux-Kernel-Dirty-COW-PTRACE_POKEDATA-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "5e911aa5-82f3-4514-84c1-0d428c6cdc12",  "id": "CLSA-2023-1683235231",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a42c0861-39ed-46f0-84cf-df4bdf0f7176",  "id": "CVE-2021-47083",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47083"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mediatek: fix global-out-of-bounds issue\n\nWhen eint virtual eint number is greater than gpio number,\nit maybe produce 'desc[eint_n]' size globle-out-of-bounds issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0be07470-4e2d-4fdf-8b36-7fa02535ac42",  "id": "CVE-2016-7910",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7910"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31d13ae3-a147-45b4-8d79-b164754b82d7",  "id": "OESA-2023-1354",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9087dcfb-1b5c-44b0-b9a9-106020bb0625",  "id": "CVE-2024-26931",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix command flush on cable pull\n\nSystem crash due to command failed to flush back to SCSI layer.\n\n BUG: unable to handle kernel NULL pointer dereference at 0000000000000000\n PGD 0 P4D 0\n Oops: 0000 [#1] SMP NOPTI\n CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G           OE    --------- -  - 4.18.0-372.9.1.el8.x86_64 #1\n Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021\n Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc]\n RIP: 0010:__wake_up_common+0x4c/0x190\n Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75\n RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086\n RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000\n RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320\n RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8\n R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20\n R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000\n FS:  0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n  __wake_up_common_lock+0x7c/0xc0\n  qla_nvme_ls_req+0x355/0x4c0 [qla2xxx]\n qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0\n ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc]\n qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200.\n  ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc]\n qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1\n ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc]\n qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0\n  ? __switch_to+0x10c/0x450\n ? process_one_work+0x1a7/0x360\n qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201.\n  ? worker_thread+0x1ce/0x390\n  ? create_worker+0x1a0/0x1a0\n qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70\n  ? kthread+0x10a/0x120\n qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8\n  ? set_kthread_struct+0x40/0x40\n qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed.\n  ? ret_from_fork+0x1f/0x40\n qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout\n\nThe system was under memory stress where driver was not able to allocate an\nSRB to carry out error recovery of cable pull.  The failure to flush causes\nupper layer to start modifying scsi_cmnd.  When the system frees up some\nmemory, the subsequent cable pull trigger another command flush. At this\npoint the driver access a null pointer when attempting to DMA unmap the\nSGL.\n\nAdd a check to make sure commands are flush back on session tear down to\nprevent the null pointer access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f1a20fcd-bb1f-416c-84a5-d08c89602f09",  "id": "CVE-2023-52766",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler\n\nDo not loop over ring headers in hci_dma_irq_handler() that are not\nallocated and enabled in hci_dma_init(). Otherwise out of bounds access\nwill occur from rings->headers[i] access when i >= number of allocated\nring headers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1be5f90e-e376-4a73-b662-55ec075b1e5b",  "id": "CLSA-2025-1765804754",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5d8d0bfd-5413-4633-9727-d6021963779e",  "id": "CVE-2024-47661",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Avoid overflow from uint32_t to uint8_t\n\n[WHAT & HOW]\ndmub_rb_cmd's ramping_boundary has size of uint8_t and it is assigned\n0xFFFF. Fix it by changing it to uint8_t with value of 0xFF.\n\nThis fixes 2 INTEGER_OVERFLOW issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bb12c3b9-6b9c-4453-a5ba-2944845fded1",  "id": "CLEANSTART-2026-AG84392",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "15bf5682-dffe-4397-94fb-fe3c8ad0b7ec",  "id": "ROOT-OS-ALPINE-317-CVE-2026-75803",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b580153e-d091-4747-98ca-564968fd8ccf",  "id": "CVE-2009-2957",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2957"  },  "ratings": [    {      "score": 6.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Heap-based buffer overflow in the tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read (aka RRQ) request.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:9617'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:80896/Core-Security-Technologies-Advisory-2009.0820.html'"    }  ]},{  "bom-ref": "c3daa1fe-1d11-42b2-8289-e5409373bfa9",  "id": "CVE-2022-50106",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address\n\nof_get_next_parent() returns a node pointer with refcount incremented,\nwe should use of_node_put() on it when not need anymore.\nAdd missing of_node_put() in the error path to avoid refcount leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f2a74879-5522-43b1-ad28-fce6f5e1a8e6",  "id": "CVE-2016-3955",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3955"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48155cb6-82b3-4b9e-ba2d-32e9f6e19ec1",  "id": "CVE-2014-9645",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9645"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an \"ifconfig /usbserial up\" command or a \"mount -t /snd_pcm none /\" command.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "22ed6d8a-d482-4d7e-bb3b-716e1798ce1f",  "id": "CVE-2019-16746",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16746"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head, leading to a buffer overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a3400542-1e1f-4ec2-94f3-aaf50ab44e24",  "id": "AZL-89937",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "55c93d08-b31e-4fc3-90f5-1f24ef8af218",  "id": "CVE-2019-11487",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11487"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "247d3e93-6e2e-45b3-8d63-7c963a8b9e58",  "id": "CVE-2026-53320",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()\n\nnilfs_ioctl_mark_blocks_dirty() uses bd_oblocknr to detect dead blocks\nby comparing it with the current block number bd_blocknr. If they differ,\nthe block is considered dead and skipped.\n\nHowever, bd_oblocknr should never be 0 since block 0 typically stores the\nprimary superblock and is never a valid GC target block. A corrupted ioctl\nrequest with bd_oblocknr set to 0 causes the comparison to incorrectly\nmatch when the lookup returns -ENOENT and sets bd_blocknr to 0, bypassing\nthe dead block check and calling nilfs_bmap_mark() on a non-existent\nblock. This causes nilfs_btree_do_lookup() to return -ENOENT, triggering\nthe WARN_ON(ret == -ENOENT).\n\nFix this by rejecting ioctl requests with bd_oblocknr set to 0 at the\nbeginning of each iteration.\n\n[ryusuke: slightly modified the commit message and comments for accuracy]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "da0bea2a-c704-46be-a357-48f1e68e9f0d",  "id": "CVE-2010-4079",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4079"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The ivtvfb_ioctl function in drivers/media/video/ivtv/ivtvfb.c in the Linux kernel before 2.6.36-rc8 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FBIOGET_VBLANK ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "66338090-a2d3-431b-bb20-61319aa06456",  "id": "CVE-2017-10662",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10662"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The sanity_check_raw_super function in fs/f2fs/super.c in the Linux kernel before 4.11.1 does not validate the segment count, which allows local users to gain privileges via unspecified vectors.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2169b886-cd0f-495b-9e0f-d9fa762dc564",  "id": "CVE-2022-50359",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx88: Fix a null-ptr-deref bug in buffer_prepare()\n\nWhen the driver calls cx88_risc_buffer() to prepare the buffer, the\nfunction call may fail, resulting in a empty buffer and null-ptr-deref\nlater in buffer_queue().\n\nThe following log can reveal it:\n\n[   41.822762] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\n[   41.824488] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n[   41.828027] RIP: 0010:buffer_queue+0xc2/0x500\n[   41.836311] Call Trace:\n[   41.836945]  __enqueue_in_driver+0x141/0x360\n[   41.837262]  vb2_start_streaming+0x62/0x4a0\n[   41.838216]  vb2_core_streamon+0x1da/0x2c0\n[   41.838516]  __vb2_init_fileio+0x981/0xbc0\n[   41.839141]  __vb2_perform_fileio+0xbf9/0x1120\n[   41.840072]  vb2_fop_read+0x20e/0x400\n[   41.840346]  v4l2_read+0x215/0x290\n[   41.840603]  vfs_read+0x162/0x4c0\n\nFix this by checking the return value of cx88_risc_buffer()\n\n[hverkuil: fix coding style issues]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b6ef337a-6287-4931-b21f-fbc09fe33772",  "id": "CVE-2025-38069",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops\n\nFix a kernel oops found while testing the stm32_pcie Endpoint driver\nwith handling of PERST# deassertion:\n\nDuring EP initialization, pci_epf_test_alloc_space() allocates all BARs,\nwhich are further freed if epc_set_bar() fails (for instance, due to no\nfree inbound window).\n\nHowever, when pci_epc_set_bar() fails, the error path:\n\n  pci_epc_set_bar() ->\n    pci_epf_free_space()\n\ndoes not clear the previous assignment to epf_test->reg[bar].\n\nThen, if the host reboots, the PERST# deassertion restarts the BAR\nallocation sequence with the same allocation failure (no free inbound\nwindow), creating a double free situation since epf_test->reg[bar] was\ndeallocated and is still non-NULL.\n\nThus, make sure that pci_epf_alloc_space() and pci_epf_free_space()\ninvocations are symmetric, and as such, set epf_test->reg[bar] to NULL\nwhen memory is freed.\n\n[kwilczynski: commit log]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d97fde3e-6b46-4dac-ae45-12bc5bf68cc2",  "id": "CVE-2024-50049",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointer before dereferencing se\n\n[WHAT & HOW]\nse is null checked previously in the same function, indicating\nit might be null; therefore, it must be checked when used again.\n\nThis fixes 1 FORWARD_NULL issue reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b83d1161-8df3-433f-9f09-e93560e188ab",  "id": "CVE-2015-4167",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4167"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain length values, which allows local users to cause a denial of service (incorrect data representation or integer overflow, and OOPS) via a crafted UDF filesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d489edc4-9b0d-48ad-89fe-8df7fe32cf0c",  "id": "CVE-2024-46759",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (adc128d818) Fix underflows seen when writing limit attributes\n\nDIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large\nnegative number such as -9223372036854775808 is provided by the user.\nFix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "73c774c2-b719-4046-af5f-9fe81c3b79b1",  "id": "DLA-2604-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2666c339-d896-4cb6-9353-e4fd832779a7",  "id": "CVE-2026-53306",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    193  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: hvc_iucv: fix off-by-one in number of supported devices\n\nMAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8.\nThis is the number of entries in:\n  static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES];\n\nSometimes hvc_iucv_table[] is limited by:\n(a)\tif (num > hvc_iucv_devices) // for error detection\nor\n(b)\tfor (i = 0; i < hvc_iucv_devices; i++) // in 2 places\n(so these 2 don't agree; second one appears to be correct to me.)\n\nhvc_iucv_devices can be 0..8. This is a counter.\n(c)\tif (hvc_iucv_devices > MAX_HVC_IUCV_LINES)\n\nIf hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8].\nOops.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c97da09c-c90d-4254-9b99-6146029823e2",  "id": "CVE-2023-53485",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev\n\nSyzkaller reported the following issue:\n\nUBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:1965:6\nindex -84 is out of range for type 's8[341]' (aka 'signed char[341]')\nCPU: 1 PID: 4995 Comm: syz-executor146 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:217 [inline]\n __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348\n dbAllocDmapLev+0x3e5/0x430 fs/jfs/jfs_dmap.c:1965\n dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1809\n dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1350\n dbAlloc+0x658/0xca0 fs/jfs/jfs_dmap.c:874\n dtSplitUp fs/jfs/jfs_dtree.c:974 [inline]\n dtInsert+0xda7/0x6b00 fs/jfs/jfs_dtree.c:863\n jfs_create+0x7b6/0xbb0 fs/jfs/namei.c:137\n lookup_open fs/namei.c:3492 [inline]\n open_last_lookups fs/namei.c:3560 [inline]\n path_openat+0x13df/0x3170 fs/namei.c:3788\n do_filp_open+0x234/0x490 fs/namei.c:3818\n do_sys_openat2+0x13f/0x500 fs/open.c:1356\n do_sys_open fs/open.c:1372 [inline]\n __do_sys_openat fs/open.c:1388 [inline]\n __se_sys_openat fs/open.c:1383 [inline]\n __x64_sys_openat+0x247/0x290 fs/open.c:1383\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7f1f4e33f7e9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffc21129578 EFLAGS: 00000246 ORIG_RAX: 0000000000000101\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1f4e33f7e9\nRDX: 000000000000275a RSI: 0000000020000040 RDI: 00000000ffffff9c\nRBP: 00007f1f4e2ff080 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007f1f4e2ff110\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n </TASK>\n\nThe bug occurs when the dbAllocDmapLev()function attempts to access\ndp->tree.stree[leafidx + LEAFIND] while the leafidx value is negative.\n\nTo rectify this, the patch introduces a safeguard within the\ndbAllocDmapLev() function. A check has been added to verify if leafidx is\nnegative. If it is, the function immediately returns an I/O error, preventing\nany further execution that could potentially cause harm.\n\nTested via syzbot.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef93df41-96f7-4a87-b75c-136cb1f8c5b6",  "id": "CVE-2022-49108",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: mediatek: Fix memory leaks on probe\n\nHandle the error branches to free memory where required.\n\nAddresses-Coverity-ID: 1491825 (\"Resource leak\")",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2113449d-83c5-4576-bf29-65154b7ff088",  "id": "CVE-2021-28950",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28950"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    834  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A \"stall on CPU\" can occur because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b4570655-729f-4d0c-b686-c6e6ec762598",  "id": "CLSA-2025-1751888871",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8877df35-8e17-4a81-9d3b-56f00a18d1e5",  "id": "CVE-2023-52903",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: lock overflowing for IOPOLL\n\nsyzbot reports an issue with overflow filling for IOPOLL:\n\nWARNING: CPU: 0 PID: 28 at io_uring/io_uring.c:734 io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734\nCPU: 0 PID: 28 Comm: kworker/u4:1 Not tainted 6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0\nWorkqueue: events_unbound io_ring_exit_work\nCall trace:\n io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734\n io_req_cqe_overflow+0x5c/0x70 io_uring/io_uring.c:773\n io_fill_cqe_req io_uring/io_uring.h:168 [inline]\n io_do_iopoll+0x474/0x62c io_uring/rw.c:1065\n io_iopoll_try_reap_events+0x6c/0x108 io_uring/io_uring.c:1513\n io_uring_try_cancel_requests+0x13c/0x258 io_uring/io_uring.c:3056\n io_ring_exit_work+0xec/0x390 io_uring/io_uring.c:2869\n process_one_work+0x2d8/0x504 kernel/workqueue.c:2289\n worker_thread+0x340/0x610 kernel/workqueue.c:2436\n kthread+0x12c/0x158 kernel/kthread.c:376\n ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863\n\nThere is no real problem for normal IOPOLL as flush is also called with\nuring_lock taken, but it's getting more complicated for IOPOLL|SQPOLL,\nfor which __io_cqring_overflow_flush() happens from the CQ waiting path.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b68808bb-00a8-426e-acbd-38f2bc7f466a",  "id": "CVE-2021-47247",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47247"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix use-after-free of encap entry in neigh update handler\n\nFunction mlx5e_rep_neigh_update() wasn't updated to accommodate rtnl lock\nremoval from TC filter update path and properly handle concurrent encap\nentry insertion/deletion which can lead to following use-after-free:\n\n [23827.464923] ==================================================================\n [23827.469446] BUG: KASAN: use-after-free in mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.470971] Read of size 4 at addr ffff8881d132228c by task kworker/u20:6/21635\n [23827.472251]\n [23827.472615] CPU: 9 PID: 21635 Comm: kworker/u20:6 Not tainted 5.13.0-rc3+ #5\n [23827.473788] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n [23827.475639] Workqueue: mlx5e mlx5e_rep_neigh_update [mlx5_core]\n [23827.476731] Call Trace:\n [23827.477260]  dump_stack+0xbb/0x107\n [23827.477906]  print_address_description.constprop.0+0x18/0x140\n [23827.478896]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.479879]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.480905]  kasan_report.cold+0x7c/0xd8\n [23827.481701]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.482744]  kasan_check_range+0x145/0x1a0\n [23827.493112]  mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.494054]  ? mlx5e_tc_tun_encap_info_equal_generic+0x140/0x140 [mlx5_core]\n [23827.495296]  mlx5e_rep_neigh_update+0x41e/0x5e0 [mlx5_core]\n [23827.496338]  ? mlx5e_rep_neigh_entry_release+0xb80/0xb80 [mlx5_core]\n [23827.497486]  ? read_word_at_a_time+0xe/0x20\n [23827.498250]  ? strscpy+0xa0/0x2a0\n [23827.498889]  process_one_work+0x8ac/0x14e0\n [23827.499638]  ? lockdep_hardirqs_on_prepare+0x400/0x400\n [23827.500537]  ? pwq_dec_nr_in_flight+0x2c0/0x2c0\n [23827.501359]  ? rwlock_bug.part.0+0x90/0x90\n [23827.502116]  worker_thread+0x53b/0x1220\n [23827.502831]  ? process_one_work+0x14e0/0x14e0\n [23827.503627]  kthread+0x328/0x3f0\n [23827.504254]  ? _raw_spin_unlock_irq+0x24/0x40\n [23827.505065]  ? __kthread_bind_mask+0x90/0x90\n [23827.505912]  ret_from_fork+0x1f/0x30\n [23827.506621]\n [23827.506987] Allocated by task 28248:\n [23827.507694]  kasan_save_stack+0x1b/0x40\n [23827.508476]  __kasan_kmalloc+0x7c/0x90\n [23827.509197]  mlx5e_attach_encap+0xde1/0x1d40 [mlx5_core]\n [23827.510194]  mlx5e_tc_add_fdb_flow+0x397/0xc40 [mlx5_core]\n [23827.511218]  __mlx5e_add_fdb_flow+0x519/0xb30 [mlx5_core]\n [23827.512234]  mlx5e_configure_flower+0x191c/0x4870 [mlx5_core]\n [23827.513298]  tc_setup_cb_add+0x1d5/0x420\n [23827.514023]  fl_hw_replace_filter+0x382/0x6a0 [cls_flower]\n [23827.514975]  fl_change+0x2ceb/0x4a51 [cls_flower]\n [23827.515821]  tc_new_tfilter+0x89a/0x2070\n [23827.516548]  rtnetlink_rcv_msg+0x644/0x8c0\n [23827.517300]  netlink_rcv_skb+0x11d/0x340\n [23827.518021]  netlink_unicast+0x42b/0x700\n [23827.518742]  netlink_sendmsg+0x743/0xc20\n [23827.519467]  sock_sendmsg+0xb2/0xe0\n [23827.520131]  ____sys_sendmsg+0x590/0x770\n [23827.520851]  ___sys_sendmsg+0xd8/0x160\n [23827.521552]  __sys_sendmsg+0xb7/0x140\n [23827.522238]  do_syscall_64+0x3a/0x70\n [23827.522907]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n [23827.523797]\n [23827.524163] Freed by task 25948:\n [23827.524780]  kasan_save_stack+0x1b/0x40\n [23827.525488]  kasan_set_track+0x1c/0x30\n [23827.526187]  kasan_set_free_info+0x20/0x30\n [23827.526968]  __kasan_slab_free+0xed/0x130\n [23827.527709]  slab_free_freelist_hook+0xcf/0x1d0\n [23827.528528]  kmem_cache_free_bulk+0x33a/0x6e0\n [23827.529317]  kfree_rcu_work+0x55f/0xb70\n [23827.530024]  process_one_work+0x8ac/0x14e0\n [23827.530770]  worker_thread+0x53b/0x1220\n [23827.531480]  kthread+0x328/0x3f0\n [23827.532114]  ret_from_fork+0x1f/0x30\n [23827.532785]\n [23827.533147] Last potentially related work creation:\n [23827.534007]  kasan_save_stack+0x1b/0x40\n [23827.534710]  kasan_record_aux_stack+0xab/0xc0\n [23827.535492]  kvfree_call_rcu+0x31/0x7b0\n [23827.536206]  mlx5e_tc_del\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8154d233-aeb2-429b-812e-85ea0149d403",  "id": "CVE-2011-3353",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3353"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the fuse_notify_inval_entry function in fs/fuse/dev.c in the Linux kernel before 3.1 allows local users to cause a denial of service (BUG_ON and system crash) by leveraging the ability to mount a FUSE filesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b3a39928-d7dc-4421-a76c-30fed6ead326",  "id": "SUSE-SU-2026:20134-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "70989bf8-7349-4764-a4e7-209fb09b3c79",  "id": "SUSE-SU-2023:1764-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "89631482-6067-4548-be53-268d5bf88159",  "id": "CVE-2024-36897",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Atom Integrated System Info v2_2 for DCN35\n\nNew request from KMD/VBIOS in order to support new UMA carveout\nmodel. This fixes a null dereference from accessing\nCtx->dc_bios->integrated_info while it was NULL.\n\nDAL parses through the BIOS and extracts the necessary\nintegrated_info but was missing a case for the new BIOS\nversion 2.3.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9a4a7006-14db-4f1f-829b-937c42a2c7b4",  "id": "CVE-2022-48979",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix array index out of bound error in DCN32 DML\n\n[Why&How]\nLinkCapacitySupport array is indexed with the number of voltage states and\nnot the number of max DPPs. Fix the error by changing the array\ndeclaration to use the correct (larger) array size of total number of\nvoltage states.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84d367b2-19f0-4de6-8e0a-e66ade93bdb4",  "id": "CVE-2024-57849",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cpum_sf: Handle CPU hotplug remove during sampling\n\nCPU hotplug remove handling triggers the following function\ncall sequence:\n\n   CPUHP_AP_PERF_S390_SF_ONLINE  --> s390_pmu_sf_offline_cpu()\n   ...\n   CPUHP_AP_PERF_ONLINE          --> perf_event_exit_cpu()\n\nThe s390 CPUMF sampling CPU hotplug handler invokes:\n\n s390_pmu_sf_offline_cpu()\n +-->  cpusf_pmu_setup()\n       +--> setup_pmc_cpu()\n            +--> deallocate_buffers()\n\nThis function de-allocates all sampling data buffers (SDBs) allocated\nfor that CPU at event initialization. It also clears the\nPMU_F_RESERVED bit. The CPU is gone and can not be sampled.\n\nWith the event still being active on the removed CPU, the CPU event\nhotplug support in kernel performance subsystem triggers the\nfollowing function calls on the removed CPU:\n\n  perf_event_exit_cpu()\n  +--> perf_event_exit_cpu_context()\n       +--> __perf_event_exit_context()\n\t    +--> __perf_remove_from_context()\n\t         +--> event_sched_out()\n\t              +--> cpumsf_pmu_del()\n\t                   +--> cpumsf_pmu_stop()\n                                +--> hw_perf_event_update()\n\nto stop and remove the event. During removal of the event, the\nsampling device driver tries to read out the remaining samples from\nthe sample data buffers (SDBs). But they have already been freed\n(and may have been re-assigned). This may lead to a use after free\nsituation in which case the samples are most likely invalid. In the\nbest case the memory has not been reassigned and still contains\nvalid data.\n\nRemedy this situation and check if the CPU is still in reserved\nstate (bit PMU_F_RESERVED set). In this case the SDBs have not been\nreleased an contain valid data. This is always the case when\nthe event is removed (and no CPU hotplug off occured).\nIf the PMU_F_RESERVED bit is not set, the SDB buffers are gone.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "115cd96d-ff45-4849-8fa7-f00cbe3b2b30",  "id": "CVE-2009-0789",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0789"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL before 0.9.8k on WIN64 and certain other platforms does not properly handle a malformed ASN.1 structure, which allows remote attackers to cause a denial of service (invalid memory access and application crash) by placing this structure in the public key of a certificate, as demonstrated by an RSA public key.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c4f5bf4c-3026-41c2-83a0-4c6571e1e4dc",  "id": "CVE-2013-7421",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7421"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    269  ],  "analysis": {    "state": "in_triage"  },  "description": "The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a module name in the salg_name field, a different vulnerability than CVE-2014-9644.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d12609f-3489-460c-af54-464478dc1918",  "id": "CVE-2025-38459",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    674,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: Fix infinite recursive call of clip_push().\n\nsyzbot reported the splat below. [0]\n\nThis happens if we call ioctl(ATMARP_MKIP) more than once.\n\nDuring the first call, clip_mkip() sets clip_push() to vcc->push(),\nand the second call copies it to clip_vcc->old_push().\n\nLater, when the socket is close()d, vcc_destroy_socket() passes\nNULL skb to clip_push(), which calls clip_vcc->old_push(),\ntriggering the infinite recursion.\n\nLet's prevent the second ioctl(ATMARP_MKIP) by checking\nvcc->user_back, which is allocated by the first call as clip_vcc.\n\nNote also that we use lock_sock() to prevent racy calls.\n\n[0]:\nBUG: TASK stack guard page was hit at ffffc9000d66fff8 (stack is ffffc9000d670000..ffffc9000d678000)\nOops: stack guard page: 0000 [#1] SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted 6.16.0-rc4-syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:clip_push+0x5/0x720 net/atm/clip.c:191\nCode: e0 8f aa 8c e8 1c ad 5b fa eb ae 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 <41> 57 41 56 41 55 41 54 53 48 83 ec 20 48 89 f3 49 89 fd 48 bd 00\nRSP: 0018:ffffc9000d670000 EFLAGS: 00010246\nRAX: 1ffff1100235a4a5 RBX: ffff888011ad2508 RCX: ffff8880003c0000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888037f01000\nRBP: dffffc0000000000 R08: ffffffff8fa104f7 R09: 1ffffffff1f4209e\nR10: dffffc0000000000 R11: ffffffff8a99b300 R12: ffffffff8a99b300\nR13: ffff888037f01000 R14: ffff888011ad2500 R15: ffff888037f01578\nFS:  000055557ab6d500(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffc9000d66fff8 CR3: 0000000043172000 CR4: 0000000000352ef0\nCall Trace:\n <TASK>\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n...\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n clip_push+0x6dc/0x720 net/atm/clip.c:200\n vcc_destroy_socket net/atm/common.c:183 [inline]\n vcc_release+0x157/0x460 net/atm/common.c:205\n __sock_release net/socket.c:647 [inline]\n sock_close+0xc0/0x240 net/socket.c:1391\n __fput+0x449/0xa70 fs/file_table.c:465\n task_work_run+0x1d1/0x260 kernel/task_work.c:227\n resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]\n exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114\n exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]\n syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]\n syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]\n do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7ff31c98e929\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fffb5aa1f78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4\nRAX: 0000000000000000 RBX: 0000000000012747 RCX: 00007ff31c98e929\nRDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003\nRBP: 00007ff31cbb7ba0 R08: 0000000000000001 R09: 0000000db5aa226f\nR10: 00007ff31c7ff030 R11: 0000000000000246 R12: 00007ff31cbb608c\nR13: 00007ff31cbb6080 R14: ffffffffffffffff R15: 00007fffb5aa2090\n </TASK>\nModules linked in:",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f47bd5fb-a2b9-44ec-968d-9af4bc023752",  "id": "openSUSE-SU-2020:0222-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9e59635f-b8bd-458e-85da-7b652f864915",  "id": "CVE-2025-38190",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: Revert atm_account_tx() if copy_from_iter_full() fails.\n\nIn vcc_sendmsg(), we account skb->truesize to sk->sk_wmem_alloc by\natm_account_tx().\n\nIt is expected to be reverted by atm_pop_raw() later called by\nvcc->dev->ops->send(vcc, skb).\n\nHowever, vcc_sendmsg() misses the same revert when copy_from_iter_full()\nfails, and then we will leak a socket.\n\nLet's factorise the revert part as atm_return_tx() and call it in\nthe failure path.\n\nNote that the corresponding sk_wmem_alloc operation can be found in\nalloc_tx() as of the blamed commit.\n\n  $ git blame -L:alloc_tx net/atm/common.c c55fa3cccbc2c~",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c0eab9ab-132b-440c-bb83-b2c9b4fd9122",  "id": "CVE-2023-52517",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain\n\nPreviously the transfer complete IRQ immediately drained to RX FIFO to\nread any data remaining in FIFO to the RX buffer. This behaviour is\ncorrect when dealing with SPI in interrupt mode. However in DMA mode the\ntransfer complete interrupt still fires as soon as all bytes to be\ntransferred have been stored in the FIFO. At that point data in the FIFO\nstill needs to be picked up by the DMA engine. Thus the drain procedure\nand DMA engine end up racing to read from RX FIFO, corrupting any data\nread. Additionally the RX buffer pointer is never adjusted according to\nDMA progress in DMA mode, thus calling the RX FIFO drain procedure in DMA\nmode is a bug.\nFix corruptions in DMA RX mode by draining RX FIFO only in interrupt mode.\nAlso wait for completion of RX DMA when in DMA mode before returning to\nensure all data has been copied to the supplied memory buffer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be9bf2f4-bb3b-4124-81c0-61b3b678d7d2",  "id": "CVE-2023-52811",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ibmvfc: Remove BUG_ON in the case of an empty event pool\n\nIn practice the driver should never send more commands than are allocated\nto a queue's event pool. In the unlikely event that this happens, the code\nasserts a BUG_ON, and in the case that the kernel is not configured to\ncrash on panic returns a junk event pointer from the empty event list\ncausing things to spiral from there. This BUG_ON is a historical artifact\nof the ibmvfc driver first being upstreamed, and it is well known now that\nthe use of BUG_ON is bad practice except in the most unrecoverable\nscenario. There is nothing about this scenario that prevents the driver\nfrom recovering and carrying on.\n\nRemove the BUG_ON in question from ibmvfc_get_event() and return a NULL\npointer in the case of an empty event pool. Update all call sites to\nibmvfc_get_event() to check for a NULL pointer and perfrom the appropriate\nfailure or recovery action.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f0afaae3-14fb-4c97-af35-8b9829bd4305",  "id": "CVE-2019-19377",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19377"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d6684216-a47b-4f53-aabd-fcd1bcb5a0db",  "id": "CVE-2011-1010",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1010"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the mac_partition function in fs/partitions/mac.c in the Linux kernel before 2.6.37.2 allows local users to cause a denial of service (panic) or possibly have unspecified other impact via a malformed Mac OS partition table.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ec1a586-aafc-4c58-9689-95b4482eca4c",  "id": "CVE-2026-31671",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm_user: fix info leak in build_report()\n\nstruct xfrm_user_report is a __u8 proto field followed by a struct\nxfrm_selector which means there is three \"empty\" bytes of padding, but\nthe padding is never zeroed before copying to userspace.  Fix that up by\nzeroing the structure before setting individual member variables.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "00b15ad7-bb07-4709-beee-93293e3a156c",  "id": "CVE-2022-49276",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: fix memory leak in jffs2_scan_medium\n\nIf an error is returned in jffs2_scan_eraseblock() and some memory\nhas been added to the jffs2_summary *s, we can observe the following\nkmemleak report:\n\n--------------------------------------------\nunreferenced object 0xffff88812b889c40 (size 64):\n  comm \"mount\", pid 692, jiffies 4294838325 (age 34.288s)\n  hex dump (first 32 bytes):\n    40 48 b5 14 81 88 ff ff 01 e0 31 00 00 00 50 00  @H........1...P.\n    00 00 01 00 00 00 01 00 00 00 02 00 00 00 09 08  ................\n  backtrace:\n    [<ffffffffae93a3a3>] __kmalloc+0x613/0x910\n    [<ffffffffaf423b9c>] jffs2_sum_add_dirent_mem+0x5c/0xa0\n    [<ffffffffb0f3afa8>] jffs2_scan_medium.cold+0x36e5/0x4794\n    [<ffffffffb0f3dbe1>] jffs2_do_mount_fs.cold+0xa7/0x2267\n    [<ffffffffaf40acf3>] jffs2_do_fill_super+0x383/0xc30\n    [<ffffffffaf40c00a>] jffs2_fill_super+0x2ea/0x4c0\n    [<ffffffffb0315d64>] mtd_get_sb+0x254/0x400\n    [<ffffffffb0315f5f>] mtd_get_sb_by_nr+0x4f/0xd0\n    [<ffffffffb0316478>] get_tree_mtd+0x498/0x840\n    [<ffffffffaf40bd15>] jffs2_get_tree+0x25/0x30\n    [<ffffffffae9f358d>] vfs_get_tree+0x8d/0x2e0\n    [<ffffffffaea7a98f>] path_mount+0x50f/0x1e50\n    [<ffffffffaea7c3d7>] do_mount+0x107/0x130\n    [<ffffffffaea7c5c5>] __se_sys_mount+0x1c5/0x2f0\n    [<ffffffffaea7c917>] __x64_sys_mount+0xc7/0x160\n    [<ffffffffb10142f5>] do_syscall_64+0x45/0x70\nunreferenced object 0xffff888114b54840 (size 32):\n  comm \"mount\", pid 692, jiffies 4294838325 (age 34.288s)\n  hex dump (first 32 bytes):\n    c0 75 b5 14 81 88 ff ff 02 e0 02 00 00 00 02 00  .u..............\n    00 00 84 00 00 00 44 00 00 00 6b 6b 6b 6b 6b a5  ......D...kkkkk.\n  backtrace:\n    [<ffffffffae93be24>] kmem_cache_alloc_trace+0x584/0x880\n    [<ffffffffaf423b04>] jffs2_sum_add_inode_mem+0x54/0x90\n    [<ffffffffb0f3bd44>] jffs2_scan_medium.cold+0x4481/0x4794\n    [...]\nunreferenced object 0xffff888114b57280 (size 32):\n  comm \"mount\", pid 692, jiffies 4294838393 (age 34.357s)\n  hex dump (first 32 bytes):\n    10 d5 6c 11 81 88 ff ff 08 e0 05 00 00 00 01 00  ..l.............\n    00 00 38 02 00 00 28 00 00 00 6b 6b 6b 6b 6b a5  ..8...(...kkkkk.\n  backtrace:\n    [<ffffffffae93be24>] kmem_cache_alloc_trace+0x584/0x880\n    [<ffffffffaf423c34>] jffs2_sum_add_xattr_mem+0x54/0x90\n    [<ffffffffb0f3a24f>] jffs2_scan_medium.cold+0x298c/0x4794\n    [...]\nunreferenced object 0xffff8881116cd510 (size 16):\n  comm \"mount\", pid 692, jiffies 4294838395 (age 34.355s)\n  hex dump (first 16 bytes):\n    00 00 00 00 00 00 00 00 09 e0 60 02 00 00 6b a5  ..........`...k.\n  backtrace:\n    [<ffffffffae93be24>] kmem_cache_alloc_trace+0x584/0x880\n    [<ffffffffaf423cc4>] jffs2_sum_add_xref_mem+0x54/0x90\n    [<ffffffffb0f3b2e3>] jffs2_scan_medium.cold+0x3a20/0x4794\n    [...]\n--------------------------------------------\n\nTherefore, we should call jffs2_sum_reset_collected(s) on exit to\nrelease the memory added in s. In addition, a new tag \"out_buf\" is\nadded to prevent the NULL pointer reference caused by s being NULL.\n(thanks to Zhang Yi for this analysis)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "07f61a69-cded-436f-9c8d-b215eca1505d",  "id": "CLSA-2022-1650377131",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e514720b-3904-4770-8b29-935e79996fc3",  "id": "CVE-2024-49992",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/stm: Avoid use-after-free issues with crtc and plane\n\nltdc_load() calls functions drm_crtc_init_with_planes(),\ndrm_universal_plane_init() and drm_encoder_init(). These functions\nshould not be called with parameters allocated with devm_kzalloc()\nto avoid use-after-free issues [1].\n\nUse allocations managed by the DRM framework.\n\nFound by Linux Verification Center (linuxtesting.org).\n\n[1]\nhttps://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ecaa952-c2ee-4a0f-bacd-ed58112afcef",  "id": "CVE-2013-3226",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3226"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The sco_sock_recvmsg function in net/bluetooth/sco.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e7911b59-d868-403c-adb6-7eb6cfc09a79",  "id": "CLSA-2023-1676026057",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c8aaed28-54cf-4774-9df8-3548cb51ab3b",  "id": "CVE-2023-52730",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: sdio: fix possible resource leaks in some error paths\n\nIf sdio_add_func() or sdio_init_func() fails, sdio_remove_func() can\nnot release the resources, because the sdio function is not presented\nin these two cases, it won't call of_node_put() or put_device().\n\nTo fix these leaks, make sdio_func_present() only control whether\ndevice_del() needs to be called or not, then always call of_node_put()\nand put_device().\n\nIn error case in sdio_init_func(), the reference of 'card->dev' is\nnot get, to avoid redundant put in sdio_free_func_cis(), move the\nget_device() to sdio_alloc_func() and put_device() to sdio_release_func(),\nit can keep the get/put function be balanced.\n\nWithout this patch, while doing fault inject test, it can get the\nfollowing leak reports, after this fix, the leak is gone.\n\nunreferenced object 0xffff888112514000 (size 2048):\n  comm \"kworker/3:2\", pid 65, jiffies 4294741614 (age 124.774s)\n  hex dump (first 32 bytes):\n    00 e0 6f 12 81 88 ff ff 60 58 8d 06 81 88 ff ff  ..o.....`X......\n    10 40 51 12 81 88 ff ff 10 40 51 12 81 88 ff ff  .@Q......@Q.....\n  backtrace:\n    [<000000009e5931da>] kmalloc_trace+0x21/0x110\n    [<000000002f839ccb>] mmc_alloc_card+0x38/0xb0 [mmc_core]\n    [<0000000004adcbf6>] mmc_sdio_init_card+0xde/0x170 [mmc_core]\n    [<000000007538fea0>] mmc_attach_sdio+0xcb/0x1b0 [mmc_core]\n    [<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core]\n\nunreferenced object 0xffff888112511000 (size 2048):\n  comm \"kworker/3:2\", pid 65, jiffies 4294741623 (age 124.766s)\n  hex dump (first 32 bytes):\n    00 40 51 12 81 88 ff ff e0 58 8d 06 81 88 ff ff  .@Q......X......\n    10 10 51 12 81 88 ff ff 10 10 51 12 81 88 ff ff  ..Q.......Q.....\n  backtrace:\n    [<000000009e5931da>] kmalloc_trace+0x21/0x110\n    [<00000000fcbe706c>] sdio_alloc_func+0x35/0x100 [mmc_core]\n    [<00000000c68f4b50>] mmc_attach_sdio.cold.18+0xb1/0x395 [mmc_core]\n    [<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1ef2d5b1-44c8-4c98-a5fb-92197128852e",  "id": "CVE-2010-4250",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4250"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in the inotify_init1 function in fs/notify/inotify/inotify_user.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory consumption) via vectors involving failed attempts to create files.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:35013'"    }  ]},{  "bom-ref": "a45be94d-b909-4cf2-999e-c011a066ada5",  "id": "CVE-2026-46014",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Add missing save/restore handling of LBR MSRs\n\nMSR_IA32_DEBUGCTLMSR and LBR MSRs are currently not enumerated by\nKVM_GET_MSR_INDEX_LIST, and LBR MSRs cannot be set with KVM_SET_MSRS. So\nsave/restore is completely broken.\n\nFix it by adding the MSRs to msrs_to_save_base, and allowing writes to\nLBR MSRs from userspace only (as they are read-only MSRs) if LBR\nvirtualization is enabled.  Additionally, to correctly restore L1's LBRs\nwhile L2 is running, make sure the LBRs are copied from the captured\nVMCB01 save area in svm_copy_vmrun_state().\n\nNote, for VMX, this also fixes a flaw where MSR_IA32_DEBUGCTLMSR isn't\nreported as an MSR to save/restore.\n\nNote #2, over-reporting MSR_IA32_LASTxxx on Intel is ok, as KVM already\nhandles unsupported reads and writes thanks to commit b5e2fec0ebc3 (\"KVM:\nIgnore DEBUGCTL MSRs with no effect\") (kvm_do_msr_access() will morph the\nunsupported userspace write into a nop).\n\n[sean: guard with lbrv checks, massage changelog]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "14424761-b5eb-4828-89f9-6d808983b100",  "id": "SUSE-SU-2023:2332-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fef7d07e-a57e-488e-af35-31b1e9b5d4ce",  "id": "CVE-2019-19043",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19043"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the i40e_setup_macvlans() function in drivers/net/ethernet/intel/i40e/i40e_main.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering i40e_setup_channel() failures, aka CID-27d461333459.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "170465a8-3072-4a37-b9a8-7cc8bae615d3",  "id": "CLSA-2025-1751142817",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae040bc3-b661-4ff9-8321-e1e47f604ec1",  "id": "CVE-2011-1080",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1080"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_replace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability to replace a table, and then reading a modprobe command line.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "afbeedac-5857-478e-a7ea-6c81205f28e1",  "id": "DSA-5139-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd972c70-7239-4536-a5fd-e480cffdd7c0",  "id": "RHSA-2023:1335",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "88c528b5-9c4c-4a6f-a6bc-c0c79caf69cc",  "id": "CVE-2022-49501",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Run unregister_netdev() before unbind() again\n\nCommit 2c9d6c2b871d (\"usbnet: run unbind() before unregister_netdev()\")\nsought to fix a use-after-free on disconnect of USB Ethernet adapters.\n\nIt turns out that a different fix is necessary to address the issue:\nhttps://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/\n\nSo the commit was not necessary.\n\nThe commit made binding and unbinding of USB Ethernet asymmetrical:\nBefore, usbnet_probe() first invoked the ->bind() callback and then\nregister_netdev().  usbnet_disconnect() mirrored that by first invoking\nunregister_netdev() and then ->unbind().\n\nSince the commit, the order in usbnet_disconnect() is reversed and no\nlonger mirrors usbnet_probe().\n\nOne consequence is that a PHY disconnected (and stopped) in ->unbind()\nis afterwards stopped once more by unregister_netdev() as it closes the\nnetdev before unregistering.  That necessitates a contortion in ->stop()\nbecause the PHY may only be stopped if it hasn't already been\ndisconnected.\n\nReverting the commit allows making the call to phy_stop() unconditional\nin ->stop().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bcc2938a-8eb5-4385-b610-6f8b10eaacca",  "id": "CVE-2023-52462",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix check for attempt to corrupt spilled pointer\n\nWhen register is spilled onto a stack as a 1/2/4-byte register, we set\nslot_type[BPF_REG_SIZE - 1] (plus potentially few more below it,\ndepending on actual spill size). So to check if some stack slot has\nspilled register we need to consult slot_type[7], not slot_type[0].\n\nTo avoid the need to remember and double-check this in the future, just\nuse is_spilled_reg() helper.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aa6c4d1a-666c-4372-8901-5e68b3e6a901",  "id": "OESA-2026-3625",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d050ed91-bd79-4573-8f78-99cbdffecfbf",  "id": "CVE-2025-38321",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Log an error when close_all_cached_dirs fails\n\nUnder low-memory conditions, close_all_cached_dirs() can't move the\ndentries to a separate list to dput() them once the locks are dropped.\nThis will result in a \"Dentry still in use\" error, so add an error\nmessage that makes it clear this is what happened:\n\n[  495.281119] CIFS: VFS: \\\\otters.example.com\\share Out of memory while dropping dentries\n[  495.281595] ------------[ cut here ]------------\n[  495.281887] BUG: Dentry ffff888115531138{i=78,n=/}  still in use (2) [unmount of cifs cifs]\n[  495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0\n\nAlso, bail out of looping through all tcons as soon as a single\nallocation fails, since we're already in trouble, and kmalloc() attempts\nfor subseqeuent tcons are likely to fail just like the first one did.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "58fec7f6-59eb-48be-972e-7065497734cd",  "id": "CVE-2026-23121",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: annotate data-race around dev->work\n\ndev->work can re read locklessly in mISDN_read()\nand mISDN_poll(). Add READ_ONCE()/WRITE_ONCE() annotations.\n\nBUG: KCSAN: data-race in mISDN_ioctl / mISDN_read\n\nwrite to 0xffff88812d848280 of 4 bytes by task 10864 on cpu 1:\n  misdn_add_timer drivers/isdn/mISDN/timerdev.c:175 [inline]\n  mISDN_ioctl+0x2fb/0x550 drivers/isdn/mISDN/timerdev.c:233\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:597 [inline]\n  __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583\n  __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583\n  x64_sys_call+0x14b0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nread to 0xffff88812d848280 of 4 bytes by task 10857 on cpu 0:\n  mISDN_read+0x1f2/0x470 drivers/isdn/mISDN/timerdev.c:112\n  do_loop_readv_writev fs/read_write.c:847 [inline]\n  vfs_readv+0x3fb/0x690 fs/read_write.c:1020\n  do_readv+0xe7/0x210 fs/read_write.c:1080\n  __do_sys_readv fs/read_write.c:1165 [inline]\n  __se_sys_readv fs/read_write.c:1162 [inline]\n  __x64_sys_readv+0x45/0x50 fs/read_write.c:1162\n  x64_sys_call+0x2831/0x3000 arch/x86/include/generated/asm/syscalls_64.h:20\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x00000000 -> 0x00000001",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "50ea6d3b-2ea8-4a64-b862-b884f873916b",  "id": "CVE-2013-4592",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4592"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9 allows local users to cause a denial of service (memory consumption) by leveraging certain device access to trigger movement of memory slots.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fd7eb7df-468d-4a83-8d1f-933197c09278",  "id": "CVE-2022-49178",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick/mspro_block: fix handling of read-only devices\n\nUse set_disk_ro to propagate the read-only state to the block layer\ninstead of checking for it in ->open and leaking a reference in case\nof a read-only device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c8fbcfff-8698-478b-9e62-4e279ab2471e",  "id": "CVE-2026-46235",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: saa7164: add ioremap return checks and cleanups\n\nAdd checks for ioremap return values in saa7164_dev_setup(). If\nioremap for BAR0 or BAR2 fails, release the already allocated PCI\nmemory regions, remove the device from the global list, decrement\nthe device count, and return -ENODEV.\n\nThis prevents potential null pointer dereferences and ensures proper\ncleanup on memory mapping failures.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "62ce7b75-4a68-4138-8620-1fb574c502f4",  "id": "DSA-5417-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f9e8800-6de0-4c9f-b492-45d1ea6c033a",  "id": "CVE-2018-13096",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13096"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. A denial of service (out-of-bounds memory access and BUG) can occur upon encountering an abnormal bitmap size when mounting a crafted f2fs image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1bb2ebcd-a63d-4c6b-8522-699b880cd9d1",  "id": "CVE-2012-2123",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2123"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The cap_bprm_set_creds function in security/commoncap.c in the Linux kernel before 3.3.3 does not properly handle the use of file system capabilities (aka fcaps) for implementing a privileged executable file, which allows local users to bypass intended personality restrictions via a crafted application, as demonstrated by an attack that uses a parent process to disable ASLR.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "19df4f5d-82ff-4426-a2d6-7e99338a6c8f",  "id": "CVE-2021-47578",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47578"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Don't call kcalloc() if size arg is zero\n\nIf the size arg to kcalloc() is zero, it returns ZERO_SIZE_PTR.  Because of\nthat, for a following NULL pointer check to work on the returned pointer,\nkcalloc() must not be called with the size arg equal to zero. Return early\nwithout error before the kcalloc() call if size arg is zero.\n\nBUG: KASAN: null-ptr-deref in memcpy include/linux/fortify-string.h:191 [inline]\nBUG: KASAN: null-ptr-deref in sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974\nWrite of size 4 at addr 0000000000000010 by task syz-executor.1/22789\n\nCPU: 1 PID: 22789 Comm: syz-executor.1 Not tainted 5.15.0-syzk #1\nHardware name: Red Hat KVM, BIOS 1.13.0-2\nCall Trace:\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106\n __kasan_report mm/kasan/report.c:446 [inline]\n kasan_report.cold.14+0x112/0x117 mm/kasan/report.c:459\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0x1a3/0x210 mm/kasan/generic.c:189\n memcpy+0x3b/0x60 mm/kasan/shadow.c:66\n memcpy include/linux/fortify-string.h:191 [inline]\n sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974\n do_dout_fetch drivers/scsi/scsi_debug.c:2954 [inline]\n do_dout_fetch drivers/scsi/scsi_debug.c:2946 [inline]\n resp_verify+0x49e/0x930 drivers/scsi/scsi_debug.c:4276\n schedule_resp+0x4d8/0x1a70 drivers/scsi/scsi_debug.c:5478\n scsi_debug_queuecommand+0x8c9/0x1ec0 drivers/scsi/scsi_debug.c:7533\n scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1520 [inline]\n scsi_queue_rq+0x16b0/0x2d40 drivers/scsi/scsi_lib.c:1699\n blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1639\n __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325\n blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358\n __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1761\n __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1838\n blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891\n blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474\n blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:62\n blk_execute_rq+0xdb/0x360 block/blk-exec.c:102\n sg_scsi_ioctl drivers/scsi/scsi_ioctl.c:621 [inline]\n scsi_ioctl+0x8bb/0x15c0 drivers/scsi/scsi_ioctl.c:930\n sg_ioctl_common+0x172d/0x2710 drivers/scsi/sg.c:1112\n sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1165\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:874 [inline]\n __se_sys_ioctl fs/ioctl.c:860 [inline]\n __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "00267fcc-c8c9-48ab-ab98-5759238a8913",  "id": "CVE-2021-46905",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46905"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hso: fix NULL-deref on disconnect regression\n\nCommit 8a12f8836145 (\"net: hso: fix null-ptr-deref during tty device\nunregistration\") fixed the racy minor allocation reported by syzbot, but\nintroduced an unconditional NULL-pointer dereference on every disconnect\ninstead.\n\nSpecifically, the serial device table must no longer be accessed after\nthe minor has been released by hso_serial_tty_unregister().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99e8d507-289c-48ad-9f29-87d225347709",  "id": "CLSA-2020-1608724134",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6507cb3f-605f-43c3-a5ff-bd1a31772be6",  "id": "CVE-2022-49520",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall\n\nIf a compat process tries to execute an unknown system call above the\n__ARM_NR_COMPAT_END number, the kernel sends a SIGILL signal to the\noffending process. Information about the error is printed to dmesg in\ncompat_arm_syscall() -> arm64_notify_die() -> arm64_force_sig_fault() ->\narm64_show_signal().\n\narm64_show_signal() interprets a non-zero value for\ncurrent->thread.fault_code as an exception syndrome and displays the\nmessage associated with the ESR_ELx.EC field (bits 31:26).\ncurrent->thread.fault_code is set in compat_arm_syscall() ->\narm64_notify_die() with the bad syscall number instead of a valid ESR_ELx\nvalue. This means that the ESR_ELx.EC field has the value that the user set\nfor the syscall number and the kernel can end up printing bogus exception\nmessages*. For example, for the syscall number 0x68000000, which evaluates\nto ESR_ELx.EC value of 0x1A (ESR_ELx_EC_FPAC) the kernel prints this error:\n\n[   18.349161] syscall[300]: unhandled exception: ERET/ERETAA/ERETAB, ESR 0x68000000, Oops - bad compat syscall(2) in syscall[10000+50000]\n[   18.350639] CPU: 2 PID: 300 Comm: syscall Not tainted 5.18.0-rc1 #79\n[   18.351249] Hardware name: Pine64 RockPro64 v2.0 (DT)\n[..]\n\nwhich is misleading, as the bad compat syscall has nothing to do with\npointer authentication.\n\nStop arm64_show_signal() from printing exception syndrome information by\nhaving compat_arm_syscall() set the ESR_ELx value to 0, as it has no\nmeaning for an invalid system call number. The example above now becomes:\n\n[   19.935275] syscall[301]: unhandled exception: Oops - bad compat syscall(2) in syscall[10000+50000]\n[   19.936124] CPU: 1 PID: 301 Comm: syscall Not tainted 5.18.0-rc1-00005-g7e08006d4102 #80\n[   19.936894] Hardware name: Pine64 RockPro64 v2.0 (DT)\n[..]\n\nwhich although shows less information because the syscall number,\nwrongfully advertised as the ESR value, is missing, it is better than\nshowing plainly wrong information. The syscall number can be easily\nobtained with strace.\n\n*A 32-bit value above or equal to 0x8000_0000 is interpreted as a negative\ninteger in compat_arm_syscal() and the condition scno < __ARM_NR_COMPAT_END\nevaluates to true; the syscall will exit to userspace in this case with the\nENOSYS error code instead of arm64_notify_die() being called.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be9495e7-597d-48b1-8f78-b2a9ca93d880",  "id": "DLA-132-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5f5b048d-cbfc-4bdd-8d28-74744023dd25",  "id": "CVE-2022-49407",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix plock invalid read\n\nThis patch fixes an invalid read showed by KASAN. A unlock will allocate a\n\"struct plock_op\" and a followed send_op() will append it to a global\nsend_list data structure. In some cases a followed dev_read() moves it\nto recv_list and dev_write() will cast it to \"struct plock_xop\" and access\nfields which are only available in those structures. At this point an\ninvalid read happens by accessing those fields.\n\nTo fix this issue the \"callback\" field is moved to \"struct plock_op\" to\nindicate that a cast to \"plock_xop\" is allowed and does the additional\n\"plock_xop\" handling if set.\n\nExample of the KASAN output which showed the invalid read:\n\n[ 2064.296453] ==================================================================\n[ 2064.304852] BUG: KASAN: slab-out-of-bounds in dev_write+0x52b/0x5a0 [dlm]\n[ 2064.306491] Read of size 8 at addr ffff88800ef227d8 by task dlm_controld/7484\n[ 2064.308168]\n[ 2064.308575] CPU: 0 PID: 7484 Comm: dlm_controld Kdump: loaded Not tainted 5.14.0+ #9\n[ 2064.310292] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n[ 2064.311618] Call Trace:\n[ 2064.312218]  dump_stack_lvl+0x56/0x7b\n[ 2064.313150]  print_address_description.constprop.8+0x21/0x150\n[ 2064.314578]  ? dev_write+0x52b/0x5a0 [dlm]\n[ 2064.315610]  ? dev_write+0x52b/0x5a0 [dlm]\n[ 2064.316595]  kasan_report.cold.14+0x7f/0x11b\n[ 2064.317674]  ? dev_write+0x52b/0x5a0 [dlm]\n[ 2064.318687]  dev_write+0x52b/0x5a0 [dlm]\n[ 2064.319629]  ? dev_read+0x4a0/0x4a0 [dlm]\n[ 2064.320713]  ? bpf_lsm_kernfs_init_security+0x10/0x10\n[ 2064.321926]  vfs_write+0x17e/0x930\n[ 2064.322769]  ? __fget_light+0x1aa/0x220\n[ 2064.323753]  ksys_write+0xf1/0x1c0\n[ 2064.324548]  ? __ia32_sys_read+0xb0/0xb0\n[ 2064.325464]  do_syscall_64+0x3a/0x80\n[ 2064.326387]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 2064.327606] RIP: 0033:0x7f807e4ba96f\n[ 2064.328470] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 39 87 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 87 f8 ff 48\n[ 2064.332902] RSP: 002b:00007ffd50cfe6e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\n[ 2064.334658] RAX: ffffffffffffffda RBX: 000055cc3886eb30 RCX: 00007f807e4ba96f\n[ 2064.336275] RDX: 0000000000000040 RSI: 00007ffd50cfe7e0 RDI: 0000000000000010\n[ 2064.337980] RBP: 00007ffd50cfe7e0 R08: 0000000000000000 R09: 0000000000000001\n[ 2064.339560] R10: 000055cc3886eb30 R11: 0000000000000293 R12: 000055cc3886eb80\n[ 2064.341237] R13: 000055cc3886eb00 R14: 000055cc3886f590 R15: 0000000000000001\n[ 2064.342857]\n[ 2064.343226] Allocated by task 12438:\n[ 2064.344057]  kasan_save_stack+0x1c/0x40\n[ 2064.345079]  __kasan_kmalloc+0x84/0xa0\n[ 2064.345933]  kmem_cache_alloc_trace+0x13b/0x220\n[ 2064.346953]  dlm_posix_unlock+0xec/0x720 [dlm]\n[ 2064.348811]  do_lock_file_wait.part.32+0xca/0x1d0\n[ 2064.351070]  fcntl_setlk+0x281/0xbc0\n[ 2064.352879]  do_fcntl+0x5e4/0xfe0\n[ 2064.354657]  __x64_sys_fcntl+0x11f/0x170\n[ 2064.356550]  do_syscall_64+0x3a/0x80\n[ 2064.358259]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 2064.360745]\n[ 2064.361511] Last potentially related work creation:\n[ 2064.363957]  kasan_save_stack+0x1c/0x40\n[ 2064.365811]  __kasan_record_aux_stack+0xaf/0xc0\n[ 2064.368100]  call_rcu+0x11b/0xf70\n[ 2064.369785]  dlm_process_incoming_buffer+0x47d/0xfd0 [dlm]\n[ 2064.372404]  receive_from_sock+0x290/0x770 [dlm]\n[ 2064.374607]  process_recv_sockets+0x32/0x40 [dlm]\n[ 2064.377290]  process_one_work+0x9a8/0x16e0\n[ 2064.379357]  worker_thread+0x87/0xbf0\n[ 2064.381188]  kthread+0x3ac/0x490\n[ 2064.383460]  ret_from_fork+0x22/0x30\n[ 2064.385588]\n[ 2064.386518] Second to last potentially related work creation:\n[ 2064.389219]  kasan_save_stack+0x1c/0x40\n[ 2064.391043]  __kasan_record_aux_stack+0xaf/0xc0\n[ 2064.393303]  call_rcu+0x11b/0xf70\n[ 2064.394885]  dlm_process_incoming_buffer+0x47d/0xfd0 [dlm]\n[ 2064.397694]  receive_from_sock+0x290/0x770 \n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7f406230-b126-4d3e-a823-aef0c5fab5b3",  "id": "SUSE-SU-2018:0975-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc957258-2398-4b4c-981c-4127d12f3fa1",  "id": "CVE-2023-52894",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()\n\nIn Google internal bug 265639009 we've received an (as yet) unreproducible\ncrash report from an aarch64 GKI 5.10.149-android13 running device.\n\nAFAICT the source code is at:\n  https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10\n\nThe call stack is:\n  ncm_close() -> ncm_notify() -> ncm_do_notify()\nwith the crash at:\n  ncm_do_notify+0x98/0x270\nCode: 79000d0b b9000a6c f940012a f9400269 (b9405d4b)\n\nWhich I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...):\n\n  // halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification)\n  0B 0D 00 79    strh w11, [x8, #6]\n\n  // word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request)\n  6C 0A 00 B9    str  w12, [x19, #8]\n\n  // x10 (NULL) was read here from offset 0 of valid pointer x9\n  // IMHO we're reading 'cdev->gadget' and getting NULL\n  // gadget is indeed at offset 0 of struct usb_composite_dev\n  2A 01 40 F9    ldr  x10, [x9]\n\n  // loading req->buf pointer, which is at offset 0 of struct usb_request\n  69 02 40 F9    ldr  x9, [x19]\n\n  // x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed\n  4B 5D 40 B9    ldr  w11, [x10, #0x5c]\n\nwhich seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment:\n\n  event->wLength = cpu_to_le16(8);\n  req->length = NCM_STATUS_BYTECOUNT;\n\n  /* SPEED_CHANGE data is up/down speeds in bits/sec */\n  data = req->buf + sizeof *event;\n  data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));\n\nMy analysis of registers and NULL ptr deref crash offset\n  (Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c)\nheavily suggests that the crash is due to 'cdev->gadget' being NULL when executing:\n  data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));\nwhich calls:\n  ncm_bitrate(NULL)\nwhich then calls:\n  gadget_is_superspeed(NULL)\nwhich reads\n  ((struct usb_gadget *)NULL)->max_speed\nand hits a panic.\n\nAFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C.\n(remember there's a GKI KABI reservation of 16 bytes in struct work_struct)\n\nIt's not at all clear to me how this is all supposed to work...\nbut returning 0 seems much better than panic-ing...",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "684f024b-ecae-435e-9c9c-62d1b7001674",  "id": "CVE-2024-57899",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.6,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix mbss changed flags corruption on 32 bit systems\n\nOn 32-bit systems, the size of an unsigned long is 4 bytes,\nwhile a u64 is 8 bytes. Therefore, when using\nor_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE),\nthe code is incorrectly searching for a bit in a 32-bit\nvariable that is expected to be 64 bits in size,\nleading to incorrect bit finding.\n\nSolution: Ensure that the size of the bits variable is correctly\nadjusted for each architecture.\n\n Call Trace:\n  ? show_regs+0x54/0x58\n  ? __warn+0x6b/0xd4\n  ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211]\n  ? report_bug+0x113/0x150\n  ? exc_overflow+0x30/0x30\n  ? handle_bug+0x27/0x44\n  ? exc_invalid_op+0x18/0x50\n  ? handle_exception+0xf6/0xf6\n  ? exc_overflow+0x30/0x30\n  ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211]\n  ? exc_overflow+0x30/0x30\n  ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211]\n  ? ieee80211_mesh_work+0xff/0x260 [mac80211]\n  ? cfg80211_wiphy_work+0x72/0x98 [cfg80211]\n  ? process_one_work+0xf1/0x1fc\n  ? worker_thread+0x2c0/0x3b4\n  ? kthread+0xc7/0xf0\n  ? mod_delayed_work_on+0x4c/0x4c\n  ? kthread_complete_and_exit+0x14/0x14\n  ? ret_from_fork+0x24/0x38\n  ? kthread_complete_and_exit+0x14/0x14\n  ? ret_from_fork_asm+0xf/0x14\n  ? entry_INT80_32+0xf0/0xf0\n\n[restore no-op path for no changes]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1827de7b-63b3-496f-a6b2-4ed9fd5cf0eb",  "id": "RUSTSEC-2023-0024",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e86f7450-2079-4fdc-a135-edcf71dba28a",  "id": "CVE-2025-21708",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: rtl8150: enable basic endpoint checking\n\nSyzkaller reports [1] encountering a common issue of utilizing a wrong\nusb endpoint type during URB submitting stage. This, in turn, triggers\na warning shown below.\n\nFor now, enable simple endpoint checking (specifically, bulk and\ninterrupt eps, testing control one is not essential) to mitigate\nthe issue with a view to do other related cosmetic changes later,\nif they are necessary.\n\n[1] Syzkaller report:\nusb 1-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 1 PID: 2586 at drivers/usb/core/urb.c:503 usb_submit_urb+0xe4b/0x1730 driv>\nModules linked in:\nCPU: 1 UID: 0 PID: 2586 Comm: dhcpcd Not tainted 6.11.0-rc4-syzkaller-00069-gfc88bb11617>\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nRIP: 0010:usb_submit_urb+0xe4b/0x1730 drivers/usb/core/urb.c:503\nCode: 84 3c 02 00 00 e8 05 e4 fc fc 4c 89 ef e8 fd 25 d7 fe 45 89 e0 89 e9 4c 89 f2 48 8>\nRSP: 0018:ffffc9000441f740 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: ffff888112487a00 RCX: ffffffff811a99a9\nRDX: ffff88810df6ba80 RSI: ffffffff811a99b6 RDI: 0000000000000001\nRBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001\nR13: ffff8881023bf0a8 R14: ffff888112452a20 R15: ffff888112487a7c\nFS:  00007fc04eea5740(0000) GS:ffff8881f6300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f0a1de9f870 CR3: 000000010dbd0000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n rtl8150_open+0x300/0xe30 drivers/net/usb/rtl8150.c:733\n __dev_open+0x2d4/0x4e0 net/core/dev.c:1474\n __dev_change_flags+0x561/0x720 net/core/dev.c:8838\n dev_change_flags+0x8f/0x160 net/core/dev.c:8910\n devinet_ioctl+0x127a/0x1f10 net/ipv4/devinet.c:1177\n inet_ioctl+0x3aa/0x3f0 net/ipv4/af_inet.c:1003\n sock_do_ioctl+0x116/0x280 net/socket.c:1222\n sock_ioctl+0x22e/0x6c0 net/socket.c:1341\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl fs/ioctl.c:893 [inline]\n __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fc04ef73d49\n...\n\nThis change has not been tested on real hardware.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0d7a6926-7585-459b-991c-5a6cd4e485c1",  "id": "CVE-2021-38205",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38205"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    824  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/net/ethernet/xilinx/xilinx_emaclite.c in the Linux kernel before 5.13.3 makes it easier for attackers to defeat an ASLR protection mechanism because it prints a kernel pointer (i.e., the real IOMEM pointer).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ca9ea6d4-33dc-41d1-959a-58c4b0855d1a",  "id": "CVE-2024-56593",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()\n\nThis patch fixes a NULL pointer dereference bug in brcmfmac that occurs\nwhen a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs\nare sent from the pkt queue.\n\nThe problem is the number of entries in the pre-allocated sgtable, it is\nnents = max(rxglom_size, txglom_size) + max(rxglom_size, txglom_size) >> 4 + 1.\nGiven the default [rt]xglom_size=32 it's actually 35 which is too small.\nWorst case, the pkt queue can end up with 64 SKBs. This occurs when a new SKB\nis added for each original SKB if tailroom isn't enough to hold tail_pad.\nAt least one sg entry is needed for each SKB. So, eventually the \"skb_queue_walk loop\"\nin brcmf_sdiod_sglist_rw may run out of sg entries. This makes sg_next return\nNULL and this causes the oops.\n\nThe patch sets nents to max(rxglom_size, txglom_size) * 2 to be able handle\nthe worst-case.\nBtw. this requires only 64-35=29 * 16 (or 20 if CONFIG_NEED_SG_DMA_LENGTH) = 464\nadditional bytes of memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "22fadd63-c843-46a3-894d-44ebfadeeb02",  "id": "CVE-2017-17450",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17450"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    862  ],  "analysis": {    "state": "in_triage"  },  "description": "net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9eb7e1ee-785a-4d73-8c86-c2a2c8d5c7c7",  "id": "CVE-2022-49168",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not clean up repair bio if submit fails\n\nThe submit helper will always run bio_endio() on the bio if it fails to\nsubmit, so cleaning up the bio just leads to a variety of use-after-free\nand NULL pointer dereference bugs because we race with the endio\nfunction that is cleaning up the bio.  Instead just return BLK_STS_OK as\nthe repair function has to continue to process the rest of the pages,\nand the endio for the repair bio will do the appropriate cleanup for the\npage that it was given.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "66f0f453-1f23-45d7-b6b6-d4b19e9793c0",  "id": "CVE-2022-42329",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42329"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10e635d3-9d39-4d76-a895-2c7755ed271f",  "id": "CVE-2015-8041",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8041"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record, which triggers an out-of-bounds read.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69e3e64c-fced-43cc-a945-257cf876ee72",  "id": "CVE-2013-3222",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3222"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e6eee676-c940-45da-b2cb-d994ee5e9c56",  "id": "CVE-2006-2937",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-2937"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d allows remote attackers to cause a denial of service (infinite loop and memory consumption) via malformed ASN.1 structures that trigger an improperly handled error condition.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "29bb8734-c628-4466-a691-08fc986f8b4e",  "id": "openSUSE-SU-2024:13181-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9ef21849-7989-4d05-916c-b5f9105c497b",  "id": "RHSA-2026:4163",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f4c3d24f-b201-4dff-beab-e9c956eace8a",  "id": "CVE-2023-52587",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/ipoib: Fix mcast list locking\n\nReleasing the `priv->lock` while iterating the `priv->multicast_list` in\n`ipoib_mcast_join_task()` opens a window for `ipoib_mcast_dev_flush()` to\nremove the items while in the middle of iteration. If the mcast is removed\nwhile the lock was dropped, the for loop spins forever resulting in a hard\nlockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel):\n\n    Task A (kworker/u72:2 below)       | Task B (kworker/u72:0 below)\n    -----------------------------------+-----------------------------------\n    ipoib_mcast_join_task(work)        | ipoib_ib_dev_flush_light(work)\n      spin_lock_irq(&priv->lock)       | __ipoib_ib_dev_flush(priv, ...)\n      list_for_each_entry(mcast,       | ipoib_mcast_dev_flush(dev = priv->dev)\n          &priv->multicast_list, list) |\n        ipoib_mcast_join(dev, mcast)   |\n          spin_unlock_irq(&priv->lock) |\n                                       |   spin_lock_irqsave(&priv->lock, flags)\n                                       |   list_for_each_entry_safe(mcast, tmcast,\n                                       |                  &priv->multicast_list, list)\n                                       |     list_del(&mcast->list);\n                                       |     list_add_tail(&mcast->list, &remove_list)\n                                       |   spin_unlock_irqrestore(&priv->lock, flags)\n          spin_lock_irq(&priv->lock)   |\n                                       |   ipoib_mcast_remove_list(&remove_list)\n   (Here, `mcast` is no longer on the  |     list_for_each_entry_safe(mcast, tmcast,\n    `priv->multicast_list` and we keep |                            remove_list, list)\n    spinning on the `remove_list` of   |  >>>  wait_for_completion(&mcast->done)\n    the other thread which is blocked  |\n    and the list is still valid on     |\n    it's stack.)\n\nFix this by keeping the lock held and changing to GFP_ATOMIC to prevent\neventual sleeps.\nUnfortunately we could not reproduce the lockup and confirm this fix but\nbased on the code review I think this fix should address such lockups.\n\ncrash> bc 31\nPID: 747      TASK: ff1c6a1a007e8000  CPU: 31   COMMAND: \"kworker/u72:2\"\n--\n    [exception RIP: ipoib_mcast_join_task+0x1b1]\n    RIP: ffffffffc0944ac1  RSP: ff646f199a8c7e00  RFLAGS: 00000002\n    RAX: 0000000000000000  RBX: ff1c6a1a04dc82f8  RCX: 0000000000000000\n                                  work (&priv->mcast_task{,.work})\n    RDX: ff1c6a192d60ac68  RSI: 0000000000000286  RDI: ff1c6a1a04dc8000\n           &mcast->list\n    RBP: ff646f199a8c7e90   R8: ff1c699980019420   R9: ff1c6a1920c9a000\n    R10: ff646f199a8c7e00  R11: ff1c6a191a7d9800  R12: ff1c6a192d60ac00\n                                                         mcast\n    R13: ff1c6a1d82200000  R14: ff1c6a1a04dc8000  R15: ff1c6a1a04dc82d8\n           dev                    priv (&priv->lock)     &priv->multicast_list (aka head)\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n--- <NMI exception stack> ---\n #5 [ff646f199a8c7e00] ipoib_mcast_join_task+0x1b1 at ffffffffc0944ac1 [ib_ipoib]\n #6 [ff646f199a8c7e98] process_one_work+0x1a7 at ffffffff9bf10967\n\ncrash> rx ff646f199a8c7e68\nff646f199a8c7e68:  ff1c6a1a04dc82f8 <<< work = &priv->mcast_task.work\n\ncrash> list -hO ipoib_dev_priv.multicast_list ff1c6a1a04dc8000\n(empty)\n\ncrash> ipoib_dev_priv.mcast_task.work.func,mcast_mutex.owner.counter ff1c6a1a04dc8000\n  mcast_task.work.func = 0xffffffffc0944910 <ipoib_mcast_join_task>,\n  mcast_mutex.owner.counter = 0xff1c69998efec000\n\ncrash> b 8\nPID: 8        TASK: ff1c69998efec000  CPU: 33   COMMAND: \"kworker/u72:0\"\n--\n #3 [ff646f1980153d50] wait_for_completion+0x96 at ffffffff9c7d7646\n #4 [ff646f1980153d90] ipoib_mcast_remove_list+0x56 at ffffffffc0944dc6 [ib_ipoib]\n #5 [ff646f1980153de8] ipoib_mcast_dev_flush+0x1a7 at ffffffffc09455a7 [ib_ipoib]\n #6 [ff646f1980153e58] __ipoib_ib_dev_flush+0x1a4 at ffffffffc09431a4 [ib_ipoib]\n #7 [ff\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d1f317b3-b8a5-4764-93fe-86c986a5b800",  "id": "CVE-2019-16413",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16413"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly, which causes an i_size_read() infinite loop and denial of service on SMP systems.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c93ec623-28bc-4a84-a2a7-94f14241325f",  "id": "CVE-2022-49766",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: Bounds-check struct nlmsgerr creation\n\nIn preparation for FORTIFY_SOURCE doing bounds-check on memcpy(),\nswitch from __nlmsg_put to nlmsg_put(), and explain the bounds check\nfor dealing with the memcpy() across a composite flexible array struct.\nAvoids this future run-time warning:\n\n  memcpy: detected field-spanning write (size 32) of single field \"&errmsg->msg\" at net/netlink/af_netlink.c:2447 (size 16)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4c9720bc-f7c0-4dc5-ae24-e9e4147fa71d",  "id": "CVE-2014-7842",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7842"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to CVE-2010-5313.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d4aab804-515c-435c-9685-eea55967a416",  "id": "CVE-2022-50386",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix user-after-free\n\nThis uses l2cap_chan_hold_unless_zero() after calling\n__l2cap_get_chan_blah() to prevent the following trace:\n\nBluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref\n*kref)\nBluetooth: chan 0000000023c4974d\nBluetooth: parent 00000000ae861c08\n==================================================================\nBUG: KASAN: use-after-free in __mutex_waiter_is_first\nkernel/locking/mutex.c:191 [inline]\nBUG: KASAN: use-after-free in __mutex_lock_common\nkernel/locking/mutex.c:671 [inline]\nBUG: KASAN: use-after-free in __mutex_lock+0x278/0x400\nkernel/locking/mutex.c:729\nRead of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1135c090-bf87-4fa9-9e71-1adcc044c532",  "id": "CVE-2024-44957",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen: privcmd: Switch from mutex to spinlock for irqfds\n\nirqfd_wakeup() gets EPOLLHUP, when it is called by\neventfd_release() by way of wake_up_poll(&ctx->wqh, EPOLLHUP), which\ngets called under spin_lock_irqsave(). We can't use a mutex here as it\nwill lead to a deadlock.\n\nFix it by switching over to a spin lock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "659bf028-e229-4275-b873-dd03951031ef",  "id": "CVE-2017-18208",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18208"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "55fbf651-4cf2-40c5-bc4d-430596999b07",  "id": "CVE-2011-4916",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4916"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /dev/pts/ and /dev/tty*.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4c3d239b-d98b-4e80-978c-f1a3b54d054d",  "id": "CVE-2011-0726",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0726"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE binary.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "50706133-92e8-49a0-a0c9-aeb7f99d3aad",  "id": "CVE-2022-48841",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix NULL pointer dereference in ice_update_vsi_tx_ring_stats()\n\nIt is possible to do NULL pointer dereference in routine that updates\nTx ring stats. Currently only stats and bytes are updated when ring\npointer is valid, but later on ring is accessed to propagate gathered Tx\nstats onto VSI stats.\n\nChange the existing logic to move to next ring when ring is NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2b4e3e3-c68c-4777-bdad-b136e7dd1167",  "id": "SUSE-SU-2015:2275-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "14932738-5b59-42be-9400-17801335e2a5",  "id": "CVE-2015-7613",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7613"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e290421-6fbd-4151-adc1-f120329771e7",  "id": "CVE-2021-28715",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28715"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default). Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time. (CVE-2021-28715) The timeout could even never trigger if the guest manages to have only one free slot in its RX queue ring page and the next package would require more than one free slot, which may be the case when using GSO, XDP, or software hashing. (CVE-2021-28714)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e8fa3d46-e067-4dd1-8795-911863b92371",  "id": "CVE-2011-1020",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1020"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:41770'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:141912/Linux-Kernel-2.6.32-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "a3ee5fb3-b2c4-4951-b79c-e79b1b1347c4",  "id": "CVE-2012-5532",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5532"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.8-rc1, allows local users to cause a denial of service (daemon exit) via a crafted application that sends a Netlink message.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2669.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aab8c24f-88e7-4b59-8403-f1dfe23945f8",  "id": "CVE-2023-53257",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check S1G action frame size\n\nBefore checking the action code, check that it even\nexists in the frame.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "78ab1987-3ef5-4682-8be9-1cb4567e71aa",  "id": "CVE-2019-19080",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19080"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c44766a4-c80a-4265-a270-b8f906be2838",  "id": "CVE-2024-50059",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition\n\nIn the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev\nfunction, then &sndev->check_link_status_work is bound with\ncheck_link_status_work. switchtec_ntb_link_notification may be called\nto start the work.\n\nIf we remove the module which will call switchtec_ntb_remove to make\ncleanup, it will free sndev through kfree(sndev), while the work\nmentioned above will be used. The sequence of operations that may lead\nto a UAF bug is as follows:\n\nCPU0                                 CPU1\n\n                        | check_link_status_work\nswitchtec_ntb_remove    |\nkfree(sndev);           |\n                        | if (sndev->link_force_down)\n                        | // use sndev\n\nFix it by ensuring that the work is canceled before proceeding with\nthe cleanup in switchtec_ntb_remove.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c8595f88-4e3f-4774-b077-1c1ab2c39725",  "id": "ROOT-OS-ALPINE-317-CVE-2026-54874",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e8b3b92e-7cf1-4861-a847-f938d759901a",  "id": "CVE-2019-15927",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15927"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 4.20.2. An out-of-bounds access exists in the function build_audio_procunit in the file sound/usb/mixer.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "72c26228-eaca-4ccb-a5a1-2fb21d2a2635",  "id": "SUSE-SU-2019:2397-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c1c5f967-afc6-4896-a0b1-6dd5922455c1",  "id": "CVE-2018-10901",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10901"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    665  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cpu variables. An attacker can use this to escalate their privileges.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5c74258d-09f8-40da-a40a-4507dceee4f7",  "id": "AZL-92843",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2a889fb0-24e4-4783-a06e-df710207d44d",  "id": "CVE-2023-53675",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ses: Fix possible desc_ptr out-of-bounds accesses\n\nSanitize possible desc_ptr out-of-bounds accesses in\nses_enclosure_data_process().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a2e7e19-4f5e-4656-a5ab-a6be19bcbfe6",  "id": "DSA-3413-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d605b12f-2c7b-4872-bf6e-8b994ddf8231",  "id": "CVE-2016-3841",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3841"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "16c4aef1-8d3a-4224-83e6-3b886e67b888",  "id": "DSA-5169-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b7ac3af6-9a7c-4bf6-996d-e3d0378de2a8",  "id": "CVE-2025-22053",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ibmveth: make veth_pool_store stop hanging\n\nv2:\n- Created a single error handling unlock and exit in veth_pool_store\n- Greatly expanded commit message with previous explanatory-only text\n\nSummary: Use rtnl_mutex to synchronize veth_pool_store with itself,\nibmveth_close and ibmveth_open, preventing multiple calls in a row to\nnapi_disable.\n\nBackground: Two (or more) threads could call veth_pool_store through\nwriting to /sys/devices/vio/30000002/pool*/*. You can do this easily\nwith a little shell script. This causes a hang.\n\nI configured LOCKDEP, compiled ibmveth.c with DEBUG, and built a new\nkernel. I ran this test again and saw:\n\n    Setting pool0/active to 0\n    Setting pool1/active to 1\n    [   73.911067][ T4365] ibmveth 30000002 eth0: close starting\n    Setting pool1/active to 1\n    Setting pool1/active to 0\n    [   73.911367][ T4366] ibmveth 30000002 eth0: close starting\n    [   73.916056][ T4365] ibmveth 30000002 eth0: close complete\n    [   73.916064][ T4365] ibmveth 30000002 eth0: open starting\n    [  110.808564][  T712] systemd-journald[712]: Sent WATCHDOG=1 notification.\n    [  230.808495][  T712] systemd-journald[712]: Sent WATCHDOG=1 notification.\n    [  243.683786][  T123] INFO: task stress.sh:4365 blocked for more than 122 seconds.\n    [  243.683827][  T123]       Not tainted 6.14.0-01103-g2df0c02dab82-dirty #8\n    [  243.683833][  T123] \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n    [  243.683838][  T123] task:stress.sh       state:D stack:28096 pid:4365  tgid:4365  ppid:4364   task_flags:0x400040 flags:0x00042000\n    [  243.683852][  T123] Call Trace:\n    [  243.683857][  T123] [c00000000c38f690] [0000000000000001] 0x1 (unreliable)\n    [  243.683868][  T123] [c00000000c38f840] [c00000000001f908] __switch_to+0x318/0x4e0\n    [  243.683878][  T123] [c00000000c38f8a0] [c000000001549a70] __schedule+0x500/0x12a0\n    [  243.683888][  T123] [c00000000c38f9a0] [c00000000154a878] schedule+0x68/0x210\n    [  243.683896][  T123] [c00000000c38f9d0] [c00000000154ac80] schedule_preempt_disabled+0x30/0x50\n    [  243.683904][  T123] [c00000000c38fa00] [c00000000154dbb0] __mutex_lock+0x730/0x10f0\n    [  243.683913][  T123] [c00000000c38fb10] [c000000001154d40] napi_enable+0x30/0x60\n    [  243.683921][  T123] [c00000000c38fb40] [c000000000f4ae94] ibmveth_open+0x68/0x5dc\n    [  243.683928][  T123] [c00000000c38fbe0] [c000000000f4aa20] veth_pool_store+0x220/0x270\n    [  243.683936][  T123] [c00000000c38fc70] [c000000000826278] sysfs_kf_write+0x68/0xb0\n    [  243.683944][  T123] [c00000000c38fcb0] [c0000000008240b8] kernfs_fop_write_iter+0x198/0x2d0\n    [  243.683951][  T123] [c00000000c38fd00] [c00000000071b9ac] vfs_write+0x34c/0x650\n    [  243.683958][  T123] [c00000000c38fdc0] [c00000000071bea8] ksys_write+0x88/0x150\n    [  243.683966][  T123] [c00000000c38fe10] [c0000000000317f4] system_call_exception+0x124/0x340\n    [  243.683973][  T123] [c00000000c38fe50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec\n    ...\n    [  243.684087][  T123] Showing all locks held in the system:\n    [  243.684095][  T123] 1 lock held by khungtaskd/123:\n    [  243.684099][  T123]  #0: c00000000278e370 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x50/0x248\n    [  243.684114][  T123] 4 locks held by stress.sh/4365:\n    [  243.684119][  T123]  #0: c00000003a4cd3f8 (sb_writers#3){.+.+}-{0:0}, at: ksys_write+0x88/0x150\n    [  243.684132][  T123]  #1: c000000041aea888 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x154/0x2d0\n    [  243.684143][  T123]  #2: c0000000366fb9a8 (kn->active#64){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x160/0x2d0\n    [  243.684155][  T123]  #3: c000000035ff4cb8 (&dev->lock){+.+.}-{3:3}, at: napi_enable+0x30/0x60\n    [  243.684166][  T123] 5 locks held by stress.sh/4366:\n    [  243.684170][  T123]  #0: c00000003a4cd3f8 (sb_writers#3){.+.+}-{0:0}, at: ksys_write+0x88/0x150\n    [  243.\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f0f3b886-a630-4557-b843-5723f227b284",  "id": "CVE-2017-6074",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6074"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:41457'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:141339/Linux-Kernel-4.4.0-Ubuntu-DCCP-Double-Free-Crash.html'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'PSS:141331/Linux-Kernel-4.4.0-Ubuntu-DCCP-Double-Free-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "3045b149-2773-44cb-bcc4-a93430f59949",  "id": "DSA-2896-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f7100d56-260a-4c6e-8d90-e759172a063a",  "id": "CLSA-2024-1720179161",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "683302ad-c3ec-4076-b4e1-397e608ad17e",  "id": "CVE-2014-2889",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2889"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Off-by-one error in the bpf_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 3.1.8, when BPF JIT is enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges via a long jump after a conditional jump.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "73c283a6-fbb3-49be-ad2b-b926ca3a0928",  "id": "CVE-2025-21721",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: handle errors that nilfs_prepare_chunk() may return\n\nPatch series \"nilfs2: fix issues with rename operations\".\n\nThis series fixes BUG_ON check failures reported by syzbot around rename\noperations, and a minor behavioral issue where the mtime of a child\ndirectory changes when it is renamed instead of moved.\n\n\nThis patch (of 2):\n\nThe directory manipulation routines nilfs_set_link() and\nnilfs_delete_entry() rewrite the directory entry in the folio/page\npreviously read by nilfs_find_entry(), so error handling is omitted on the\nassumption that nilfs_prepare_chunk(), which prepares the buffer for\nrewriting, will always succeed for these.  And if an error is returned, it\ntriggers the legacy BUG_ON() checks in each routine.\n\nThis assumption is wrong, as proven by syzbot: the buffer layer called by\nnilfs_prepare_chunk() may call nilfs_get_block() if necessary, which may\nfail due to metadata corruption or other reasons.  This has been there all\nalong, but improved sanity checks and error handling may have made it more\nreproducible in fuzzing tests.\n\nFix this issue by adding missing error paths in nilfs_set_link(),\nnilfs_delete_entry(), and their caller nilfs_rename().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4379d944-2618-4302-b006-ef5f4b428ff7",  "id": "CVE-2013-6367",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6367"  },  "ratings": [    {      "score": 5.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "The apic_get_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via crafted modifications of the TMICT value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d4bf6b8-dc03-492a-9f12-0d1f57d6373f",  "id": "CVE-2026-43496",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked\n\nWhen red qdisc has children (eg qfq qdisc) whose peek() callback is\nqdisc_peek_dequeued(), we could get a kernel panic. When the parent of such\nqdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from\nits child (red in this case), it will do the following:\n 1a. do a peek() - and when sensing there's an skb the child can offer, then\n     - the child in this case(red) calls its child's (qfq) peek.\n        qfq does the right thing and will return the gso_skb queue packet.\n        Note: if there wasnt a gso_skb entry then qfq will store it there.\n 1b. invoke a dequeue() on the child (red). And herein lies the problem.\n     - red will call the child's dequeue() which will essentially just\n       try to grab something of qfq's queue.\n\n[   78.667668][  T363] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]\n[   78.667927][  T363] CPU: 1 UID: 0 PID: 363 Comm: ping Not tainted 7.1.0-rc1-00033-g46f74a3f7d57-dirty #790 PREEMPT(full)\n[   78.668263][  T363] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[   78.668486][  T363] RIP: 0010:qfq_dequeue+0x446/0xc90 [sch_qfq]\n[   78.668718][  T363] Code: 54 c0 e8 dd 90 00 f1 48 c7 c7 e0 03 54 c0 48 89 de e8 ce 90 00 f1 48 8d 7b 48 b8 ff ff 37 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 <80> 3c 02 00 74 05 e8 ef a1 e1 f1 48 8b 7b 48 48 8d 54 24 58 48 8d\n[   78.669312][  T363] RSP: 0018:ffff88810de573e0 EFLAGS: 00010216\n[   78.669533][  T363] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[   78.669790][  T363] RDX: 0000000000000009 RSI: 0000000000000004 RDI: 0000000000000048\n[   78.670044][  T363] RBP: ffff888110dc4000 R08: ffffffffb1b0885a R09: fffffbfff6ba9078\n[   78.670297][  T363] R10: 0000000000000003 R11: ffff888110e31c80 R12: 0000001880000000\n[   78.670560][  T363] R13: ffff888110dc4150 R14: ffff888110dc42b8 R15: 0000000000000200\n[   78.670814][  T363] FS:  00007f66a8f09c40(0000) GS:ffff888163428000(0000) knlGS:0000000000000000\n[   78.671110][  T363] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   78.671324][  T363] CR2: 000055db4c6a30a8 CR3: 000000010da67000 CR4: 0000000000750ef0\n[   78.671585][  T363] PKRU: 55555554\n[   78.671713][  T363] Call Trace:\n[   78.671843][  T363]  <TASK>\n[   78.671936][  T363]  ? __pfx_qfq_dequeue+0x10/0x10 [sch_qfq]\n[   78.672148][  T363]  ? __pfx__printk+0x10/0x10\n[   78.672322][  T363]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   78.672496][  T363]  ? lockdep_hardirqs_on_prepare+0xa8/0x1a0\n[   78.672706][  T363]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   78.672875][  T363]  ? trace_hardirqs_on+0x19/0x1a0\n[   78.673047][  T363]  red_dequeue+0x65/0x270 [sch_red]\n[   78.673217][  T363]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   78.673385][  T363]  tbf_dequeue.cold+0xb0/0x70c [sch_tbf]\n[   78.673566][  T363]  __qdisc_run+0x169/0x1900\n\nThe right thing to do in #1b is to grab the skb off gso_skb queue.\nThis patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked()\nmethod instead.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e3997a3d-9bff-4fe0-b024-d03990b26417",  "id": "CVE-2024-41068",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/sclp: Fix sclp_init() cleanup on failure\n\nIf sclp_init() fails it only partially cleans up: if there are multiple\nfailing calls to sclp_init() sclp_state_change_event will be added several\ntimes to sclp_reg_list, which results in the following warning:\n\n------------[ cut here ]------------\nlist_add double add: new=000003ffe1598c10, prev=000003ffe1598bf0, next=000003ffe1598c10.\nWARNING: CPU: 0 PID: 1 at lib/list_debug.c:35 __list_add_valid_or_report+0xde/0xf8\nCPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3\nKrnl PSW : 0404c00180000000 000003ffe0d6076a (__list_add_valid_or_report+0xe2/0xf8)\n           R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3\n...\nCall Trace:\n [<000003ffe0d6076a>] __list_add_valid_or_report+0xe2/0xf8\n([<000003ffe0d60766>] __list_add_valid_or_report+0xde/0xf8)\n [<000003ffe0a8d37e>] sclp_init+0x40e/0x450\n [<000003ffe00009f2>] do_one_initcall+0x42/0x1e0\n [<000003ffe15b77a6>] do_initcalls+0x126/0x150\n [<000003ffe15b7a0a>] kernel_init_freeable+0x1ba/0x1f8\n [<000003ffe0d6650e>] kernel_init+0x2e/0x180\n [<000003ffe000301c>] __ret_from_fork+0x3c/0x60\n [<000003ffe0d759ca>] ret_from_fork+0xa/0x30\n\nFix this by removing sclp_state_change_event from sclp_reg_list when\nsclp_init() fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95bfc88b-d4c6-4357-80d7-828f088b7e2e",  "id": "DLA-1435-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3db7a443-98a0-4b9e-81c6-dda851813f3e",  "id": "RLSA-2026:22314",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4b15b315-0f0c-4593-b7aa-295c44ff01c2",  "id": "CVE-2026-43048",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Mitigate potential OOB by removing bogus memset()\n\nThe memset() in hid_report_raw_event() has the good intention of\nclearing out bogus data by zeroing the area from the end of the incoming\ndata string to the assumed end of the buffer.  However, as we have\npreviously seen, doing so can easily result in OOB reads and writes in\nthe subsequent thread of execution.\n\nThe current suggestion from one of the HID maintainers is to remove the\nmemset() and simply return if the incoming event buffer size is not\nlarge enough to fill the associated report.\n\nSuggested-by Benjamin Tissoires <bentiss@kernel.org>\n\n[bentiss: changed the return value]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "02f5504e-3f3a-4a58-9760-340f36ae50a8",  "id": "CVE-2022-48733",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free after failure to create a snapshot\n\nAt ioctl.c:create_snapshot(), we allocate a pending snapshot structure and\nthen attach it to the transaction's list of pending snapshots. After that\nwe call btrfs_commit_transaction(), and if that returns an error we jump\nto 'fail' label, where we kfree() the pending snapshot structure. This can\nresult in a later use-after-free of the pending snapshot:\n\n1) We allocated the pending snapshot and added it to the transaction's\n   list of pending snapshots;\n\n2) We call btrfs_commit_transaction(), and it fails either at the first\n   call to btrfs_run_delayed_refs() or btrfs_start_dirty_block_groups().\n   In both cases, we don't abort the transaction and we release our\n   transaction handle. We jump to the 'fail' label and free the pending\n   snapshot structure. We return with the pending snapshot still in the\n   transaction's list;\n\n3) Another task commits the transaction. This time there's no error at\n   all, and then during the transaction commit it accesses a pointer\n   to the pending snapshot structure that the snapshot creation task\n   has already freed, resulting in a user-after-free.\n\nThis issue could actually be detected by smatch, which produced the\nfollowing warning:\n\n  fs/btrfs/ioctl.c:843 create_snapshot() warn: '&pending_snapshot->list' not removed from list\n\nSo fix this by not having the snapshot creation ioctl directly add the\npending snapshot to the transaction's list. Instead add the pending\nsnapshot to the transaction handle, and then at btrfs_commit_transaction()\nwe add the snapshot to the list only when we can guarantee that any error\nreturned after that point will result in a transaction abort, in which\ncase the ioctl code can safely free the pending snapshot and no one can\naccess it anymore.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cecd6eb1-95c4-4c8d-a7b4-f7a323b00175",  "id": "CVE-2022-49174",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix ext4_mb_mark_bb() with flex_bg with fast_commit\n\nIn case of flex_bg feature (which is by default enabled), extents for\nany given inode might span across blocks from two different block group.\next4_mb_mark_bb() only reads the buffer_head of block bitmap once for the\nstarting block group, but it fails to read it again when the extent length\nboundary overflows to another block group. Then in this below loop it\naccesses memory beyond the block group bitmap buffer_head and results\ninto a data abort.\n\n\tfor (i = 0; i < clen; i++)\n\t\tif (!mb_test_bit(blkoff + i, bitmap_bh->b_data) == !state)\n\t\t\talready++;\n\nThis patch adds this functionality for checking block group boundary in\next4_mb_mark_bb() and update the buffer_head(bitmap_bh) for every different\nblock group.\n\nw/o this patch, I was easily able to hit a data access abort using Power platform.\n\n<...>\n[   74.327662] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1141: group 11, block bitmap and bg descriptor inconsistent: 21248 vs 23294 free clusters\n[   74.533214] EXT4-fs (loop3): shut down requested (2)\n[   74.536705] Aborting journal on device loop3-8.\n[   74.702705] BUG: Unable to handle kernel data access on read at 0xc00000005e980000\n[   74.703727] Faulting instruction address: 0xc0000000007bffb8\ncpu 0xd: Vector: 300 (Data Access) at [c000000015db7060]\n    pc: c0000000007bffb8: ext4_mb_mark_bb+0x198/0x5a0\n    lr: c0000000007bfeec: ext4_mb_mark_bb+0xcc/0x5a0\n    sp: c000000015db7300\n   msr: 800000000280b033\n   dar: c00000005e980000\n dsisr: 40000000\n  current = 0xc000000027af6880\n  paca    = 0xc00000003ffd5200   irqmask: 0x03   irq_happened: 0x01\n    pid   = 5167, comm = mount\n<...>\nenter ? for help\n[c000000015db7380] c000000000782708 ext4_ext_clear_bb+0x378/0x410\n[c000000015db7400] c000000000813f14 ext4_fc_replay+0x1794/0x2000\n[c000000015db7580] c000000000833f7c do_one_pass+0xe9c/0x12a0\n[c000000015db7710] c000000000834504 jbd2_journal_recover+0x184/0x2d0\n[c000000015db77c0] c000000000841398 jbd2_journal_load+0x188/0x4a0\n[c000000015db7880] c000000000804de8 ext4_fill_super+0x2638/0x3e10\n[c000000015db7a40] c0000000005f8404 get_tree_bdev+0x2b4/0x350\n[c000000015db7ae0] c0000000007ef058 ext4_get_tree+0x28/0x40\n[c000000015db7b00] c0000000005f6344 vfs_get_tree+0x44/0x100\n[c000000015db7b70] c00000000063c408 path_mount+0xdd8/0xe70\n[c000000015db7c40] c00000000063c8f0 sys_mount+0x450/0x550\n[c000000015db7d50] c000000000035770 system_call_exception+0x4a0/0x4e0\n[c000000015db7e10] c00000000000c74c system_call_common+0xec/0x250",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b226d124-5dbd-4727-84dc-11b0fca50f15",  "id": "CVE-2022-49472",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: micrel: Allow probing without .driver_data\n\nCurrently, if the .probe element is present in the phy_driver structure\nand the .driver_data is not, a NULL pointer dereference happens.\n\nAllow passing .probe without .driver_data by inserting NULL checks\nfor priv->type.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9011f4d3-0526-43ea-b425-2d3d6b3710e3",  "id": "CVE-2016-3139",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3139"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:39538'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:136143/Linux-wacom-Multiple-Null-Pointer-Dereferences.html'"    }  ]},{  "bom-ref": "14b6bcf3-5f10-49b1-8dd2-ea1dcbd03352",  "id": "CVE-2021-42739",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42739"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandles bounds checking.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5c2fd4e3-f4c7-4926-adf6-b6ba213b89ad",  "id": "CVE-2025-38045",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: fix debug actions order\n\nThe order of actions taken for debug was implemented incorrectly.\nNow we implemented the dump split and do the FW reset only in the\nmiddle of the dump (rather than the FW killing itself on error.)\nAs a result, some of the actions taken when applying the config\nwill now crash the device, so we need to fix the order.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c360a558-0885-411f-997e-a41442610ce4",  "id": "CVE-2021-47229",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47229"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: aardvark: Fix kernel panic during PIO transfer\n\nTrying to start a new PIO transfer by writing value 0 in PIO_START register\nwhen previous transfer has not yet completed (which is indicated by value 1\nin PIO_START) causes an External Abort on CPU, which results in kernel\npanic:\n\n    SError Interrupt on CPU0, code 0xbf000002 -- SError\n    Kernel panic - not syncing: Asynchronous SError Interrupt\n\nTo prevent kernel panic, it is required to reject a new PIO transfer when\nprevious one has not finished yet.\n\nIf previous PIO transfer is not finished yet, the kernel may issue a new\nPIO request only if the previous PIO transfer timed out.\n\nIn the past the root cause of this issue was incorrectly identified (as it\noften happens during link retraining or after link down event) and special\nhack was implemented in Trusted Firmware to catch all SError events in EL3,\nto ignore errors with code 0xbf000002 and not forwarding any other errors\nto kernel and instead throw panic from EL3 Trusted Firmware handler.\n\nLinks to discussion and patches about this issue:\nhttps://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/commit/?id=3c7dcdac5c50\nhttps://lore.kernel.org/linux-pci/20190316161243.29517-1-repk@triplefau.lt/\nhttps://lore.kernel.org/linux-pci/971be151d24312cc533989a64bd454b4@www.loen.fr/\nhttps://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/1541\n\nBut the real cause was the fact that during link retraining or after link\ndown event the PIO transfer may take longer time, up to the 1.44s until it\ntimes out. This increased probability that a new PIO transfer would be\nissued by kernel while previous one has not finished yet.\n\nAfter applying this change into the kernel, it is possible to revert the\nmentioned TF-A hack and SError events do not have to be caught in TF-A EL3.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b588783-5bc5-44fa-be7e-dc00cd533d91",  "id": "CVE-2020-8647",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8647"  },  "ratings": [    {      "score": 6.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "641e6435-e4c9-4fdd-83b5-bca7b9ef473c",  "id": "CVE-2022-49135",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix memory leak\n\n[why]\nResource release is needed on the error handling path\nto prevent memory leak.\n\n[how]\nFix this by adding kfree on the error handling path.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a6d5d2e5-8254-4b9e-a302-3da4ffb72a1e",  "id": "RHSA-2021:1131",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "449af64b-28f2-4901-bc04-63740466e4c7",  "id": "CVE-2021-47509",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47509"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Limit the period size to 16MB\n\nSet the practical limit to the period size (the fragment shift in OSS)\ninstead of a full 31bit; a too large value could lead to the exhaust\nof memory as we allocate temporary buffers of the period size, too.\n\nAs of this patch, we set to 16MB limit, which should cover all use\ncases.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "da735bdc-b235-47d2-b5c3-978bf9817ce9",  "id": "CVE-2011-2183",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2183"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the scan_get_next_rmap_item function in mm/ksm.c in the Linux kernel before 2.6.39.3, when Kernel SamePage Merging (KSM) is enabled, allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:35820'"    }  ]},{  "bom-ref": "5d1688e3-34ae-4fea-9086-7b851cd4876f",  "id": "CVE-2018-18397",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18397"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    863  ],  "analysis": {    "state": "in_triage"  },  "description": "The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:150748/Linux-userfaultfd-tmpfs-File-Permission-Bypass.html'"    }  ]},{  "bom-ref": "ec0c30fd-1799-4f9b-b29b-bf3ade36ed25",  "id": "AZL-42975",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "19057f6a-1007-460e-981b-765020be9a5f",  "id": "CVE-2014-7843",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7843"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    17  ],  "analysis": {    "state": "in_triage"  },  "description": "The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0f11f18-5285-496d-ae4c-9db0db199038",  "id": "CVE-2022-48765",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: LAPIC: Also cancel preemption timer during SET_LAPIC\n\nThe below warning is splatting during guest reboot.\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 0 PID: 1931 at arch/x86/kvm/x86.c:10322 kvm_arch_vcpu_ioctl_run+0x874/0x880 [kvm]\n  CPU: 0 PID: 1931 Comm: qemu-system-x86 Tainted: G          I       5.17.0-rc1+ #5\n  RIP: 0010:kvm_arch_vcpu_ioctl_run+0x874/0x880 [kvm]\n  Call Trace:\n   <TASK>\n   kvm_vcpu_ioctl+0x279/0x710 [kvm]\n   __x64_sys_ioctl+0x83/0xb0\n   do_syscall_64+0x3b/0xc0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n  RIP: 0033:0x7fd39797350b\n\nThis can be triggered by not exposing tsc-deadline mode and doing a reboot in\nthe guest. The lapic_shutdown() function which is called in sys_reboot path\nwill not disarm the flying timer, it just masks LVTT. lapic_shutdown() clears\nAPIC state w/ LVT_MASKED and timer-mode bit is 0, this can trigger timer-mode\nswitch between tsc-deadline and oneshot/periodic, which can result in preemption\ntimer be cancelled in apic_update_lvtt(). However, We can't depend on this when\nnot exposing tsc-deadline mode and oneshot/periodic modes emulated by preemption\ntimer. Qemu will synchronise states around reset, let's cancel preemption timer\nunder KVM_SET_LAPIC.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1e153768-da6e-41b0-b422-8bb997cb3959",  "id": "CVE-2012-1146",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1146"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The mem_cgroup_usage_unregister_event function in mm/memcontrol.c in the Linux kernel before 3.2.10 does not properly handle multiple events that are attached to the same eventfd, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by registering memory threshold events.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e1d24d2d-5a95-4384-9f14-eed313500c3c",  "id": "MGASA-2015-0214",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "de48bf0f-3a2e-4ca7-a746-252da0403d90",  "id": "CVE-2024-46835",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix smatch static checker warning\n\nadev->gfx.imu.funcs could be NULL",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2f0323a-f221-4189-89aa-f95f301b916d",  "id": "DLA-2492-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f36fdcd-d734-4239-94cf-40bade24513e",  "id": "CVE-2024-56779",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur\n\nThe action force umount(umount -f) will attempt to kill all rpc_task even\numount operation may ultimately fail if some files remain open.\nConsequently, if an action attempts to open a file, it can potentially\nsend two rpc_task to nfs server.\n\n                   NFS CLIENT\nthread1                             thread2\nopen(\"file\")\n...\nnfs4_do_open\n _nfs4_do_open\n  _nfs4_open_and_get_state\n   _nfs4_proc_open\n    nfs4_run_open_task\n     /* rpc_task1 */\n     rpc_run_task\n     rpc_wait_for_completion_task\n\n                                    umount -f\n                                    nfs_umount_begin\n                                     rpc_killall_tasks\n                                      rpc_signal_task\n     rpc_task1 been wakeup\n     and return -512\n _nfs4_do_open // while loop\n    ...\n    nfs4_run_open_task\n     /* rpc_task2 */\n     rpc_run_task\n     rpc_wait_for_completion_task\n\nWhile processing an open request, nfsd will first attempt to find or\nallocate an nfs4_openowner. If it finds an nfs4_openowner that is not\nmarked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since\ntwo rpc_task can attempt to open the same file simultaneously from the\nclient to server, and because two instances of nfsd can run\nconcurrently, this situation can lead to lots of memory leak.\nAdditionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be\ntriggered.\n\n                    NFS SERVER\nnfsd1                  nfsd2       echo 0 > /proc/fs/nfsd/threads\n\nnfsd4_open\n nfsd4_process_open1\n  find_or_alloc_open_stateowner\n   // alloc oo1, stateid1\n                       nfsd4_open\n                        nfsd4_process_open1\n                        find_or_alloc_open_stateowner\n                        // find oo1, without NFS4_OO_CONFIRMED\n                         release_openowner\n                          unhash_openowner_locked\n                          list_del_init(&oo->oo_perclient)\n                          // cannot find this oo\n                          // from client, LEAK!!!\n                         alloc_stateowner // alloc oo2\n\n nfsd4_process_open2\n  init_open_stateid\n  // associate oo1\n  // with stateid1, stateid1 LEAK!!!\n  nfs4_get_vfs_file\n  // alloc nfsd_file1 and nfsd_file_mark1\n  // all LEAK!!!\n\n                         nfsd4_process_open2\n                         ...\n\n                                    write_threads\n                                     ...\n                                     nfsd_destroy_serv\n                                      nfsd_shutdown_net\n                                       nfs4_state_shutdown_net\n                                        nfs4_state_destroy_net\n                                         destroy_client\n                                          __destroy_client\n                                          // won't find oo1!!!\n                                     nfsd_shutdown_generic\n                                      nfsd_file_cache_shutdown\n                                       kmem_cache_destroy\n                                       for nfsd_file_slab\n                                       and nfsd_file_mark_slab\n                                       // bark since nfsd_file1\n                                       // and nfsd_file_mark1\n                                       // still alive\n\n=======================================================================\nBUG nfsd_file (Not tainted): Objects remaining in nfsd_file on\n__kmem_cache_shutdown()\n-----------------------------------------------------------------------\n\nSlab 0xffd4000004438a80 objects=34 used=1 fp=0xff11000110e2ad28\nflags=0x17ffffc0000240(workingset|head|node=0|zone=2|lastcpupid=0x1fffff)\nCPU: 4 UID: 0 PID: 757 Comm: sh Not tainted 6.12.0-rc6+ #19\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nCall Trace:\n <TASK>\n dum\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bd7013ee-dbf0-4305-97da-572fb432d980",  "id": "SUSE-SU-2018:1968-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d3832ff-afe0-4176-a4d6-c2718ba092e2",  "id": "CVE-2013-3231",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3231"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "feb1fbca-425f-4da2-ae28-f3317a64f365",  "id": "CVE-2019-19462",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19462"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3591c664-c7fc-49b9-b258-f894e59cff14",  "id": "AZL-13351",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee507cf6-8c51-42fd-a5c9-1a5dd74b29f9",  "id": "CVE-2023-1670",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1670"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c6a1a66e-c510-4a56-a9e8-35a0056f674e",  "id": "CVE-2025-21925",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: do not use skb_get() before dev_queue_xmit()\n\nsyzbot is able to crash hosts [1], using llc and devices\nnot supporting IFF_TX_SKB_SHARING.\n\nIn this case, e1000 driver calls eth_skb_pad(), while\nthe skb is shared.\n\nSimply replace skb_get() by skb_clone() in net/llc/llc_s_ac.c\n\nNote that e1000 driver might have an issue with pktgen,\nbecause it does not clear IFF_TX_SKB_SHARING, this is an\northogonal change.\n\nWe need to audit other skb_get() uses in net/llc.\n\n[1]\n\nkernel BUG at net/core/skbuff.c:2178 !\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 16371 Comm: syz.2.2764 Not tainted 6.14.0-rc4-syzkaller-00052-gac9c34d1e45a #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n RIP: 0010:pskb_expand_head+0x6ce/0x1240 net/core/skbuff.c:2178\nCall Trace:\n <TASK>\n  __skb_pad+0x18a/0x610 net/core/skbuff.c:2466\n  __skb_put_padto include/linux/skbuff.h:3843 [inline]\n  skb_put_padto include/linux/skbuff.h:3862 [inline]\n  eth_skb_pad include/linux/etherdevice.h:656 [inline]\n  e1000_xmit_frame+0x2d99/0x5800 drivers/net/ethernet/intel/e1000/e1000_main.c:3128\n  __netdev_start_xmit include/linux/netdevice.h:5151 [inline]\n  netdev_start_xmit include/linux/netdevice.h:5160 [inline]\n  xmit_one net/core/dev.c:3806 [inline]\n  dev_hard_start_xmit+0x9a/0x7b0 net/core/dev.c:3822\n  sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343\n  __dev_xmit_skb net/core/dev.c:4045 [inline]\n  __dev_queue_xmit+0x13d4/0x43e0 net/core/dev.c:4621\n  dev_queue_xmit include/linux/netdevice.h:3313 [inline]\n  llc_sap_action_send_test_c+0x268/0x320 net/llc/llc_s_ac.c:144\n  llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline]\n  llc_sap_next_state net/llc/llc_sap.c:182 [inline]\n  llc_sap_state_process+0x239/0x510 net/llc/llc_sap.c:209\n  llc_ui_sendmsg+0xd0d/0x14e0 net/llc/af_llc.c:993\n  sock_sendmsg_nosec net/socket.c:718 [inline]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "892bd07d-39fb-4ab3-9053-81f8405faa81",  "id": "CVE-2011-0716",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0716"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The br_multicast_add_group function in net/bridge/br_multicast.c in the Linux kernel before 2.6.38, when a certain Ethernet bridge configuration is used, allows local users to cause a denial of service (memory corruption and system crash) by sending IGMP packets to a local interface.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "533aead3-f6f2-40c8-b13b-3b1bb5a0d05d",  "id": "CVE-2013-4513",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4513"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the oz_cdev_write function in drivers/staging/ozwpan/ozcdev.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted write operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "21db88d4-4533-49d3-bde3-a53231e26390",  "id": "CVE-2015-0209",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0209"  },  "ratings": [    {      "score": 6.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0146f8c-b355-4a5d-a762-a1cb0c327f0c",  "id": "CVE-2022-49622",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: avoid skb access on nf_stolen\n\nWhen verdict is NF_STOLEN, the skb might have been freed.\n\nWhen tracing is enabled, this can result in a use-after-free:\n1. access to skb->nf_trace\n2. access to skb->mark\n3. computation of trace id\n4. dump of packet payload\n\nTo avoid 1, keep a cached copy of skb->nf_trace in the\ntrace state struct.\nRefresh this copy whenever verdict is != STOLEN.\n\nAvoid 2 by skipping skb->mark access if verdict is STOLEN.\n\n3 is avoided by precomputing the trace id.\n\nOnly dump the packet when verdict is not \"STOLEN\".",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f11a6f5-8a78-4c9c-877b-8b8161be3070",  "id": "SUSE-SU-2015:0541-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "42de317e-5599-417b-8fff-6b1852feedbd",  "id": "MGASA-2026-0128",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "e52e445b-24d0-4150-822b-d76563b46e68",      "versions": [        {          "component": "sed",          "version": "4.0"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db286085-1a85-46d8-bdd0-0cf8f09b7490",  "id": "RHSA-2026:0887",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "44206bd2-3058-4890-b530-6ea198ccece0",  "id": "CVE-2012-4508",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4508"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in fs/ext4/extents.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2624d74e-e427-46c2-baed-6dcd23b96a6d",  "id": "CVE-2021-47253",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47253"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix potential memory leak in DMUB hw_init\n\n[Why]\nOn resume we perform DMUB hw_init which allocates memory:\ndm_resume->dm_dmub_hw_init->dc_dmub_srv_create->kzalloc\nThat results in memory leak in suspend/resume scenarios.\n\n[How]\nAllocate memory for the DC wrapper to DMUB only if it was not\nallocated before.\nNo need to reallocate it on suspend/resume.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f389f7d-9461-4615-8e40-cc4564820e76",  "id": "CVE-2024-56533",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usx2y: Use snd_card_free_when_closed() at disconnection\n\nThe USB disconnect callback is supposed to be short and not too-long\nwaiting.  OTOH, the current code uses snd_card_free() at\ndisconnection, but this waits for the close of all used fds, hence it\ncan take long.  It eventually blocks the upper layer USB ioctls, which\nmay trigger a soft lockup.\n\nAn easy workaround is to replace snd_card_free() with\nsnd_card_free_when_closed().  This variant returns immediately while\nthe release of resources is done asynchronously by the card device\nrelease at the last close.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c221b39a-84f5-438c-b7fa-c58ccb78b209",  "id": "CVE-2023-1195",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1195"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in reconn_set_ipaddr_from_hostname in fs/cifs/connect.c in the Linux kernel. The issue occurs when it forgets to set the free pointer server->hostname to NULL, leading to an invalid pointer request.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c75c8cd-2af4-49ba-b3c6-9f21acb68271",  "id": "CVE-2026-46178",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()\n\nSashiko points out that mlx4_srq_alloc() was not undone during error\nunwind, add the missing call to mlx4_srq_free().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "24e07a12-19e2-46d9-a5e9-623b4fd9c19b",  "id": "SUSE-SU-2022:1307-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a54f328f-c7ce-4515-813c-f596839e6947",  "id": "ALSA-2025:21255",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8d331baa-a77e-4803-8c90-b6cdcfce6691",  "id": "AZL-75275",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6cca88a9-525a-4e51-880b-c41ffa8ad9a7",  "id": "CVE-2015-5366",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5366"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allows remote attackers to cause a denial of service (EPOLLET epoll application read outage) via an incorrect checksum in a UDP packet, a different vulnerability than CVE-2015-5364.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9a60f70-f60c-4ecc-b8ae-18e90d3c3daf",  "id": "CVE-2022-50431",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()\n\ndev_set_name() in soundbus_add_one() allocates memory for name, it need be\nfreed when of_device_register() fails, call soundbus_dev_put() to give up\nthe reference that hold in device_initialize(), so that it can be freed in\nkobject_cleanup() when the refcount hit to 0. And other resources are also\nfreed in i2sbus_release_dev(), so it can return 0 directly.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc9124ad-327d-446a-a4c6-e38b5b14924a",  "id": "CVE-2025-21704",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdc-acm: Check control transfer buffer size before access\n\nIf the first fragment is shorter than struct usb_cdc_notification, we can't\ncalculate an expected_size. Log an error and discard the notification\ninstead of reading lengths from memory outside the received data, which can\nlead to memory corruption when the expected_size decreases between\nfragments, causing `expected_size - acm->nb_index` to wrap.\n\nThis issue has been present since the beginning of git history; however,\nit only leads to memory corruption since commit ea2583529cd1\n(\"cdc-acm: reassemble fragmented notifications\").\n\nA mitigating factor is that acm_ctrl_irq() can only execute after userspace\nhas opened /dev/ttyACM*; but if ModemManager is running, ModemManager will\ndo that automatically depending on the USB device's vendor/product IDs and\nits other interfaces.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c24970c-0c49-4b1e-9e46-ed4fb0fb7bc2",  "id": "RHSA-2023:1199",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b4ec7889-796e-4bc5-9391-b075af7400b8",  "id": "CVE-2014-9715",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9715"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that triggers extension loading, as demonstrated by configuring a PPTP tunnel in a NAT environment.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "64fe3d68-ebb1-4059-a0fd-7ba49036a389",  "id": "CVE-2022-48704",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: add a force flush to delay work when radeon\n\nAlthough radeon card fence and wait for gpu to finish processing current batch rings,\nthere is still a corner case that radeon lockup work queue may not be fully flushed,\nand meanwhile the radeon_suspend_kms() function has called pci_set_power_state() to\nput device in D3hot state.\nPer PCI spec rev 4.0 on 5.3.1.4.1 D3hot State.\n> Configuration and Message requests are the only TLPs accepted by a Function in\n> the D3hot state. All other received Requests must be handled as Unsupported Requests,\n> and all received Completions may optionally be handled as Unexpected Completions.\nThis issue will happen in following logs:\nUnable to handle kernel paging request at virtual address 00008800e0008010\nCPU 0 kworker/0:3(131): Oops 0\npc = [<ffffffff811bea5c>]  ra = [<ffffffff81240844>]  ps = 0000 Tainted: G        W\npc is at si_gpu_check_soft_reset+0x3c/0x240\nra is at si_dma_is_lockup+0x34/0xd0\nv0 = 0000000000000000  t0 = fff08800e0008010  t1 = 0000000000010000\nt2 = 0000000000008010  t3 = fff00007e3c00000  t4 = fff00007e3c00258\nt5 = 000000000000ffff  t6 = 0000000000000001  t7 = fff00007ef078000\ns0 = fff00007e3c016e8  s1 = fff00007e3c00000  s2 = fff00007e3c00018\ns3 = fff00007e3c00000  s4 = fff00007fff59d80  s5 = 0000000000000000\ns6 = fff00007ef07bd98\na0 = fff00007e3c00000  a1 = fff00007e3c016e8  a2 = 0000000000000008\na3 = 0000000000000001  a4 = 8f5c28f5c28f5c29  a5 = ffffffff810f4338\nt8 = 0000000000000275  t9 = ffffffff809b66f8  t10 = ff6769c5d964b800\nt11= 000000000000b886  pv = ffffffff811bea20  at = 0000000000000000\ngp = ffffffff81d89690  sp = 00000000aa814126\nDisabling lock debugging due to kernel taint\nTrace:\n[<ffffffff81240844>] si_dma_is_lockup+0x34/0xd0\n[<ffffffff81119610>] radeon_fence_check_lockup+0xd0/0x290\n[<ffffffff80977010>] process_one_work+0x280/0x550\n[<ffffffff80977350>] worker_thread+0x70/0x7c0\n[<ffffffff80977410>] worker_thread+0x130/0x7c0\n[<ffffffff80982040>] kthread+0x200/0x210\n[<ffffffff809772e0>] worker_thread+0x0/0x7c0\n[<ffffffff80981f8c>] kthread+0x14c/0x210\n[<ffffffff80911658>] ret_from_kernel_thread+0x18/0x20\n[<ffffffff80981e40>] kthread+0x0/0x210\n Code: ad3e0008  43f0074a  ad7e0018  ad9e0020  8c3001e8  40230101\n <88210000> 4821ed21\nSo force lockup work queue flush to fix this problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f84a51c2-97b4-4945-8ad8-c5eb6f52b5c7",  "id": "CVE-2021-47086",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47086"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nphonet/pep: refuse to enable an unbound pipe\n\nThis ioctl() implicitly assumed that the socket was already bound to\na valid local socket name, i.e. Phonet object. If the socket was not\nbound, two separate problems would occur:\n\n1) We'd send an pipe enablement request with an invalid source object.\n2) Later socket calls could BUG on the socket unexpectedly being\n   connected yet not bound to a valid object.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b392d71c-e0e4-4140-b92f-47655f455c7a",  "id": "CVE-2024-49925",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: efifb: Register sysfs groups through driver core\n\nThe driver core can register and cleanup sysfs groups already.\nMake use of that functionality to simplify the error handling and\ncleanup.\n\nAlso avoid a UAF race during unregistering where the sysctl attributes\nwere usable after the info struct was freed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b5dab374-fc36-44d0-81dc-365226e050da",  "id": "openSUSE-SU-2024:14031-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "64e6bb85-0093-4c43-99ff-cc22c65fecbe",  "id": "CVE-2026-23289",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()\n\nFix a user triggerable leak on the system call failure path.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "50713d52-385a-4692-8a9c-418d148195d8",  "id": "CVE-2022-49536",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix SCSI I/O completion and abort handler deadlock\n\nDuring stress I/O tests with 500+ vports, hard LOCKUP call traces are\nobserved.\n\nCPU A:\n native_queued_spin_lock_slowpath+0x192\n _raw_spin_lock_irqsave+0x32\n lpfc_handle_fcp_err+0x4c6\n lpfc_fcp_io_cmd_wqe_cmpl+0x964\n lpfc_sli4_fp_handle_cqe+0x266\n __lpfc_sli4_process_cq+0x105\n __lpfc_sli4_hba_process_cq+0x3c\n lpfc_cq_poll_hdler+0x16\n irq_poll_softirq+0x76\n __softirqentry_text_start+0xe4\n irq_exit+0xf7\n do_IRQ+0x7f\n\nCPU B:\n native_queued_spin_lock_slowpath+0x5b\n _raw_spin_lock+0x1c\n lpfc_abort_handler+0x13e\n scmd_eh_abort_handler+0x85\n process_one_work+0x1a7\n worker_thread+0x30\n kthread+0x112\n ret_from_fork+0x1f\n\nDiagram of lockup:\n\nCPUA                            CPUB\n----                            ----\nlpfc_cmd->buf_lock\n                            phba->hbalock\n                            lpfc_cmd->buf_lock\nphba->hbalock\n\nFix by reordering the taking of the lpfc_cmd->buf_lock and phba->hbalock in\nlpfc_abort_handler routine so that it tries to take the lpfc_cmd->buf_lock\nfirst before phba->hbalock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "632e6cb3-150e-43d2-ac45-5cd2c658cf37",  "id": "CVE-2024-49960",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix timer use-after-free on failed mount\n\nSyzbot has found an ODEBUG bug in ext4_fill_super\n\nThe del_timer_sync function cancels the s_err_report timer,\nwhich reminds about filesystem errors daily. We should\nguarantee the timer is no longer active before kfree(sbi).\n\nWhen filesystem mounting fails, the flow goes to failed_mount3,\nwhere an error occurs when ext4_stop_mmpd is called, causing\na read I/O failure. This triggers the ext4_handle_error function\nthat ultimately re-arms the timer,\nleaving the s_err_report timer active before kfree(sbi) is called.\n\nFix the issue by canceling the s_err_report timer after calling ext4_stop_mmpd.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8193cd7a-cd51-4bbc-91c6-9cd2f04a214f",  "id": "CVE-2022-49917",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix WARNING in ip_vs_app_net_cleanup()\n\nDuring the initialization of ip_vs_app_net_init(), if file ip_vs_app\nfails to be created, the initialization is successful by default.\nTherefore, the ip_vs_app file doesn't be found during the remove in\nip_vs_app_net_cleanup(). It will cause WRNING.\n\nThe following is the stack information:\nname 'ip_vs_app'\nWARNING: CPU: 1 PID: 9 at fs/proc/generic.c:712 remove_proc_entry+0x389/0x460\nModules linked in:\nWorkqueue: netns cleanup_net\nRIP: 0010:remove_proc_entry+0x389/0x460\nCall Trace:\n<TASK>\nops_exit_list+0x125/0x170\ncleanup_net+0x4ea/0xb00\nprocess_one_work+0x9bf/0x1710\nworker_thread+0x665/0x1080\nkthread+0x2e4/0x3a0\nret_from_fork+0x1f/0x30\n</TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "67274a65-738e-4591-af9e-f41f82fa71c5",  "id": "CVE-2025-71304",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: /smack/doi: accept previously used values\n\nWriting to /smack/doi a value that has ever been\nwritten there in the past disables networking for\nnon-ambient labels.\nE.g.\n\n    # cat /smack/doi\n    3\n    # netlabelctl -p cipso list\n    Configured CIPSO mappings (1)\n     DOI value : 3\n       mapping type : PASS_THROUGH\n    # netlabelctl -p map list\n    Configured NetLabel domain mappings (3)\n     domain: \"_\" (IPv4)\n       protocol: UNLABELED\n     domain: DEFAULT (IPv4)\n       protocol: CIPSO, DOI = 3\n     domain: DEFAULT (IPv6)\n       protocol: UNLABELED\n\n    # cat /smack/ambient\n    _\n    # cat /proc/$$/attr/smack/current\n    _\n    # ping -c1 10.1.95.12\n    64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.964 ms\n    # echo foo >/proc/$$/attr/smack/current\n    # ping -c1 10.1.95.12\n    64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.956 ms\n    unknown option 86\n\n    # echo 4 >/smack/doi\n    # echo 3 >/smack/doi\n!>  [  214.050395] smk_cipso_doi:691 cipso add rc = -17\n    # echo 3 >/smack/doi\n!>  [  249.402261] smk_cipso_doi:678 remove rc = -2\n!>  [  249.402261] smk_cipso_doi:691 cipso add rc = -17\n\n    # ping -c1 10.1.95.12\n!!> ping: 10.1.95.12: Address family for hostname not supported\n\n    # echo _ >/proc/$$/attr/smack/current\n    # ping -c1 10.1.95.12\n    64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.617 ms\n\nThis happens because Smack keeps decommissioned DOIs,\nfails to re-add them, and consequently refuses to add\nthe “default” domain map:\n\n    # netlabelctl -p cipso list\n    Configured CIPSO mappings (2)\n     DOI value : 3\n       mapping type : PASS_THROUGH\n     DOI value : 4\n       mapping type : PASS_THROUGH\n    # netlabelctl -p map list\n    Configured NetLabel domain mappings (2)\n     domain: \"_\" (IPv4)\n       protocol: UNLABELED\n!>  (no ipv4 map for default domain here)\n     domain: DEFAULT (IPv6)\n       protocol: UNLABELED\n\nFix by clearing decommissioned DOI definitions and\nserializing concurrent DOI updates with a new lock.\n\nAlso:\n- allow /smack/doi to live unconfigured, since\n  adding a map (netlbl_cfg_cipsov4_map_add) may fail.\n  CIPSO_V4_DOI_UNKNOWN(0) indicates the unconfigured DOI\n- add new DOI before removing the old default map,\n  so the old map remains if the add fails\n\n(2008-02-04, Casey Schaufler)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d63fcc7e-916a-4f74-979c-3b2eb6e3b220",  "id": "CVE-2017-13693",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13693"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "522dabab-77a3-4bfb-8618-7108281aae93",  "id": "CVE-2022-49314",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: Fix a possible resource leak in icom_probe\n\nWhen pci_read_config_dword failed, call pci_release_regions() and\npci_disable_device() to recycle the resource previously allocated.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "681bc03c-f99f-4325-936b-373e6d2b0c7e",  "id": "CVE-2015-7872",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7872"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f0885df1-d82f-4019-8052-e7a71433267c",  "id": "CVE-2016-4578",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4578"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:46529'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:152031/Linux-Kernel-4.4-Ubuntu-16.04-snd_timer_user_ccallback-Kernel-Pointer-Leak.html'"    }  ]},{  "bom-ref": "65570925-f581-4262-8e4d-1dfe45299911",  "id": "CVE-2017-8890",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8890"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c3126c76-b53d-4974-a11e-2aebbdc22551",  "id": "CLSA-2022-1660238832",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0e936e0c-fed9-49be-87fe-132525137a42",  "id": "MGASA-2021-0533",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f64508f2-34f4-4c60-93da-5740326c4155",  "id": "CVE-2015-8569",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8569"  },  "ratings": [    {      "score": 2.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2c36c6fc-e8e7-4e58-9e95-7ef469a99243",  "id": "CVE-2024-42083",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nionic: fix kernel panic due to multi-buffer handling\n\nCurrently, the ionic_run_xdp() doesn't handle multi-buffer packets\nproperly for XDP_TX and XDP_REDIRECT.\nWhen a jumbo frame is received, the ionic_run_xdp() first makes xdp\nframe with all necessary pages in the rx descriptor.\nAnd if the action is either XDP_TX or XDP_REDIRECT, it should unmap\ndma-mapping and reset page pointer to NULL for all pages, not only the\nfirst page.\nBut it doesn't for SG pages. So, SG pages unexpectedly will be reused.\nIt eventually causes kernel panic.\n\nOops: general protection fault, probably for non-canonical address 0x504f4e4dbebc64ff: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.10.0-rc3+ #25\nRIP: 0010:xdp_return_frame+0x42/0x90\nCode: 01 75 12 5b 4c 89 e6 5d 31 c9 41 5c 31 d2 41 5d e9 73 fd ff ff 44 8b 6b 20 0f b7 43 0a 49 81 ed 68 01 00 00 49 29 c5 49 01 fd <41> 80 7d0\nRSP: 0018:ffff99d00122ce08 EFLAGS: 00010202\nRAX: 0000000000005453 RBX: ffff8d325f904000 RCX: 0000000000000001\nRDX: 00000000670e1000 RSI: 000000011f90d000 RDI: 504f4e4d4c4b4a49\nRBP: ffff99d003907740 R08: 0000000000000000 R09: 0000000000000000\nR10: 000000011f90d000 R11: 0000000000000000 R12: ffff8d325f904010\nR13: 504f4e4dbebc64fd R14: ffff8d3242b070c8 R15: ffff99d0039077c0\nFS:  0000000000000000(0000) GS:ffff8d399f780000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f41f6c85e38 CR3: 000000037ac30000 CR4: 00000000007506f0\nPKRU: 55555554\nCall Trace:\n <IRQ>\n ? die_addr+0x33/0x90\n ? exc_general_protection+0x251/0x2f0\n ? asm_exc_general_protection+0x22/0x30\n ? xdp_return_frame+0x42/0x90\n ionic_tx_clean+0x211/0x280 [ionic 15881354510e6a9c655c59c54812b319ed2cd015]\n ionic_tx_cq_service+0xd3/0x210 [ionic 15881354510e6a9c655c59c54812b319ed2cd015]\n ionic_txrx_napi+0x41/0x1b0 [ionic 15881354510e6a9c655c59c54812b319ed2cd015]\n __napi_poll.constprop.0+0x29/0x1b0\n net_rx_action+0x2c4/0x350\n handle_softirqs+0xf4/0x320\n irq_exit_rcu+0x78/0xa0\n common_interrupt+0x77/0x90",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "37e28325-0c73-4bbd-87f7-3a15a06b3aa6",  "id": "CVE-2022-49291",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Fix races among concurrent hw_params and hw_free calls\n\nCurrently we have neither proper check nor protection against the\nconcurrent calls of PCM hw_params and hw_free ioctls, which may result\nin a UAF.  Since the existing PCM stream lock can't be used for\nprotecting the whole ioctl operations, we need a new mutex to protect\nthose racy calls.\n\nThis patch introduced a new mutex, runtime->buffer_mutex, and applies\nit to both hw_params and hw_free ioctl code paths.  Along with it, the\nboth functions are slightly modified (the mmap_count check is moved\ninto the state-check block) for code simplicity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0a1f53a5-c729-4e76-9763-09573e711728",  "id": "CVE-2020-35508",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35508"  },  "ratings": [    {      "score": 4.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    362,    665  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c4005cc0-f06f-4b56-ada9-646e215bc4c0",  "id": "CVE-2019-19066",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19066"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures, aka CID-0e62395da2bd.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5da26f30-92d8-4efa-8de8-9bbb6faa3413",  "id": "AZL-75585",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7bba6af2-a24a-44e0-bca8-6925efe89108",  "id": "CVE-2026-46243",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    20,    825  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject userspace cifs.spnego descriptions\n\ncifs.spnego key descriptions contain authority-bearing fields such as\npid, uid, creduid, and upcall_target that cifs.upcall treats as\nkernel-originating inputs. However, userspace can also create keys of\nthis type through request_key(2) or add_key(2), allowing those fields to\nbe supplied without CIFS origin.\n\nOnly accept cifs.spnego descriptions while CIFS is using its private\nspnego_cred to request the key.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "592b89b7-2647-4ef4-adbc-9c53ab60d9b9",  "id": "CVE-2018-20836",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20836"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "12f0ac20-6519-41f9-9901-e90eb741719d",  "id": "CVE-2017-2583",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2583"  },  "ratings": [    {      "score": 8.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5 improperly emulates a \"MOV SS, NULL selector\" instruction, which allows guest OS users to cause a denial of service (guest OS crash) or gain guest OS privileges via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "405019af-0d2b-4c91-91a7-fb86b845dd0f",  "id": "RHSA-2026:58563",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "42d4b8c5-53b6-4a9c-b398-321016b577a5",  "id": "CVE-2013-7348",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7348"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Double free vulnerability in the ioctx_alloc function in fs/aio.c in the Linux kernel before 3.12.4 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via vectors involving an error condition in the aio_setup_ring function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17e301c5-44f7-4039-9a18-119d87a25785",  "id": "CVE-2003-0948",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0948"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in iwconfig allows local users to execute arbitrary code via a long HOME environment variable.",  "affects": [    {      "ref": "28e56438-7ab7-42b3-ac8b-d963c9673703",      "versions": [        {          "component": "wireless_tools",          "version": "26"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:1215'"    }  ]},{  "bom-ref": "ead2ddbd-1953-4a11-82bb-aa14a8d4cb6f",  "id": "CVE-2021-38208",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38208"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "net/nfc/llcp_sock.c in the Linux kernel before 5.12.10 allows local unprivileged users to cause a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d7e21fcc-d0f6-4ca5-8712-0e75e3a80066",  "id": "CVE-2023-53369",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dcb: choose correct policy to parse DCB_ATTR_BCN\n\nThe dcbnl_bcn_setcfg uses erroneous policy to parse tb[DCB_ATTR_BCN],\nwhich is introduced in commit 859ee3c43812 (\"DCB: Add support for DCB\nBCN\"). Please see the comment in below code\n\nstatic int dcbnl_bcn_setcfg(...)\n{\n  ...\n  ret = nla_parse_nested_deprecated(..., dcbnl_pfc_up_nest, .. )\n  // !!! dcbnl_pfc_up_nest for attributes\n  //  DCB_PFC_UP_ATTR_0 to DCB_PFC_UP_ATTR_ALL in enum dcbnl_pfc_up_attrs\n  ...\n  for (i = DCB_BCN_ATTR_RP_0; i <= DCB_BCN_ATTR_RP_7; i++) {\n  // !!! DCB_BCN_ATTR_RP_0 to DCB_BCN_ATTR_RP_7 in enum dcbnl_bcn_attrs\n    ...\n    value_byte = nla_get_u8(data[i]);\n    ...\n  }\n  ...\n  for (i = DCB_BCN_ATTR_BCNA_0; i <= DCB_BCN_ATTR_RI; i++) {\n  // !!! DCB_BCN_ATTR_BCNA_0 to DCB_BCN_ATTR_RI in enum dcbnl_bcn_attrs\n  ...\n    value_int = nla_get_u32(data[i]);\n  ...\n  }\n  ...\n}\n\nThat is, the nla_parse_nested_deprecated uses dcbnl_pfc_up_nest\nattributes to parse nlattr defined in dcbnl_pfc_up_attrs. But the\nfollowing access code fetch each nlattr as dcbnl_bcn_attrs attributes.\nBy looking up the associated nla_policy for dcbnl_bcn_attrs. We can find\nthe beginning part of these two policies are \"same\".\n\nstatic const struct nla_policy dcbnl_pfc_up_nest[...] = {\n        [DCB_PFC_UP_ATTR_0]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_1]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_2]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_3]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_4]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_5]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_6]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_7]   = {.type = NLA_U8},\n        [DCB_PFC_UP_ATTR_ALL] = {.type = NLA_FLAG},\n};\n\nstatic const struct nla_policy dcbnl_bcn_nest[...] = {\n        [DCB_BCN_ATTR_RP_0]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_1]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_2]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_3]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_4]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_5]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_6]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_7]         = {.type = NLA_U8},\n        [DCB_BCN_ATTR_RP_ALL]       = {.type = NLA_FLAG},\n        // from here is somewhat different\n        [DCB_BCN_ATTR_BCNA_0]       = {.type = NLA_U32},\n        ...\n        [DCB_BCN_ATTR_ALL]          = {.type = NLA_FLAG},\n};\n\nTherefore, the current code is buggy and this\nnla_parse_nested_deprecated could overflow the dcbnl_pfc_up_nest and use\nthe adjacent nla_policy to parse attributes from DCB_BCN_ATTR_BCNA_0.\n\nHence use the correct policy dcbnl_bcn_nest to parse the nested\ntb[DCB_ATTR_BCN] TLV.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ba5c56ff-680b-4a77-b6c7-e3c72c311bf4",  "id": "CVE-2018-14614",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14614"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 4.17.10. There is an out-of-bounds access in __remove_dirty_segment() in fs/f2fs/segment.c when mounting an f2fs image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "99af0cfc-7acc-4fe4-9763-c4c7066e9acd",  "id": "CVE-2025-37823",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too\n\nSimilarly to the previous patch, we need to safe guard hfsc_dequeue()\ntoo. But for this one, we don't have a reliable reproducer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9413f0ca-8c40-4944-8c56-a63a718773a9",  "id": "CVE-2013-2148",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2148"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The fill_event_metadata function in fs/notify/fanotify/fanotify_user.c in the Linux kernel through 3.9.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a read operation on the fanotify descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "702a223b-fa19-4106-8404-01695bc67f9a",  "id": "CVE-2011-2699",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2699"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The IPv6 implementation in the Linux kernel before 3.1 does not generate Fragment Identification values separately for each destination, which makes it easier for remote attackers to cause a denial of service (disrupted networking) by predicting these values and sending crafted packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45635048-5fc3-4af2-b8c0-6ef227bd9b05",  "id": "CVE-2020-25673",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25673"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak and eventually hanging-up the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f7021674-8467-444e-9dfd-eafb8bb1f608",  "id": "CVE-2023-53097",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/iommu: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f305353c-77a3-4f79-b26a-d134789b8dbc",  "id": "CVE-2023-28450",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28450"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7fb43f5c-55fd-45d1-a714-56ad54dde2bd",  "id": "DSA-4539-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4fbe2ac7-8288-401f-97d1-3a003cb801e8",  "id": "CVE-2022-49762",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: check overflow when iterating ATTR_RECORDs\n\nKernel iterates over ATTR_RECORDs in mft record in ntfs_attr_find(). \nBecause the ATTR_RECORDs are next to each other, kernel can get the next\nATTR_RECORD from end address of current ATTR_RECORD, through current\nATTR_RECORD length field.\n\nThe problem is that during iteration, when kernel calculates the end\naddress of current ATTR_RECORD, kernel may trigger an integer overflow bug\nin executing `a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))`.  This\nmay wrap, leading to a forever iteration on 32bit systems.\n\nThis patch solves it by adding some checks on calculating end address\nof current ATTR_RECORD during iteration.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9878f9c6-aead-4697-a25a-abddde868811",  "id": "CVE-2010-4258",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4258"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    269  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:15704'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:96484/Linux-Kernel-2.6.37-Local-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "a8042d6e-cbf7-40b7-a47c-b1f82dfb1110",  "id": "ALSA-2024:9333",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf3e45aa-4e77-4804-b3d1-ee79204319c1",  "id": "CVE-2023-37453",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37453"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "958774e9-edaf-48e0-ac2f-9a1bd5603e41",  "id": "CVE-1999-0656",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-1999-0656"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    16  ],  "analysis": {    "state": "in_triage"  },  "description": "The ugidd RPC interface, by design, allows remote attackers to enumerate valid usernames by specifying arbitrary UIDs that ugidd maps to local user and group names.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9662d178-40b2-4da2-9d7e-3dc5ec56c95a",  "id": "CVE-2014-2706",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2706"  },  "ratings": [    {      "score": 7.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f4ce64ba-b52c-469c-b513-61dd1b6b0eb4",  "id": "CVE-2025-21806",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: let net.core.dev_weight always be non-zero\n\nThe following problem was encountered during stability test:\n\n(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \\\n\treturned 1, exceeding its budget of 0.\n------------[ cut here ]------------\nlist_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \\\n\tnext=ffff88905f746e40.\nWARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \\\n\t__list_add_valid_or_report+0xf3/0x130\nCPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+\nRIP: 0010:__list_add_valid_or_report+0xf3/0x130\nCall Trace:\n? __warn+0xcd/0x250\n? __list_add_valid_or_report+0xf3/0x130\nenqueue_to_backlog+0x923/0x1070\nnetif_rx_internal+0x92/0x2b0\n__netif_rx+0x15/0x170\nloopback_xmit+0x2ef/0x450\ndev_hard_start_xmit+0x103/0x490\n__dev_queue_xmit+0xeac/0x1950\nip_finish_output2+0x6cc/0x1620\nip_output+0x161/0x270\nip_push_pending_frames+0x155/0x1a0\nraw_sendmsg+0xe13/0x1550\n__sys_sendto+0x3bf/0x4e0\n__x64_sys_sendto+0xdc/0x1b0\ndo_syscall_64+0x5b/0x170\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe reproduction command is as follows:\n  sysctl -w net.core.dev_weight=0\n  ping 127.0.0.1\n\nThis is because when the napi's weight is set to 0, process_backlog() may\nreturn 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this\nnapi to be re-polled in net_rx_action() until __do_softirq() times out.\nSince the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can\nbe retriggered in enqueue_to_backlog(), causing this issue.\n\nMaking the napi's weight always non-zero solves this problem.\n\nTriggering this issue requires system-wide admin (setting is\nnot namespaced).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8215f747-93f8-4dde-aa80-73814b3243dc",  "id": "CVE-2013-2898",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2898"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/hid/hid-sensor-hub.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_SENSOR_HUB is enabled, allows physically proximate attackers to obtain sensitive information from kernel memory via a crafted device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0dc48ae8-a04b-449a-a6e6-9c0be62af5bf",  "id": "CVE-2022-50519",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure\n\nIf creation or finalization of a checkpoint fails due to anomalies in the\ncheckpoint metadata on disk, a kernel warning is generated.\n\nThis patch replaces the WARN_ONs by nilfs_error, so that a kernel, booted\nwith panic_on_warn, does not panic.  A nilfs_error is appropriate here to\nhandle the abnormal filesystem condition.\n\nThis also replaces the detected error codes with an I/O error so that\nneither of the internal error codes is returned to callers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "544d37b8-3f75-4e43-9966-5b6e1cb9511c",  "id": "CVE-2024-57798",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()\n\nWhile receiving an MST up request message from one thread in\ndrm_dp_mst_handle_up_req(), the MST topology could be removed from\nanother thread via drm_dp_mst_topology_mgr_set_mst(false), freeing\nmst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL.\nThis could lead to a NULL deref/use-after-free of mst_primary in\ndrm_dp_mst_handle_up_req().\n\nAvoid the above by holding a reference for mst_primary in\ndrm_dp_mst_handle_up_req() while it's used.\n\nv2: Fix kfreeing the request if getting an mst_primary reference fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2590271-fce0-4e1d-9b39-a8f6375fc988",  "id": "CLSA-2024-1735121358",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d0f391a-19f8-4a32-8034-392183f3d8ac",  "id": "CVE-2025-38617",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: fix a race in packet_set_ring() and packet_notifier()\n\nWhen packet_set_ring() releases po->bind_lock, another thread can\nrun packet_notifier() and process an NETDEV_UP event.\n\nThis race and the fix are both similar to that of commit 15fe076edea7\n(\"net/packet: fix a race in packet_bind() and packet_notifier()\").\n\nThere too the packet_notifier NETDEV_UP event managed to run while a\npo->bind_lock critical section had to be temporarily released. And\nthe fix was similarly to temporarily set po->num to zero to keep\nthe socket unhooked until the lock is retaken.\n\nThe po->bind_lock in packet_set_ring and packet_notifier precede the\nintroduction of git history.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a47caea2-1aa3-43b6-b043-1ff4ee1c0ca2",  "id": "CVE-2024-35864",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in smb2_is_valid_lease_break()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "25460a07-a670-49ea-b396-ba798006423f",  "id": "AZL-90087",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ad2b0527-856f-42a3-b7ee-e32d347fff41",  "id": "CVE-2022-48947",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix u8 overflow\n\nBy keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases\nmultiple times and eventually it will wrap around the maximum number\n(i.e., 255).\nThis patch prevents this by adding a boundary check with\nL2CAP_MAX_CONF_RSP\n\nBtmon log:\nBluetooth monitor ver 5.64\n= Note: Linux version 6.1.0-rc2 (x86_64)                               0.264594\n= Note: Bluetooth subsystem version 2.22                               0.264636\n@ MGMT Open: btmon (privileged) version 1.22                  {0x0001} 0.272191\n= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0)          [hci0] 13.877604\n@ RAW Open: 9496 (privileged) version 2.22                   {0x0002} 13.890741\n= Open Index: 00:00:00:00:00:00                                [hci0] 13.900426\n(...)\n> ACL Data RX: Handle 200 flags 0x00 dlen 1033             #32 [hci0] 14.273106\n        invalid packet size (12 != 1033)\n        08 00 01 00 02 01 04 00 01 10 ff ff              ............\n> ACL Data RX: Handle 200 flags 0x00 dlen 1547             #33 [hci0] 14.273561\n        invalid packet size (14 != 1547)\n        0a 00 01 00 04 01 06 00 40 00 00 00 00 00        ........@.....\n> ACL Data RX: Handle 200 flags 0x00 dlen 2061             #34 [hci0] 14.274390\n        invalid packet size (16 != 2061)\n        0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04  ........@.......\n> ACL Data RX: Handle 200 flags 0x00 dlen 2061             #35 [hci0] 14.274932\n        invalid packet size (16 != 2061)\n        0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00  ........@.......\n= bluetoothd: Bluetooth daemon 5.43                                   14.401828\n> ACL Data RX: Handle 200 flags 0x00 dlen 1033             #36 [hci0] 14.275753\n        invalid packet size (12 != 1033)\n        08 00 01 00 04 01 04 00 40 00 00 00              ........@...",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b244d49e-037f-4f84-a538-7e28d638c54f",  "id": "CVE-2023-52498",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM: sleep: Fix possible deadlocks in core system-wide PM code\n\nIt is reported that in low-memory situations the system-wide resume core\ncode deadlocks, because async_schedule_dev() executes its argument\nfunction synchronously if it cannot allocate memory (and not only in\nthat case) and that function attempts to acquire a mutex that is already\nheld.  Executing the argument function synchronously from within\ndpm_async_fn() may also be problematic for ordering reasons (it may\ncause a consumer device's resume callback to be invoked before a\nrequisite supplier device's one, for example).\n\nAddress this by changing the code in question to use\nasync_schedule_dev_nocall() for scheduling the asynchronous\nexecution of device suspend and resume functions and to directly\nrun them synchronously if async_schedule_dev_nocall() returns false.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "02c727ff-1d57-473b-aeae-5e41df89c2f0",  "id": "CVE-2011-4594",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4594"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The __sys_sendmsg function in net/socket.c in the Linux kernel before 3.1 allows local users to cause a denial of service (system crash) via crafted use of the sendmmsg system call, leading to an incorrect pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d194c460-2095-4d4d-8e2f-61a84cb680ae",  "id": "CVE-2019-15117",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15117"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9358ca58-2393-48f6-a44a-f20a44ed3b06",  "id": "CVE-2021-47434",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47434"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: Fix command ring pointer corruption while aborting a command\n\nThe command ring pointer is located at [6:63] bits of the command\nring control register (CRCR). All the control bits like command stop,\nabort are located at [0:3] bits. While aborting a command, we read the\nCRCR and set the abort bit and write to the CRCR. The read will always\ngive command ring pointer as all zeros. So we essentially write only\nthe control bits. Since we split the 64 bit write into two 32 bit writes,\nthere is a possibility of xHC command ring stopped before the upper\ndword (all zeros) is written. If that happens, xHC updates the upper\ndword of its internal command ring pointer with all zeros. Next time,\nwhen the command ring is restarted, we see xHC memory access failures.\nFix this issue by only writing to the lower dword of CRCR where all\ncontrol bits are located.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2bd88f58-2ba4-42c4-b521-4b30b7b6e0ea",  "id": "CVE-2025-22079",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate l_tree_depth to avoid out-of-bounds access\n\nThe l_tree_depth field is 16-bit (__le16), but the actual maximum depth is\nlimited to OCFS2_MAX_PATH_DEPTH.\n\nAdd a check to prevent out-of-bounds access if l_tree_depth has an invalid\nvalue, which may occur when reading from a corrupted mounted disk [1].",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f1eea372-0e5a-4270-88c2-04819ea81606",  "id": "CVE-2016-10723",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10723"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 4.17.2. Since the page allocator does not yield CPU resources to the owner of the oom_lock mutex, a local unprivileged user can trivially lock up the system forever by wasting CPU resources from the page allocator (e.g., via concurrent page fault events) when the global OOM killer is invoked. NOTE: the software maintainer has not accepted certain proposed patches, in part because of a viewpoint that \"the underlying problem is non-trivial to handle.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "493c828e-a9fe-417c-bad8-067d315d9d53",  "id": "GHSA-mmrq-6999-72v8",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "449acb7d-fd9a-469d-ae77-92ff33b67fe2",  "id": "CVE-2026-31577",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map\n\nThe DAT inode's btree node cache (i_assoc_inode) is initialized lazily\nduring btree operations. However, nilfs_mdt_save_to_shadow_map()\nassumes i_assoc_inode is already initialized when copying dirty pages\nto the shadow map during GC.\n\nIf NILFS_IOCTL_CLEAN_SEGMENTS is called immediately after mount before\nany btree operation has occurred on the DAT inode, i_assoc_inode is\nNULL leading to a general protection fault.\n\nFix this by calling nilfs_attach_btree_node_cache() on the DAT inode\nin nilfs_dat_read() at mount time, ensuring i_assoc_inode is always\ninitialized before any GC operation can use it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f4bae7c3-2b8c-48ae-acd0-d08a7428fd66",  "id": "CVE-2023-52638",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: prevent deadlock by changing j1939_socks_lock to rwlock\n\nThe following 3 locks would race against each other, causing the\ndeadlock situation in the Syzbot bug report:\n\n- j1939_socks_lock\n- active_session_list_lock\n- sk_session_queue_lock\n\nA reasonable fix is to change j1939_socks_lock to an rwlock, since in\nthe rare situations where a write lock is required for the linked list\nthat j1939_socks_lock is protecting, the code does not attempt to\nacquire any more locks. This would break the circular lock dependency,\nwhere, for example, the current thread already locks j1939_socks_lock\nand attempts to acquire sk_session_queue_lock, and at the same time,\nanother thread attempts to acquire j1939_socks_lock while holding\nsk_session_queue_lock.\n\nNOTE: This patch along does not fix the unregister_netdevice bug\nreported by Syzbot; instead, it solves a deadlock situation to prepare\nfor one or more further patches to actually fix the Syzbot bug, which\nappears to be a reference counting problem within the j1939 codebase.\n\n[mkl: remove unrelated newline change]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4de700de-fdb0-4fd0-80c9-e788a11645c4",  "id": "CLSA-2026-1778787445",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "35a29447-7b41-483d-b928-26cdf6390c34",  "id": "CVE-2011-1746",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1746"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple integer overflows in the (1) agp_allocate_memory and (2) agp_create_user_memory functions in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allow local users to trigger buffer overflows, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via vectors related to calls that specify a large number of memory pages.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "02732f00-9d03-483a-9983-d618e9a6605e",  "id": "CVE-2014-9803",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9803"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    19  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/arm64/include/asm/pgtable.h in the Linux kernel before 3.15-rc5-next-20140519, as used in Android before 2016-07-05 on Nexus 5X and 6P devices, mishandles execute-only pages, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28557020.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c1ad2c29-6ae5-49ad-ab79-36385076177e",  "id": "CVE-2019-15030",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15030"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"    }  ],  "cwes": [    862  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then accesses vector registers. At some point, the vector registers will be corrupted with the values from a different local Linux process because of a missing arch/powerpc/kernel/process.c check.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2173356f-bcb4-4ebd-ba63-916edc92d2fe",  "id": "CVE-2023-53040",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nca8210: fix mac_len negative array access\n\nThis patch fixes a buffer overflow access of skb->data if\nieee802154_hdr_peek_addrs() fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc439c9b-b3d4-436c-a282-eda9424e5476",  "id": "CVE-2023-52806",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: Fix possible null-ptr-deref when assigning a stream\n\nWhile AudioDSP drivers assign streams exclusively of HOST or LINK type,\nnothing blocks a user to attempt to assign a COUPLED stream. As\nsupplied substream instance may be a stub, what is the case when\ncode-loading, such scenario ends with null-ptr-deref.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b217842-572c-4dab-bd8a-abbf34f13adb",  "id": "CVE-2015-1420",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1420"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "675f6fd6-99b7-4308-b2c9-71660d1c6234",  "id": "RHSA-2022:1076",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "efe59349-4260-455a-a31d-93332fa22389",  "id": "CVE-2012-6647",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6647"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that calls have two different futex addresses, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted FUTEX_WAIT_REQUEUE_PI command.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "972d6473-e191-424a-811d-7b029417c359",  "id": "CVE-2026-53075",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: require CAP_NET_ADMIN in target netns for unattached ioctls\n\n/dev/ppp open is currently authorized against file->f_cred->user_ns,\nwhile unattached administrative ioctls operate on current->nsproxy->net_ns.\n\nAs a result, a local unprivileged user can create a new user namespace\nwith CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,\nand still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against\nan inherited network namespace.\n\nRequire CAP_NET_ADMIN in the user namespace that owns the target network\nnamespace before handling unattached PPP administrative ioctls.\n\nThis preserves normal pppd operation in the network namespace it is\nactually privileged in, while rejecting the userns-only inherited-netns\ncase.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2ec75063-c133-487d-a726-914da0a53c85",  "id": "CVE-2010-4073",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4073"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not initialize certain structures, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to the (1) compat_sys_semctl, (2) compat_sys_msgctl, and (3) compat_sys_shmctl functions in ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in ipc/compat_mq.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:17787'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:104820/Linux-Kernel-Econet-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "ca7864ca-915b-42ce-8985-cac94b775c85",  "id": "CVE-2024-26878",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nquota: Fix potential NULL pointer dereference\n\nBelow race may cause NULL pointer dereference\n\nP1\t\t\t\t\tP2\ndquot_free_inode\t\t\tquota_off\n\t\t\t\t\t  drop_dquot_ref\n\t\t\t\t\t   remove_dquot_ref\n\t\t\t\t\t   dquots = i_dquot(inode)\n  dquots = i_dquot(inode)\n  srcu_read_lock\n  dquots[cnt]) != NULL (1)\n\t\t\t\t\t     dquots[type] = NULL (2)\n  spin_lock(&dquots[cnt]->dq_dqb_lock) (3)\n   ....\n\nIf dquot_free_inode(or other routines) checks inode's quota pointers (1)\nbefore quota_off sets it to NULL(2) and use it (3) after that, NULL pointer\ndereference will be triggered.\n\nSo let's fix it by using a temporary pointer to avoid this issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7f0878e7-66ba-46ce-b6c6-6638c7df7b01",  "id": "CLSA-2026-1772098723",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a445772-fa69-4324-8022-523e58180365",  "id": "openSUSE-SU-2026:20985-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d15b09b3-83d5-4e2e-b18f-dcb17f8e1a9a",  "id": "CVE-2023-28772",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28772"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d17c9ad-6589-478c-b2a6-6ea05e44cc7c",  "id": "CVE-2023-52501",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Do not attempt to read past \"commit\"\n\nWhen iterating over the ring buffer while the ring buffer is active, the\nwriter can corrupt the reader. There's barriers to help detect this and\nhandle it, but that code missed the case where the last event was at the\nvery end of the page and has only 4 bytes left.\n\nThe checks to detect the corruption by the writer to reads needs to see the\nlength of the event. If the length in the first 4 bytes is zero then the\nlength is stored in the second 4 bytes. But if the writer is in the process\nof updating that code, there's a small window where the length in the first\n4 bytes could be zero even though the length is only 4 bytes. That will\ncause rb_event_length() to read the next 4 bytes which could happen to be off the\nallocated page.\n\nTo protect against this, fail immediately if the next event pointer is\nless than 8 bytes from the end of the commit (last byte of data), as all\nevents must be a minimum of 8 bytes anyway.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f58dd8ac-9199-4933-a3c2-d895db1d2ab2",  "id": "CVE-2022-49103",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify()\n\n[You don't often get email from xiongx18@fudan.edu.cn. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification.]\n\nThe reference counting issue happens in two error paths in the\nfunction _nfs42_proc_copy_notify(). In both error paths, the function\nsimply returns the error code and forgets to balance the refcount of\nobject `ctx`, bumped by get_nfs_open_context() earlier, which may\ncause refcount leaks.\n\nFix it by balancing refcount of the `ctx` object before the function\nreturns in both error paths.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "640652c6-17d0-480c-a9e7-295fc8339293",  "id": "CVE-2017-6951",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6951"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The keyring_search_aux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the \"dead\" type.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "218507cc-780f-4765-8ae6-e7b2598b0603",  "id": "CVE-2014-8159",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8159"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly restrict use of User Verbs for registration of memory regions, which allows local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7aea1cf4-b72a-4d38-b8c7-9e895be512d3",  "id": "CVE-2022-49948",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: Clear selection before changing the font\n\nWhen changing the console font with ioctl(KDFONTOP) the new font size\ncan be bigger than the previous font. A previous selection may thus now\nbe outside of the new screen size and thus trigger out-of-bounds\naccesses to graphics memory if the selection is removed in\nvc_do_resize().\n\nPrevent such out-of-memory accesses by dropping the selection before the\nvarious con_font_set() console handlers are called.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2940645-1243-4c6f-88a6-607bb308868b",  "id": "RUSTSEC-2023-0022",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "24129874-c497-42b2-9f79-f589cf0bdc71",  "id": "CVE-2023-46862",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46862"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9f4cad36-800a-4c05-a55a-6b6a4583308c",  "id": "SUSE-SU-2023:3819-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4a74eefa-283d-4762-8130-f62d92a4d407",  "id": "CVE-2018-14634",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14634"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:45516'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:149567/Linux-create_elf_tables-Integer-Overflow.html'"    }  ]},{  "bom-ref": "8ca362c6-798a-4a9d-8375-e8aaeb85fd95",  "id": "CVE-2024-49923",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags\n\n[WHAT & HOW]\n\"dcn20_validate_apply_pipe_split_flags\" dereferences merge, and thus it\ncannot be a null pointer. Let's pass a valid pointer to avoid null\ndereference.\n\nThis fixes 2 FORWARD_NULL issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7fae4852-2559-4e85-aeb8-1c54ce17262a",  "id": "CVE-2023-52484",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range\n\nWhen running an SVA case, the following soft lockup is triggered:\n--------------------------------------------------------------------\nwatchdog: BUG: soft lockup - CPU#244 stuck for 26s!\npstate: 83400009 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\npc : arm_smmu_cmdq_issue_cmdlist+0x178/0xa50\nlr : arm_smmu_cmdq_issue_cmdlist+0x150/0xa50\nsp : ffff8000d83ef290\nx29: ffff8000d83ef290 x28: 000000003b9aca00 x27: 0000000000000000\nx26: ffff8000d83ef3c0 x25: da86c0812194a0e8 x24: 0000000000000000\nx23: 0000000000000040 x22: ffff8000d83ef340 x21: ffff0000c63980c0\nx20: 0000000000000001 x19: ffff0000c6398080 x18: 0000000000000000\nx17: 0000000000000000 x16: 0000000000000000 x15: ffff3000b4a3bbb0\nx14: ffff3000b4a30888 x13: ffff3000b4a3cf60 x12: 0000000000000000\nx11: 0000000000000000 x10: 0000000000000000 x9 : ffffc08120e4d6bc\nx8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000048cfa\nx5 : 0000000000000000 x4 : 0000000000000001 x3 : 000000000000000a\nx2 : 0000000080000000 x1 : 0000000000000000 x0 : 0000000000000001\nCall trace:\n arm_smmu_cmdq_issue_cmdlist+0x178/0xa50\n __arm_smmu_tlb_inv_range+0x118/0x254\n arm_smmu_tlb_inv_range_asid+0x6c/0x130\n arm_smmu_mm_invalidate_range+0xa0/0xa4\n __mmu_notifier_invalidate_range_end+0x88/0x120\n unmap_vmas+0x194/0x1e0\n unmap_region+0xb4/0x144\n do_mas_align_munmap+0x290/0x490\n do_mas_munmap+0xbc/0x124\n __vm_munmap+0xa8/0x19c\n __arm64_sys_munmap+0x28/0x50\n invoke_syscall+0x78/0x11c\n el0_svc_common.constprop.0+0x58/0x1c0\n do_el0_svc+0x34/0x60\n el0_svc+0x2c/0xd4\n el0t_64_sync_handler+0x114/0x140\n el0t_64_sync+0x1a4/0x1a8\n--------------------------------------------------------------------\n\nNote that since 6.6-rc1 the arm_smmu_mm_invalidate_range above is renamed\nto \"arm_smmu_mm_arch_invalidate_secondary_tlbs\", yet the problem remains.\n\nThe commit 06ff87bae8d3 (\"arm64: mm: remove unused functions and variable\nprotoypes\") fixed a similar lockup on the CPU MMU side. Yet, it can occur\nto SMMU too, since arm_smmu_mm_arch_invalidate_secondary_tlbs() is called\ntypically next to MMU tlb flush function, e.g.\n\ttlb_flush_mmu_tlbonly {\n\t\ttlb_flush {\n\t\t\t__flush_tlb_range {\n\t\t\t\t// check MAX_TLBI_OPS\n\t\t\t}\n\t\t}\n\t\tmmu_notifier_arch_invalidate_secondary_tlbs {\n\t\t\tarm_smmu_mm_arch_invalidate_secondary_tlbs {\n\t\t\t\t// does not check MAX_TLBI_OPS\n\t\t\t}\n\t\t}\n\t}\n\nClone a CMDQ_MAX_TLBI_OPS from the MAX_TLBI_OPS in tlbflush.h, since in an\nSVA case SMMU uses the CPU page table, so it makes sense to align with the\ntlbflush code. Then, replace per-page TLBI commands with a single per-asid\nTLBI command, if the request size hits this threshold.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb99f8ab-81a1-4b52-8dc6-e569e850c97a",  "id": "openSUSE-SU-2025:14890-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5254bdeb-6def-4ff0-ae29-0190e9c46134",  "id": "ROOT-OS-ALPINE-323-CVE-2026-22796",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1affcf36-9c4c-4970-96ae-6893875703dc",  "id": "CVE-2018-10074",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10074"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The hi3660_stub_clk_probe function in drivers/clk/hisilicon/clk-hi3660-stub.c in the Linux kernel before 4.16 allows local users to cause a denial of service (NULL pointer dereference) by triggering a failure of resource retrieval.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "92c762a7-29fb-42d7-920b-e9e5608ee98b",  "id": "CVE-2024-47670",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: add bounds checking to ocfs2_xattr_find_entry()\n\nAdd a paranoia check to make sure it doesn't stray beyond valid memory\nregion containing ocfs2 xattr entries when scanning for a match.  It will\nprevent out-of-bound access in case of crafted images.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "65e693a5-40d7-4056-ba2d-86075da9688f",  "id": "CVE-2024-26686",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats\n\nlock_task_sighand() can trigger a hard lockup.  If NR_CPUS threads call\ndo_task_stat() at the same time and the process has NR_THREADS, it will\nspin with irqs disabled O(NR_CPUS * NR_THREADS) time.\n\nChange do_task_stat() to use sig->stats_lock to gather the statistics\noutside of ->siglock protected section, in the likely case this code will\nrun lockless.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2bf59f4a-20bf-477b-91c9-5256c8e5c004",  "id": "CVE-2022-49077",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    193  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)\n\nIf an mremap() syscall with old_size=0 ends up in move_page_tables(), it\nwill call invalidate_range_start()/invalidate_range_end() unnecessarily,\ni.e.  with an empty range.\n\nThis causes a WARN in KVM's mmu_notifier.  In the past, empty ranges\nhave been diagnosed to be off-by-one bugs, hence the WARNing.  Given the\nlow (so far) number of unique reports, the benefits of detecting more\nbuggy callers seem to outweigh the cost of having to fix cases such as\nthis one, where userspace is doing something silly.  In this particular\ncase, an early return from move_page_tables() is enough to fix the\nissue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e15991aa-59b8-43f1-a2af-996c5b19c6a9",  "id": "RHSA-2014:1652",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "feec63d0-7b05-43b4-b36f-993368c9062b",  "id": "CVE-2025-38194",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: check that raw node were preallocated before writing summary\n\nSyzkaller detected a kernel bug in jffs2_link_node_ref, caused by fault\ninjection in jffs2_prealloc_raw_node_refs. jffs2_sum_write_sumnode doesn't\ncheck return value of jffs2_prealloc_raw_node_refs and simply lets any\nerror propagate into jffs2_sum_write_data, which eventually calls\njffs2_link_node_ref in order to link the summary to an expectedly allocated\nnode.\n\nkernel BUG at fs/jffs2/nodelist.c:592!\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 1 PID: 31277 Comm: syz-executor.7 Not tainted 6.1.128-syzkaller-00139-ge10f83ca10a1 #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:jffs2_link_node_ref+0x570/0x690 fs/jffs2/nodelist.c:592\nCall Trace:\n <TASK>\n jffs2_sum_write_data fs/jffs2/summary.c:841 [inline]\n jffs2_sum_write_sumnode+0xd1a/0x1da0 fs/jffs2/summary.c:874\n jffs2_do_reserve_space+0xa18/0xd60 fs/jffs2/nodemgmt.c:388\n jffs2_reserve_space+0x55f/0xaa0 fs/jffs2/nodemgmt.c:197\n jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362\n jffs2_write_end+0x726/0x15d0 fs/jffs2/file.c:301\n generic_perform_write+0x314/0x5d0 mm/filemap.c:3856\n __generic_file_write_iter+0x2ae/0x4d0 mm/filemap.c:3973\n generic_file_write_iter+0xe3/0x350 mm/filemap.c:4005\n call_write_iter include/linux/fs.h:2265 [inline]\n do_iter_readv_writev+0x20f/0x3c0 fs/read_write.c:735\n do_iter_write+0x186/0x710 fs/read_write.c:861\n vfs_iter_write+0x70/0xa0 fs/read_write.c:902\n iter_file_splice_write+0x73b/0xc90 fs/splice.c:685\n do_splice_from fs/splice.c:763 [inline]\n direct_splice_actor+0x10c/0x170 fs/splice.c:950\n splice_direct_to_actor+0x337/0xa10 fs/splice.c:896\n do_splice_direct+0x1a9/0x280 fs/splice.c:1002\n do_sendfile+0xb13/0x12c0 fs/read_write.c:1255\n __do_sys_sendfile64 fs/read_write.c:1323 [inline]\n __se_sys_sendfile64 fs/read_write.c:1309 [inline]\n __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nFix this issue by checking return value of jffs2_prealloc_raw_node_refs\nbefore calling jffs2_sum_write_data.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f3d6644-9508-4125-a9e2-c24422696c1f",  "id": "AZL-89943",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7dbf6d69-adbf-4df9-a223-eff2d61bb8fc",  "id": "CVE-2021-47169",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47169"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'\n\nIn 'rp2_probe', the driver registers 'rp2_uart_interrupt' then calls\n'rp2_fw_cb' through 'request_firmware_nowait'. In 'rp2_fw_cb', if the\nfirmware don't exists, function just return without initializing ports\nof 'rp2_card'. But now the interrupt handler function has been\nregistered, and when an interrupt comes, 'rp2_uart_interrupt' may access\nthose ports then causing NULL pointer dereference or other bugs.\n\nBecause the driver does some initialization work in 'rp2_fw_cb', in\norder to make the driver ready to handle interrupts, 'request_firmware'\nshould be used instead of asynchronous 'request_firmware_nowait'.\n\nThis report reveals it:\n\nINFO: trying to register non-static key.\nthe code is fine but needs lockdep annotation.\nturning off the locking correctness validator.\nCPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef-dirty #45\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-\ngc9ba5276e321-prebuilt.qemu.org 04/01/2014\nCall Trace:\n <IRQ>\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0xec/0x156 lib/dump_stack.c:118\n assign_lock_key kernel/locking/lockdep.c:727 [inline]\n register_lock_class+0x14e5/0x1ba0 kernel/locking/lockdep.c:753\n __lock_acquire+0x187/0x3750 kernel/locking/lockdep.c:3303\n lock_acquire+0x124/0x340 kernel/locking/lockdep.c:3907\n __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]\n _raw_spin_lock+0x32/0x50 kernel/locking/spinlock.c:144\n spin_lock include/linux/spinlock.h:329 [inline]\n rp2_ch_interrupt drivers/tty/serial/rp2.c:466 [inline]\n rp2_asic_interrupt.isra.9+0x15d/0x990 drivers/tty/serial/rp2.c:493\n rp2_uart_interrupt+0x49/0xe0 drivers/tty/serial/rp2.c:504\n __handle_irq_event_percpu+0xfb/0x770 kernel/irq/handle.c:149\n handle_irq_event_percpu+0x79/0x150 kernel/irq/handle.c:189\n handle_irq_event+0xac/0x140 kernel/irq/handle.c:206\n handle_fasteoi_irq+0x232/0x5c0 kernel/irq/chip.c:725\n generic_handle_irq_desc include/linux/irqdesc.h:155 [inline]\n handle_irq+0x230/0x3a0 arch/x86/kernel/irq_64.c:87\n do_IRQ+0xa7/0x1e0 arch/x86/kernel/irq.c:247\n common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670\n </IRQ>\nRIP: 0010:native_safe_halt+0x28/0x30 arch/x86/include/asm/irqflags.h:61\nCode: 00 00 55 be 04 00 00 00 48 c7 c7 00 c2 2f 8c 48 89 e5 e8 fb 31 e7 f8\n8b 05 75 af 8d 03 85 c0 7e 07 0f 00 2d 8a 61 65 00 fb f4 <5d> c3 90 90 90\n90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41\nRSP: 0018:ffff88806b71fcc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde\nRAX: 0000000000000000 RBX: ffffffff8bde7e48 RCX: ffffffff88a21285\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff8c2fc200\nRBP: ffff88806b71fcc8 R08: fffffbfff185f840 R09: fffffbfff185f840\nR10: 0000000000000001 R11: fffffbfff185f840 R12: 0000000000000002\nR13: ffffffff8bea18a0 R14: 0000000000000000 R15: 0000000000000000\n arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]\n default_idle+0x6f/0x360 arch/x86/kernel/process.c:557\n arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:548\n default_idle_call+0x3b/0x60 kernel/sched/idle.c:93\n cpuidle_idle_call kernel/sched/idle.c:153 [inline]\n do_idle+0x2ab/0x3c0 kernel/sched/idle.c:263\n cpu_startup_entry+0xcb/0xe0 kernel/sched/idle.c:369\n start_secondary+0x3b8/0x4e0 arch/x86/kernel/smpboot.c:271\n secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243\nBUG: unable to handle kernel NULL pointer dereference at 0000000000000010\nPGD 8000000056d27067 P4D 8000000056d27067 PUD 56d28067 PMD 0\nOops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef-dirty #45\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-\ngc9ba5276e321-prebuilt.qemu.org 04/01/2014\nRIP: 0010:readl arch/x86/include/asm/io.h:59 [inline]\nRIP: 0010:rp2_ch_interrupt drivers/tty/serial/rp2.c:472 [inline]\nRIP: 0010:rp2_asic_interrupt.isra.9+0x181/0x990 drivers/tty/serial/rp2.c:\n493\nCo\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "30577bff-2394-49af-9dc1-0bf7fca25741",  "id": "CVE-2024-26841",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    459  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Update cpu_sibling_map when disabling nonboot CPUs\n\nUpdate cpu_sibling_map when disabling nonboot CPUs by defining & calling\nclear_cpu_sibling_map(), otherwise we get such errors on SMT systems:\n\njump label: negative count!\nWARNING: CPU: 6 PID: 45 at kernel/jump_label.c:263 __static_key_slow_dec_cpuslocked+0xec/0x100\nCPU: 6 PID: 45 Comm: cpuhp/6 Not tainted 6.8.0-rc5+ #1340\npc 90000000004c302c ra 90000000004c302c tp 90000001005bc000 sp 90000001005bfd20\na0 000000000000001b a1 900000000224c278 a2 90000001005bfb58 a3 900000000224c280\na4 900000000224c278 a5 90000001005bfb50 a6 0000000000000001 a7 0000000000000001\nt0 ce87a4763eb5234a t1 ce87a4763eb5234a t2 0000000000000000 t3 0000000000000000\nt4 0000000000000006 t5 0000000000000000 t6 0000000000000064 t7 0000000000001964\nt8 000000000009ebf6 u0 9000000001f2a068 s9 0000000000000000 s0 900000000246a2d8\ns1 ffffffffffffffff s2 ffffffffffffffff s3 90000000021518c0 s4 0000000000000040\ns5 9000000002151058 s6 9000000009828e40 s7 00000000000000b4 s8 0000000000000006\n   ra: 90000000004c302c __static_key_slow_dec_cpuslocked+0xec/0x100\n  ERA: 90000000004c302c __static_key_slow_dec_cpuslocked+0xec/0x100\n CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n PRMD: 00000004 (PPLV0 +PIE -PWE)\n EUEN: 00000000 (-FPE -SXE -ASXE -BTE)\n ECFG: 00071c1c (LIE=2-4,10-12 VS=7)\nESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0)\n PRID: 0014d000 (Loongson-64bit, Loongson-3A6000-HV)\nCPU: 6 PID: 45 Comm: cpuhp/6 Not tainted 6.8.0-rc5+ #1340\nStack : 0000000000000000 900000000203f258 900000000179afc8 90000001005bc000\n        90000001005bf980 0000000000000000 90000001005bf988 9000000001fe0be0\n        900000000224c280 900000000224c278 90000001005bf8c0 0000000000000001\n        0000000000000001 ce87a4763eb5234a 0000000007f38000 90000001003f8cc0\n        0000000000000000 0000000000000006 0000000000000000 4c206e6f73676e6f\n        6f4c203a656d616e 000000000009ec99 0000000007f38000 0000000000000000\n        900000000214b000 9000000001fe0be0 0000000000000004 0000000000000000\n        0000000000000107 0000000000000009 ffffffffffafdabe 00000000000000b4\n        0000000000000006 90000000004c302c 9000000000224528 00005555939a0c7c\n        00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c\n        ...\nCall Trace:\n[<9000000000224528>] show_stack+0x48/0x1a0\n[<900000000179afc8>] dump_stack_lvl+0x78/0xa0\n[<9000000000263ed0>] __warn+0x90/0x1a0\n[<90000000017419b8>] report_bug+0x1b8/0x280\n[<900000000179c564>] do_bp+0x264/0x420\n[<90000000004c302c>] __static_key_slow_dec_cpuslocked+0xec/0x100\n[<90000000002b4d7c>] sched_cpu_deactivate+0x2fc/0x300\n[<9000000000266498>] cpuhp_invoke_callback+0x178/0x8a0\n[<9000000000267f70>] cpuhp_thread_fun+0xf0/0x240\n[<90000000002a117c>] smpboot_thread_fn+0x1dc/0x2e0\n[<900000000029a720>] kthread+0x140/0x160\n[<9000000000222288>] ret_from_kernel_thread+0xc/0xa4",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9128fd28-eb9e-4af2-935e-e541d98ff518",  "id": "CVE-2019-9495",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9495"  },  "ratings": [    {      "score": 3.7,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    203,    524  ],  "analysis": {    "state": "in_triage"  },  "description": "The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bef6539b-b542-4f6a-9ffc-cc916a6c69fe",  "id": "CVE-2024-50142",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: validate new SA's prefixlen using SA family when sel.family is unset\n\nThis expands the validation introduced in commit 07bf7908950a (\"xfrm:\nValidate address prefix lengths in the xfrm selector.\")\n\nsyzbot created an SA with\n    usersa.sel.family = AF_UNSPEC\n    usersa.sel.prefixlen_s = 128\n    usersa.family = AF_INET\n\nBecause of the AF_UNSPEC selector, verify_newsa_info doesn't put\nlimits on prefixlen_{s,d}. But then copy_from_user_state sets\nx->sel.family to usersa.family (AF_INET). Do the same conversion in\nverify_newsa_info before validating prefixlen_{s,d}, since that's how\nprefixlen is going to be used later on.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9aa156ac-7509-4957-9afb-8e5e2e44ea39",  "id": "CVE-2023-3567",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3567"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3d16bf29-7e10-4037-ac46-84dee554164a",  "id": "CVE-2016-7056",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7056"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    320,    385  ],  "analysis": {    "state": "in_triage"  },  "description": "A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d64d655b-deef-4376-91a8-e2491890f06f",  "id": "AZL-10109",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "964900fe-13c4-4356-95a0-db34d12ed2af",  "id": "CVE-2021-47277",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47277"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nkvm: avoid speculation-based attacks from out-of-range memslot accesses\n\nKVM's mechanism for accessing guest memory translates a guest physical\naddress (gpa) to a host virtual address using the right-shifted gpa\n(also known as gfn) and a struct kvm_memory_slot.  The translation is\nperformed in __gfn_to_hva_memslot using the following formula:\n\n      hva = slot->userspace_addr + (gfn - slot->base_gfn) * PAGE_SIZE\n\nIt is expected that gfn falls within the boundaries of the guest's\nphysical memory.  However, a guest can access invalid physical addresses\nin such a way that the gfn is invalid.\n\n__gfn_to_hva_memslot is called from kvm_vcpu_gfn_to_hva_prot, which first\nretrieves a memslot through __gfn_to_memslot.  While __gfn_to_memslot\ndoes check that the gfn falls within the boundaries of the guest's\nphysical memory or not, a CPU can speculate the result of the check and\ncontinue execution speculatively using an illegal gfn. The speculation\ncan result in calculating an out-of-bounds hva.  If the resulting host\nvirtual address is used to load another guest physical address, this\nis effectively a Spectre gadget consisting of two consecutive reads,\nthe second of which is data dependent on the first.\n\nRight now it's not clear if there are any cases in which this is\nexploitable.  One interesting case was reported by the original author\nof this patch, and involves visiting guest page tables on x86.  Right\nnow these are not vulnerable because the hva read goes through get_user(),\nwhich contains an LFENCE speculation barrier.  However, there are\npatches in progress for x86 uaccess.h to mask kernel addresses instead of\nusing LFENCE; once these land, a guest could use speculation to read\nfrom the VMM's ring 3 address space.  Other architectures such as ARM\nalready use the address masking method, and would be susceptible to\nthis same kind of data-dependent access gadgets.  Therefore, this patch\nproactively protects from these attacks by masking out-of-bounds gfns\nin __gfn_to_hva_memslot, which blocks speculation of invalid hvas.\n\nSean Christopherson noted that this patch does not cover\nkvm_read_guest_offset_cached.  This however is limited to a few bytes\npast the end of the cache, and therefore it is unlikely to be useful in\nthe context of building a chain of data dependent accesses.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7f8581ae-1ae6-48f6-b9c9-ac070b8f9fc3",  "id": "CVE-2023-53359",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic at\nonce.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5eaa6a6a-3e5a-455d-83d9-a532bda1b692",  "id": "CVE-2022-3521",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3521"  },  "ratings": [    {      "score": 2.5,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier assigned to this vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c0cf4b66-7878-425a-b3d9-a52aba855683",  "id": "CVE-2021-47323",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47323"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0f174ea4-05af-4424-b68a-02fe04138559",  "id": "CVE-2022-49172",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Fix non-access data TLB cache flush faults\n\nWhen a page is not present, we get non-access data TLB faults from\nthe fdc and fic instructions in flush_user_dcache_range_asm and\nflush_user_icache_range_asm. When these occur, the cache line is\nnot invalidated and potentially we get memory corruption. The\nproblem was hidden by the nullification of the flush instructions.\n\nThese faults also affect performance. With pa8800/pa8900 processors,\nthere will be 32 faults per 4 KB page since the cache line is 128\nbytes.  There will be more faults with earlier processors.\n\nThe problem is fixed by using flush_cache_pages(). It does the flush\nusing a tmp alias mapping.\n\nThe flush_cache_pages() call in flush_cache_range() flushed too\nlarge a range.\n\nV2: Remove unnecessary preempt_disable() and preempt_enable() calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b4c08d98-bf82-4964-857c-ad47855e2b37",  "id": "CVE-2022-49623",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/xive/spapr: correct bitmap allocation size\n\nkasan detects access beyond the end of the xibm->bitmap allocation:\n\nBUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140\nRead of size 8 at addr c00000001d1d0118 by task swapper/0/1\n\nCPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc2-00001-g90df023b36dd #28\nCall Trace:\n[c00000001d98f770] [c0000000012baab8] dump_stack_lvl+0xac/0x108 (unreliable)\n[c00000001d98f7b0] [c00000000068faac] print_report+0x37c/0x710\n[c00000001d98f880] [c0000000006902c0] kasan_report+0x110/0x354\n[c00000001d98f950] [c000000000692324] __asan_load8+0xa4/0xe0\n[c00000001d98f970] [c0000000011c6ed0] _find_first_zero_bit+0x40/0x140\n[c00000001d98f9b0] [c0000000000dbfbc] xive_spapr_get_ipi+0xcc/0x260\n[c00000001d98fa70] [c0000000000d6d28] xive_setup_cpu_ipi+0x1e8/0x450\n[c00000001d98fb30] [c000000004032a20] pSeries_smp_probe+0x5c/0x118\n[c00000001d98fb60] [c000000004018b44] smp_prepare_cpus+0x944/0x9ac\n[c00000001d98fc90] [c000000004009f9c] kernel_init_freeable+0x2d4/0x640\n[c00000001d98fd90] [c0000000000131e8] kernel_init+0x28/0x1d0\n[c00000001d98fe10] [c00000000000cd54] ret_from_kernel_thread+0x5c/0x64\n\nAllocated by task 0:\n kasan_save_stack+0x34/0x70\n __kasan_kmalloc+0xb4/0xf0\n __kmalloc+0x268/0x540\n xive_spapr_init+0x4d0/0x77c\n pseries_init_irq+0x40/0x27c\n init_IRQ+0x44/0x84\n start_kernel+0x2a4/0x538\n start_here_common+0x1c/0x20\n\nThe buggy address belongs to the object at c00000001d1d0118\n which belongs to the cache kmalloc-8 of size 8\nThe buggy address is located 0 bytes inside of\n 8-byte region [c00000001d1d0118, c00000001d1d0120)\n\nThe buggy address belongs to the physical page:\npage:c00c000000074740 refcount:1 mapcount:0 mapping:0000000000000000 index:0xc00000001d1d0558 pfn:0x1d1d\nflags: 0x7ffff000000200(slab|node=0|zone=0|lastcpupid=0x7ffff)\nraw: 007ffff000000200 c00000001d0003c8 c00000001d0003c8 c00000001d010480\nraw: c00000001d1d0558 0000000001e1000a 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n c00000001d1d0000: fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n c00000001d1d0080: fc fc 00 fc fc fc fc fc fc fc fc fc fc fc fc fc\n>c00000001d1d0100: fc fc fc 02 fc fc fc fc fc fc fc fc fc fc fc fc\n                            ^\n c00000001d1d0180: fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc fc\n c00000001d1d0200: fc fc fc fc fc 04 fc fc fc fc fc fc fc fc fc fc\n\nThis happens because the allocation uses the wrong unit (bits) when it\nshould pass (BITS_TO_LONGS(count) * sizeof(long)) or equivalent. With small\nnumbers of bits, the allocated object can be smaller than sizeof(long),\nwhich results in invalid accesses.\n\nUse bitmap_zalloc() to allocate and initialize the irq bitmap, paired with\nbitmap_free() for consistency.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c66a4d09-b14c-46cd-b880-e0251ba21b53",  "id": "CVE-2014-3510",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3510"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6c78a3ef-2cb0-40f3-99c7-c6ccce6a4248",  "id": "CVE-2015-8816",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8816"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The hub_activate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly maintain a hub-interface data structure, which allows physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bbae483d-65e3-4103-bd87-05cd8685780d",  "id": "CVE-2026-31674",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()\n\nReject rt match rules whose addrnr exceeds IP6T_RT_HOPS.\n\nrt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[].\nValidate addrnr during rule installation so malformed rules are rejected\nbefore the match logic can use an out-of-range value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "efc18e65-bd63-482c-826f-2c78061f9639",  "id": "CVE-2017-18221",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18221"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6da6c5e0-2232-4d7a-a345-a6540c06f85e",  "id": "MGASA-2021-0108",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17de822f-29e5-4cb1-bff0-d5a16050cce5",  "id": "DSA-4661-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "71a1041c-070d-427c-b4c9-e66377c441d7",  "id": "CVE-2014-4699",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4699"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:34134'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:127573/Linux-Kernel-ptrace-sysret-Local-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "fcd59627-117b-4a8d-8935-1594606218e6",  "id": "CVE-2013-2929",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2929"  },  "ratings": [    {      "score": 3.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 3.12.2 does not properly use the get_dumpable function, which allows local users to bypass intended ptrace restrictions or obtain sensitive information from IA64 scratch registers via a crafted application, related to kernel/ptrace.c and arch/ia64/include/asm/processor.h.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "45f08067-441b-49a6-9e6d-e5663dc1969e",  "id": "CVE-2013-1958",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1958"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.8.6 does not properly enforce capability requirements for controlling the PID value associated with a UNIX domain socket, which allows local users to bypass intended access restrictions by leveraging the time interval during which a user namespace has been created but a PID namespace has not been created.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "24b6a8ca-0d92-4354-82a8-9548dde04944",  "id": "OESA-2021-1001",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f164c4bd-12e3-4351-8704-05c0ff3f7cb6",  "id": "CVE-2021-4204",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4204"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    119,    20  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows a local attacker with a special privilege to crash the system or leak internal information.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d83f3450-3e1a-403a-a5d2-dacab64bb01f",  "id": "CVE-2020-25285",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25285"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    476,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9b09247-4efb-4ac9-bd86-f48d92eda9ba",  "id": "CLEANSTART-2026-KY78316",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f7b172dd-0a70-49b8-8f82-2efb25f4be3b",  "id": "CVE-2024-26636",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nllc: make llc_ui_sendmsg() more robust against bonding changes\n\nsyzbot was able to trick llc_ui_sendmsg(), allocating an skb with no\nheadroom, but subsequently trying to push 14 bytes of Ethernet header [1]\n\nLike some others, llc_ui_sendmsg() releases the socket lock before\ncalling sock_alloc_send_skb().\nThen it acquires it again, but does not redo all the sanity checks\nthat were performed.\n\nThis fix:\n\n- Uses LL_RESERVED_SPACE() to reserve space.\n- Check all conditions again after socket lock is held again.\n- Do not account Ethernet header for mtu limitation.\n\n[1]\n\nskbuff: skb_under_panic: text:ffff800088baa334 len:1514 put:14 head:ffff0000c9c37000 data:ffff0000c9c36ff2 tail:0x5dc end:0x6c0 dev:bond0\n\n kernel BUG at net/core/skbuff.c:193 !\nInternal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\nModules linked in:\nCPU: 0 PID: 6875 Comm: syz-executor.0 Not tainted 6.7.0-rc8-syzkaller-00101-g0802e17d9aca-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : skb_panic net/core/skbuff.c:189 [inline]\n pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\n lr : skb_panic net/core/skbuff.c:189 [inline]\n lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\nsp : ffff800096f97000\nx29: ffff800096f97010 x28: ffff80008cc8d668 x27: dfff800000000000\nx26: ffff0000cb970c90 x25: 00000000000005dc x24: ffff0000c9c36ff2\nx23: ffff0000c9c37000 x22: 00000000000005ea x21: 00000000000006c0\nx20: 000000000000000e x19: ffff800088baa334 x18: 1fffe000368261ce\nx17: ffff80008e4ed000 x16: ffff80008a8310f8 x15: 0000000000000001\nx14: 1ffff00012df2d58 x13: 0000000000000000 x12: 0000000000000000\nx11: 0000000000000001 x10: 0000000000ff0100 x9 : e28a51f1087e8400\nx8 : e28a51f1087e8400 x7 : ffff80008028f8d0 x6 : 0000000000000000\nx5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff800082b78714\nx2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000089\nCall trace:\n  skb_panic net/core/skbuff.c:189 [inline]\n  skb_under_panic+0x13c/0x140 net/core/skbuff.c:203\n  skb_push+0xf0/0x108 net/core/skbuff.c:2451\n  eth_header+0x44/0x1f8 net/ethernet/eth.c:83\n  dev_hard_header include/linux/netdevice.h:3188 [inline]\n  llc_mac_hdr_init+0x110/0x17c net/llc/llc_output.c:33\n  llc_sap_action_send_xid_c+0x170/0x344 net/llc/llc_s_ac.c:85\n  llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline]\n  llc_sap_next_state net/llc/llc_sap.c:182 [inline]\n  llc_sap_state_process+0x1ec/0x774 net/llc/llc_sap.c:209\n  llc_build_and_send_xid_pkt+0x12c/0x1c0 net/llc/llc_sap.c:270\n  llc_ui_sendmsg+0x7bc/0xb1c net/llc/af_llc.c:997\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg net/socket.c:745 [inline]\n  sock_sendmsg+0x194/0x274 net/socket.c:767\n  splice_to_socket+0x7cc/0xd58 fs/splice.c:881\n  do_splice_from fs/splice.c:933 [inline]\n  direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142\n  splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088\n  do_splice_direct+0x20c/0x348 fs/splice.c:1194\n  do_sendfile+0x4bc/0xc70 fs/read_write.c:1254\n  __do_sys_sendfile64 fs/read_write.c:1322 [inline]\n  __se_sys_sendfile64 fs/read_write.c:1308 [inline]\n  __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308\n  __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]\n  invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51\n  el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136\n  do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155\n  el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678\n  el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696\n  el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595\nCode: aa1803e6 aa1903e7 a90023f5 94792f6a (d4210000)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c8d9b699-7acf-4659-8180-f373d16a5f1d",  "id": "CVE-2025-38480",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix use of uninitialized data in insn_rw_emulate_bits()\n\nFor Comedi `INSN_READ` and `INSN_WRITE` instructions on \"digital\"\nsubdevices (subdevice types `COMEDI_SUBD_DI`, `COMEDI_SUBD_DO`, and\n`COMEDI_SUBD_DIO`), it is common for the subdevice driver not to have\n`insn_read` and `insn_write` handler functions, but to have an\n`insn_bits` handler function for handling Comedi `INSN_BITS`\ninstructions.  In that case, the subdevice's `insn_read` and/or\n`insn_write` function handler pointers are set to point to the\n`insn_rw_emulate_bits()` function by `__comedi_device_postconfig()`.\n\nFor `INSN_WRITE`, `insn_rw_emulate_bits()` currently assumes that the\nsupplied `data[0]` value is a valid copy from user memory.  It will at\nleast exist because `do_insnlist_ioctl()` and `do_insn_ioctl()` in\n\"comedi_fops.c\" ensure at lease `MIN_SAMPLES` (16) elements are\nallocated.  However, if `insn->n` is 0 (which is allowable for\n`INSN_READ` and `INSN_WRITE` instructions, then `data[0]` may contain\nuninitialized data, and certainly contains invalid data, possibly from a\ndifferent instruction in the array of instructions handled by\n`do_insnlist_ioctl()`.  This will result in an incorrect value being\nwritten to the digital output channel (or to the digital input/output\nchannel if configured as an output), and may be reflected in the\ninternal saved state of the channel.\n\nFix it by returning 0 early if `insn->n` is 0, before reaching the code\nthat accesses `data[0]`.  Previously, the function always returned 1 on\nsuccess, but it is supposed to be the number of data samples actually\nread or written up to `insn->n`, which is 0 in this case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e85eb633-54d0-4c15-92d8-80daaad29a07",  "id": "CVE-2024-36939",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: Handle error of rpc_proc_register() in nfs_net_init().\n\nsyzkaller reported a warning [0] triggered while destroying immature\nnetns.\n\nrpc_proc_register() was called in init_nfs_fs(), but its error\nhas been ignored since at least the initial commit 1da177e4c3f4\n(\"Linux-2.6.12-rc2\").\n\nRecently, commit d47151b79e32 (\"nfs: expose /proc/net/sunrpc/nfs\nin net namespaces\") converted the procfs to per-netns and made\nthe problem more visible.\n\nEven when rpc_proc_register() fails, nfs_net_init() could succeed,\nand thus nfs_net_exit() will be called while destroying the netns.\n\nThen, remove_proc_entry() will be called for non-existing proc\ndirectory and trigger the warning below.\n\nLet's handle the error of rpc_proc_register() properly in nfs_net_init().\n\n[0]:\nname 'nfs'\nWARNING: CPU: 1 PID: 1710 at fs/proc/generic.c:711 remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711\nModules linked in:\nCPU: 1 PID: 1710 Comm: syz-executor.2 Not tainted 6.8.0-12822-gcd51db110a7e #12\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711\nCode: 41 5d 41 5e c3 e8 85 09 b5 ff 48 c7 c7 88 58 64 86 e8 09 0e 71 02 e8 74 09 b5 ff 4c 89 e6 48 c7 c7 de 1b 80 84 e8 c5 ad 97 ff <0f> 0b eb b1 e8 5c 09 b5 ff 48 c7 c7 88 58 64 86 e8 e0 0d 71 02 eb\nRSP: 0018:ffffc9000c6d7ce0 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff8880422b8b00 RCX: ffffffff8110503c\nRDX: ffff888030652f00 RSI: ffffffff81105045 RDI: 0000000000000001\nRBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000001 R11: ffffffff81bb62cb R12: ffffffff84807ffc\nR13: ffff88804ad6fcc0 R14: ffffffff84807ffc R15: ffffffff85741ff8\nFS:  00007f30cfba8640(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ff51afe8000 CR3: 000000005a60a005 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n <TASK>\n rpc_proc_unregister+0x64/0x70 net/sunrpc/stats.c:310\n nfs_net_exit+0x1c/0x30 fs/nfs/inode.c:2438\n ops_exit_list+0x62/0xb0 net/core/net_namespace.c:170\n setup_net+0x46c/0x660 net/core/net_namespace.c:372\n copy_net_ns+0x244/0x590 net/core/net_namespace.c:505\n create_new_namespaces+0x2ed/0x770 kernel/nsproxy.c:110\n unshare_nsproxy_namespaces+0xae/0x160 kernel/nsproxy.c:228\n ksys_unshare+0x342/0x760 kernel/fork.c:3322\n __do_sys_unshare kernel/fork.c:3393 [inline]\n __se_sys_unshare kernel/fork.c:3391 [inline]\n __x64_sys_unshare+0x1f/0x30 kernel/fork.c:3391\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x4f/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x46/0x4e\nRIP: 0033:0x7f30d0febe5d\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48\nRSP: 002b:00007f30cfba7cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000110\nRAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f30d0febe5d\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c020600\nRBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002\nR13: 000000000000000b R14: 00007f30d104c530 R15: 0000000000000000\n </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "711e7ac5-91d6-4487-9bae-903fceaa97fc",  "id": "CVE-2010-3698",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3698"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The KVM implementation in the Linux kernel before 2.6.36 does not properly reload the FS and GS segment registers, which allows host OS users to cause a denial of service (host OS crash) via a KVM_RUN ioctl call in conjunction with a modified Local Descriptor Table (LDT).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4aa02533-c7b8-4f13-b3da-fe4190e35fae",  "id": "CVE-2014-8086",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8086"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef21bcf9-bdca-4a4a-81d3-d0e8f7f0255e",  "id": "CVE-2024-58085",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntomoyo: don't emit warning in tomoyo_write_control()\n\nsyzbot is reporting too large allocation warning at tomoyo_write_control(),\nfor one can write a very very long line without new line character. To fix\nthis warning, I use __GFP_NOWARN rather than checking for KMALLOC_MAX_SIZE,\nfor practically a valid line should be always shorter than 32KB where the\n\"too small to fail\" memory-allocation rule applies.\n\nOne might try to write a valid line that is longer than 32KB, but such\nrequest will likely fail with -ENOMEM. Therefore, I feel that separately\nreturning -EINVAL when a line is longer than KMALLOC_MAX_SIZE is redundant.\nThere is no need to distinguish over-32KB and over-KMALLOC_MAX_SIZE.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1e9da0c6-99fe-42ad-9763-cb65026d8a15",  "id": "CVE-2022-48773",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create\n\nIf there are failures then we must not leave the non-NULL pointers with\nthe error value, otherwise `rpcrdma_ep_destroy` gets confused and tries\nfree them, resulting in an Oops.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8e7b1c8d-6a0b-4043-b8a0-569479271463",  "id": "CVE-2016-2548",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2548"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "sound/core/timer.c in the Linux kernel before 4.4.1 retains certain linked lists after a close or stop action, which allows local users to cause a denial of service (system crash) via a crafted ioctl call, related to the (1) snd_timer_close and (2) _snd_timer_stop functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c4181393-f4e7-4b68-96dd-a2ef1a143b25",  "id": "CVE-2023-53395",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer\n\nACPICA commit 90310989a0790032f5a0140741ff09b545af4bc5\n\nAccording to the ACPI specification 19.6.134, no argument is required to be passed for ASL Timer instruction. For taking care of no argument, AML_NO_OPERAND_RESOLVE flag is added to ASL Timer instruction opcode.\n\nWhen ASL timer instruction interpreted by ACPI interpreter, getting error. After adding AML_NO_OPERAND_RESOLVE flag to ASL Timer instruction opcode, issue is not observed.\n\n=============================================================\nUBSAN: array-index-out-of-bounds in acpica/dswexec.c:401:12 index -1 is out of range for type 'union acpi_operand_object *[9]'\nCPU: 37 PID: 1678 Comm: cat Not tainted\n6.0.0-dev-th500-6.0.y-1+bcf8c46459e407-generic-64k\nHW name: NVIDIA BIOS v1.1.1-d7acbfc-dirty 12/19/2022 Call trace:\n dump_backtrace+0xe0/0x130\n show_stack+0x20/0x60\n dump_stack_lvl+0x68/0x84\n dump_stack+0x18/0x34\n ubsan_epilogue+0x10/0x50\n __ubsan_handle_out_of_bounds+0x80/0x90\n acpi_ds_exec_end_op+0x1bc/0x6d8\n acpi_ps_parse_loop+0x57c/0x618\n acpi_ps_parse_aml+0x1e0/0x4b4\n acpi_ps_execute_method+0x24c/0x2b8\n acpi_ns_evaluate+0x3a8/0x4bc\n acpi_evaluate_object+0x15c/0x37c\n acpi_evaluate_integer+0x54/0x15c\n show_power+0x8c/0x12c [acpi_power_meter]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10c904b4-4ac8-481f-aa61-f1b02166ed84",  "id": "SUSE-SU-2026:22454-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b4e0c6c-a822-4400-80f4-c0cbe3368b90",  "id": "DSA-4807-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1ce11732-329a-4a78-a441-b52492a52c16",  "id": "CVE-2012-6704",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6704"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "731be542-84d3-46d8-ad08-8bd29191f536",  "id": "CVE-2024-9355",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L"    }  ],  "cwes": [    457  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b6e1adc-41a2-45f7-b0da-7a016de7e9d7",  "id": "CVE-2021-47335",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47335"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances\n\nAs syzbot reported, there is an use-after-free issue during f2fs recovery:\n\nUse-after-free write at 0xffff88823bc16040 (in kfence-#10):\n kmem_cache_destroy+0x1f/0x120 mm/slab_common.c:486\n f2fs_recover_fsync_data+0x75b0/0x8380 fs/f2fs/recovery.c:869\n f2fs_fill_super+0x9393/0xa420 fs/f2fs/super.c:3945\n mount_bdev+0x26c/0x3a0 fs/super.c:1367\n legacy_get_tree+0xea/0x180 fs/fs_context.c:592\n vfs_get_tree+0x86/0x270 fs/super.c:1497\n do_new_mount fs/namespace.c:2905 [inline]\n path_mount+0x196f/0x2be0 fs/namespace.c:3235\n do_mount fs/namespace.c:3248 [inline]\n __do_sys_mount fs/namespace.c:3456 [inline]\n __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3433\n do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe root cause is multi f2fs filesystem instances can race on accessing\nglobal fsync_entry_slab pointer, result in use-after-free issue of slab\ncache, fixes to init/destroy this slab cache only once during module\ninit/destroy procedure to avoid this issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f828d3d7-0e66-452f-bd9b-3eb2954780b0",  "id": "DLA-4321-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b3c9cc8a-55c5-40fc-94e4-310a1a1e8f96",  "id": "CVE-2011-4326",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4326"  },  "ratings": [    {      "score": 7.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The udp6_ufo_fragment function in net/ipv6/udp.c in the Linux kernel before 2.6.39, when a certain UDP Fragmentation Offload (UFO) configuration is enabled, allows remote attackers to cause a denial of service (system crash) by sending fragmented IPv6 UDP packets to a bridge device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1ad7f430-de1c-47d6-a728-0b6c7deb0e4d",  "id": "CVE-2021-45868",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45868"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c8af726e-9dbe-4cb0-96e6-b4da59c9a85f",  "id": "CVE-2022-48875",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: sdata can be NULL during AMPDU start\n\nieee80211_tx_ba_session_handle_start() may get NULL for sdata when a\ndeauthentication is ongoing.\n\nHere a trace triggering the race with the hostapd test\nmulti_ap_fronthaul_on_ap:\n\n(gdb) list *drv_ampdu_action+0x46\n0x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396).\n391             int ret = -EOPNOTSUPP;\n392\n393             might_sleep();\n394\n395             sdata = get_bss_sdata(sdata);\n396             if (!check_sdata_in_driver(sdata))\n397                     return -EIO;\n398\n399             trace_drv_ampdu_action(local, sdata, params);\n400\n\nwlan0: moving STA 02:00:00:00:03:00 to state 3\nwlan0: associated\nwlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING)\nwlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0\nwlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port)\nwlan0: moving STA 02:00:00:00:03:00 to state 2\nwlan0: moving STA 02:00:00:00:03:00 to state 1\nwlan0: Removed STA 02:00:00:00:03:00\nwlan0: Destroyed STA 02:00:00:00:03:00\nBUG: unable to handle page fault for address: fffffffffffffb48\nPGD 11814067 P4D 11814067 PUD 11816067 PMD 0\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G        W          6.1.0-rc8-wt+ #59\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014\nWorkqueue: phy3 ieee80211_ba_session_work [mac80211]\nRIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211]\nCode: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 <8b> 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85\nRSP: 0018:ffffc900025ebd20 EFLAGS: 00010287\nRAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240\nRDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40\nRBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001\nR10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0\nR13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8\nFS:  0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0\nCall Trace:\n <TASK>\n ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211]\n ieee80211_ba_session_work+0xff/0x2e0 [mac80211]\n process_one_work+0x29f/0x620\n worker_thread+0x4d/0x3d0\n ? process_one_work+0x620/0x620\n kthread+0xfb/0x120\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x22/0x30\n </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69a5cd56-2c8e-4ea3-ba00-3f1dfe6258ac",  "id": "OESA-2026-3312",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "531d7c9e-1135-40e7-82d7-f6b8135e7438",  "id": "CVE-2024-43914",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: avoid BUG_ON() while continue reshape after reassembling\n\nCurrently, mdadm support --revert-reshape to abort the reshape while\nreassembling, as the test 07revert-grow. However, following BUG_ON()\ncan be triggerred by the test:\n\nkernel BUG at drivers/md/raid5.c:6278!\ninvalid opcode: 0000 [#1] PREEMPT SMP PTI\nirq event stamp: 158985\nCPU: 6 PID: 891 Comm: md0_reshape Not tainted 6.9.0-03335-g7592a0b0049a #94\nRIP: 0010:reshape_request+0x3f1/0xe60\nCall Trace:\n <TASK>\n raid5_sync_request+0x43d/0x550\n md_do_sync+0xb7a/0x2110\n md_thread+0x294/0x2b0\n kthread+0x147/0x1c0\n ret_from_fork+0x59/0x70\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nRoot cause is that --revert-reshape update the raid_disks from 5 to 4,\nwhile reshape position is still set, and after reassembling the array,\nreshape position will be read from super block, then during reshape the\nchecking of 'writepos' that is caculated by old reshape position will\nfail.\n\nFix this panic the easy way first, by converting the BUG_ON() to\nWARN_ON(), and stop the reshape if checkings fail.\n\nNoted that mdadm must fix --revert-shape as well, and probably md/raid\nshould enhance metadata validation as well, however this means\nreassemble will fail and there must be user tools to fix the wrong\nmetadata.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4349c547-2c6c-4b7f-b49f-9fcd81a7b620",  "id": "CLSA-2024-1729546540",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2b011d97-3bdd-4b8a-a88c-2dd6749ce620",  "id": "CVE-2026-63803",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhdlc_ppp: sync per-proto timers before freeing hdlc state\n\nEach PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp\nregisters a timer via timer_setup(). That struct ppp is the\nhdlc->state allocation, which detach_hdlc_protocol() frees with kfree()\nin both teardown paths: unregister_hdlc_device() and the re-attach inside\nattach_hdlc_protocol().\n\nThe ppp proto never registered a .detach callback, so\ndetach_hdlc_protocol() performs no timer synchronization before the\nkfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(),\nis partial (it does not wait for a running callback) and only runs on the\n->CLOSED transition; ppp_stop()/ppp_close() do not sync either. A\nppp_timer callback already executing (blocked on ppp->lock) survives the\nkfree and then dereferences proto->state / ppp->lock in freed memory,\nleading to a use-after-free.\n\nFix this by adding a .detach helper that calls timer_shutdown_sync() on\nevery per-proto timer. detach_hdlc_protocol() invokes proto->detach(dev)\nbefore kfree(hdlc->state), so timer_shutdown_sync()\nnow runs on both free paths.\ntimer_shutdown_sync() is used instead of timer_delete_sync() because the\nkeepalive path re-arms the timer through add_timer()/mod_timer() and\nshutdown blocks any re-activation during teardown.\n\nInitialize the per-protocol timers in ppp_ioctl() when the protocol is\nattached, and remove the now-redundant timer_setup() from ppp_start(), so\nthat the timers are initialized exactly once at attach time and\nppp_timer_release() never operates on uninitialized timer_list\nstructures. attach_hdlc_protocol() uses kmalloc() (not kzalloc), so\nstruct ppp's protos[i].timer is uninitialized garbage until the first\ntimer_setup(); without this init-at-attach, attaching the PPP protocol\nwithout ever bringing the device up would leave timer_shutdown_sync()\noperating on uninitialized memory in .detach. Moving the init out of\nppp_start() (which only runs on NETDEV_UP) into the attach path makes the\ninitialization unconditional and avoids initializing the same timer_list\ntwice.\n\nThis bug was found by static analysis.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d0c6e936-e46a-4bc8-8aa0-93726619f688",  "id": "MGASA-2022-0233",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed1aef29-8c46-4d1b-917a-aefde4f53767",  "id": "CVE-2019-12818",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12818"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This affects nfc_llcp_build_gb in net/nfc/llcp_core.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e0c921f-fcaf-454c-a8e1-2a2412546589",  "id": "OESA-2025-1856",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f48accb7-5900-4f8c-a1a1-ffb2d5ac6828",  "id": "CVE-2022-3303",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3303"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    667  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "842a90c8-0444-4ed5-a890-b72b8073bed5",  "id": "CVE-2011-4347",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4347"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The kvm_vm_ioctl_assign_device function in virt/kvm/assigned-dev.c in the KVM subsystem in the Linux kernel before 3.1.10 does not verify permission to access PCI configuration space and BAR resources, which allows host OS users to assign PCI devices and cause a denial of service (host OS crash) via a KVM_ASSIGN_PCI_DEVICE operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "59406573-846b-42ee-9b5b-1de4692c3c46",  "id": "CVE-2022-49453",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc\n\nThe allocation funciton devm_kcalloc may fail and return a null pointer,\nwhich would cause a null-pointer dereference later.\nIt might be better to check it and directly return -ENOMEM just like the\nusage of devm_kcalloc in previous code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0308c59e-8701-4ebf-b32a-24cf08acc26b",  "id": "AZL-86772",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8068ef9d-aed9-4a28-a24d-9bf93942eace",  "id": "CVE-2023-39193",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39193"  },  "ratings": [    {      "score": 6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "73ced5c3-f091-4d05-b9f2-4a65ae7b23ee",  "id": "CVE-2019-12456",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12456"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux kernel through 5.1.5. It allows local users to cause a denial of service or possibly have unspecified other impact by changing the value of ioc_number between two kernel reads of that value, aka a \"double fetch\" vulnerability. NOTE: a third party reports that this is unexploitable because the doubly fetched value is not used",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "13af6f30-7158-4a05-a7ff-f5209022a06d",  "id": "CVE-2020-12657",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12657"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c3c77ba-ac9a-4a8c-8d4c-75a0e516b0e8",  "id": "CLSA-2023-1699439565",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "931ef472-5740-4c8a-990f-eff33c43da04",  "id": "CVE-2023-53041",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Perform lockless command completion in abort path\n\nWhile adding and removing the controller, the following call trace was\nobserved:\n\nWARNING: CPU: 3 PID: 623596 at kernel/dma/mapping.c:532 dma_free_attrs+0x33/0x50\nCPU: 3 PID: 623596 Comm: sh Kdump: loaded Not tainted 5.14.0-96.el9.x86_64 #1\nRIP: 0010:dma_free_attrs+0x33/0x50\n\nCall Trace:\n   qla2x00_async_sns_sp_done+0x107/0x1b0 [qla2xxx]\n   qla2x00_abort_srb+0x8e/0x250 [qla2xxx]\n   ? ql_dbg+0x70/0x100 [qla2xxx]\n   __qla2x00_abort_all_cmds+0x108/0x190 [qla2xxx]\n   qla2x00_abort_all_cmds+0x24/0x70 [qla2xxx]\n   qla2x00_abort_isp_cleanup+0x305/0x3e0 [qla2xxx]\n   qla2x00_remove_one+0x364/0x400 [qla2xxx]\n   pci_device_remove+0x36/0xa0\n   __device_release_driver+0x17a/0x230\n   device_release_driver+0x24/0x30\n   pci_stop_bus_device+0x68/0x90\n   pci_stop_and_remove_bus_device_locked+0x16/0x30\n   remove_store+0x75/0x90\n   kernfs_fop_write_iter+0x11c/0x1b0\n   new_sync_write+0x11f/0x1b0\n   vfs_write+0x1eb/0x280\n   ksys_write+0x5f/0xe0\n   do_syscall_64+0x5c/0x80\n   ? do_user_addr_fault+0x1d8/0x680\n   ? do_syscall_64+0x69/0x80\n   ? exc_page_fault+0x62/0x140\n   ? asm_exc_page_fault+0x8/0x30\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe command was completed in the abort path during driver unload with a\nlock held, causing the warning in abort path. Hence complete the command\nwithout any lock held.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a48c3460-cda9-4bac-8b61-8d008b9bc334",  "id": "CVE-2024-23851",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23851"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_kernel->data_size check. This is related to ctl_ioctl.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "883ec9c3-f03a-45b1-826e-bb2847145d42",  "id": "CVE-2021-47622",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47622"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: Fix a deadlock in the error handler\n\nThe following deadlock has been observed on a test setup:\n\n - All tags allocated\n\n - The SCSI error handler calls ufshcd_eh_host_reset_handler()\n\n - ufshcd_eh_host_reset_handler() queues work that calls\n   ufshcd_err_handler()\n\n - ufshcd_err_handler() locks up as follows:\n\nWorkqueue: ufs_eh_wq_0 ufshcd_err_handler.cfi_jt\nCall trace:\n __switch_to+0x298/0x5d8\n __schedule+0x6cc/0xa94\n schedule+0x12c/0x298\n blk_mq_get_tag+0x210/0x480\n __blk_mq_alloc_request+0x1c8/0x284\n blk_get_request+0x74/0x134\n ufshcd_exec_dev_cmd+0x68/0x640\n ufshcd_verify_dev_init+0x68/0x35c\n ufshcd_probe_hba+0x12c/0x1cb8\n ufshcd_host_reset_and_restore+0x88/0x254\n ufshcd_reset_and_restore+0xd0/0x354\n ufshcd_err_handler+0x408/0xc58\n process_one_work+0x24c/0x66c\n worker_thread+0x3e8/0xa4c\n kthread+0x150/0x1b4\n ret_from_fork+0x10/0x30\n\nFix this lockup by making ufshcd_exec_dev_cmd() allocate a reserved\nrequest.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84de5c8e-51a1-4e28-875f-8550319bfd9a",  "id": "CVE-2016-10208",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10208"  },  "ratings": [    {      "score": 4.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups, which allows physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "61d566f5-b6c8-42f5-89e9-05f8c77794e7",  "id": "CVE-2026-31393",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access\n\nl2cap_information_rsp() checks that cmd_len covers the fixed\nl2cap_info_rsp header (type + result, 4 bytes) but then reads\nrsp->data without verifying that the payload is present:\n\n - L2CAP_IT_FEAT_MASK calls get_unaligned_le32(rsp->data), which reads\n   4 bytes past the header (needs cmd_len >= 8).\n\n - L2CAP_IT_FIXED_CHAN reads rsp->data[0], 1 byte past the header\n   (needs cmd_len >= 5).\n\nA truncated L2CAP_INFO_RSP with result == L2CAP_IR_SUCCESS triggers an\nout-of-bounds read of adjacent skb data.\n\nGuard each data access with the required payload length check.  If the\npayload is too short, skip the read and let the state machine complete\nwith safe defaults (feat_mask and remote_fixed_chan remain zero from\nkzalloc), so the info timer cleanup and l2cap_conn_start() still run\nand the connection is not stalled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9220e4a-1b8a-4123-b150-b6db28de0d43",  "id": "openSUSE-SU-2024:12415-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "732990f2-3d1d-44c1-9b64-d8d8a1056bae",  "id": "CVE-2022-50293",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range\n\nIf we get -ENOMEM while dropping file extent items in a given range, at\nbtrfs_drop_extents(), due to failure to allocate memory when attempting to\nincrement the reference count for an extent or drop the reference count,\nwe handle it with a BUG_ON(). This is excessive, instead we can simply\nabort the transaction and return the error to the caller. In fact most\ncallers of btrfs_drop_extents(), directly or indirectly, already abort\nthe transaction if btrfs_drop_extents() returns any error.\n\nAlso, we already have error paths at btrfs_drop_extents() that may return\n-ENOMEM and in those cases we abort the transaction, like for example\nanything that changes the b+tree may return -ENOMEM due to a failure to\nallocate a new extent buffer when COWing an existing extent buffer, such\nas a call to btrfs_duplicate_item() for example.\n\nSo replace the BUG_ON() calls with proper logic to abort the transaction\nand return the error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5e83648-165b-40e3-aeef-a2d823398f17",  "id": "CVE-2021-47202",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47202"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: Fix NULL pointer dereferences in of_thermal_ functions\n\nof_parse_thermal_zones() parses the thermal-zones node and registers a\nthermal_zone device for each subnode. However, if a thermal zone is\nconsuming a thermal sensor and that thermal sensor device hasn't probed\nyet, an attempt to set trip_point_*_temp for that thermal zone device\ncan cause a NULL pointer dereference. Fix it.\n\n console:/sys/class/thermal/thermal_zone87 # echo 120000 > trip_point_0_temp\n ...\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020\n ...\n Call trace:\n  of_thermal_set_trip_temp+0x40/0xc4\n  trip_point_temp_store+0xc0/0x1dc\n  dev_attr_store+0x38/0x88\n  sysfs_kf_write+0x64/0xc0\n  kernfs_fop_write_iter+0x108/0x1d0\n  vfs_write+0x2f4/0x368\n  ksys_write+0x7c/0xec\n  __arm64_sys_write+0x20/0x30\n  el0_svc_common.llvm.7279915941325364641+0xbc/0x1bc\n  do_el0_svc+0x28/0xa0\n  el0_svc+0x14/0x24\n  el0_sync_handler+0x88/0xec\n  el0_sync+0x1c0/0x200\n\nWhile at it, fix the possible NULL pointer dereference in other\nfunctions as well: of_thermal_get_temp(), of_thermal_set_emul_temp(),\nof_thermal_get_trend().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e891082-3778-4892-900c-17c6f2ddaf94",  "id": "CVE-2013-2232",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2232"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The ip6_sk_dst_check function in net/ipv6/ip6_output.c in the Linux kernel before 3.10 allows local users to cause a denial of service (system crash) by using an AF_INET6 socket for a connection to an IPv4 interface.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ecddedce-ac82-436f-ac39-90335a3af667",  "id": "DSA-4348-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f1470529-85c7-4ac7-ac2d-6613c50cd63c",  "id": "CLSA-2021-1639681783",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8bd2c9f2-a683-4744-9319-bcb4fd7242b6",  "id": "CVE-2007-4995",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4995"  },  "ratings": [    {      "score": 9.300000000000001,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified vectors.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8627821e-c7ff-400f-9899-9d7f0bb192f3",  "id": "CVE-2011-4330",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4330"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Stack-based buffer overflow in the hfs_mac2asc function in fs/hfs/trans.c in the Linux kernel 2.6 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via an HFS image with a crafted len field.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "250d24be-092e-48e4-9ce9-2f69df3f15f4",  "id": "AZL-56490",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7cf95cc5-fd34-4f31-96a2-7d810f40bb05",  "id": "CVE-2010-4650",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4650"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the fuse_do_ioctl function in fs/fuse/file.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging the ability to operate a CUSE server.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bfe264f3-78b0-420e-ab5a-814ef40f9f0a",  "id": "CVE-2023-3355",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3355"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in the Linux kernel's drivers/gpu/drm/msm/msm_gem_submit.c code in the submit_lookup_cmds function, which fails because it lacks a check of the return value of kmalloc(). This issue allows a local user to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b6176b68-a91d-4e5a-a284-111975a79db5",  "id": "CVE-2016-2186",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2186"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:136217/Linux-powermate-Null-Pointer-Dereference.html'"    }  ]},{  "bom-ref": "afae38c2-3c63-40df-bf6c-137c228c0692",  "id": "CVE-2024-53164",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: fix ordering of qlen adjustment\n\nChanges to sch->q.qlen around qdisc_tree_reduce_backlog() need to happen\n_before_ a call to said function because otherwise it may fail to notify\nparent qdiscs when the child is about to become empty.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dddc987a-4bb1-4805-9f76-f64ce8bf59fe",  "id": "CVE-2010-3310",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3310"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple integer signedness errors in net/rose/af_rose.c in the Linux kernel before 2.6.36-rc5-next-20100923 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a rose_getname function call, related to the rose_bind and rose_connect functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "29f1d361-4c40-4af9-b73f-5ef8c766af72",  "id": "CVE-2023-53282",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write\n\nDuring the sysfs firmware write process, a use-after-free read warning is\nlogged from the lpfc_wr_object() routine:\n\n  BUG: KFENCE: use-after-free read in lpfc_wr_object+0x235/0x310 [lpfc]\n  Use-after-free read at 0x0000000000cf164d (in kfence-#111):\n  lpfc_wr_object+0x235/0x310 [lpfc]\n  lpfc_write_firmware.cold+0x206/0x30d [lpfc]\n  lpfc_sli4_request_firmware_update+0xa6/0x100 [lpfc]\n  lpfc_request_firmware_upgrade_store+0x66/0xb0 [lpfc]\n  kernfs_fop_write_iter+0x121/0x1b0\n  new_sync_write+0x11c/0x1b0\n  vfs_write+0x1ef/0x280\n  ksys_write+0x5f/0xe0\n  do_syscall_64+0x59/0x90\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe driver accessed wr_object pointer data, which was initialized into\nmailbox payload memory, after the mailbox object was released back to the\nmailbox pool.\n\nFix by moving the mailbox free calls to the end of the routine ensuring\nthat we don't reference internal mailbox memory after release.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ba548a6-8190-426c-a7a4-7557b4742d1e",  "id": "CVE-2022-50410",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Protect against send buffer overflow in NFSv2 READ\n\nSince before the git era, NFSD has conserved the number of pages\nheld by each nfsd thread by combining the RPC receive and send\nbuffers into a single array of pages. This works because there are\nno cases where an operation needs a large RPC Call message and a\nlarge RPC Reply at the same time.\n\nOnce an RPC Call has been received, svc_process() updates\nsvc_rqst::rq_res to describe the part of rq_pages that can be\nused for constructing the Reply. This means that the send buffer\n(rq_res) shrinks when the received RPC record containing the RPC\nCall is large.\n\nA client can force this shrinkage on TCP by sending a correctly-\nformed RPC Call header contained in an RPC record that is\nexcessively large. The full maximum payload size cannot be\nconstructed in that case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be50483c-2892-4087-a458-fdd7f4b675df",  "id": "CVE-2014-8480",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8480"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel before 3.18-rc2 lacks intended decoder-table flags for certain RIP-relative instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fb902827-f33f-408b-b8d9-4d1717f31585",  "id": "openSUSE-SU-2024:12536-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd8b16d0-16d1-4353-903b-494e37ce0504",  "id": "CVE-2010-2960",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2960"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The keyctl_session_to_parent function in security/keys/keyctl.c in the Linux kernel 2.6.35.4 and earlier expects that a certain parent session keyring exists, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a KEYCTL_SESSION_TO_PARENT argument to the keyctl function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "23c6f11a-5502-4db7-b3fa-0d85baee1d88",  "id": "CVE-2020-11668",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11668"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, aka CID-a246b4d54770.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69c0e62e-1966-4854-92fe-8bfb00e3b235",  "id": "CVE-2017-14489",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14489"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of service (panic) by leveraging incorrect length validation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:42932'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:144476/Linux-Kernel-4-14-rc1-Denial-Of-Service.html'"    }  ]},{  "bom-ref": "e0bd12a0-7cf1-4af6-97be-95e08037a993",  "id": "CVE-2024-36964",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/9p: only translate RWX permissions for plain 9P2000\n\nGarbage in plain 9P2000's perm bits is allowed through, which causes it\nto be able to set (among others) the suid bit. This was presumably not\nthe intent since the unix extended bits are handled explicitly and\nconditionally on .u.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed4f0deb-a742-436d-b9a1-65eee4777f30",  "id": "CVE-2023-53140",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Remove the /proc/scsi/${proc_name} directory earlier\n\nRemove the /proc/scsi/${proc_name} directory earlier to fix a race\ncondition between unloading and reloading kernel modules. This fixes a bug\nintroduced in 2009 by commit 77c019768f06 (\"[SCSI] fix /proc memory leak in\nthe SCSI core\").\n\nFix the following kernel warning:\n\nproc_dir_entry 'scsi/scsi_debug' already registered\nWARNING: CPU: 19 PID: 27986 at fs/proc/generic.c:376 proc_register+0x27d/0x2e0\nCall Trace:\n proc_mkdir+0xb5/0xe0\n scsi_proc_hostdir_add+0xb5/0x170\n scsi_host_alloc+0x683/0x6c0\n sdebug_driver_probe+0x6b/0x2d0 [scsi_debug]\n really_probe+0x159/0x540\n __driver_probe_device+0xdc/0x230\n driver_probe_device+0x4f/0x120\n __device_attach_driver+0xef/0x180\n bus_for_each_drv+0xe5/0x130\n __device_attach+0x127/0x290\n device_initial_probe+0x17/0x20\n bus_probe_device+0x110/0x130\n device_add+0x673/0xc80\n device_register+0x1e/0x30\n sdebug_add_host_helper+0x1a7/0x3b0 [scsi_debug]\n scsi_debug_init+0x64f/0x1000 [scsi_debug]\n do_one_initcall+0xd7/0x470\n do_init_module+0xe7/0x330\n load_module+0x122a/0x12c0\n __do_sys_finit_module+0x124/0x1a0\n __x64_sys_finit_module+0x46/0x50\n do_syscall_64+0x38/0x80\n entry_SYSCALL_64_after_hwframe+0x46/0xb0",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ae0c179a-5959-4ee2-8b9c-7a7a48071c97",  "id": "SUSE-SU-2015:1143-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc7042ea-3b77-4cff-b151-4bb5c7aabf4c",  "id": "RLSA-2021:5226",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "33a66121-5f32-4143-9744-6f40ae277467",  "id": "CVE-2016-3713",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3713"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    284  ],  "analysis": {    "state": "in_triage"  },  "description": "The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to read or write to the kvm_arch_vcpu data structure, and consequently obtain sensitive information or cause a denial of service (system crash), via a crafted ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "76770f6d-8b49-4649-9ae7-3673f0f6950b",  "id": "CVE-2017-17975",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17975"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux kernel through 4.14.10 allows attackers to cause a denial of service (system crash) or possibly have unspecified other impact by triggering failure of audio registration, because a kfree of the usbtv data structure occurs during a usbtv_video_free call, but the usbtv_video_fail label's code attempts to both access and free this data structure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "73afcaf0-633b-43df-a9e7-e40a54606a24",  "id": "RHSA-2026:0794",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2c6f03ae-52dc-4635-805e-7b1b5a6f3806",  "id": "CVE-2013-6378",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6378"  },  "ratings": [    {      "score": 4.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:S/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-length write operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0af86ade-ddec-458b-b0fb-67ca7f5307ff",  "id": "CVE-2025-21744",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()\n\nOn removal of the device or unloading of the kernel module a potential NULL\npointer dereference occurs.\n\nThe following sequence deletes the interface:\n\n  brcmf_detach()\n    brcmf_remove_interface()\n      brcmf_del_if()\n\nInside the brcmf_del_if() function the drvr->if2bss[ifidx] is updated to\nBRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches.\n\nAfter brcmf_remove_interface() call the brcmf_proto_detach() function is\ncalled providing the following sequence:\n\n  brcmf_detach()\n    brcmf_proto_detach()\n      brcmf_proto_msgbuf_detach()\n        brcmf_flowring_detach()\n          brcmf_msgbuf_delete_flowring()\n            brcmf_msgbuf_remove_flowring()\n              brcmf_flowring_delete()\n                brcmf_get_ifp()\n                brcmf_txfinalize()\n\nSince brcmf_get_ip() can and actually will return NULL in this case the\ncall to brcmf_txfinalize() will result in a NULL pointer dereference inside\nbrcmf_txfinalize() when trying to update ifp->ndev->stats.tx_errors.\n\nThis will only happen if a flowring still has an skb.\n\nAlthough the NULL pointer dereference has only been seen when trying to\nupdate the tx statistic, all other uses of the ifp pointer have been\nguarded as well with an early return if ifp is NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a3cec4ce-29b5-4bd3-aa73-2f88240804b1",  "id": "CVE-2021-3655",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3655"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    20,    909  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e1c3f92-02f4-4da9-bc11-18256ca7834d",  "id": "CVE-2013-4387",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4387"  },  "ratings": [    {      "score": 6.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via network traffic that triggers a large response packet.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aa9ac11d-c52a-4f62-af03-ec9a4251935d",  "id": "ALSA-2023:2523",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18454fbd-4e56-438b-9966-20f66e9bb867",  "id": "CVE-2011-1494",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1494"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17541274-66eb-4cf1-bb67-7c9174232949",  "id": "OESA-2026-2783",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e853d517-e65c-4724-88cd-65ff5dc29f33",  "id": "CVE-2024-44961",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Forward soft recovery errors to userspace\n\nAs we discussed before[1], soft recovery should be\nforwarded to userspace, or we can get into a really\nbad state where apps will keep submitting hanging\ncommand buffers cascading us to a hard reset.\n\n1: https://lore.kernel.org/all/bf23d5ed-9a6b-43e7-84ee-8cbfd0d60f18@froggi.es/\n(cherry picked from commit 434967aadbbbe3ad9103cc29e9a327de20fdba01)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52154ecb-91da-442a-bdc4-8cb37b2952d0",  "id": "CVE-2026-43425",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: image: mdc800: kill download URB on timeout\n\nmdc800_device_read() submits download_urb and waits for completion.\nIf the timeout fires and the device has not responded, the function\nreturns without killing the URB, leaving it active.\n\nA subsequent read() resubmits the same URB while it is still\nin-flight, triggering the WARN in usb_submit_urb():\n\n  \"URB submitted while active\"\n\nCheck the return value of wait_event_timeout() and kill the URB if\nit indicates timeout, ensuring the URB is complete before its status\nis inspected or the URB is resubmitted.\n\nSimilar to\n- commit 372c93131998 (\"USB: yurex: fix control-URB timeout handling\")\n- commit b98d5000c505 (\"media: rc: iguanair: handle timeouts\")",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2c777eeb-6a02-466c-85df-26dbe522b906",  "id": "CVE-2023-52819",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga\n\nFor pptable structs that use flexible array sizes, use flexible arrays.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8c5a7465-90c1-4c0c-9ec6-6614dbf4482a",  "id": "CVE-2026-43168",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix reflink preserve cleanup issue\n\ncommit c06c303832ec (\"ocfs2: fix xattr array entry __counted_by error\")\ndoesn't handle all cases and the cleanup job for preserved xattr entries\nstill has bug:\n- the 'last' pointer should be shifted by one unit after cleanup\n  an array entry.\n- current code logic doesn't cleanup the first entry when xh_count is 1.\n\nNote, commit c06c303832ec is also a bug fix for 0fe9b66c65f3.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c272ac18-03b6-4705-ae48-0eb8f253f902",  "id": "CVE-2024-25744",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25744"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    693  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "63ddad06-3a48-450e-a666-07b47293dde6",  "id": "CVE-2012-6537",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6537"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "63f3bb2b-1ce4-4218-9366-d81e0a538867",  "id": "CVE-2017-11472",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11472"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    755  ],  "analysis": {    "state": "in_triage"  },  "description": "The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31e38c36-c199-4536-8859-32b85bd49947",  "id": "SUSE-SU-2022:1289-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a0064800-0a0d-4a48-8b27-7c0057af8174",  "id": "CVE-2016-2188",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2188"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:39556'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:136219/Linux-iowarrior-Null-Pointer-Dereference.html'"    }  ]},{  "bom-ref": "8e186990-e7e7-45eb-92e4-4eaa344de607",  "id": "CVE-2017-18509",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18509"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "308b39cd-557d-43a7-85ab-fd15cc00262d",  "id": "MGASA-2014-0012",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0abaec0e-3fce-4569-a759-abfa56c7e569",  "id": "CLSA-2026-1777999127",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "01e1d0db-6061-4e40-9250-f59c9f3e5acb",  "id": "RHSA-2026:3437",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7f6af4a6-fd95-4fa8-a203-a7f1af015428",  "id": "CVE-2012-6549",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6549"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The isofs_export_encode_fh function in fs/isofs/export.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3ce092a-5669-4d4c-a1a2-350c79f487f1",  "id": "ALSA-2026:0337",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "91a55f0a-8e0b-4f70-8b01-e3e316699d87",  "id": "openSUSE-SU-2021:0124-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fcd9c9dd-f88b-422c-b86a-3c3785bd9f6a",  "id": "CVE-2025-38040",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: mctrl_gpio: split disable_ms into sync and no_sync APIs\n\nThe following splat has been observed on a SAMA5D27 platform using\natmel_serial:\n\nBUG: sleeping function called from invalid context at kernel/irq/manage.c:738\nin_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 27, name: kworker/u5:0\npreempt_count: 1, expected: 0\nINFO: lockdep is turned off.\nirq event stamp: 0\nhardirqs last  enabled at (0): [<00000000>] 0x0\nhardirqs last disabled at (0): [<c01588f0>] copy_process+0x1c4c/0x7bec\nsoftirqs last  enabled at (0): [<c0158944>] copy_process+0x1ca0/0x7bec\nsoftirqs last disabled at (0): [<00000000>] 0x0\nCPU: 0 UID: 0 PID: 27 Comm: kworker/u5:0 Not tainted 6.13.0-rc7+ #74\nHardware name: Atmel SAMA5\nWorkqueue: hci0 hci_power_on [bluetooth]\nCall trace:\n  unwind_backtrace from show_stack+0x18/0x1c\n  show_stack from dump_stack_lvl+0x44/0x70\n  dump_stack_lvl from __might_resched+0x38c/0x598\n  __might_resched from disable_irq+0x1c/0x48\n  disable_irq from mctrl_gpio_disable_ms+0x74/0xc0\n  mctrl_gpio_disable_ms from atmel_disable_ms.part.0+0x80/0x1f4\n  atmel_disable_ms.part.0 from atmel_set_termios+0x764/0x11e8\n  atmel_set_termios from uart_change_line_settings+0x15c/0x994\n  uart_change_line_settings from uart_set_termios+0x2b0/0x668\n  uart_set_termios from tty_set_termios+0x600/0x8ec\n  tty_set_termios from ttyport_set_flow_control+0x188/0x1e0\n  ttyport_set_flow_control from wilc_setup+0xd0/0x524 [hci_wilc]\n  wilc_setup [hci_wilc] from hci_dev_open_sync+0x330/0x203c [bluetooth]\n  hci_dev_open_sync [bluetooth] from hci_dev_do_open+0x40/0xb0 [bluetooth]\n  hci_dev_do_open [bluetooth] from hci_power_on+0x12c/0x664 [bluetooth]\n  hci_power_on [bluetooth] from process_one_work+0x998/0x1a38\n  process_one_work from worker_thread+0x6e0/0xfb4\n  worker_thread from kthread+0x3d4/0x484\n  kthread from ret_from_fork+0x14/0x28\n\nThis warning is emitted when trying to toggle, at the highest level,\nsome flow control (with serdev_device_set_flow_control) in a device\ndriver. At the lowest level, the atmel_serial driver is using\nserial_mctrl_gpio lib to enable/disable the corresponding IRQs\naccordingly.  The warning emitted by CONFIG_DEBUG_ATOMIC_SLEEP is due to\ndisable_irq (called in mctrl_gpio_disable_ms) being possibly called in\nsome atomic context (some tty drivers perform modem lines configuration\nin regions protected by port lock).\n\nSplit mctrl_gpio_disable_ms into two differents APIs, a non-blocking one\nand a blocking one. Replace mctrl_gpio_disable_ms calls with the\nrelevant version depending on whether the call is protected by some port\nlock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "443c8cc2-61a3-47ec-b445-631895bf6e94",  "id": "CVE-2024-50057",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    763  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tipd: Free IRQ only if it was requested before\n\nIn polling mode, if no IRQ was requested there is no need to free it.\nCall devm_free_irq() only if client->irq is set. This fixes the warning\ncaused by the tps6598x module removal:\n\nWARNING: CPU: 2 PID: 333 at kernel/irq/devres.c:144 devm_free_irq+0x80/0x8c\n...\n...\nCall trace:\n  devm_free_irq+0x80/0x8c\n  tps6598x_remove+0x28/0x88 [tps6598x]\n  i2c_device_remove+0x2c/0x9c\n  device_remove+0x4c/0x80\n  device_release_driver_internal+0x1cc/0x228\n  driver_detach+0x50/0x98\n  bus_remove_driver+0x6c/0xbc\n  driver_unregister+0x30/0x60\n  i2c_del_driver+0x54/0x64\n  tps6598x_i2c_driver_exit+0x18/0xc3c [tps6598x]\n  __arm64_sys_delete_module+0x184/0x264\n  invoke_syscall+0x48/0x110\n  el0_svc_common.constprop.0+0xc8/0xe8\n  do_el0_svc+0x20/0x2c\n  el0_svc+0x28/0x98\n  el0t_64_sync_handler+0x13c/0x158\n  el0t_64_sync+0x190/0x194",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8ed51a51-161d-42d7-91d1-a2a4690fe789",  "id": "CVE-2013-2015",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2015"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journal filesystems, which allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media, as demonstrated by the e2fsprogs tests/f_orphan_extents_inode/image.gz test.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18212ceb-1750-46ec-98be-4e86cbfadae3",  "id": "CVE-2026-23271",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix __perf_event_overflow() vs perf_remove_from_context() race\n\nMake sure that __perf_event_overflow() runs with IRQs disabled for all\npossible callchains. Specifically the software events can end up running\nit with only preemption disabled.\n\nThis opens up a race vs perf_event_exit_event() and friends that will go\nand free various things the overflow path expects to be present, like\nthe BPF program.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2d929bc3-adb8-4b82-88d5-dc4c834276d6",  "id": "CVE-2022-49053",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: tcmu: Fix possible page UAF\n\ntcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not\ntake refcount properly and just returns page pointer. When\ntcmu_try_get_data_page() returns, the returned page may have been freed by\ntcmu_blocks_release().\n\nWe need to get_page() under cmdr_lock to avoid concurrent\ntcmu_blocks_release().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "da2268d7-881d-427d-8df7-3afb8997f588",  "id": "CVE-2022-48791",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix use-after-free for aborted TMF sas_task\n\nCurrently a use-after-free may occur if a TMF sas_task is aborted before we\nhandle the IO completion in mpi_ssp_completion(). The abort occurs due to\ntimeout.\n\nWhen the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the\nsas_task is freed in pm8001_exec_internal_tmf_task().\n\nHowever, if the I/O completion occurs later, the I/O completion still\nthinks that the sas_task is available. Fix this by clearing the ccb->task\nif the TMF times out - the I/O completion handler does nothing if this\npointer is cleared.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8e01096e-7bb1-4163-b079-42519c8a1df5",  "id": "openSUSE-SU-2026:21360-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cde8fe93-a211-4c7d-a9ff-10d68ec1d168",  "id": "CVE-2024-50247",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Check if more than chunk-size bytes are written\n\nA incorrectly formatted chunk may decompress into\nmore than LZNT_CHUNK_SIZE bytes and a index out of bounds\nwill occur in s_max_off.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ba43ef61-bdea-4552-a830-3085c7e3b1a2",  "id": "CVE-2019-15118",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15118"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    674  ],  "analysis": {    "state": "in_triage"  },  "description": "check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee106ed3-3eb9-4f9b-8c8b-8b86f85e1019",  "id": "CVE-2019-15221",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15221"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/pcm.c driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e5d0871a-169c-44ad-8273-d2a144549316",  "id": "CVE-2024-23848",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23848"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1bc983a4-9a71-4b2c-ba8b-83f16ec95cfb",  "id": "CVE-2013-10069",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-10069"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    78  ],  "analysis": {    "state": "in_triage"  },  "description": "The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to spawn a Telnet service on a specified port, enabling persistent interactive shell access as root.",  "affects": [    {      "ref": "0f9017f6-bd13-4064-97b2-6cfc35c2947d",      "versions": [        {          "component": "dir-600_firmware",          "version": "2.14b01"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'MSF:dlink_dir_300_600_exec_noauth'"    }  ]},{  "bom-ref": "3cfc0858-eed6-4356-b642-ee488c1b2f49",  "id": "CVE-2023-53412",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c7c358f8-cdeb-4293-8bd6-b8f3b8df596e",  "id": "CVE-2026-46017",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: fix deferred split queue races during migration\n\nmigrate_folio_move() records the deferred split queue state from src and\nreplays it on dst.  Replaying it after remove_migration_ptes(src, dst, 0)\nmakes dst visible before it is requeued, so a concurrent rmap-removal path\ncan mark dst partially mapped and trip the WARN in deferred_split_folio().\n\nMove the requeue before remove_migration_ptes() so dst is back on the\ndeferred split queue before it becomes visible again.\n\nBecause migration still holds dst locked at that point, teach\ndeferred_split_scan() to requeue a folio when folio_trylock() fails. \nOtherwise a fully mapped underused folio can be dequeued by the shrinker\nand silently lost from split_queue.\n\n[ziy@nvidia.com: move the comment]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "091b7d9c-08df-4865-8fa6-b187a7e64d21",  "id": "CVE-2012-3411",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3411"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "Dnsmasq before 2.63test1, when used with certain libvirt configurations, replies to requests from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed DNS query.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6da0f29d-faa4-4ea3-b87d-60095fb39ea8",  "id": "CVE-2024-38580",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nepoll: be better about file lifetimes\n\nepoll can call out to vfs_poll() with a file pointer that may race with\nthe last 'fput()'. That would make f_count go down to zero, and while\nthe ep->mtx locking means that the resulting file pointer tear-down will\nbe blocked until the poll returns, it means that f_count is already\ndead, and any use of it won't actually get a reference to the file any\nmore: it's dead regardless.\n\nMake sure we have a valid ref on the file pointer before we call down to\nvfs_poll() from the epoll routines.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6a9d8ebf-3760-4dad-a96f-55609183ac7e",  "id": "OESA-2021-1027",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9fda83f2-3a42-4ba3-98c5-a223ce616af2",  "id": "CVE-2016-2143",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2143"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "748a20bd-0e0a-49ee-b482-2aa5b587e74a",  "id": "CVE-2021-47355",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47355"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: nicstar: Fix possible use-after-free in nicstar_cleanup()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d0664cb-4e89-4780-8161-eda17b1ca40d",  "id": "CVE-2023-4273",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4273"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    121,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf7cdd4f-1e76-4953-862d-fab279bbd5ff",  "id": "CVE-2011-1748",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1748"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The raw_release function in net/can/raw.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f75c6c85-4472-458a-821a-8022c8564305",  "id": "CVE-2025-21699",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Truncate address space when flipping GFS2_DIF_JDATA flag\n\nTruncate an inode's address space when flipping the GFS2_DIF_JDATA flag:\ndepending on that flag, the pages in the address space will either use\nbuffer heads or iomap_folio_state structs, and we cannot mix the two.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4ae6c8ee-d1ac-4dc8-8f9a-d8705f429b8a",  "id": "CVE-2025-39797",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Duplicate SPI Handling\n\nThe issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI\nNetlink message, which triggers the kernel function xfrm_alloc_spi().\nThis function is expected to ensure uniqueness of the Security Parameter\nIndex (SPI) for inbound Security Associations (SAs). However, it can\nreturn success even when the requested SPI is already in use, leading\nto duplicate SPIs assigned to multiple inbound SAs, differentiated\nonly by their destination addresses.\n\nThis behavior causes inconsistencies during SPI lookups for inbound packets.\nSince the lookup may return an arbitrary SA among those with the same SPI,\npacket processing can fail, resulting in packet drops.\n\nAccording to RFC 4301 section 4.4.2 , for inbound processing a unicast SA\nis uniquely identified by the SPI and optionally protocol.\n\nReproducing the Issue Reliably:\nTo consistently reproduce the problem, restrict the available SPI range in\ncharon.conf : spi_min = 0x10000000 spi_max = 0x10000002\nThis limits the system to only 2 usable SPI values.\nNext, create more than 2 Child SA. each using unique pair of src/dst address.\nAs soon as the 3rd Child SA is initiated, it will be assigned a duplicate\nSPI, since the SPI pool is already exhausted.\nWith a narrow SPI range, the issue is consistently reproducible.\nWith a broader/default range, it becomes rare and unpredictable.\n\nCurrent implementation:\nxfrm_spi_hash() lookup function computes hash using daddr, proto, and family.\nSo if two SAs have the same SPI but different destination addresses, then\nthey will:\na. Hash into different buckets\nb. Be stored in different linked lists (byspi + h)\nc. Not be seen in the same hlist_for_each_entry_rcu() iteration.\nAs a result, the lookup will result in NULL and kernel allows that Duplicate SPI\n\nProposed Change:\nxfrm_state_lookup_spi_proto() does a truly global search - across all states,\nregardless of hash bucket and matches SPI and proto.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f1e1510-7855-4200-abc0-9ae9684a8336",  "id": "CVE-2023-6200",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6200"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2d9345af-f3b9-4e64-b899-b8c12fbfc0f3",  "id": "CVE-2025-39902",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: avoid accessing metadata when pointer is invalid in object_err()\n\nobject_err() reports details of an object for further debugging, such as\nthe freelist pointer, redzone, etc. However, if the pointer is invalid,\nattempting to access object metadata can lead to a crash since it does\nnot point to a valid object.\n\nOne known path to the crash is when alloc_consistency_checks()\ndetermines the pointer to the allocated object is invalid because of a\nfreelist corruption, and calls object_err() to report it. The debug code\nshould report and handle the corruption gracefully and not crash in the\nprocess.\n\nIn case the pointer is NULL or check_valid_pointer() returns false for\nthe pointer, only print the pointer value and skip accessing metadata.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9acd73fb-d63c-45c4-acf1-dcea900616e9",  "id": "RHSA-2020:5637",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5154efc2-bf51-41bc-bb0c-56a54e94d21b",  "id": "CVE-2022-49325",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: add accessors to read/set tp->snd_cwnd\n\nWe had various bugs over the years with code\nbreaking the assumption that tp->snd_cwnd is greater\nthan zero.\n\nLately, syzbot reported the WARN_ON_ONCE(!tp->prior_cwnd) added\nin commit 8b8a321ff72c (\"tcp: fix zero cwnd in tcp_cwnd_reduction\")\ncan trigger, and without a repro we would have to spend\nconsiderable time finding the bug.\n\nInstead of complaining too late, we want to catch where\nand when tp->snd_cwnd is set to an illegal value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e928b73a-dadb-425d-a117-ab8b593fa278",  "id": "CVE-2024-26791",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: dev-replace: properly validate device names\n\nThere's a syzbot report that device name buffers passed to device\nreplace are not properly checked for string termination which could lead\nto a read out of bounds in getname_kernel().\n\nAdd a helper that validates both source and target device name buffers.\nFor devid as the source initialize the buffer to empty string in case\nsomething tries to read it later.\n\nThis was originally analyzed and fixed in a different way by Edward Adam\nDavis (see links).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cffb39fb-59fe-4de9-a88f-6b54338de3fc",  "id": "MGASA-2020-0310",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b22cab62-5873-471e-9167-431a49fc9733",  "id": "CVE-2021-46932",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46932"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    665  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: appletouch - initialize work before device registration\n\nSyzbot has reported warning in __flush_work(). This warning is caused by\nwork->func == NULL, which means missing work initialization.\n\nThis may happen, since input_dev->close() calls\ncancel_work_sync(&dev->work), but dev->work initalization happens _after_\ninput_register_device() call.\n\nSo this patch moves dev->work initialization before registering input\ndevice",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "daeec45f-a941-4f4d-8e2f-13c9b448e26e",  "id": "CVE-2026-31687",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: omap: do not register driver in probe()\n\nCommit 11a78b794496 (\"ARM: OMAP: MPUIO wake updates\") registers the\nomap_mpuio_driver from omap_mpuio_init(), which is called from\nomap_gpio_probe().\n\nHowever, it neither makes sense to register drivers from probe()\ncallbacks of other drivers, nor does the driver core allow registering\ndrivers with a device lock already being held.\n\nThe latter was revealed by commit dc23806a7c47 (\"driver core: enforce\ndevice_lock for driver_match_device()\") leading to a potential deadlock\ncondition described in [1].\n\nAdditionally, the omap_mpuio_driver is never unregistered from the\ndriver core, even if the module is unloaded.\n\nHence, register the omap_mpuio_driver from the module initcall and\nunregister it in module_exit().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c0b8b7ca-7865-4506-bef9-4b2849de4d08",  "id": "CVE-2019-19051",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19051"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the i2400m_op_rfkill_sw_toggle() function in drivers/net/wimax/i2400m/op-rfkill.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-6f3ef5c25cc7.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a085c5ba-ce6e-4128-8b24-4a1ec16071fa",  "id": "CVE-2022-25258",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25258"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f530a173-f788-421f-86ff-cfd3cd131cdf",  "id": "CVE-2022-50203",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: OMAP2+: display: Fix refcount leak bug\n\nIn omapdss_init_fbdev(), of_find_node_by_name() will return a node\npointer with refcount incremented. We should use of_node_put() when\nit is not used anymore.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "12eacd3d-035c-4306-bb53-db494d593da5",  "id": "CVE-2026-31496",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_expect: skip expectations in other netns via proc\n\nSkip expectations that do not reside in this netns.\n\nSimilar to e77e6ff502ea (\"netfilter: conntrack: do not dump other netns's\nconntrack entries via proc\").",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5f296e93-7e9a-49f4-aeea-275b551b93d5",  "id": "CVE-2023-52762",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-blk: fix implicit overflow on virtio_max_dma_size\n\nThe following codes have an implicit conversion from size_t to u32:\n(u32)max_size = (size_t)virtio_max_dma_size(vdev);\n\nThis may lead overflow, Ex (size_t)4G -> (u32)0. Once\nvirtio_max_dma_size() has a larger size than U32_MAX, use U32_MAX\ninstead.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bdf6fc65-91ad-4ded-88aa-d28c953efeb6",  "id": "CVE-2022-49639",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncipso: Fix data-races around sysctl.\n\nWhile reading cipso sysctl variables, they can be changed concurrently.\nSo, we need to add READ_ONCE() to avoid data-races.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32f40425-dde3-468f-8546-7cdacdb8e99a",  "id": "CVE-2026-31778",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix stack out-of-bounds read in init_card\n\nThe loop creates a whitespace-stripped copy of the card shortname\nwhere `len < sizeof(card->id)` is used for the bounds check. Since\nsizeof(card->id) is 16 and the local id buffer is also 16 bytes,\nwriting 16 non-space characters fills the entire buffer,\noverwriting the terminating nullbyte.\n\nWhen this non-null-terminated string is later passed to\nsnd_card_set_id() -> copy_valid_id_string(), the function scans\nforward with `while (*nid && ...)` and reads past the end of the\nstack buffer, reading the contents of the stack.\n\nA USB device with a product name containing many non-ASCII, non-space\ncharacters (e.g. multibyte UTF-8) will reliably trigger this as follows:\n\n  BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n       sound/core/init.c:696 [inline]\n  BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n       sound/core/init.c:718\n\nThe off-by-one has been present since commit bafeee5b1f8d (\"ALSA:\nsnd_usb_caiaq: give better shortname\") from June 2009 (v2.6.31-rc1),\nwhich first introduced this whitespace-stripping loop. The original\ncode never accounted for the null terminator when bounding the copy.\n\nFix this by changing the loop bound to `sizeof(card->id) - 1`,\nensuring at least one byte remains as the null terminator.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6712b38f-d0dd-4d48-b809-ed9505a7295d",  "id": "CVE-2021-47654",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47654"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsamples/landlock: Fix path_list memory leak\n\nClang static analysis reports this error\n\nsandboxer.c:134:8: warning: Potential leak of memory\n  pointed to by 'path_list'\n        ret = 0;\n              ^\npath_list is allocated in parse_path() but never freed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "80d72144-6e29-4454-9e48-b109c14c1075",  "id": "CVE-2024-47666",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Set phy->enable_completion only when we wait for it\n\npm8001_phy_control() populates the enable_completion pointer with a stack\naddress, sends a PHY_LINK_RESET / PHY_HARD_RESET, waits 300 ms, and\nreturns. The problem arises when a phy control response comes late.  After\n300 ms the pm8001_phy_control() function returns and the passed\nenable_completion stack address is no longer valid. Late phy control\nresponse invokes complete() on a dangling enable_completion pointer which\nleads to a kernel crash.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b4a43a7-27da-4208-a11a-5bf839f3ed76",  "id": "CVE-2021-3669",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3669"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400,    770  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5dbb8c9a-342a-442a-ad4f-710bc057dcde",  "id": "CVE-2020-27675",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27675"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    416,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6a22eca5-c825-424a-b276-ae715a7021f5",  "id": "CVE-2018-19824",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19824"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "783ad063-b7b0-44ff-9ee7-bb063600b9e0",  "id": "CVE-2016-7911",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7911"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "73b8e8a4-09d4-4295-ab00-7f2c1e674664",  "id": "CVE-2024-26829",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ir_toy: fix a memleak in irtoy_tx\n\nWhen irtoy_command fails, buf should be freed since it is allocated by\nirtoy_tx, or there is a memleak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "20f32a4b-4f58-42ea-8583-204497549823",  "id": "CVE-2021-47258",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47258"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix error handling of scsi_host_alloc()\n\nAfter device is initialized via device_initialize(), or its name is set via\ndev_set_name(), the device has to be freed via put_device().  Otherwise\ndevice name will be leaked because it is allocated dynamically in\ndev_set_name().\n\nFix the leak by replacing kfree() with put_device(). Since\nscsi_host_dev_release() properly handles IDA and kthread removal, remove\nspecial-casing these from the error handling as well.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b9b1a0f4-b0d1-4c68-9186-0e85c457753d",  "id": "CVE-2022-49100",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_console: eliminate anonymous module_init & module_exit\n\nEliminate anonymous module_init() and module_exit(), which can lead to\nconfusion or ambiguity when reading System.map, crashes/oops/bugs,\nor an initcall_debug log.\n\nGive each of these init and exit functions unique driver-specific\nnames to eliminate the anonymous names.\n\nExample 1: (System.map)\n ffffffff832fc78c t init\n ffffffff832fc79e t init\n ffffffff832fc8f8 t init\n\nExample 2: (initcall_debug log)\n calling  init+0x0/0x12 @ 1\n initcall init+0x0/0x12 returned 0 after 15 usecs\n calling  init+0x0/0x60 @ 1\n initcall init+0x0/0x60 returned 0 after 2 usecs\n calling  init+0x0/0x9a @ 1\n initcall init+0x0/0x9a returned 0 after 74 usecs",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "76901c07-f8b2-4f1d-b157-96a2c2d41e16",  "id": "MGASA-2016-0277",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4ea365d9-567b-402a-820d-df28b3a88b88",  "id": "CVE-2015-0287",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0287"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    17  ],  "analysis": {    "state": "in_triage"  },  "description": "The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8fb512db-4a2a-4d67-96bd-a8d6a9b0a67a",  "id": "CVE-2010-2946",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2946"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/jfs/xattr.c in the Linux kernel before 2.6.35.2 does not properly handle a certain legacy format for storage of extended attributes, which might allow local users by bypass intended xattr namespace restrictions via an \"os2.\" substring at the beginning of a name.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d17a686-fc38-492f-af6b-fc0531d9f887",  "id": "CVE-2016-4997",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4997"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:40489'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'MSF:netfilter_priv_esc_ipv4'"    }  ]},{  "bom-ref": "bae61644-e5d7-420f-82e0-0eaa99825a5a",  "id": "CVE-2026-53256",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()\n\nrfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock,\nbut returns the selected listener after dropping that lock without\ntaking a reference. rfcomm_connect_ind() then locks the listener,\nqueues a child socket on it, and may notify it after unlocking it.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nrfcomm_connect_ind():            listener close:\n  1. Find parent in              1. close() enters\n     rfcomm_get_sock_by_channel()   rfcomm_sock_release().\n  2. Drop rfcomm_sk_list.lock    2. rfcomm_sock_shutdown()\n     without pinning parent.        closes the listener.\n  3. Call lock_sock(parent) and  3. rfcomm_sock_kill()\n     bt_accept_enqueue(parent,      unlinks and puts parent.\n     sk, true).\n  4. Read parent flags and may   4. parent can be freed.\n     call sk_state_change().\n\nIf close wins the race, parent can be freed before\nrfcomm_connect_ind() reaches lock_sock(), bt_accept_enqueue(), or the\ndeferred-setup callback.\n\nTake a reference on the listener before leaving rfcomm_sk_list.lock.\nAfter lock_sock() succeeds, recheck that it is still in BT_LISTEN\nbefore queueing a child, cache the deferred-setup bit while the parent\nis locked, and drop the reference after the last parent use.\n\nKASAN reported a slab-use-after-free in lock_sock_nested() from\nrfcomm_connect_ind(), with the freeing stack going through\nrfcomm_sock_kill() and rfcomm_sock_release().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0487e599-68e9-4645-8a82-3ee37ea072de",  "id": "CVE-2023-4623",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.\n\nIf a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.\n\nWe recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f0d14e5b-06cb-4402-82a6-3238a99468ea",  "id": "CLSA-2026-1771003612",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b7babebb-2cd6-498b-8ced-e9178e1d1944",  "id": "CVE-2022-49105",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: wfx: fix an error handling in wfx_init_common()\n\nOne error handler of wfx_init_common() return without calling\nieee80211_free_hw(hw), which may result in memory leak. And I add\none err label to unify the error handler, which is useful for the\nsubsequent changes.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f81c7b4d-f611-4884-a23d-4b9f7aa3d80e",  "id": "CVE-2019-14896",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14896"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    122,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2f359d1a-b303-4847-9b92-e582ff1b9db0",  "id": "CVE-2025-22037",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix null pointer dereference in alloc_preauth_hash()\n\nThe Client send malformed smb2 negotiate request. ksmbd return error\nresponse. Subsequently, the client can send smb2 session setup even\nthought conn->preauth_info is not allocated.\nThis patch add KSMBD_SESS_NEED_SETUP status of connection to ignore\nsession setup request if smb2 negotiate phase is not complete.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "562977d0-2b9b-497d-9bf8-153c784dc223",  "id": "CVE-2026-23074",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416,    825  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Enforce that teql can only be used as root qdisc\n\nDesign intent of teql is that it is only supposed to be used as root qdisc.\nWe need to check for that constraint.\n\nAlthough not important, I will describe the scenario that unearthed this\nissue for the curious.\n\nGangMin Kim <km.kim1503@gmail.com> managed to concot a scenario as follows:\n\nROOT qdisc 1:0 (QFQ)\n  ├── class 1:1 (weight=15, lmax=16384) netem with delay 6.4s\n  └── class 1:2 (weight=1, lmax=1514) teql\n\nGangMin sends a packet which is enqueued to 1:1 (netem).\nAny invocation of dequeue by QFQ from this class will not return a packet\nuntil after 6.4s. In the meantime, a second packet is sent and it lands on\n1:2. teql's enqueue will return success and this will activate class 1:2.\nMain issue is that teql only updates the parent visible qlen (sch->q.qlen)\nat dequeue. Since QFQ will only call dequeue if peek succeeds (and teql's\npeek always returns NULL), dequeue will never be called and thus the qlen\nwill remain as 0. With that in mind, when GangMin updates 1:2's lmax value,\nthe qfq_change_class calls qfq_deact_rm_from_agg. Since the child qdisc's\nqlen was not incremented, qfq fails to deactivate the class, but still\nfrees its pointers from the aggregate. So when the first packet is\nrescheduled after 6.4 seconds (netem's delay), a dangling pointer is\naccessed causing GangMin's causing a UAF.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e06b3db8-267c-4b8f-a22d-4087cb39c37e",  "id": "CVE-2025-38208",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: add NULL check in automount_fullpath\n\npage is checked for null in __build_path_from_dentry_optional_prefix\nwhen tcon->origin_fullpath is not set. However, the check is missing when\nit is set.\nAdd a check to prevent a potential NULL pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "03b24497-c565-48b2-bc72-db7be26c8542",  "id": "CVE-2013-4162",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4162"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The udp_v6_push_pending_frames function in net/ipv6/udp.c in the IPv6 implementation in the Linux kernel through 3.10.3 makes an incorrect function call for pending data, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1e230715-1f85-48cd-8b32-e771232aeaf8",  "id": "CVE-2023-52609",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix race between mmput() and do_exit()\n\nTask A calls binder_update_page_range() to allocate and insert pages on\na remote address space from Task B. For this, Task A pins the remote mm\nvia mmget_not_zero() first. This can race with Task B do_exit() and the\nfinal mmput() refcount decrement will come from Task A.\n\n  Task A            | Task B\n  ------------------+------------------\n  mmget_not_zero()  |\n                    |  do_exit()\n                    |    exit_mm()\n                    |      mmput()\n  mmput()           |\n    exit_mmap()     |\n      remove_vma()  |\n        fput()      |\n\nIn this case, the work of ____fput() from Task B is queued up in Task A\nas TWA_RESUME. So in theory, Task A returns to userspace and the cleanup\nwork gets executed. However, Task A instead sleep, waiting for a reply\nfrom Task B that never comes (it's dead).\n\nThis means the binder_deferred_release() is blocked until an unrelated\nbinder event forces Task A to go back to userspace. All the associated\ndeath notifications will also be delayed until then.\n\nIn order to fix this use mmput_async() that will schedule the work in\nthe corresponding mm->async_put_work WQ instead of Task A.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f87445f3-d5dd-4b14-b31e-889837d26eb1",  "id": "CVE-2023-1582",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1582"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue may allow a local attacker with user privilege to cause a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "39b03c43-38fc-45d7-aecd-9f2cb5274384",  "id": "CVE-2026-43131",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Fix null pointer dereference issue\n\nIf SMU is disabled, during RAS initialization,\nthere will be null pointer dereference issue here.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "85086ab1-9d0a-4616-8519-842b2c5c0a1c",  "id": "CVE-2017-16531",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16531"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2bcf9d83-1af3-4df3-824f-ff50c59941e8",  "id": "CVE-2026-31449",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: validate p_idx bounds in ext4_ext_correct_indexes\n\next4_ext_correct_indexes() walks up the extent tree correcting\nindex entries when the first extent in a leaf is modified. Before\naccessing path[k].p_idx->ei_block, there is no validation that\np_idx falls within the valid range of index entries for that\nlevel.\n\nIf the on-disk extent header contains a corrupted or crafted\neh_entries value, p_idx can point past the end of the allocated\nbuffer, causing a slab-out-of-bounds read.\n\nFix this by validating path[k].p_idx against EXT_LAST_INDEX() at\nboth access sites: before the while loop and inside it. Return\n-EFSCORRUPTED if the index pointer is out of range, consistent\nwith how other bounds violations are handled in the ext4 extent\ntree code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b272bfb-d10d-4cf8-9f59-3b422dd2c391",  "id": "CVE-2013-2889",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2889"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_ZEROPLUS is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8dd2cb66-7fa7-470a-b73e-93a1be2e7ddd",  "id": "CVE-2016-2109",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2109"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "33002fd4-774b-4a12-8b71-7fc033a98741",  "id": "CVE-2022-49525",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx25821: Fix the warning when removing the module\n\nWhen removing the module, we will get the following warning:\n\n[   14.746697] remove_proc_entry: removing non-empty directory 'irq/21', leaking at least 'cx25821[1]'\n[   14.747449] WARNING: CPU: 4 PID: 368 at fs/proc/generic.c:717 remove_proc_entry+0x389/0x3f0\n[   14.751611] RIP: 0010:remove_proc_entry+0x389/0x3f0\n[   14.759589] Call Trace:\n[   14.759792]  <TASK>\n[   14.759975]  unregister_irq_proc+0x14c/0x170\n[   14.760340]  irq_free_descs+0x94/0xe0\n[   14.760640]  mp_unmap_irq+0xb6/0x100\n[   14.760937]  acpi_unregister_gsi_ioapic+0x27/0x40\n[   14.761334]  acpi_pci_irq_disable+0x1d3/0x320\n[   14.761688]  pci_disable_device+0x1ad/0x380\n[   14.762027]  ? _raw_spin_unlock_irqrestore+0x2d/0x60\n[   14.762442]  ? cx25821_shutdown+0x20/0x9f0 [cx25821]\n[   14.762848]  cx25821_finidev+0x48/0xc0 [cx25821]\n[   14.763242]  pci_device_remove+0x92/0x240\n\nFix this by freeing the irq before call pci_disable_device().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c834d688-eb01-4a62-a9c0-a8f40f302b0b",  "id": "CVE-2014-3470",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3470"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "20c696ca-1048-4f30-ab54-5ae7be29a4de",  "id": "CVE-2023-52804",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/jfs: Add validity check for db_maxag and db_agpref\n\nBoth db_maxag and db_agpref are used as the index of the\ndb_agfree array, but there is currently no validity check for\ndb_maxag and db_agpref, which can lead to errors.\n\nThe following is related bug reported by Syzbot:\n\nUBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:639:20\nindex 7936 is out of range for type 'atomic_t[128]'\n\nAdd checking that the values of db_maxag and db_agpref are valid\nindexes for the db_agfree array.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "475007f5-3d1b-46c6-aa91-939a90ed40e6",  "id": "CVE-2013-7027",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7027"  },  "ratings": [    {      "score": 6.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The ieee80211_radiotap_iterator_init function in net/wireless/radiotap.c in the Linux kernel before 3.11.7 does not check whether a frame contains any data outside of the header, which might allow attackers to cause a denial of service (buffer over-read) via a crafted header.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "87399694-51c8-4d3c-a019-e9cfa23b47fa",  "id": "CVE-2024-42135",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost_task: Handle SIGKILL by flushing work and exiting\n\nInstead of lingering until the device is closed, this has us handle\nSIGKILL by:\n\n1. marking the worker as killed so we no longer try to use it with\n   new virtqueues and new flush operations.\n2. setting the virtqueue to worker mapping so no new works are queued.\n3. running all the exiting works.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b98fed28-7d8a-45f9-a5d1-31e2a59e0c3c",  "id": "CVE-2021-47506",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47506"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix use-after-free due to delegation race\n\nA delegation break could arrive as soon as we've called vfs_setlease.  A\ndelegation break runs a callback which immediately (in\nnfsd4_cb_recall_prepare) adds the delegation to del_recall_lru.  If we\nthen exit nfs4_set_delegation without hashing the delegation, it will be\nfreed as soon as the callback is done with it, without ever being\nremoved from del_recall_lru.\n\nSymptoms show up later as use-after-free or list corruption warnings,\nusually in the laundromat thread.\n\nI suspect aba2072f4523 \"nfsd: grant read delegations to clients holding\nwrites\" made this bug easier to hit, but I looked as far back as v3.0\nand it looks to me it already had the same problem.  So I'm not sure\nwhere the bug was introduced; it may have been there from the beginning.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9437d705-d73d-4d91-93b9-4267475fdf27",  "id": "CVE-2011-2211",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2211"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The osf_wait4 function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform uses an incorrect pointer, which allows local users to gain privileges by writing a certain integer value to kernel memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "07157ac1-78b2-43e7-a650-20bc202ea8bf",  "id": "CVE-2025-21957",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla1280: Fix kernel oops when debug level > 2\n\nA null dereference or oops exception will eventually occur when qla1280.c\ndriver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2.  I\nthink its clear from the code that the intention here is sg_dma_len(s) not\nlength of sg_next(s) when printing the debug info.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b661febf-444a-4770-97a2-1763afc3e0d3",  "id": "CVE-2022-50250",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: core: fix use_count leakage when handling boot-on\n\nI found a use_count leakage towards supply regulator of rdev with\nboot-on option.\n\n┌───────────────────┐           ┌───────────────────┐\n│  regulator_dev A  │           │  regulator_dev B  │\n│     (boot-on)     │           │     (boot-on)     │\n│    use_count=0    │◀──supply──│    use_count=1    │\n│                   │           │                   │\n└───────────────────┘           └───────────────────┘\n\nIn case of rdev(A) configured with `regulator-boot-on', the use_count\nof supplying regulator(B) will increment inside\nregulator_enable(rdev->supply).\n\nThus, B will acts like always-on, and further balanced\nregulator_enable/disable cannot actually disable it anymore.\n\nHowever, B was also configured with `regulator-boot-on', we wish it\ncould be disabled afterwards.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f3f2679a-4612-4174-b6a4-a1709ff32bb3",  "id": "CVE-2023-53450",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: remove a BUG_ON in ext4_mb_release_group_pa()\n\nIf a malicious fuzzer overwrites the ext4 superblock while it is\nmounted such that the s_first_data_block is set to a very large\nnumber, the calculation of the block group can underflow, and trigger\na BUG_ON check.  Change this to be an ext4_warning so that we don't\ncrash the kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c4d6391d-0c17-46df-8162-cecd0c82e6a1",  "id": "RHSA-2020:5588",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2be54cb-ca63-482d-bc05-f91c8e9f142e",  "id": "CVE-2023-53400",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: Fix Oops by 9.1 surround channel names\n\nget_line_out_pfx() may trigger an Oops by overflowing the static array\nwith more than 8 channels.  This was reported for MacBookPro 12,1 with\nCirrus codec.\n\nAs a workaround, extend for the 9.1 channels and also fix the\npotential Oops by unifying the code paths accessing the same array\nwith the proper size check.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "873a9ec4-ef09-443f-8d5e-8f5693215f26",  "id": "CVE-2023-53265",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: ensure that VID header offset + VID header size <= alloc, size\n\nEnsure that the VID header offset + VID header size does not exceed\nthe allocated area to avoid slab OOB.\n\nBUG: KASAN: slab-out-of-bounds in crc32_body lib/crc32.c:111 [inline]\nBUG: KASAN: slab-out-of-bounds in crc32_le_generic lib/crc32.c:179 [inline]\nBUG: KASAN: slab-out-of-bounds in crc32_le_base+0x58c/0x626 lib/crc32.c:197\nRead of size 4 at addr ffff88802bb36f00 by task syz-executor136/1555\n\nCPU: 2 PID: 1555 Comm: syz-executor136 Tainted: G        W\n6.0.0-1868 #1\nHardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7860+a7792d29\n04/01/2014\nCall Trace:\n  <TASK>\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x85/0xad lib/dump_stack.c:106\n  print_address_description mm/kasan/report.c:317 [inline]\n  print_report.cold.13+0xb6/0x6bb mm/kasan/report.c:433\n  kasan_report+0xa7/0x11b mm/kasan/report.c:495\n  crc32_body lib/crc32.c:111 [inline]\n  crc32_le_generic lib/crc32.c:179 [inline]\n  crc32_le_base+0x58c/0x626 lib/crc32.c:197\n  ubi_io_write_vid_hdr+0x1b7/0x472 drivers/mtd/ubi/io.c:1067\n  create_vtbl+0x4d5/0x9c4 drivers/mtd/ubi/vtbl.c:317\n  create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline]\n  ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812\n  ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601\n  ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965\n  ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:870 [inline]\n  __se_sys_ioctl fs/ioctl.c:856 [inline]\n  __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856\n  do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n  do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80\n  entry_SYSCALL_64_after_hwframe+0x63/0x0\nRIP: 0033:0x7f96d5cf753d\nCode:\nRSP: 002b:00007fffd72206f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f96d5cf753d\nRDX: 0000000020000080 RSI: 0000000040186f40 RDI: 0000000000000003\nRBP: 0000000000400cd0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400be0\nR13: 00007fffd72207e0 R14: 0000000000000000 R15: 0000000000000000\n  </TASK>\n\nAllocated by task 1555:\n  kasan_save_stack+0x20/0x3d mm/kasan/common.c:38\n  kasan_set_track mm/kasan/common.c:45 [inline]\n  set_alloc_info mm/kasan/common.c:437 [inline]\n  ____kasan_kmalloc mm/kasan/common.c:516 [inline]\n  __kasan_kmalloc+0x88/0xa3 mm/kasan/common.c:525\n  kasan_kmalloc include/linux/kasan.h:234 [inline]\n  __kmalloc+0x138/0x257 mm/slub.c:4429\n  kmalloc include/linux/slab.h:605 [inline]\n  ubi_alloc_vid_buf drivers/mtd/ubi/ubi.h:1093 [inline]\n  create_vtbl+0xcc/0x9c4 drivers/mtd/ubi/vtbl.c:295\n  create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline]\n  ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812\n  ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601\n  ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965\n  ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:870 [inline]\n  __se_sys_ioctl fs/ioctl.c:856 [inline]\n  __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856\n  do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n  do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80\n  entry_SYSCALL_64_after_hwframe+0x63/0x0\n\nThe buggy address belongs to the object at ffff88802bb36e00\n  which belongs to the cache kmalloc-256 of size 256\nThe buggy address is located 0 bytes to the right of\n  256-byte region [ffff88802bb36e00, ffff88802bb36f00)\n\nThe buggy address belongs to the physical page:\npage:00000000ea4d1263 refcount:1 mapcount:0 mapping:0000000000000000\nindex:0x0 pfn:0x2bb36\nhead:00000000ea4d1263 order:1 compound_mapcount:0 compound_pincount:0\nflags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)\nraw: 000fffffc0010200 ffffea000066c300 dead000000000003 ffff888100042b40\nraw: 0000000000000000 00000000001\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9f819659-9b84-4577-a5f0-3a635979ddfc",  "id": "OESA-2021-1189",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a76e64fc-f4ea-4ab2-a6f6-faf87111f893",  "id": "CVE-2024-53227",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: bfa: Fix use-after-free in bfad_im_module_exit()\n\nBUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20\nRead of size 8 at addr ffff8881082d80c8 by task modprobe/25303\n\nCall Trace:\n <TASK>\n dump_stack_lvl+0x95/0xe0\n print_report+0xcb/0x620\n kasan_report+0xbd/0xf0\n __lock_acquire+0x2aca/0x3a20\n lock_acquire+0x19b/0x520\n _raw_spin_lock+0x2b/0x40\n attribute_container_unregister+0x30/0x160\n fc_release_transport+0x19/0x90 [scsi_transport_fc]\n bfad_im_module_exit+0x23/0x60 [bfa]\n bfad_init+0xdb/0xff0 [bfa]\n do_one_initcall+0xdc/0x550\n do_init_module+0x22d/0x6b0\n load_module+0x4e96/0x5ff0\n init_module_from_file+0xcd/0x130\n idempotent_init_module+0x330/0x620\n __x64_sys_finit_module+0xb3/0x110\n do_syscall_64+0xc1/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nAllocated by task 25303:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x7f/0x90\n fc_attach_transport+0x4f/0x4740 [scsi_transport_fc]\n bfad_im_module_init+0x17/0x80 [bfa]\n bfad_init+0x23/0xff0 [bfa]\n do_one_initcall+0xdc/0x550\n do_init_module+0x22d/0x6b0\n load_module+0x4e96/0x5ff0\n init_module_from_file+0xcd/0x130\n idempotent_init_module+0x330/0x620\n __x64_sys_finit_module+0xb3/0x110\n do_syscall_64+0xc1/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 25303:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x38/0x50\n kfree+0x212/0x480\n bfad_im_module_init+0x7e/0x80 [bfa]\n bfad_init+0x23/0xff0 [bfa]\n do_one_initcall+0xdc/0x550\n do_init_module+0x22d/0x6b0\n load_module+0x4e96/0x5ff0\n init_module_from_file+0xcd/0x130\n idempotent_init_module+0x330/0x620\n __x64_sys_finit_module+0xb3/0x110\n do_syscall_64+0xc1/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nAbove issue happens as follows:\n\nbfad_init\n  error = bfad_im_module_init()\n    fc_release_transport(bfad_im_scsi_transport_template);\n  if (error)\n    goto ext;\n\next:\n  bfad_im_module_exit();\n    fc_release_transport(bfad_im_scsi_transport_template);\n    --> Trigger double release\n\nDon't call bfad_im_module_exit() if bfad_im_module_init() failed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3670aef9-5d5c-42b4-9ef6-accf727b82da",  "id": "CVE-2024-41072",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: wext: add extra SIOCSIWSCAN data check\n\nIn 'cfg80211_wext_siwscan()', add extra check whether number of\nchannels passed via 'ioctl(sock, SIOCSIWSCAN, ...)' doesn't exceed\nIW_MAX_FREQUENCIES and reject invalid request with -EINVAL otherwise.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d46b9dff-6164-4e4f-9304-3f328f80cda1",  "id": "CVE-2024-46778",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check UnboundedRequestEnabled's value\n\nCalculateSwathAndDETConfiguration_params_st's UnboundedRequestEnabled\nis a pointer (i.e. dml_bool_t *UnboundedRequestEnabled), and thus\nif (p->UnboundedRequestEnabled) checks its address, not bool value.\n\nThis fixes 1 REVERSE_INULL issue reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48abdf45-77c9-4e99-aa60-8db1158f1efb",  "id": "SUSE-SU-2022:0854-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "56d2789c-cac7-466d-ac69-47b24ab7c17c",  "id": "CVE-2025-38556",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Harden s32ton() against conversion to 0 bits\n\nTesting by the syzbot fuzzer showed that the HID core gets a\nshift-out-of-bounds exception when it tries to convert a 32-bit\nquantity to a 0-bit quantity.  Ideally this should never occur, but\nthere are buggy devices and some might have a report field with size\nset to zero; we shouldn't reject the report or the device just because\nof that.\n\nInstead, harden the s32ton() routine so that it returns a reasonable\nresult instead of crashing when it is called with the number of bits\nset to 0 -- the same as what snto32() does.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10be8c68-3b39-41cc-beef-07576ddea5a4",  "id": "CVE-2019-12380",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12380"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    388  ],  "analysis": {    "state": "in_triage"  },  "description": "**DISPUTED** An issue was discovered in the efi subsystem in the Linux kernel through 5.1.5. phys_efi_set_virtual_address_map in arch/x86/platform/efi/efi.c and efi_call_phys_prolog in arch/x86/platform/efi/efi_64.c mishandle memory allocation failures. NOTE: This id is disputed as not being an issue because “All the code touched by the referenced commit runs only at boot, before any user processes are started. Therefore, there is no possibility for an unprivileged user to control it.”.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7a2f47cc-b6e9-465d-a0b6-f0c507fc4776",  "id": "CVE-2026-23125",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT\n\nA null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key\ninitialization fails:\n\n  ==================================================================\n  KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]\n  CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G W 6.6.0 #2\n  RIP: 0010:sctp_packet_bundle_auth net/sctp/output.c:264 [inline]\n  RIP: 0010:sctp_packet_append_chunk+0xb36/0x1260 net/sctp/output.c:401\n  Call Trace:\n\n  sctp_packet_transmit_chunk+0x31/0x250 net/sctp/output.c:189\n  sctp_outq_flush_data+0xa29/0x26d0 net/sctp/outqueue.c:1111\n  sctp_outq_flush+0xc80/0x1240 net/sctp/outqueue.c:1217\n  sctp_cmd_interpreter.isra.0+0x19a5/0x62c0 net/sctp/sm_sideeffect.c:1787\n  sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]\n  sctp_do_sm+0x1a3/0x670 net/sctp/sm_sideeffect.c:1169\n  sctp_assoc_bh_rcv+0x33e/0x640 net/sctp/associola.c:1052\n  sctp_inq_push+0x1dd/0x280 net/sctp/inqueue.c:88\n  sctp_rcv+0x11ae/0x3100 net/sctp/input.c:243\n  sctp6_rcv+0x3d/0x60 net/sctp/ipv6.c:1127\n\nThe issue is triggered when sctp_auth_asoc_init_active_key() fails in\nsctp_sf_do_5_1C_ack() while processing an INIT_ACK. In this case, the\ncommand sequence is currently:\n\n- SCTP_CMD_PEER_INIT\n- SCTP_CMD_TIMER_STOP (T1_INIT)\n- SCTP_CMD_TIMER_START (T1_COOKIE)\n- SCTP_CMD_NEW_STATE (COOKIE_ECHOED)\n- SCTP_CMD_ASSOC_SHKEY\n- SCTP_CMD_GEN_COOKIE_ECHO\n\nIf SCTP_CMD_ASSOC_SHKEY fails, asoc->shkey remains NULL, while\nasoc->peer.auth_capable and asoc->peer.peer_chunks have already been set by\nSCTP_CMD_PEER_INIT. This allows a DATA chunk with auth = 1 and shkey = NULL\nto be queued by sctp_datamsg_from_user().\n\nSince command interpretation stops on failure, no COOKIE_ECHO should been\nsent via SCTP_CMD_GEN_COOKIE_ECHO. However, the T1_COOKIE timer has already\nbeen started, and it may enqueue a COOKIE_ECHO into the outqueue later. As\na result, the DATA chunk can be transmitted together with the COOKIE_ECHO\nin sctp_outq_flush_data(), leading to the observed issue.\n\nSimilar to the other places where it calls sctp_auth_asoc_init_active_key()\nright after sctp_process_init(), this patch moves the SCTP_CMD_ASSOC_SHKEY\nimmediately after SCTP_CMD_PEER_INIT, before stopping T1_INIT and starting\nT1_COOKIE. This ensures that if shared key generation fails, authenticated\nDATA cannot be sent. It also allows the T1_INIT timer to retransmit INIT,\ngiving the client another chance to process INIT_ACK and retry key setup.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3cc097eb-eebd-4dad-af1a-dc71c26aa4cf",  "id": "openSUSE-SU-2024:12887-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "15e9651a-3cee-4ab3-8fa2-c798f814de5f",  "id": "CVE-2023-23000",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23000"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an error pointer is used.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "384e4dc8-e255-44de-bfda-fc53ea61276a",  "id": "SUSE-SU-2016:2458-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee59658c-ecfb-4931-97cc-89de4f86e5ad",  "id": "CVE-2026-64298",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: include MAY_WRITE in open permission mask for O_TRUNC\n\nPOSIX requires write permission to truncate a file, so an open() that\nspecifies O_TRUNC must be authorized for write access regardless of the\nO_ACCMODE access mode.\n\nnfs_open_permission_mask() builds the access mask passed to\nnfs_may_open(), which is the local authorization gate for OPENs the\nclient serves itself from a cached write delegation via the\ncan_open_delegated() path in nfs4_try_open_cached().  The mask is\nderived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a\nfile the caller cannot write requests only MAY_READ and passes the\nlocal check.  The OPEN is then satisfied locally and the truncation is\nissued to the server as a SETATTR(size=0) over the delegation stateid,\nwhich the server accepts under standard write-delegation semantics.\nPOSIX requires that this open fail with EACCES.\n\nInclude MAY_WRITE in the mask whenever O_TRUNC is set so the local\ncheck matches the access the server would have enforced.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31ca06a2-2f06-4bcd-85f1-959e7137d7c8",  "id": "CVE-2022-50258",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()\n\nThis patch fixes a stack-out-of-bounds read in brcmfmac that occurs\nwhen 'buf' that is not null-terminated is passed as an argument of\nstrsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware\nversion string by memcpy() in brcmf_fil_iovar_data_get().\nThe patch ensures buf is null-terminated.\n\nFound by a modified version of syzkaller.\n\n[   47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3\n[   47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available\n[   47.601565][ T1897] ==================================================================\n[   47.602574][ T1897] BUG: KASAN: stack-out-of-bounds in strsep+0x1b2/0x1f0\n[   47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task kworker/0:2/1897\n[   47.604336][ T1897]\n[   47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G           O      5.14.0+ #131\n[   47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014\n[   47.606907][ T1897] Workqueue: usb_hub_wq hub_event\n[   47.607453][ T1897] Call Trace:\n[   47.607801][ T1897]  dump_stack_lvl+0x8e/0xd1\n[   47.608295][ T1897]  print_address_description.constprop.0.cold+0xf/0x334\n[   47.609009][ T1897]  ? strsep+0x1b2/0x1f0\n[   47.609434][ T1897]  ? strsep+0x1b2/0x1f0\n[   47.609863][ T1897]  kasan_report.cold+0x83/0xdf\n[   47.610366][ T1897]  ? strsep+0x1b2/0x1f0\n[   47.610882][ T1897]  strsep+0x1b2/0x1f0\n[   47.611300][ T1897]  ? brcmf_fil_iovar_data_get+0x3a/0xf0\n[   47.611883][ T1897]  brcmf_c_preinit_dcmds+0x995/0xc40\n[   47.612434][ T1897]  ? brcmf_c_set_joinpref_default+0x100/0x100\n[   47.613078][ T1897]  ? rcu_read_lock_sched_held+0xa1/0xd0\n[   47.613662][ T1897]  ? rcu_read_lock_bh_held+0xb0/0xb0\n[   47.614208][ T1897]  ? lock_acquire+0x19d/0x4e0\n[   47.614704][ T1897]  ? find_held_lock+0x2d/0x110\n[   47.615236][ T1897]  ? brcmf_usb_deq+0x1a7/0x260\n[   47.615741][ T1897]  ? brcmf_usb_rx_fill_all+0x5a/0xf0\n[   47.616288][ T1897]  brcmf_attach+0x246/0xd40\n[   47.616758][ T1897]  ? wiphy_new_nm+0x1703/0x1dd0\n[   47.617280][ T1897]  ? kmemdup+0x43/0x50\n[   47.617720][ T1897]  brcmf_usb_probe+0x12de/0x1690\n[   47.618244][ T1897]  ? brcmf_usbdev_qinit.constprop.0+0x470/0x470\n[   47.618901][ T1897]  usb_probe_interface+0x2aa/0x760\n[   47.619429][ T1897]  ? usb_probe_device+0x250/0x250\n[   47.619950][ T1897]  really_probe+0x205/0xb70\n[   47.620435][ T1897]  ? driver_allows_async_probing+0x130/0x130\n[   47.621048][ T1897]  __driver_probe_device+0x311/0x4b0\n[   47.621595][ T1897]  ? driver_allows_async_probing+0x130/0x130\n[   47.622209][ T1897]  driver_probe_device+0x4e/0x150\n[   47.622739][ T1897]  __device_attach_driver+0x1cc/0x2a0\n[   47.623287][ T1897]  bus_for_each_drv+0x156/0x1d0\n[   47.623796][ T1897]  ? bus_rescan_devices+0x30/0x30\n[   47.624309][ T1897]  ? lockdep_hardirqs_on_prepare+0x273/0x3e0\n[   47.624907][ T1897]  ? trace_hardirqs_on+0x46/0x160\n[   47.625437][ T1897]  __device_attach+0x23f/0x3a0\n[   47.625924][ T1897]  ? device_bind_driver+0xd0/0xd0\n[   47.626433][ T1897]  ? kobject_uevent_env+0x287/0x14b0\n[   47.627057][ T1897]  bus_probe_device+0x1da/0x290\n[   47.627557][ T1897]  device_add+0xb7b/0x1eb0\n[   47.628027][ T1897]  ? wait_for_completion+0x290/0x290\n[   47.628593][ T1897]  ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0\n[   47.629249][ T1897]  usb_set_configuration+0xf59/0x16f0\n[   47.629829][ T1897]  usb_generic_driver_probe+0x82/0xa0\n[   47.630385][ T1897]  usb_probe_device+0xbb/0x250\n[   47.630927][ T1897]  ? usb_suspend+0x590/0x590\n[   47.631397][ T1897]  really_probe+0x205/0xb70\n[   47.631855][ T1897]  ? driver_allows_async_probing+0x130/0x130\n[   47.632469][ T1897]  __driver_probe_device+0x311/0x4b0\n[   47.633002][ \n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b86a8b0-ebde-4ca3-a63a-3d29fd4332d9",  "id": "CVE-2025-38312",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()\n\nIn fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000,\ncvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's\nthen passed to fb_cvt_hperiod(), where it's used as a divider -- division\nby 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to\navoid such overflow...\n\nFound by Linux Verification Center (linuxtesting.org) with the Svace static\nanalysis tool.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2fb3f2ec-b530-43ff-b15e-0eff9e7e94bb",  "id": "CVE-2010-5331",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5331"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    193  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 2.6.34, a range check issue in drivers/gpu/drm/radeon/atombios.c could cause an off by one (buffer overflow) problem. NOTE: At least one Linux maintainer believes that this CVE is incorrectly assigned and should be rejected because the value is hard coded and are not user-controllable where it is used",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1cd001a2-5e1c-48ab-bb97-8469864c0381",  "id": "CVE-2024-49972",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Deallocate DML memory if allocation fails\n\n[Why]\nWhen DC state create DML memory allocation fails, memory is not\ndeallocated subsequently, resulting in uninitialized structure\nthat is not NULL.\n\n[How]\nDeallocate memory if DML memory allocation fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "59b68eb1-50cd-4eea-8e41-efa0e1a46630",  "id": "CVE-2019-14284",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14284"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should be called. It can be triggered by an unprivileged local user even when a floppy disk has not been inserted. NOTE: QEMU creates the floppy device by default.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "91482166-e2f8-4c8c-9565-195a379732c2",  "id": "CVE-2024-26846",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: do not wait in vain when unloading module\n\nThe module exit path has race between deleting all controllers and\nfreeing 'left over IDs'. To prevent double free a synchronization\nbetween nvme_delete_ctrl and ida_destroy has been added by the initial\ncommit.\n\nThere is some logic around trying to prevent from hanging forever in\nwait_for_completion, though it does not handling all cases. E.g.\nblktests is able to reproduce the situation where the module unload\nhangs forever.\n\nIf we completely rely on the cleanup code executed from the\nnvme_delete_ctrl path, all IDs will be freed eventually. This makes\ncalling ida_destroy unnecessary. We only have to ensure that all\nnvme_delete_ctrl code has been executed before we leave\nnvme_fc_exit_module. This is done by flushing the nvme_delete_wq\nworkqueue.\n\nWhile at it, remove the unused nvme_fc_wq workqueue too.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e04edb0-1df1-4e14-8697-58613e7e1ff2",  "id": "CVE-2009-1378",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1378"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka \"DTLS fragment handling memory leak.\"",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:77591/OpenSSL-0.9.8k-Memory-Exhaustion.html'"    }  ]},{  "bom-ref": "01e8710d-3856-4d63-9257-2b8774603cd8",  "id": "CVE-2012-1097",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1097"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The regset (aka register set) feature in the Linux kernel before 3.2.10 does not properly handle the absence of .get and .set methods, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a (1) PTRACE_GETREGSET or (2) PTRACE_SETREGSET ptrace call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "757694cc-4a10-45c5-b4b6-a53b6e9c473d",  "id": "CVE-2017-1000364",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000364"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be \"jumped\" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:45625'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'MSF:rsh_stack_clash_priv_esc'"    }  ]},{  "bom-ref": "fa2dd28a-fb29-49d5-8148-8d7b8cecbb53",  "id": "CVE-2011-2184",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2184"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The key_replace_session_keyring function in security/keys/process_keys.c in the Linux kernel before 2.6.39.1 does not initialize a certain structure member, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a KEYCTL_SESSION_TO_PARENT argument to the keyctl function, a different vulnerability than CVE-2010-2960.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "21a75881-2861-46c3-96a1-b283a4ddba70",  "id": "CVE-2019-11555",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11555"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference (denial of service). This affects eap_server/eap_server_pwd.c and eap_peer/eap_pwd.c.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "56751bd4-0486-4607-bd28-8fe30b50ac93",  "id": "CVE-2016-6480",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6480"  },  "ratings": [    {      "score": 5.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a \"double fetch\" vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c3a82949-f135-451b-a16b-9f5fd693b89a",  "id": "AZL-48535",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "741e9552-7467-4109-a999-f2e22fc63a5b",  "id": "CVE-2017-16537",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16537"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a2982b8a-713b-4ef9-95fb-582f7a74988d",  "id": "CVE-2018-13406",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13406"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "58b5cb62-3c7b-41c2-8d80-1d8d7aad159b",  "id": "CVE-2024-49962",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()\n\nACPICA commit 4d4547cf13cca820ff7e0f859ba83e1a610b9fd0\n\nACPI_ALLOCATE_ZEROED() may fail, elements might be NULL and will cause\nNULL pointer dereference later.\n\n[ rjw: Subject and changelog edits ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0753bd00-8e09-4d52-858d-9b66d08ef740",  "id": "CVE-2022-50344",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix null-ptr-deref in ext4_write_info\n\nI caught a null-ptr-deref bug as follows:\n==================================================================\nKASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]\nCPU: 1 PID: 1589 Comm: umount Not tainted 5.10.0-02219-dirty #339\nRIP: 0010:ext4_write_info+0x53/0x1b0\n[...]\nCall Trace:\n dquot_writeback_dquots+0x341/0x9a0\n ext4_sync_fs+0x19e/0x800\n __sync_filesystem+0x83/0x100\n sync_filesystem+0x89/0xf0\n generic_shutdown_super+0x79/0x3e0\n kill_block_super+0xa1/0x110\n deactivate_locked_super+0xac/0x130\n deactivate_super+0xb6/0xd0\n cleanup_mnt+0x289/0x400\n __cleanup_mnt+0x16/0x20\n task_work_run+0x11c/0x1c0\n exit_to_user_mode_prepare+0x203/0x210\n syscall_exit_to_user_mode+0x5b/0x3a0\n do_syscall_64+0x59/0x70\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n ==================================================================\n\nAbove issue may happen as follows:\n-------------------------------------\nexit_to_user_mode_prepare\n task_work_run\n  __cleanup_mnt\n   cleanup_mnt\n    deactivate_super\n     deactivate_locked_super\n      kill_block_super\n       generic_shutdown_super\n        shrink_dcache_for_umount\n         dentry = sb->s_root\n         sb->s_root = NULL              <--- Here set NULL\n        sync_filesystem\n         __sync_filesystem\n          sb->s_op->sync_fs > ext4_sync_fs\n           dquot_writeback_dquots\n            sb->dq_op->write_info > ext4_write_info\n             ext4_journal_start(d_inode(sb->s_root), EXT4_HT_QUOTA, 2)\n              d_inode(sb->s_root)\n               s_root->d_inode          <--- Null pointer dereference\n\nTo solve this problem, we use ext4_journal_start_sb directly\nto avoid s_root being used.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f8f8c237-e7ff-4cc6-9109-2d228ae54087",  "id": "CLSA-2023-1693419428",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "59d6e78f-fc00-4418-9d81-9b73f6b106c4",  "id": "CLSA-2023-1687269523",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d3ed69d-71f8-485b-9cce-9820156f0f50",  "id": "CVE-2025-37948",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: bpf: Add BHB mitigation to the epilogue for cBPF programs\n\nA malicious BPF program may manipulate the branch history to influence\nwhat the hardware speculates will happen next.\n\nOn exit from a BPF program, emit the BHB mititgation sequence.\n\nThis is only applied for 'classic' cBPF programs that are loaded by\nseccomp.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "79f1e874-9e4d-465f-af25-dcf2982b0015",  "id": "CVE-2013-0311",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0311"  },  "ratings": [    {      "score": 6.5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:H/Au:S/C:C/I:C/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b83a9c1f-5eea-4587-b16b-6082b2822289",  "id": "SUSE-SU-2019:14174-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ccd91cdf-cc99-4fb9-9e52-5d751a6102be",  "id": "CVE-2019-19602",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19602"  },  "ratings": [    {      "score": 6.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstrated by mishandling of signal-based non-cooperative preemption in Go 1.14 prereleases on amd64, aka CID-59c4bd853abc.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32724018-0b3f-41de-bb9b-ffea3acc9b04",  "id": "RUSTSEC-2023-0072",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "957b4613-2143-483b-ba1a-e57200d42030",  "id": "CVE-2025-38458",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: clip: Fix NULL pointer dereference in vcc_sendmsg()\n\natmarpd_dev_ops does not implement the send method, which may cause crash\nas bellow.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 0 P4D 0\nOops: Oops: 0010 [#1] SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted 6.15.0-rc6-syzkaller-00346-g5723cc3450bc #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\nRSP: 0018:ffffc9000d3cf778 EFLAGS: 00010246\nRAX: 1ffffffff1910dd1 RBX: 00000000000000c0 RCX: dffffc0000000000\nRDX: ffffc9000dc82000 RSI: ffff88803e4c4640 RDI: ffff888052cd0000\nRBP: ffffc9000d3cf8d0 R08: ffff888052c9143f R09: 1ffff1100a592287\nR10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff92001a79f00\nR13: ffff888052cd0000 R14: ffff88803e4c4640 R15: ffffffff8c886e88\nFS:  00007fbc762566c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffffffffd6 CR3: 0000000041f1b000 CR4: 0000000000352ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n vcc_sendmsg+0xa10/0xc50 net/atm/common.c:644\n sock_sendmsg_nosec net/socket.c:712 [inline]\n __sock_sendmsg+0x219/0x270 net/socket.c:727\n ____sys_sendmsg+0x52d/0x830 net/socket.c:2566\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2620\n __sys_sendmmsg+0x227/0x430 net/socket.c:2709\n __do_sys_sendmmsg net/socket.c:2736 [inline]\n __se_sys_sendmmsg net/socket.c:2733 [inline]\n __x64_sys_sendmmsg+0xa0/0xc0 net/socket.c:2733\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84d2b64a-4275-4d7c-a074-1c51e9aeb856",  "id": "CVE-2020-25641",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25641"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device, resulting in a denial of service. The highest threat from this vulnerability is to system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4271719c-c1b5-4088-b939-225427c9209b",  "id": "CVE-2023-53438",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/MCE: Always save CS register on AMD Zen IF Poison errors\n\nThe Instruction Fetch (IF) units on current AMD Zen-based systems do not\nguarantee a synchronous #MC is delivered for poison consumption errors.\nTherefore, MCG_STATUS[EIPV|RIPV] will not be set. However, the\nmicroarchitecture does guarantee that the exception is delivered within\nthe same context. In other words, the exact rIP is not known, but the\ncontext is known to not have changed.\n\nThere is no architecturally-defined method to determine this behavior.\n\nThe Code Segment (CS) register is always valid on such IF unit poison\nerrors regardless of the value of MCG_STATUS[EIPV|RIPV].\n\nAdd a quirk to save the CS register for poison consumption from the IF\nunit banks.\n\nThis is needed to properly determine the context of the error.\nOtherwise, the severity grading function will assume the context is\nIN_KERNEL due to the m->cs value being 0 (the initialized value). This\nleads to unnecessary kernel panics on data poison errors due to the\nkernel believing the poison consumption occurred in kernel context.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6474e145-c606-482d-81a2-0807d5038fd3",  "id": "CVE-2016-7913",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7913"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) via vectors involving omission of the firmware name from a certain data structure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6e173d73-76eb-41c6-bc9f-87620ea4f73c",  "id": "CVE-2014-3153",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3153"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:35370'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'MSF:futex_requeue'"    }  ]},{  "bom-ref": "69f48b37-614c-47da-a8e3-2198d8274e5c",  "id": "CVE-2022-50278",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPNP: fix name memory leak in pnp_alloc_dev()\n\nAfter commit 1fa5ae857bb1 (\"driver core: get rid of struct device's\nbus_id string array\"), the name of device is allocated dynamically,\nmove dev_set_name() after pnp_add_id() to avoid memory leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3902d4da-abf3-4bb2-b67a-e7a343f9270a",  "id": "CVE-2021-47552",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47552"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()\n\nFor avoiding to slow down queue destroy, we don't call\nblk_mq_quiesce_queue() in blk_cleanup_queue(), instead of delaying to\ncancel dispatch work in blk_release_queue().\n\nHowever, this way has caused kernel oops[1], reported by Changhui. The log\nshows that scsi_device can be freed before running blk_release_queue(),\nwhich is expected too since scsi_device is released after the scsi disk\nis closed and the scsi_device is removed.\n\nFixes the issue by canceling blk-mq dispatch work in both blk_cleanup_queue()\nand disk_release():\n\n1) when disk_release() is run, the disk has been closed, and any sync\ndispatch activities have been done, so canceling dispatch work is enough to\nquiesce filesystem I/O dispatch activity.\n\n2) in blk_cleanup_queue(), we only focus on passthrough request, and\npassthrough request is always explicitly allocated & freed by\nits caller, so once queue is frozen, all sync dispatch activity\nfor passthrough request has been done, then it is enough to just cancel\ndispatch work for avoiding any dispatch activity.\n\n[1] kernel panic log\n[12622.769416] BUG: kernel NULL pointer dereference, address: 0000000000000300\n[12622.777186] #PF: supervisor read access in kernel mode\n[12622.782918] #PF: error_code(0x0000) - not-present page\n[12622.788649] PGD 0 P4D 0\n[12622.791474] Oops: 0000 [#1] PREEMPT SMP PTI\n[12622.796138] CPU: 10 PID: 744 Comm: kworker/10:1H Kdump: loaded Not tainted 5.15.0+ #1\n[12622.804877] Hardware name: Dell Inc. PowerEdge R730/0H21J3, BIOS 1.5.4 10/002/2015\n[12622.813321] Workqueue: kblockd blk_mq_run_work_fn\n[12622.818572] RIP: 0010:sbitmap_get+0x75/0x190\n[12622.823336] Code: 85 80 00 00 00 41 8b 57 08 85 d2 0f 84 b1 00 00 00 45 31 e4 48 63 cd 48 8d 1c 49 48 c1 e3 06 49 03 5f 10 4c 8d 6b 40 83 f0 01 <48> 8b 33 44 89 f2 4c 89 ef 0f b6 c8 e8 fa f3 ff ff 83 f8 ff 75 58\n[12622.844290] RSP: 0018:ffffb00a446dbd40 EFLAGS: 00010202\n[12622.850120] RAX: 0000000000000001 RBX: 0000000000000300 RCX: 0000000000000004\n[12622.858082] RDX: 0000000000000006 RSI: 0000000000000082 RDI: ffffa0b7a2dfe030\n[12622.866042] RBP: 0000000000000004 R08: 0000000000000001 R09: ffffa0b742721334\n[12622.874003] R10: 0000000000000008 R11: 0000000000000008 R12: 0000000000000000\n[12622.881964] R13: 0000000000000340 R14: 0000000000000000 R15: ffffa0b7a2dfe030\n[12622.889926] FS:  0000000000000000(0000) GS:ffffa0baafb40000(0000) knlGS:0000000000000000\n[12622.898956] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[12622.905367] CR2: 0000000000000300 CR3: 0000000641210001 CR4: 00000000001706e0\n[12622.913328] Call Trace:\n[12622.916055]  <TASK>\n[12622.918394]  scsi_mq_get_budget+0x1a/0x110\n[12622.922969]  __blk_mq_do_dispatch_sched+0x1d4/0x320\n[12622.928404]  ? pick_next_task_fair+0x39/0x390\n[12622.933268]  __blk_mq_sched_dispatch_requests+0xf4/0x140\n[12622.939194]  blk_mq_sched_dispatch_requests+0x30/0x60\n[12622.944829]  __blk_mq_run_hw_queue+0x30/0xa0\n[12622.949593]  process_one_work+0x1e8/0x3c0\n[12622.954059]  worker_thread+0x50/0x3b0\n[12622.958144]  ? rescuer_thread+0x370/0x370\n[12622.962616]  kthread+0x158/0x180\n[12622.966218]  ? set_kthread_struct+0x40/0x40\n[12622.970884]  ret_from_fork+0x22/0x30\n[12622.974875]  </TASK>\n[12622.977309] Modules linked in: scsi_debug rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs sunrpc dm_multipath intel_rapl_msr intel_rapl_common dell_wmi_descriptor sb_edac rfkill video x86_pkg_temp_thermal intel_powerclamp dcdbas coretemp kvm_intel kvm mgag200 irqbypass i2c_algo_bit rapl drm_kms_helper ipmi_ssif intel_cstate intel_uncore syscopyarea sysfillrect sysimgblt fb_sys_fops pcspkr cec mei_me lpc_ich mei ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter drm fuse xfs libcrc32c sr_mod cdrom sd_mod t10_pi sg ixgbe ahci libahci crct10dif_pclmul crc32_pclmul crc32c_intel libata megaraid_sas ghash_clmulni_intel tg3 wdat_w\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7999cc54-3985-4525-9226-9662c8a976ab",  "id": "CVE-2018-20855",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20855"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f4ea2e6-22a9-4f79-982f-44e0b24a2546",  "id": "CVE-2014-4667",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4667"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9713d07-4db8-4800-a589-67a4f1e49f46",  "id": "DSA-3287-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "626ee229-a613-4251-8977-84f4570d343d",  "id": "CVE-2021-47207",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47207"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: gus: fix null pointer dereference on pointer block\n\nThe pointer block return from snd_gf1_dma_next_block could be\nnull, so there is a potential null pointer dereference issue.\nFix this by adding a null check before dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c4d1f92c-7186-4765-8c82-07051665af46",  "id": "GHSA-3gxf-9r58-2ghg",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5280a998-9641-4e1d-99ea-64854e203328",  "id": "CVE-2022-3105",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3105"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f75d7005-51d2-4649-a8b9-0a2668f8a986",  "id": "CVE-2017-18222",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18222"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 4.12, Hisilicon Network Subsystem (HNS) does not consider the ETH_SS_PRIV_FLAGS case when retrieving sset_count data, which allows local users to cause a denial of service (buffer overflow and memory corruption) or possibly have unspecified other impact, as demonstrated by incompatibility between hns_get_sset_count and ethtool_get_strings.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5cdb89c7-b053-469f-ac8d-90302779fd86",  "id": "CVE-2022-49522",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: jz4740: Apply DMA engine limits to maximum segment size\n\nDo what is done in other DMA-enabled MMC host drivers (cf. host/mmci.c) and\nlimit the maximum segment size based on the DMA engine's capabilities. This\nis needed to avoid warnings like the following with CONFIG_DMA_API_DEBUG=y.\n\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 21 at kernel/dma/debug.c:1162 debug_dma_map_sg+0x2f4/0x39c\nDMA-API: jz4780-dma 13420000.dma-controller: mapping sg segment longer than device claims to support [len=98304] [max=65536]\nCPU: 0 PID: 21 Comm: kworker/0:1H Not tainted 5.18.0-rc1 #19\nWorkqueue: kblockd blk_mq_run_work_fn\nStack : 81575aec 00000004 80620000 80620000 80620000 805e7358 00000009 801537ac\n        814c832c 806276e3 806e34b4 80620000 81575aec 00000001 81575ab8 09291444\n        00000000 00000000 805e7358 81575958 ffffffea 8157596c 00000000 636f6c62\n        6220646b 80387a70 0000000f 6d5f6b6c 80620000 00000000 81575ba4 00000009\n        805e170c 80896640 00000001 00010000 00000000 00000000 00006098 806e0000\n        ...\nCall Trace:\n[<80107670>] show_stack+0x84/0x120\n[<80528cd8>] __warn+0xb8/0xec\n[<80528d78>] warn_slowpath_fmt+0x6c/0xb8\n[<8016f1d4>] debug_dma_map_sg+0x2f4/0x39c\n[<80169d4c>] __dma_map_sg_attrs+0xf0/0x118\n[<8016a27c>] dma_map_sg_attrs+0x14/0x28\n[<804f66b4>] jz4740_mmc_prepare_dma_data+0x74/0xa4\n[<804f6714>] jz4740_mmc_pre_request+0x30/0x54\n[<804f4ff4>] mmc_blk_mq_issue_rq+0x6e0/0x7bc\n[<804f5590>] mmc_mq_queue_rq+0x220/0x2d4\n[<8038b2c0>] blk_mq_dispatch_rq_list+0x480/0x664\n[<80391040>] blk_mq_do_dispatch_sched+0x2dc/0x370\n[<80391468>] __blk_mq_sched_dispatch_requests+0xec/0x164\n[<80391540>] blk_mq_sched_dispatch_requests+0x44/0x94\n[<80387900>] __blk_mq_run_hw_queue+0xb0/0xcc\n[<80134c14>] process_one_work+0x1b8/0x264\n[<80134ff8>] worker_thread+0x2ec/0x3b8\n[<8013b13c>] kthread+0x104/0x10c\n[<80101dcc>] ret_from_kernel_thread+0x14/0x1c\n\n---[ end trace 0000000000000000 ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c4af351-bbf6-4804-a6b6-4045b0906fda",  "id": "CVE-2022-48969",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netfront: Fix NULL sring after live migration\n\nA NAPI is setup for each network sring to poll data to kernel\nThe sring with source host is destroyed before live migration and\nnew sring with target host is setup after live migration.\nThe NAPI for the old sring is not deleted until setup new sring\nwith target host after migration. With busy_poll/busy_read enabled,\nthe NAPI can be polled before got deleted when resume VM.\n\nBUG: unable to handle kernel NULL pointer dereference at\n0000000000000008\nIP: xennet_poll+0xae/0xd20\nPGD 0 P4D 0\nOops: 0000 [#1] SMP PTI\nCall Trace:\n finish_task_switch+0x71/0x230\n timerqueue_del+0x1d/0x40\n hrtimer_try_to_cancel+0xb5/0x110\n xennet_alloc_rx_buffers+0x2a0/0x2a0\n napi_busy_loop+0xdb/0x270\n sock_poll+0x87/0x90\n do_sys_poll+0x26f/0x580\n tracing_map_insert+0x1d4/0x2f0\n event_hist_trigger+0x14a/0x260\n\n finish_task_switch+0x71/0x230\n __schedule+0x256/0x890\n recalc_sigpending+0x1b/0x50\n xen_sched_clock+0x15/0x20\n __rb_reserve_next+0x12d/0x140\n ring_buffer_lock_reserve+0x123/0x3d0\n event_triggers_call+0x87/0xb0\n trace_event_buffer_commit+0x1c4/0x210\n xen_clocksource_get_cycles+0x15/0x20\n ktime_get_ts64+0x51/0xf0\n SyS_ppoll+0x160/0x1a0\n SyS_ppoll+0x160/0x1a0\n do_syscall_64+0x73/0x130\n entry_SYSCALL_64_after_hwframe+0x41/0xa6\n...\nRIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900\nCR2: 0000000000000008\n---[ end trace f8601785b354351c ]---\n\nxen frontend should remove the NAPIs for the old srings before live\nmigration as the bond srings are destroyed\n\nThere is a tiny window between the srings are set to NULL and\nthe NAPIs are disabled, It is safe as the NAPI threads are still\nfrozen at that time",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e78cb9f3-f9ca-4ada-b4fd-97d150643580",  "id": "CVE-2021-20177",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20177"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user (with root or CAP_NET_ADMIN) when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5-rc1 is affected.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8fdec278-5d5e-44f1-a151-ec8615329346",  "id": "SUSE-SU-2026:22836-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3a8669d1-32cc-4c66-b446-3d7c58208768",      "versions": [        {          "component": "radvd",          "version": "1.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95d7c44f-bfbc-4af6-b83d-5c9c1d359b09",  "id": "CVE-2022-50093",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)\n\nKASAN reports:\n\n[ 4.668325][ T0] BUG: KASAN: wild-memory-access in dmar_parse_one_rhsa (arch/x86/include/asm/bitops.h:214 arch/x86/include/asm/bitops.h:226 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/nodemask.h:415 drivers/iommu/intel/dmar.c:497)\n[    4.676149][    T0] Read of size 8 at addr 1fffffff85115558 by task swapper/0/0\n[    4.683454][    T0]\n[    4.685638][    T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0-rc3-00004-g0e862838f290 #1\n[    4.694331][    T0] Hardware name: Supermicro SYS-5018D-FN4T/X10SDV-8C-TLN4F, BIOS 1.1 03/02/2016\n[    4.703196][    T0] Call Trace:\n[    4.706334][    T0]  <TASK>\n[ 4.709133][ T0] ? dmar_parse_one_rhsa (arch/x86/include/asm/bitops.h:214 arch/x86/include/asm/bitops.h:226 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/nodemask.h:415 drivers/iommu/intel/dmar.c:497)\n\nafter converting the type of the first argument (@nr, bit number)\nof arch_test_bit() from `long` to `unsigned long`[0].\n\nUnder certain conditions (for example, when ACPI NUMA is disabled\nvia command line), pxm_to_node() can return %NUMA_NO_NODE (-1).\nIt is valid 'magic' number of NUMA node, but not valid bit number\nto use in bitops.\nnode_online() eventually descends to test_bit() without checking\nfor the input, assuming it's on caller side (which might be good\nfor perf-critical tasks). There, -1 becomes %ULONG_MAX which leads\nto an insane array index when calculating bit position in memory.\n\nFor now, add an explicit check for @node being not %NUMA_NO_NODE\nbefore calling test_bit(). The actual logics didn't change here\nat all.\n\n[0] https://github.com/norov/linux/commit/0e862838f290147ea9c16db852d8d494b552d38d",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "404d4dd8-90ac-4f89-8c13-af6a27e14259",  "id": "OESA-2021-1449",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.2,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a2cacd4c-b394-45b7-a0c8-3b6931a00729",  "id": "CVE-2021-20320",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20320"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2f1542f3-439e-4de6-b0a4-51bdc8b46010",  "id": "SUSE-SU-2023:4489-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9eef379-78c2-4496-828c-e1ce4488f399",  "id": "RHSA-2022:1082",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c709a016-ebb7-4d7c-a96e-6bd84359dc52",  "id": "CVE-2022-39842",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39842"  },  "ratings": [    {      "score": 6.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "09afa18f-f0ac-4bf0-8d9f-62ec1355a118",  "id": "CVE-2026-45915",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfat: avoid parent link count underflow in rmdir\n\nCorrupted FAT images can leave a directory inode with an incorrect\ni_nlink (e.g. 2 even though subdirectories exist). rmdir then\nunconditionally calls drop_nlink(dir) and can drive i_nlink to 0,\ntriggering the WARN_ON in drop_nlink().\n\nAdd a sanity check in vfat_rmdir() and msdos_rmdir(): only drop the\nparent link count when it is at least 3, otherwise report a filesystem\nerror.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "76660f6a-b6ca-450f-a432-31c660e4c771",  "id": "CVE-2017-14494",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14494"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:42944'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:144471/Dnsmasq-Information-Leak.html'"    }  ]},{  "bom-ref": "fafab028-522e-4081-9ead-3cf8c20d1b10",  "id": "CVE-2024-41014",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: add bounds checking to xlog_recover_process_data\n\nThere is a lack of verification of the space occupied by fixed members\nof xlog_op_header in the xlog_recover_process_data.\n\nWe can create a crafted image to trigger an out of bounds read by\nfollowing these steps:\n    1) Mount an image of xfs, and do some file operations to leave records\n    2) Before umounting, copy the image for subsequent steps to simulate\n       abnormal exit. Because umount will ensure that tail_blk and\n       head_blk are the same, which will result in the inability to enter\n       xlog_recover_process_data\n    3) Write a tool to parse and modify the copied image in step 2\n    4) Make the end of the xlog_op_header entries only 1 byte away from\n       xlog_rec_header->h_size\n    5) xlog_rec_header->h_num_logops++\n    6) Modify xlog_rec_header->h_crc\n\nFix:\nAdd a check to make sure there is sufficient space to access fixed members\nof xlog_op_header.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2df94b64-7e83-4c9d-8e80-59f0f302ad02",  "id": "OESA-2026-2702",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d328992-c2f1-4a9e-b1f8-16d25ef3f603",  "id": "CVE-2019-19054",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19054"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering kfifo_alloc() failures, aka CID-a7b2df76b42b.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "066eaeac-1c9d-4c73-aade-c0d8bcf8306f",  "id": "CVE-2013-2547",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2547"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "75d61195-d28b-4dec-a144-cbd9ff7aba4c",  "id": "CVE-2020-25704",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25704"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cbaccc3f-cabc-4415-9ab1-3491ae3c8b33",  "id": "ALSA-2024:6783",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "114ba79b-b951-4c1c-9b67-2ac0a312b561",  "id": "CVE-2025-39940",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-stripe: fix a possible integer overflow\n\nThere's a possible integer overflow in stripe_io_hints if we have too\nlarge chunk size. Test if the overflow happened, and if it did, don't set\nlimits->io_min and limits->io_opt;",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f276c11a-3027-43f5-ace0-0df89e762181",  "id": "CLSA-2026-1770821221",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6958cde8-49d0-4e99-86ff-076db5881ce0",  "id": "CVE-2016-2544",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2544"  },  "ratings": [    {      "score": 5.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the queue_delete function in sound/core/seq/seq_queue.c in the Linux kernel before 4.4.1 allows local users to cause a denial of service (use-after-free and system crash) by making an ioctl call at a certain time.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b482fffb-4f22-45c6-8a3b-1870c6a01946",  "id": "CVE-2022-49619",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sfp: fix memory leak in sfp_probe()\n\nsfp_probe() allocates a memory chunk from sfp with sfp_alloc(). When\ndevm_add_action() fails, sfp is not freed, which leads to a memory leak.\n\nWe should use devm_add_action_or_reset() instead of devm_add_action().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "711c1100-33a4-4401-a427-300d6e2a6223",  "id": "CVE-2013-1956",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1956"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The create_user_ns function in kernel/user_namespace.c in the Linux kernel before 3.8.6 does not check whether a chroot directory exists that differs from the namespace root directory, which allows local users to bypass intended filesystem restrictions via a crafted clone system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a22635b8-a4d7-4f4f-9fc7-fccbeb9e1cb6",  "id": "CVE-2024-36023",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nJulia Lawall reported this null pointer dereference, this should fix it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "83853688-76a1-47a3-b2ee-4f046883d51b",  "id": "CVE-2021-47193",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47193"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm80xx: Fix memory leak during rmmod\n\nDriver failed to release all memory allocated. This would lead to memory\nleak during driver removal.\n\nProperly free memory when the module is removed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5558788f-f328-42ba-8a7d-aece6b92e02c",  "id": "CVE-2020-28941",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28941"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    763  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ff11b2a-3ef6-4a92-acf8-fe9079bac102",  "id": "CVE-2025-38498",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndo_change_type(): refuse to operate on unmounted/not ours mounts\n\nEnsure that propagation settings can only be changed for mounts located\nin the caller's mount namespace. This change aligns permission checking\nwith the rest of mount(2).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a30eb921-e045-4fd0-9b7f-01ad73fea4e5",  "id": "CLSA-2025-1742723010",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f972532f-8c27-4e52-a36c-695a0282baf5",  "id": "CVE-2024-46805",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix the waring dereferencing hive\n\nCheck the amdgpu_hive_info *hive that maybe is NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "897065db-6306-4e20-a955-a2bbb36579b3",  "id": "CVE-2012-6542",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6542"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel before 3.6 has an incorrect return value in certain circumstances, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that leverages an uninitialized pointer argument.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31aaabae-8af6-4f18-8940-5c2765e4237a",  "id": "CVE-2021-47216",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47216"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: advansys: Fix kernel pointer leak\n\nPointers should be printed with %p or %px rather than cast to 'unsigned\nlong' and printed with %lx.\n\nChange %lx to %p to print the hashed pointer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "290ba84f-2ea5-4d3e-9aa7-9490645be00b",  "id": "CVE-2016-9178",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9178"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variable, which allows local users to obtain sensitive information from kernel stack memory by triggering failure of a get_user_ex call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0f2d08cd-fc8f-439a-8f67-26a8bcf60253",  "id": "CVE-2024-53690",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: prevent use of deleted inode\n\nsyzbot reported a WARNING in nilfs_rmdir. [1]\n\nBecause the inode bitmap is corrupted, an inode with an inode number that\nshould exist as a \".nilfs\" file was reassigned by nilfs_mkdir for \"file0\",\ncausing an inode duplication during execution.  And this causes an\nunderflow of i_nlink in rmdir operations.\n\nThe inode is used twice by the same task to unmount and remove directories\n\".nilfs\" and \"file0\", it trigger warning in nilfs_rmdir.\n\nAvoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means\nthat this inode has been deleted, and iput is executed to reclaim it.\n\n[1]\nWARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407\n...\nCall Trace:\n <TASK>\n nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342\n vfs_rmdir+0x3a3/0x510 fs/namei.c:4394\n do_rmdir+0x3b5/0x580 fs/namei.c:4453\n __do_sys_rmdir fs/namei.c:4472 [inline]\n __se_sys_rmdir fs/namei.c:4470 [inline]\n __x64_sys_rmdir+0x47/0x50 fs/namei.c:4470\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "75784bf1-42cc-424f-b9fd-01732c4704dc",  "id": "RHSA-2022:1065",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3559878-dc8d-4674-87f9-b13ca98dc6f4",  "id": "CVE-2022-50021",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: block range must be validated before use in ext4_mb_clear_bb()\n\nBlock range to free is validated in ext4_free_blocks() using\next4_inode_block_valid() and then it's passed to ext4_mb_clear_bb().\nHowever in some situations on bigalloc file system the range might be\nadjusted after the validation in ext4_free_blocks() which can lead to\ntroubles on corrupted file systems such as one found by syzkaller that\nresulted in the following BUG\n\nkernel BUG at fs/ext4/ext4.h:3319!\nPREEMPT SMP NOPTI\nCPU: 28 PID: 4243 Comm: repro Kdump: loaded Not tainted 5.19.0-rc6+ #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1.fc35 04/01/2014\nRIP: 0010:ext4_free_blocks+0x95e/0xa90\nCall Trace:\n <TASK>\n ? lock_timer_base+0x61/0x80\n ? __es_remove_extent+0x5a/0x760\n ? __mod_timer+0x256/0x380\n ? ext4_ind_truncate_ensure_credits+0x90/0x220\n ext4_clear_blocks+0x107/0x1b0\n ext4_free_data+0x15b/0x170\n ext4_ind_truncate+0x214/0x2c0\n ? _raw_spin_unlock+0x15/0x30\n ? ext4_discard_preallocations+0x15a/0x410\n ? ext4_journal_check_start+0xe/0x90\n ? __ext4_journal_start_sb+0x2f/0x110\n ext4_truncate+0x1b5/0x460\n ? __ext4_journal_start_sb+0x2f/0x110\n ext4_evict_inode+0x2b4/0x6f0\n evict+0xd0/0x1d0\n ext4_enable_quotas+0x11f/0x1f0\n ext4_orphan_cleanup+0x3de/0x430\n ? proc_create_seq_private+0x43/0x50\n ext4_fill_super+0x295f/0x3ae0\n ? snprintf+0x39/0x40\n ? sget_fc+0x19c/0x330\n ? ext4_reconfigure+0x850/0x850\n get_tree_bdev+0x16d/0x260\n vfs_get_tree+0x25/0xb0\n path_mount+0x431/0xa70\n __x64_sys_mount+0xe2/0x120\n do_syscall_64+0x5b/0x80\n ? do_user_addr_fault+0x1e2/0x670\n ? exc_page_fault+0x70/0x170\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7fdf4e512ace\n\nFix it by making sure that the block range is properly validated before\nused every time it changes in ext4_free_blocks() or ext4_mb_clear_bb().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7378b61e-c266-40b1-a0c1-5c196a47068f",  "id": "AZL-41790",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b848217-2494-4345-b5a2-94949e91a314",  "id": "CVE-2011-1477",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1477"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119,    264  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple array index errors in sound/oss/opl3.c in the Linux kernel before 2.6.39 allow local users to cause a denial of service (heap memory corruption) or possibly gain privileges by leveraging write access to /dev/sequencer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "07b1275f-8f3b-44b6-97cf-9429499f4bd7",  "id": "DLA-421-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d0daa710-bd80-4179-8411-110a79fe91aa",  "id": "SUSE-SU-2026:22706-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b1d792c2-eaeb-418d-bd94-7f1fc9feb085",  "id": "OESA-2026-2807",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3a8669d1-32cc-4c66-b446-3d7c58208768",      "versions": [        {          "component": "radvd",          "version": "1.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e8ddffa4-de04-4f06-a2ac-fca1281894db",  "id": "CVE-2010-2226",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2226"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b2bf2b5-ec44-4e6b-87f9-395433e76087",  "id": "GHSA-6hcf-g6gr-hhcr",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c447185-e1e9-44d9-adf2-2b409195f1dc",  "id": "CVE-2014-7822",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7822"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:36743'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:131402/Linux-splice_write-Kernel-Panic.html'"    }  ]},{  "bom-ref": "d44bc7ee-ee8b-46dd-8795-8e32ba4e264a",  "id": "OESA-2024-2441",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d907abb-10c9-41cb-9dd1-78059b6dc3d0",  "id": "CVE-2021-43975",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43975"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bd4f8829-437e-40a5-b570-b4ca499275b4",  "id": "MGASA-2014-0204",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "df11a5d8-8c87-45ae-9e0e-9cb8a364cf69",  "id": "CVE-2023-2166",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2166"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "75b5e8a3-e63b-4fde-aa64-f5e811c50d0b",  "id": "RHSA-2025:1330",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3d8f4324-964c-4d5a-b10e-a3cd1a828608",  "id": "CVE-2024-56597",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix shift-out-of-bounds in dbSplit\n\nWhen dmt_budmin is less than zero, it causes errors\nin the later stages. Added a check to return an error beforehand\nin dbAllocCtl itself.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "25111880-17db-4ef1-8004-7852889aea22",  "id": "CVE-2022-49564",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - add param check for DH\n\nReject requests with a source buffer that is bigger than the size of the\nkey. This is to prevent a possible integer underflow that might happen\nwhen copying the source scatterlist into a linear buffer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd9c672c-b861-409b-92a7-2bd1f36b9d92",  "id": "CVE-2018-10853",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10853"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    250,    269  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff55a92a-81b8-45a5-af35-7d4a6f7c4f21",  "id": "CVE-2019-18807",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18807"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "Two memory leaks in the sja1105_static_config_upload() function in drivers/net/dsa/sja1105/sja1105_spi.c in the Linux kernel before 5.3.5 allow attackers to cause a denial of service (memory consumption) by triggering static_config_buf_prepare_for_upload() or sja1105_inhibit_tx() failures, aka CID-68501df92d11.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "027d3f67-4316-45a9-8801-7c4c54bdedc8",  "id": "CVE-2010-4081",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4081"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "109c8350-364e-4075-a5a1-b5d4622c1aa3",  "id": "CVE-2022-49420",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: annotate races around sk->sk_bound_dev_if\n\nUDP sendmsg() is lockless, and reads sk->sk_bound_dev_if while\nthis field can be changed by another thread.\n\nAdds minimal annotations to avoid KCSAN splats for UDP.\nFollowing patches will add more annotations to potential lockless readers.\n\nBUG: KCSAN: data-race in __ip6_datagram_connect / udpv6_sendmsg\n\nwrite to 0xffff888136d47a94 of 4 bytes by task 7681 on cpu 0:\n __ip6_datagram_connect+0x6e2/0x930 net/ipv6/datagram.c:221\n ip6_datagram_connect+0x2a/0x40 net/ipv6/datagram.c:272\n inet_dgram_connect+0x107/0x190 net/ipv4/af_inet.c:576\n __sys_connect_file net/socket.c:1900 [inline]\n __sys_connect+0x197/0x1b0 net/socket.c:1917\n __do_sys_connect net/socket.c:1927 [inline]\n __se_sys_connect net/socket.c:1924 [inline]\n __x64_sys_connect+0x3d/0x50 net/socket.c:1924\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nread to 0xffff888136d47a94 of 4 bytes by task 7670 on cpu 1:\n udpv6_sendmsg+0xc60/0x16e0 net/ipv6/udp.c:1436\n inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:652\n sock_sendmsg_nosec net/socket.c:705 [inline]\n sock_sendmsg net/socket.c:725 [inline]\n ____sys_sendmsg+0x39a/0x510 net/socket.c:2413\n ___sys_sendmsg net/socket.c:2467 [inline]\n __sys_sendmmsg+0x267/0x4c0 net/socket.c:2553\n __do_sys_sendmmsg net/socket.c:2582 [inline]\n __se_sys_sendmmsg net/socket.c:2579 [inline]\n __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2579\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nvalue changed: 0x00000000 -> 0xffffff9b\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 PID: 7670 Comm: syz-executor.3 Tainted: G        W         5.18.0-rc1-syzkaller-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n\nI chose to not add Fixes: tag because race has minor consequences\nand stable teams busy enough.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "85f43734-f2d8-477b-a77c-158b6afcb44a",  "id": "CVE-2017-16538",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16538"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ab69fe06-625c-4014-b078-986c9510e622",  "id": "CVE-2024-49971",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Increase array size of dummy_boolean\n\n[WHY]\ndml2_core_shared_mode_support and dml_core_mode_support access the third\nelement of dummy_boolean, i.e. hw_debug5 = &s->dummy_boolean[2], when\ndummy_boolean has size of 2. Any assignment to hw_debug5 causes an\nOVERRUN.\n\n[HOW]\nIncrease dummy_boolean's array size to 3.\n\nThis fixes 2 OVERRUN issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a6ae7795-1747-435d-b1e4-3e3af43d3451",  "id": "CVE-2017-16644",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16644"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    388  ],  "analysis": {    "state": "in_triage"  },  "description": "The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "249f4991-06c5-4044-b881-5a9afad6ac9a",  "id": "CVE-2024-44998",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: idt77252: prevent use after free in dequeue_rx()\n\nWe can't dereference \"skb\" after calling vcc->push() because the skb\nis released.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4cafe7ea-d07e-46c1-950a-217d8948229b",  "id": "ROOT-OS-ALPINE-315-CVE-2026-28388",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6c694f01-9f4f-4079-9ba3-969e589ffc50",  "id": "CVE-2024-50095",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mad: Improve handling of timed out WRs of mad agent\n\nCurrent timeout handler of mad agent acquires/releases mad_agent_priv\nlock for every timed out WRs. This causes heavy locking contention\nwhen higher no. of WRs are to be handled inside timeout handler.\n\nThis leads to softlockup with below trace in some use cases where\nrdma-cm path is used to establish connection between peer nodes\n\nTrace:\n-----\n BUG: soft lockup - CPU#4 stuck for 26s! [kworker/u128:3:19767]\n CPU: 4 PID: 19767 Comm: kworker/u128:3 Kdump: loaded Tainted: G OE\n     -------  ---  5.14.0-427.13.1.el9_4.x86_64 #1\n Hardware name: Dell Inc. PowerEdge R740/01YM03, BIOS 2.4.8 11/26/2019\n Workqueue: ib_mad1 timeout_sends [ib_core]\n RIP: 0010:__do_softirq+0x78/0x2ac\n RSP: 0018:ffffb253449e4f98 EFLAGS: 00000246\n RAX: 00000000ffffffff RBX: 0000000000000000 RCX: 000000000000001f\n RDX: 000000000000001d RSI: 000000003d1879ab RDI: fff363b66fd3a86b\n RBP: ffffb253604cbcd8 R08: 0000009065635f3b R09: 0000000000000000\n R10: 0000000000000040 R11: ffffb253449e4ff8 R12: 0000000000000000\n R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000040\n FS:  0000000000000000(0000) GS:ffff8caa1fc80000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fd9ec9db900 CR3: 0000000891934006 CR4: 00000000007706e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n  <IRQ>\n  ? show_trace_log_lvl+0x1c4/0x2df\n  ? show_trace_log_lvl+0x1c4/0x2df\n  ? __irq_exit_rcu+0xa1/0xc0\n  ? watchdog_timer_fn+0x1b2/0x210\n  ? __pfx_watchdog_timer_fn+0x10/0x10\n  ? __hrtimer_run_queues+0x127/0x2c0\n  ? hrtimer_interrupt+0xfc/0x210\n  ? __sysvec_apic_timer_interrupt+0x5c/0x110\n  ? sysvec_apic_timer_interrupt+0x37/0x90\n  ? asm_sysvec_apic_timer_interrupt+0x16/0x20\n  ? __do_softirq+0x78/0x2ac\n  ? __do_softirq+0x60/0x2ac\n  __irq_exit_rcu+0xa1/0xc0\n  sysvec_call_function_single+0x72/0x90\n  </IRQ>\n  <TASK>\n  asm_sysvec_call_function_single+0x16/0x20\n RIP: 0010:_raw_spin_unlock_irq+0x14/0x30\n RSP: 0018:ffffb253604cbd88 EFLAGS: 00000247\n RAX: 000000000001960d RBX: 0000000000000002 RCX: ffff8cad2a064800\n RDX: 000000008020001b RSI: 0000000000000001 RDI: ffff8cad5d39f66c\n RBP: ffff8cad5d39f600 R08: 0000000000000001 R09: 0000000000000000\n R10: ffff8caa443e0c00 R11: ffffb253604cbcd8 R12: ffff8cacb8682538\n R13: 0000000000000005 R14: ffffb253604cbd90 R15: ffff8cad5d39f66c\n  cm_process_send_error+0x122/0x1d0 [ib_cm]\n  timeout_sends+0x1dd/0x270 [ib_core]\n  process_one_work+0x1e2/0x3b0\n  ? __pfx_worker_thread+0x10/0x10\n  worker_thread+0x50/0x3a0\n  ? __pfx_worker_thread+0x10/0x10\n  kthread+0xdd/0x100\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork+0x29/0x50\n  </TASK>\n\nSimplified timeout handler by creating local list of timed out WRs\nand invoke send handler post creating the list. The new method acquires/\nreleases lock once to fetch the list and hence helps to reduce locking\ncontetiong when processing higher no. of WRs",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a913488b-9655-4422-905b-7f84115e0ba0",  "id": "CVE-2014-0101",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0101"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d11eafac-864f-4396-a079-f339b5fd1a24",  "id": "CVE-2024-58090",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Prevent rescheduling when interrupts are disabled\n\nDavid reported a warning observed while loop testing kexec jump:\n\n  Interrupts enabled after irqrouter_resume+0x0/0x50\n  WARNING: CPU: 0 PID: 560 at drivers/base/syscore.c:103 syscore_resume+0x18a/0x220\n   kernel_kexec+0xf6/0x180\n   __do_sys_reboot+0x206/0x250\n   do_syscall_64+0x95/0x180\n\nThe corresponding interrupt flag trace:\n\n  hardirqs last  enabled at (15573): [<ffffffffa8281b8e>] __up_console_sem+0x7e/0x90\n  hardirqs last disabled at (15580): [<ffffffffa8281b73>] __up_console_sem+0x63/0x90\n\nThat means __up_console_sem() was invoked with interrupts enabled. Further\ninstrumentation revealed that in the interrupt disabled section of kexec\njump one of the syscore_suspend() callbacks woke up a task, which set the\nNEED_RESCHED flag. A later callback in the resume path invoked\ncond_resched() which in turn led to the invocation of the scheduler:\n\n  __cond_resched+0x21/0x60\n  down_timeout+0x18/0x60\n  acpi_os_wait_semaphore+0x4c/0x80\n  acpi_ut_acquire_mutex+0x3d/0x100\n  acpi_ns_get_node+0x27/0x60\n  acpi_ns_evaluate+0x1cb/0x2d0\n  acpi_rs_set_srs_method_data+0x156/0x190\n  acpi_pci_link_set+0x11c/0x290\n  irqrouter_resume+0x54/0x60\n  syscore_resume+0x6a/0x200\n  kernel_kexec+0x145/0x1c0\n  __do_sys_reboot+0xeb/0x240\n  do_syscall_64+0x95/0x180\n\nThis is a long standing problem, which probably got more visible with\nthe recent printk changes. Something does a task wakeup and the\nscheduler sets the NEED_RESCHED flag. cond_resched() sees it set and\ninvokes schedule() from a completely bogus context. The scheduler\nenables interrupts after context switching, which causes the above\nwarning at the end.\n\nQuite some of the code paths in syscore_suspend()/resume() can result in\ntriggering a wakeup with the exactly same consequences. They might not\nhave done so yet, but as they share a lot of code with normal operations\nit's just a question of time.\n\nThe problem only affects the PREEMPT_NONE and PREEMPT_VOLUNTARY scheduling\nmodels. Full preemption is not affected as cond_resched() is disabled and\nthe preemption check preemptible() takes the interrupt disabled flag into\naccount.\n\nCure the problem by adding a corresponding check into cond_resched().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be2beff0-13d9-4a46-b0b7-c6dc4c6bbe9d",  "id": "MGASA-2014-0429",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a61962e-266b-48d0-878d-dcac86562cf3",  "id": "CVE-2025-21782",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: fix a oob in orangefs_debug_write\n\nI got a syzbot report: slab-out-of-bounds Read in\norangefs_debug_write... several people suggested fixes,\nI tested Al Viro's suggestion and made this patch.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4005c0c1-0e97-4b97-a851-5f20b622c95e",  "id": "RLSA-2023:1405",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e33b0126-506c-4506-855a-74ec3c25945e",  "id": "CVE-2025-21667",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: avoid avoid truncating 64-bit offset to 32 bits\n\non 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a\n32-bit position due to folio_next_index() returning an unsigned long.\nThis could lead to an infinite loop when writing to an xfs filesystem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "df3022c8-587f-4304-8c67-fad8a5b7c8af",  "id": "CVE-2017-16994",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16994"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:44304'"    }  ]},{  "bom-ref": "0a87b3c7-3290-4102-8f6f-8e857e31c2b4",  "id": "CVE-2020-36558",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36558"  },  "ratings": [    {      "score": 5.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6b71aed3-59e7-495a-917a-c99f6c9b3728",  "id": "CVE-2010-3477",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3477"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The tcf_act_police_dump function in net/sched/act_police.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc4 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel memory via vectors involving a dump operation.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2942.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d52cc098-490d-42be-b9ea-47bd202d5447",  "id": "CVE-2013-1773",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1773"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:23248'"    }  ]},{  "bom-ref": "8bebea23-d456-4ae9-b96d-4dee13705f47",  "id": "ROOT-OS-ALPINE-317-CVE-2026-28390",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0e5c7e62-9b9c-408b-95e0-33236a60d733",  "id": "CVE-2024-36921",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: guard against invalid STA ID on removal\n\nGuard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would\nresult in out-of-bounds array accesses. This prevents issues should the\ndriver get into a bad state during error handling.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f20edde7-5d67-4b73-a05f-b3e7f7b9f35b",  "id": "CVE-2024-49970",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Implement bounds check for stream encoder creation in DCN401\n\n'stream_enc_regs' array is an array of dcn10_stream_enc_registers\nstructures. The array is initialized with four elements, corresponding\nto the four calls to stream_enc_regs() in the array initializer. This\nmeans that valid indices for this array are 0, 1, 2, and 3.\n\nThe error message 'stream_enc_regs' 4 <= 5 below, is indicating that\nthere is an attempt to access this array with an index of 5, which is\nout of bounds. This could lead to undefined behavior\n\nHere, eng_id is used as an index to access the stream_enc_regs array. If\neng_id is 5, this would result in an out-of-bounds access on the\nstream_enc_regs array.\n\nThus fixing Buffer overflow error in dcn401_stream_encoder_create\n\nFound by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn401/dcn401_resource.c:1209 dcn401_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1dfe09b3-c6bd-4bd6-a3e9-11cf38320d7b",  "id": "CVE-2021-47508",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47508"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free exchange changeset on failures\n\nFstests runs on my VMs have show several kmemleak reports like the following.\n\n  unreferenced object 0xffff88811ae59080 (size 64):\n    comm \"xfs_io\", pid 12124, jiffies 4294987392 (age 6.368s)\n    hex dump (first 32 bytes):\n      00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00  ................\n      90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff  ................\n    backtrace:\n      [<00000000ac0176d2>] ulist_add_merge+0x60/0x150 [btrfs]\n      [<0000000076e9f312>] set_state_bits+0x86/0xc0 [btrfs]\n      [<0000000014fe73d6>] set_extent_bit+0x270/0x690 [btrfs]\n      [<000000004f675208>] set_record_extent_bits+0x19/0x20 [btrfs]\n      [<00000000b96137b1>] qgroup_reserve_data+0x274/0x310 [btrfs]\n      [<0000000057e9dcbb>] btrfs_check_data_free_space+0x5c/0xa0 [btrfs]\n      [<0000000019c4511d>] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs]\n      [<000000006d37e007>] btrfs_dio_iomap_begin+0x415/0x970 [btrfs]\n      [<00000000fb8a74b8>] iomap_iter+0x161/0x1e0\n      [<0000000071dff6ff>] __iomap_dio_rw+0x1df/0x700\n      [<000000002567ba53>] iomap_dio_rw+0x5/0x20\n      [<0000000072e555f8>] btrfs_file_write_iter+0x290/0x530 [btrfs]\n      [<000000005eb3d845>] new_sync_write+0x106/0x180\n      [<000000003fb505bf>] vfs_write+0x24d/0x2f0\n      [<000000009bb57d37>] __x64_sys_pwrite64+0x69/0xa0\n      [<000000003eba3fdf>] do_syscall_64+0x43/0x90\n\nIn case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata()\nfail the allocated extent_changeset will not be freed.\n\nSo in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space()\nfree the allocated extent_changeset to get rid of the allocated memory.\n\nThe issue currently only happens in the direct IO write path, but only\nafter 65b3c08606e5 (\"btrfs: fix ENOSPC failure when attempting direct IO\nwrite into NOCOW range\"), and also at defrag_one_locked_target(). Every\nother place is always calling extent_changeset_free() even if its call\nto btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has\nfailed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7cb34b8f-9b87-44a5-9cbe-b611bfe71b06",  "id": "CVE-2021-33034",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33034"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2ac5bb4c-3a4f-43ef-8476-8818cb07a4f4",  "id": "CVE-2022-48747",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: Fix wrong offset in bio_truncate()\n\nbio_truncate() clears the buffer outside of last block of bdev, however\ncurrent bio_truncate() is using the wrong offset of page. So it can\nreturn the uninitialized data.\n\nThis happened when both of truncated/corrupted FS and userspace (via\nbdev) are trying to read the last of bdev.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "698014a6-5727-4ddf-a708-0eac789d45ff",  "id": "CVE-2024-26733",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narp: Prevent overflow in arp_req_get().\n\nsyzkaller reported an overflown write in arp_req_get(). [0]\n\nWhen ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour\nentry and copies neigh->ha to struct arpreq.arp_ha.sa_data.\n\nThe arp_ha here is struct sockaddr, not struct sockaddr_storage, so\nthe sa_data buffer is just 14 bytes.\n\nIn the splat below, 2 bytes are overflown to the next int field,\narp_flags.  We initialise the field just after the memcpy(), so it's\nnot a problem.\n\nHowever, when dev->addr_len is greater than 22 (e.g. MAX_ADDR_LEN),\narp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL)\nin arp_ioctl() before calling arp_req_get().\n\nTo avoid the overflow, let's limit the max length of memcpy().\n\nNote that commit b5f0de6df6dc (\"net: dev: Convert sa_data to flexible\narray in struct sockaddr\") just silenced syzkaller.\n\n[0]:\nmemcpy: detected field-spanning write (size 16) of single field \"r->arp_ha.sa_data\" at net/ipv4/arp.c:1128 (size 14)\nWARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nModules linked in:\nCPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014\nRIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128\nCode: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb <0f> 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6\nRSP: 0018:ffffc900050b7998 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001\nRBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000\nR13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010\nFS:  00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n <TASK>\n arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261\n inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981\n sock_do_ioctl+0xdf/0x260 net/socket.c:1204\n sock_ioctl+0x3ef/0x650 net/socket.c:1321\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:870 [inline]\n __se_sys_ioctl fs/ioctl.c:856 [inline]\n __x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x64/0xce\nRIP: 0033:0x7f172b262b8d\nCode: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d\nRDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003\nRBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000\n </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d7ac15e1-bea1-44b4-8170-7d4411b99512",  "id": "CVE-2023-52705",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix underflow in second superblock position calculations\n\nMacro NILFS_SB2_OFFSET_BYTES, which computes the position of the second\nsuperblock, underflows when the argument device size is less than 4096\nbytes.  Therefore, when using this macro, it is necessary to check in\nadvance that the device size is not less than a lower limit, or at least\nthat underflow does not occur.\n\nThe current nilfs2 implementation lacks this check, causing out-of-bound\nblock access when mounting devices smaller than 4096 bytes:\n\n I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0\n phys_seg 1 prio class 2\n NILFS (loop0): unable to read secondary superblock (blocksize = 1024)\n\nIn addition, when trying to resize the filesystem to a size below 4096\nbytes, this underflow occurs in nilfs_resize_fs(), passing a huge number\nof segments to nilfs_sufile_resize(), corrupting parameters such as the\nnumber of segments in superblocks.  This causes excessive loop iterations\nin nilfs_sufile_resize() during a subsequent resize ioctl, causing\nsemaphore ns_segctor_sem to block for a long time and hang the writer\nthread:\n\n INFO: task segctord:5067 blocked for more than 143 seconds.\n      Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0\n \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:segctord        state:D stack:23456 pid:5067  ppid:2\n flags:0x00004000\n Call Trace:\n  <TASK>\n  context_switch kernel/sched/core.c:5293 [inline]\n  __schedule+0x1409/0x43f0 kernel/sched/core.c:6606\n  schedule+0xc3/0x190 kernel/sched/core.c:6682\n  rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190\n  nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357\n  nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline]\n  nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570\n  kthread+0x270/0x300 kernel/kthread.c:376\n  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308\n  </TASK>\n ...\n Call Trace:\n  <TASK>\n  folio_mark_accessed+0x51c/0xf00 mm/swap.c:515\n  __nilfs_get_page_block fs/nilfs2/page.c:42 [inline]\n  nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61\n  nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121\n  nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176\n  nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251\n  nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline]\n  nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline]\n  nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777\n  nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422\n  nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline]\n  nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301\n  ...\n\nThis fixes these issues by inserting appropriate minimum device size\nchecks or anti-underflow checks, depending on where the macro is used.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "76580702-0c6a-4ca2-bca5-f889b0961bff",  "id": "ROOT-OS-ALPINE-317-CVE-2026-45445",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "832dafac-9516-48a3-b0f0-55eb6a36c71b",  "id": "CVE-2022-48849",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: bypass tiling flag check in virtual display case (v2)\n\nvkms leverages common amdgpu framebuffer creation, and\nalso as it does not support FB modifier, there is no need\nto check tiling flags when initing framebuffer when virtual\ndisplay is enabled.\n\nThis can fix below calltrace:\n\namdgpu 0000:00:08.0: GFX9+ requires FB check based on format modifier\nWARNING: CPU: 0 PID: 1023 at drivers/gpu/drm/amd/amdgpu/amdgpu_display.c:1150 amdgpu_display_framebuffer_init+0x8e7/0xb40 [amdgpu]\n\nv2: check adev->enable_virtual_display instead as vkms can be\n\tenabled in bare metal as well.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cdb0a2e7-cafd-4c9b-8006-0c5df3328a41",  "id": "CVE-2019-9494",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9494"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    203,    208,    524  ],  "analysis": {    "state": "in_triage"  },  "description": "The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f79f9db1-c4b6-4e37-8d1c-4a87d6044ab5",  "id": "CVE-2024-46675",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: core: Prevent USB core invalid event buffer address access\n\nThis commit addresses an issue where the USB core could access an\ninvalid event buffer address during runtime suspend, potentially causing\nSMMU faults and other memory issues in Exynos platforms. The problem\narises from the following sequence.\n        1. In dwc3_gadget_suspend, there is a chance of a timeout when\n        moving the USB core to the halt state after clearing the\n        run/stop bit by software.\n        2. In dwc3_core_exit, the event buffer is cleared regardless of\n        the USB core's status, which may lead to an SMMU faults and\n        other memory issues. if the USB core tries to access the event\n        buffer address.\n\nTo prevent this hardware quirk on Exynos platforms, this commit ensures\nthat the event buffer address is not cleared by software  when the USB\ncore is active during runtime suspend by checking its status before\nclearing the buffer address.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51024f32-cdc1-4f16-b2dd-427ab3105805",  "id": "CVE-2010-4263",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4263"  },  "ratings": [    {      "score": 7.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The igb_receive_skb function in drivers/net/igb/igb_main.c in the Intel Gigabit Ethernet (aka igb) subsystem in the Linux kernel before 2.6.34, when Single Root I/O Virtualization (SR-IOV) and promiscuous mode are enabled but no VLANs are registered, allows remote attackers to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact via a VLAN tagged frame.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a7f15738-f781-4acc-ae86-b660d53c0ad5",  "id": "CVE-2013-2890",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2890"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/hid/hid-sony.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_SONY is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2eb7a328-a108-4f70-9e64-7d86ccef4b77",  "id": "CVE-2020-12769",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12769"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    662  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one, aka CID-19b61392c5a8.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8303be52-490e-4ddb-827a-424f91f11e41",  "id": "CVE-2024-46803",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check debug trap enable before write dbg_ev_file\n\nIn interrupt context, write dbg_ev_file will be run by work queue. It\nwill cause write dbg_ev_file execution after debug_trap_disable, which\nwill cause NULL pointer access.\nv2: cancel work \"debug_event_workarea\" before set dbg_ev_file as NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0e017d0a-3157-4b60-87ad-af0433f7d9f2",  "id": "CVE-2013-7265",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7265"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d04b4ef6-e4d3-42d3-af85-5d79f629b0c4",  "id": "CVE-2018-10878",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10878"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d8b292e0-7314-4ada-934c-104667fb362d",  "id": "CVE-2026-12725",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12725"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    122  ],  "analysis": {    "state": "in_triage"  },  "description": "A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and\nquery logging are both enabled, logging of DS or DNSKEY replies containing\nunsupported algorithm or digest types can cause dnsmasq to write past the end\nof an internal logging buffer. A remote attacker able to supply such a DNS\nresponse may crash the dnsmasq process, resulting in denial of service.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "deac956e-60e7-479b-8dc7-faef2b1dab19",  "id": "CVE-2026-53195",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()\n\nbuild_i2c_fw_hdr() allocates a fixed-size buffer of\n(16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then\ncopies le16_to_cpu(img_header->Length) bytes into it without\nvalidating that Length fits within the available space after the\nfirmware record header.\n\nimg_header->Length is a __le16 from the firmware file and can be\nup to 65535. check_fw_sanity() validates the total firmware size\nbut not img_header->Length specifically.\n\nFix by rejecting images where img_header->Length exceeds the\navailable destination space.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "74fcf59b-18a8-45a6-9160-e1d51af9b601",  "id": "CVE-2026-53268",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.199999999999999,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack_irc: fix possible out-of-bounds read\n\nWhen parsing fails after we've matched the command string we\nshould bail out instead of trying to match a different command.\n\nThis helper should be deprecated, given prevalence of TLS I doubt it has\nany relevance in 2026.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "71f00558-916f-4235-aa7d-49eb531f28d1",  "id": "CVE-2021-47645",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47645"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com\n\nOn the case tmp_dcim=1, the index of buffer is miscalculated.\nThis generate a NULL pointer dereference later.\n\nSo let's fix the calcul and add a check to prevent this to reappear.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c928118d-de69-4a7e-afca-61ac6d1b7487",  "id": "CVE-2021-29647",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29647"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain sensitive information from kernel memory because of a partially uninitialized data structure, aka CID-50535249f624.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0d2eb082-6619-41bc-9fdd-384e84bda401",  "id": "CVE-2023-53425",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: platform: mediatek: vpu: fix NULL ptr dereference\n\nIf pdev is NULL, then it is still dereferenced.\n\nThis fixes this smatch warning:\n\ndrivers/media/platform/mediatek/vpu/mtk_vpu.c:570 vpu_load_firmware() warn: address of NULL pointer 'pdev'",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "09cf6fca-530d-4879-b86a-2c28c4a549db",  "id": "RHSA-2026:1496",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7cec4f3d-a867-4d6a-b8d8-ddfe1130062f",  "id": "CVE-2026-52946",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling\n\nA SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in\nsend_sigio() and send_sigurg() when a process group receives a signal.\n\nWhen FASYNC is configured for a process group (PIDTYPE_PGID), both\nfunctions use read_lock(&tasklist_lock) to traverse the task list.\nHowever, they are frequently called from softirq context:\n- send_sigio() via input_inject_event -> kill_fasync\n- send_sigurg() via tcp_check_urg -> sk_send_sigurg (NET_RX_SOFTIRQ)\n\nThe deadlock is caused by the rwlock writer fairness mechanism:\n1. CPU 0 (process context) holds read_lock(&tasklist_lock) in do_wait().\n2. CPU 1 (process context) attempts write_lock(&tasklist_lock) in\n   fork() or exit() and spins, which blocks all new readers.\n3. CPU 0 is interrupted by a softirq (e.g., TCP URG packet reception).\n4. The softirq calls send_sigurg() and attempts to acquire\n   read_lock(&tasklist_lock), deadlocking because CPU 1 is waiting.\n\nSince PID hashing and do_each_pid_task() traversals are already\nRCU-protected, the read_lock on tasklist_lock is no longer strictly\nrequired for safe traversal. Fix this by replacing tasklist_lock with\nrcu_read_lock(), aligning the process group signaling path with the\nsingle-PID path. This also mitigates a potential remote denial of\nservice vector via TCP URG packets.\n\nLockdep splat:\n=====================================================\nWARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected\n[...]\nChain exists of:\n  &dev->event_lock --> &f_owner->lock --> tasklist_lock\n\nPossible interrupt unsafe locking scenario:\n       CPU0                    CPU1\n       ----                    ----\n  lock(tasklist_lock);\n                           local_irq_disable();\n                           lock(&dev->event_lock);\n                           lock(&f_owner->lock);\n  <Interrupt>\n    lock(&dev->event_lock);\n\n*** DEADLOCK ***",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd78fde3-df3d-48fb-95b5-a908d685e64f",  "id": "CVE-2022-50017",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start\n\nWe should call of_node_put() for the reference 'uctl_node' returned by\nof_get_parent() which will increase the refcount. Otherwise, there will\nbe a refcount leak bug.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c1172298-bf20-48fc-90b0-ba9c99b5302c",  "id": "CVE-2025-38386",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Refuse to evaluate a method if arguments are missing\n\nAs reported in [1], a platform firmware update that increased the number\nof method parameters and forgot to update a least one of its callers,\ncaused ACPICA to crash due to use-after-free.\n\nSince this a result of a clear AML issue that arguably cannot be fixed\nup by the interpreter (it cannot produce missing data out of thin air),\naddress it by making ACPICA refuse to evaluate a method if the caller\nattempts to pass fewer arguments than expected to it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b43f047a-7487-4c45-9aef-996134ec0482",  "id": "CVE-2012-2119",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2119"  },  "ratings": [    {      "score": 5.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:S/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, allows privileged KVM guest users to cause a denial of service (crash) via a long descriptor with a long vector length.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "602a8e4c-7d9b-4e44-9c6f-9391928e28a0",  "id": "CVE-2017-2584",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2584"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    200,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a09d2f80-45f8-4046-8be5-bbb9d03b3d35",  "id": "CVE-2019-19770",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19770"  },  "ratings": [    {      "score": 8.199999999999999,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created with a call to another debugfs function such as debugfs_create_file). NOTE: Linux kernel developers dispute this issue as not being an issue with debugfs, instead this is an issue with misuse of debugfs within blktrace",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "952cd69d-c39e-4a1e-9b6b-7e2c4a129162",  "id": "CVE-2025-39781",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Drop WARN_ON_ONCE() from flush_cache_vmap\n\nI have observed warning to occassionally trigger.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f43135e6-abbe-4f9f-8d8a-09262f488a81",  "id": "CVE-2024-26875",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix uaf in pvr2_context_set_notify\n\n[Syzbot reported]\nBUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35\nRead of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26\n\nCPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nWorkqueue: usb_hub_wq hub_event\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc4/0x620 mm/kasan/report.c:488\n kasan_report+0xda/0x110 mm/kasan/report.c:601\n pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35\n pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline]\n pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272\n\nFreed by task 906:\nkasan_save_stack+0x33/0x50 mm/kasan/common.c:47\nkasan_save_track+0x14/0x30 mm/kasan/common.c:68\nkasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640\npoison_slab_object mm/kasan/common.c:241 [inline]\n__kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257\nkasan_slab_free include/linux/kasan.h:184 [inline]\nslab_free_hook mm/slub.c:2121 [inline]\nslab_free mm/slub.c:4299 [inline]\nkfree+0x105/0x340 mm/slub.c:4409\npvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline]\npvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158\n\n[Analyze]\nTask A set disconnect_flag = !0, which resulted in Task B's condition being met\nand releasing mp, leading to this issue.\n\n[Fix]\nPlace the disconnect_flag assignment operation after all code in pvr2_context_disconnect()\nto avoid this issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f17987d-0f9b-4143-896a-4ad96f7a4f31",  "id": "CVE-2017-5970",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5970"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows attackers to cause a denial of service (system crash) via (1) an application that makes crafted system calls or possibly (2) IPv4 traffic with invalid IP options.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7603138a-b7ab-4cd2-b790-4f0c6774d166",  "id": "CVE-2023-53213",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()\n\nFix a slab-out-of-bounds read that occurs in kmemdup() called from\nbrcmf_get_assoc_ies().\nThe bug could occur when assoc_info->req_len, data from a URB provided\nby a USB device, is bigger than the size of buffer which is defined as\nWL_EXTRA_BUF_MAX.\n\nAdd the size check for req_len/resp_len of assoc_info.\n\nFound by a modified version of syzkaller.\n\n[   46.592467][    T7] ==================================================================\n[   46.594687][    T7] BUG: KASAN: slab-out-of-bounds in kmemdup+0x3e/0x50\n[   46.596572][    T7] Read of size 3014656 at addr ffff888019442000 by task kworker/0:1/7\n[   46.598575][    T7]\n[   46.599157][    T7] CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G           O      5.14.0+ #145\n[   46.601333][    T7] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014\n[   46.604360][    T7] Workqueue: events brcmf_fweh_event_worker\n[   46.605943][    T7] Call Trace:\n[   46.606584][    T7]  dump_stack_lvl+0x8e/0xd1\n[   46.607446][    T7]  print_address_description.constprop.0.cold+0x93/0x334\n[   46.608610][    T7]  ? kmemdup+0x3e/0x50\n[   46.609341][    T7]  kasan_report.cold+0x79/0xd5\n[   46.610151][    T7]  ? kmemdup+0x3e/0x50\n[   46.610796][    T7]  kasan_check_range+0x14e/0x1b0\n[   46.611691][    T7]  memcpy+0x20/0x60\n[   46.612323][    T7]  kmemdup+0x3e/0x50\n[   46.612987][    T7]  brcmf_get_assoc_ies+0x967/0xf60\n[   46.613904][    T7]  ? brcmf_notify_vif_event+0x3d0/0x3d0\n[   46.614831][    T7]  ? lock_chain_count+0x20/0x20\n[   46.615683][    T7]  ? mark_lock.part.0+0xfc/0x2770\n[   46.616552][    T7]  ? lock_chain_count+0x20/0x20\n[   46.617409][    T7]  ? mark_lock.part.0+0xfc/0x2770\n[   46.618244][    T7]  ? lock_chain_count+0x20/0x20\n[   46.619024][    T7]  brcmf_bss_connect_done.constprop.0+0x241/0x2e0\n[   46.620019][    T7]  ? brcmf_parse_configure_security.isra.0+0x2a0/0x2a0\n[   46.620818][    T7]  ? __lock_acquire+0x181f/0x5790\n[   46.621462][    T7]  brcmf_notify_connect_status+0x448/0x1950\n[   46.622134][    T7]  ? rcu_read_lock_bh_held+0xb0/0xb0\n[   46.622736][    T7]  ? brcmf_cfg80211_join_ibss+0x7b0/0x7b0\n[   46.623390][    T7]  ? find_held_lock+0x2d/0x110\n[   46.623962][    T7]  ? brcmf_fweh_event_worker+0x19f/0xc60\n[   46.624603][    T7]  ? mark_held_locks+0x9f/0xe0\n[   46.625145][    T7]  ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0\n[   46.625871][    T7]  ? brcmf_cfg80211_join_ibss+0x7b0/0x7b0\n[   46.626545][    T7]  brcmf_fweh_call_event_handler.isra.0+0x90/0x100\n[   46.627338][    T7]  brcmf_fweh_event_worker+0x557/0xc60\n[   46.627962][    T7]  ? brcmf_fweh_call_event_handler.isra.0+0x100/0x100\n[   46.628736][    T7]  ? rcu_read_lock_sched_held+0xa1/0xd0\n[   46.629396][    T7]  ? rcu_read_lock_bh_held+0xb0/0xb0\n[   46.629970][    T7]  ? lockdep_hardirqs_on_prepare+0x273/0x3e0\n[   46.630649][    T7]  process_one_work+0x92b/0x1460\n[   46.631205][    T7]  ? pwq_dec_nr_in_flight+0x330/0x330\n[   46.631821][    T7]  ? rwlock_bug.part.0+0x90/0x90\n[   46.632347][    T7]  worker_thread+0x95/0xe00\n[   46.632832][    T7]  ? __kthread_parkme+0x115/0x1e0\n[   46.633393][    T7]  ? process_one_work+0x1460/0x1460\n[   46.633957][    T7]  kthread+0x3a1/0x480\n[   46.634369][    T7]  ? set_kthread_struct+0x120/0x120\n[   46.634933][    T7]  ret_from_fork+0x1f/0x30\n[   46.635431][    T7]\n[   46.635687][    T7] Allocated by task 7:\n[   46.636151][    T7]  kasan_save_stack+0x1b/0x40\n[   46.636628][    T7]  __kasan_kmalloc+0x7c/0x90\n[   46.637108][    T7]  kmem_cache_alloc_trace+0x19e/0x330\n[   46.637696][    T7]  brcmf_cfg80211_attach+0x4a0/0x4040\n[   46.638275][    T7]  brcmf_attach+0x389/0xd40\n[   46.638739][    T7]  brcmf_usb_probe+0x12de/0x1690\n[   46.639279][    T7]  usb_probe_interface+0x2aa/0x760\n[   46.639820][    T7]  really_probe+0x205/0xb70\n[   46.640342][    T7]  __driver_probe_device+0\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "47047b3f-35ef-4416-b19d-67ab6b50f51b",  "id": "CVE-2023-52634",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix disable_otg_wa logic\n\n[Why]\nWhen switching to another HDMI mode, we are unnecesarilly\ndisabling/enabling FIFO causing both HPO and DIG registers to be set at\nthe same time when only HPO is supposed to be set.\n\nThis can lead to a system hang the next time we change refresh rates as\nthere are cases when we don't disable OTG/FIFO but FIFO is enabled when\nit isn't supposed to be.\n\n[How]\nRemoving the enable/disable FIFO entirely.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d26c2e83-120d-4f32-8a24-3f680d01ea23",  "id": "CVE-2017-16529",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16529"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c6bc5bbe-9e53-42d8-87a3-cf514dc3d818",  "id": "CVE-2011-5325",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-5325"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    22  ],  "analysis": {    "state": "in_triage"  },  "description": "Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4fbd2577-6e83-4460-8640-2284daa55131",  "id": "CVE-2018-9568",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9568"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    704  ],  "analysis": {    "state": "in_triage"  },  "description": "In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-113509306. References: Upstream kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2ab19e28-855d-41dc-b59e-e55192cd87f2",  "id": "CVE-2026-31495",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: use netlink policy range checks\n\nReplace manual range and mask validations with netlink policy\nannotations in ctnetlink code paths, so that the netlink core rejects\ninvalid values early and can generate extack errors.\n\n- CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at\n  policy level, removing the manual >= TCP_CONNTRACK_MAX check.\n- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE\n  (14). The normal TCP option parsing path already clamps to this value,\n  but the ctnetlink path accepted 0-255, causing undefined behavior when\n  used as a u32 shift count.\n- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with\n  CTA_FILTER_F_ALL, removing the manual mask checks.\n- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding\n  a new mask define grouping all valid expect flags.\n\nExtracted from a broader nf-next patch by Florian Westphal, scoped to\nctnetlink for the fixes tree.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "878937f8-9fcd-4653-89ba-db9bf809b7fc",  "id": "RLSA-2023:0946",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18c95b4b-1d99-4478-af4f-f4f14acd1b9a",  "id": "CVE-2022-48845",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: smp: fill in sibling and core maps earlier\n\nAfter enabling CONFIG_SCHED_CORE (landed during 5.14 cycle),\n2-core 2-thread-per-core interAptiv (CPS-driven) started emitting\nthe following:\n\n[    0.025698] CPU1 revision is: 0001a120 (MIPS interAptiv (multi))\n[    0.048183] ------------[ cut here ]------------\n[    0.048187] WARNING: CPU: 1 PID: 0 at kernel/sched/core.c:6025 sched_core_cpu_starting+0x198/0x240\n[    0.048220] Modules linked in:\n[    0.048233] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.17.0-rc3+ #35 b7b319f24073fd9a3c2aa7ad15fb7993eec0b26f\n[    0.048247] Stack : 817f0000 00000004 327804c8 810eb050 00000000 00000004 00000000 c314fdd1\n[    0.048278]         830cbd64 819c0000 81800000 817f0000 83070bf4 00000001 830cbd08 00000000\n[    0.048307]         00000000 00000000 815fcbc4 00000000 00000000 00000000 00000000 00000000\n[    0.048334]         00000000 00000000 00000000 00000000 817f0000 00000000 00000000 817f6f34\n[    0.048361]         817f0000 818a3c00 817f0000 00000004 00000000 00000000 4dc33260 0018c933\n[    0.048389]         ...\n[    0.048396] Call Trace:\n[    0.048399] [<8105a7bc>] show_stack+0x3c/0x140\n[    0.048424] [<8131c2a0>] dump_stack_lvl+0x60/0x80\n[    0.048440] [<8108b5c0>] __warn+0xc0/0xf4\n[    0.048454] [<8108b658>] warn_slowpath_fmt+0x64/0x10c\n[    0.048467] [<810bd418>] sched_core_cpu_starting+0x198/0x240\n[    0.048483] [<810c6514>] sched_cpu_starting+0x14/0x80\n[    0.048497] [<8108c0f8>] cpuhp_invoke_callback_range+0x78/0x140\n[    0.048510] [<8108d914>] notify_cpu_starting+0x94/0x140\n[    0.048523] [<8106593c>] start_secondary+0xbc/0x280\n[    0.048539]\n[    0.048543] ---[ end trace 0000000000000000 ]---\n[    0.048636] Synchronize counters for CPU 1: done.\n\n...for each but CPU 0/boot.\nBasic debug printks right before the mentioned line say:\n\n[    0.048170] CPU: 1, smt_mask:\n\nSo smt_mask, which is sibling mask obviously, is empty when entering\nthe function.\nThis is critical, as sched_core_cpu_starting() calculates\ncore-scheduling parameters only once per CPU start, and it's crucial\nto have all the parameters filled in at that moment (at least it\nuses cpu_smt_mask() which in fact is `&cpu_sibling_map[cpu]` on\nMIPS).\n\nA bit of debugging led me to that set_cpu_sibling_map() performing\nthe actual map calculation, was being invocated after\nnotify_cpu_start(), and exactly the latter function starts CPU HP\ncallback round (sched_core_cpu_starting() is basically a CPU HP\ncallback).\nWhile the flow is same on ARM64 (maps after the notifier, although\nbefore calling set_cpu_online()), x86 started calculating sibling\nmaps earlier than starting the CPU HP callbacks in Linux 4.14 (see\n[0] for the reference). Neither me nor my brief tests couldn't find\nany potential caveats in calculating the maps right after performing\ndelay calibration, but the WARN splat is now gone.\nThe very same debug prints now yield exactly what I expected from\nthem:\n\n[    0.048433] CPU: 1, smt_mask: 0-1\n\n[0] https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?id=76ce7cfe35ef",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3266e543-2bdf-4f52-b8b1-484a9fd4fd59",  "id": "CVE-2013-3224",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3224"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4fcf803f-9ae9-4dc4-9798-b54fe90046ff",  "id": "CVE-2014-3182",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3182"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ea71935e-e4c7-4ee7-94cc-5b2c337ed819",  "id": "openSUSE-SU-2024:10558-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3a8669d1-32cc-4c66-b446-3d7c58208768",      "versions": [        {          "component": "radvd",          "version": "1.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c4d5e954-02b4-4da3-b526-d7711540351b",  "id": "CVE-2017-12193",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12193"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8763f6dc-b628-479d-891a-ea57a1021d7c",  "id": "CVE-2014-3917",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3917"  },  "ratings": [    {      "score": 3.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:P"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ee4ba5a-e6f3-42aa-a3ea-70f5f462f4f1",  "id": "CVE-2025-21750",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Check the return value of of_property_read_string_index()\n\nSomewhen between 6.10 and 6.11 the driver started to crash on my\nMacBookPro14,3. The property doesn't exist and 'tmp' remains\nuninitialized, so we pass a random pointer to devm_kstrdup().\n\nThe crash I am getting looks like this:\n\nBUG: unable to handle page fault for address: 00007f033c669379\nPF: supervisor read access in kernel mode\nPF: error_code(0x0001) - permissions violation\nPGD 8000000101341067 P4D 8000000101341067 PUD 101340067 PMD 1013bb067 PTE 800000010aee9025\nOops: Oops: 0001 [#1] SMP PTI\nCPU: 4 UID: 0 PID: 827 Comm: (udev-worker) Not tainted 6.11.8-gentoo #1\nHardware name: Apple Inc. MacBookPro14,3/Mac-551B86E5744E2388, BIOS 529.140.2.0.0 06/23/2024\nRIP: 0010:strlen+0x4/0x30\nCode: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 cc\nRSP: 0018:ffffb4aac0683ad8 EFLAGS: 00010202\nRAX: 00000000ffffffea RBX: 00007f033c669379 RCX: 0000000000000001\nRDX: 0000000000000cc0 RSI: 00007f033c669379 RDI: 00007f033c669379\nRBP: 00000000ffffffea R08: 0000000000000000 R09: 00000000c0ba916a\nR10: ffffffffffffffff R11: ffffffffb61ea260 R12: ffff91f7815b50c8\nR13: 0000000000000cc0 R14: ffff91fafefffe30 R15: ffffb4aac0683b30\nFS:  00007f033ccbe8c0(0000) GS:ffff91faeed00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f033c669379 CR3: 0000000107b1e004 CR4: 00000000003706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n ? __die+0x23/0x70\n ? page_fault_oops+0x149/0x4c0\n ? raw_spin_rq_lock_nested+0xe/0x20\n ? sched_balance_newidle+0x22b/0x3c0\n ? update_load_avg+0x78/0x770\n ? exc_page_fault+0x6f/0x150\n ? asm_exc_page_fault+0x26/0x30\n ? __pfx_pci_conf1_write+0x10/0x10\n ? strlen+0x4/0x30\n devm_kstrdup+0x25/0x70\n brcmf_of_probe+0x273/0x350 [brcmfmac]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c0edeb5-ad99-471c-bf34-1b057a3f1f4a",  "id": "CVE-2024-50108",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Disable PSR-SU on Parade 08-01 TCON too\n\nStuart Hayhurst has found that both at bootup and fullscreen VA-API video\nis leading to black screens for around 1 second and kernel WARNING [1] traces\nwhen calling dmub_psr_enable() with Parade 08-01 TCON.\n\nThese symptoms all go away with PSR-SU disabled for this TCON, so disable\nit for now while DMUB traces [2] from the failure can be analyzed and the failure\nstate properly root caused.\n\n(cherry picked from commit afb634a6823d8d9db23c5fb04f79c5549349628b)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a3ec0dc-9163-4652-a5bc-3dbd8f11f7f9",  "id": "CVE-2022-50204",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: OMAP2+: pdata-quirks: Fix refcount leak bug\n\nIn pdata_quirks_init_clocks(), the loop contains\nof_find_node_by_name() but without corresponding of_node_put().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c22468b7-bdc3-4658-811f-a9196e51477b",  "id": "CVE-2026-43340",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Reinit dev->spinlock between attachments to low-level drivers\n\n`struct comedi_device` is the main controlling structure for a COMEDI\ndevice created by the COMEDI subsystem.  It contains a member `spinlock`\ncontaining a spin-lock that is initialized by the COMEDI subsystem, but\nis reserved for use by a low-level driver attached to the COMEDI device\n(at least since commit 25436dc9d84f (\"Staging: comedi: remove RT\ncode\")).\n\nSome COMEDI devices (those created on initialization of the COMEDI\nsubsystem when the \"comedi.comedi_num_legacy_minors\" parameter is\nnon-zero) can be attached to different low-level drivers over their\nlifetime using the `COMEDI_DEVCONFIG` ioctl command.  This can result in\ninconsistent lock states being reported when there is a mismatch in the\nspin-lock locking levels used by each low-level driver to which the\nCOMEDI device has been attached.  Fix it by reinitializing\n`dev->spinlock` before calling the low-level driver's `attach` function\npointer if `CONFIG_LOCKDEP` is enabled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f98b1fa3-4a49-431b-8bba-a1eb9fb77dfe",  "id": "RHSA-2019:2304",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "601adfd9-6c49-4047-9fef-68258f11843d",  "id": "CVE-2024-40918",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Try to fix random segmentation faults in package builds\n\nPA-RISC systems with PA8800 and PA8900 processors have had problems\nwith random segmentation faults for many years.  Systems with earlier\nprocessors are much more stable.\n\nSystems with PA8800 and PA8900 processors have a large L2 cache which\nneeds per page flushing for decent performance when a large range is\nflushed. The combined cache in these systems is also more sensitive to\nnon-equivalent aliases than the caches in earlier systems.\n\nThe majority of random segmentation faults that I have looked at\nappear to be memory corruption in memory allocated using mmap and\nmalloc.\n\nMy first attempt at fixing the random faults didn't work. On\nreviewing the cache code, I realized that there were two issues\nwhich the existing code didn't handle correctly. Both relate\nto cache move-in. Another issue is that the present bit in PTEs\nis racy.\n\n1) PA-RISC caches have a mind of their own and they can speculatively\nload data and instructions for a page as long as there is a entry in\nthe TLB for the page which allows move-in. TLBs are local to each\nCPU. Thus, the TLB entry for a page must be purged before flushing\nthe page. This is particularly important on SMP systems.\n\nIn some of the flush routines, the flush routine would be called\nand then the TLB entry would be purged. This was because the flush\nroutine needed the TLB entry to do the flush.\n\n2) My initial approach to trying the fix the random faults was to\ntry and use flush_cache_page_if_present for all flush operations.\nThis actually made things worse and led to a couple of hardware\nlockups. It finally dawned on me that some lines weren't being\nflushed because the pte check code was racy. This resulted in\nrandom inequivalent mappings to physical pages.\n\nThe __flush_cache_page tmpalias flush sets up its own TLB entry\nand it doesn't need the existing TLB entry. As long as we can find\nthe pte pointer for the vm page, we can get the pfn and physical\naddress of the page. We can also purge the TLB entry for the page\nbefore doing the flush. Further, __flush_cache_page uses a special\nTLB entry that inhibits cache move-in.\n\nWhen switching page mappings, we need to ensure that lines are\nremoved from the cache.  It is not sufficient to just flush the\nlines to memory as they may come back.\n\nThis made it clear that we needed to implement all the required\nflush operations using tmpalias routines. This includes flushes\nfor user and kernel pages.\n\nAfter modifying the code to use tmpalias flushes, it became clear\nthat the random segmentation faults were not fully resolved. The\nfrequency of faults was worse on systems with a 64 MB L2 (PA8900)\nand systems with more CPUs (rp4440).\n\nThe warning that I added to flush_cache_page_if_present to detect\npages that couldn't be flushed triggered frequently on some systems.\n\nHelge and I looked at the pages that couldn't be flushed and found\nthat the PTE was either cleared or for a swap page. Ignoring pages\nthat were swapped out seemed okay but pages with cleared PTEs seemed\nproblematic.\n\nI looked at routines related to pte_clear and noticed ptep_clear_flush.\nThe default implementation just flushes the TLB entry. However, it was\nobvious that on parisc we need to flush the cache page as well. If\nwe don't flush the cache page, stale lines will be left in the cache\nand cause random corruption. Once a PTE is cleared, there is no way\nto find the physical address associated with the PTE and flush the\nassociated page at a later time.\n\nI implemented an updated change with a parisc specific version of\nptep_clear_flush. It fixed the random data corruption on Helge's rp4440\nand rp3440, as well as on my c8000.\n\nAt this point, I realized that I could restore the code where we only\nflush in flush_cache_page_if_present if the page has been accessed.\nHowever, for this, we also need to flush the cache when the accessed\nbit is cleared in\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ac60ff3c-6fb0-46b1-906e-d1b95c7912eb",  "id": "CVE-2022-49128",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: Add missing pm_runtime_put_sync\n\npm_runtime_get_sync() will increase the rumtime PM counter\neven when it returns an error. Thus a pairing decrement is needed\nto prevent refcount leak. Fix this by replacing this API with\npm_runtime_resume_and_get(), which will not change the runtime\nPM counter on error. Besides, a matching decrement is needed\non the error handling path to keep the counter balanced.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c718b684-39cb-43f2-a405-6836e0ded1b0",  "id": "CVE-2023-51042",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51042"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has a fence use-after-free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "677fad68-a60c-4e7a-95cf-fce7740047b7",  "id": "CVE-2011-4917",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4917"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 3.1 there is an information disclosure issue via /proc/stat.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "19ef3d66-15f1-468d-a136-a71bd39d9a50",  "id": "CVE-2024-53183",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: net: Do not use drvdata in release\n\nThe drvdata is not available in release. Let's just use container_of()\nto get the uml_net instance. Otherwise, removing a network device will\nresult in a crash:\n\nRIP: 0033:net_device_release+0x10/0x6f\nRSP: 00000000e20c7c40  EFLAGS: 00010206\nRAX: 000000006002e4e7 RBX: 00000000600f1baf RCX: 00000000624074e0\nRDX: 0000000062778000 RSI: 0000000060551c80 RDI: 00000000627af028\nRBP: 00000000e20c7c50 R08: 00000000603ad594 R09: 00000000e20c7b70\nR10: 000000000000135a R11: 00000000603ad422 R12: 0000000000000000\nR13: 0000000062c7af00 R14: 0000000062406d60 R15: 00000000627700b6\nKernel panic - not syncing: Segfault with no mm\nCPU: 0 UID: 0 PID: 29 Comm: kworker/0:2 Not tainted 6.12.0-rc6-g59b723cd2adb #1\nWorkqueue: events mc_work_proc\nStack:\n 627af028 62c7af00 e20c7c80 60276fcd\n 62778000 603f5820 627af028 00000000\n e20c7cb0 603a2bcd 627af000 62770010\nCall Trace:\n [<60276fcd>] device_release+0x70/0xba\n [<603a2bcd>] kobject_put+0xba/0xe7\n [<60277265>] put_device+0x19/0x1c\n [<60281266>] platform_device_put+0x26/0x29\n [<60281e5f>] platform_device_unregister+0x2c/0x2e\n [<6002ec9c>] net_remove+0x63/0x69\n [<60031316>] ? mconsole_reply+0x0/0x50\n [<600310c8>] mconsole_remove+0x160/0x1cc\n [<60087d40>] ? __remove_hrtimer+0x38/0x74\n [<60087ff8>] ? hrtimer_try_to_cancel+0x8c/0x98\n [<6006b3cf>] ? dl_server_stop+0x3f/0x48\n [<6006b390>] ? dl_server_stop+0x0/0x48\n [<600672e8>] ? dequeue_entities+0x327/0x390\n [<60038fa6>] ? um_set_signals+0x0/0x43\n [<6003070c>] mc_work_proc+0x77/0x91\n [<60057664>] process_scheduled_works+0x1b3/0x2dd\n [<60055f32>] ? assign_work+0x0/0x58\n [<60057f0a>] worker_thread+0x1e9/0x293\n [<6005406f>] ? set_pf_worker+0x0/0x64\n [<6005d65d>] ? arch_local_irq_save+0x0/0x2d\n [<6005d748>] ? kthread_exit+0x0/0x3a\n [<60057d21>] ? worker_thread+0x0/0x293\n [<6005dbf1>] kthread+0x126/0x12b\n [<600219c5>] new_thread_handler+0x85/0xb6",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "387035cc-1ab6-4d8c-b9f2-92cf84621b1d",  "id": "CVE-2024-42223",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-frontends: tda10048: Fix integer overflow\n\nstate->xtal_hz can be up to 16M, so it can overflow a 32 bit integer\nwhen multiplied by pll_mfactor.\n\nCreate a new 64 bit variable to hold the calculations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cebcb2c7-7709-46f2-a8fe-06ff43d523a1",  "id": "CVE-2010-4082",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4082"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "The viafb_ioctl_get_viafb_info function in drivers/video/via/ioctl.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a VIAFB_GET_INFO ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3ba34bdf-1fab-4d42-b46b-ce61da6f2d2b",  "id": "CVE-2024-26910",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: fix performance regression in swap operation\n\nThe patch \"netfilter: ipset: fix race condition between swap/destroy\nand kernel side add/del/test\", commit 28628fa9 fixes a race condition.\nBut the synchronize_rcu() added to the swap function unnecessarily slows\nit down: it can safely be moved to destroy and use call_rcu() instead.\n\nEric Dumazet pointed out that simply calling the destroy functions as\nrcu callback does not work: sets with timeout use garbage collectors\nwhich need cancelling at destroy which can wait. Therefore the destroy\nfunctions are split into two: cancelling garbage collectors safely at\nexecuting the command received by netlink and moving the remaining\npart only into the rcu callback.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "337e31c3-33c0-4072-a515-cafc69928d99",  "id": "CVE-2022-49568",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Don't null dereference ops->destroy\n\nA KVM device cleanup happens in either of two callbacks:\n1) destroy() which is called when the VM is being destroyed;\n2) release() which is called when a device fd is closed.\n\nMost KVM devices use 1) but Book3s's interrupt controller KVM devices\n(XICS, XIVE, XIVE-native) use 2) as they need to close and reopen during\nthe machine execution. The error handling in kvm_ioctl_create_device()\nassumes destroy() is always defined which leads to NULL dereference as\ndiscovered by Syzkaller.\n\nThis adds a checks for destroy!=NULL and adds a missing release().\n\nThis is not changing kvm_destroy_devices() as devices with defined\nrelease() should have been removed from the KVM devices list by then.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b98289e5-3022-4e5a-876d-c777b035189f",  "id": "CLSA-2026-1779094874",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "01094607-9981-42e5-89c2-20b47e8e698c",  "id": "CVE-2013-4299",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4299"  },  "ratings": [    {      "score": 6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:P"    }  ],  "cwes": [    200,    264  ],  "analysis": {    "state": "in_triage"  },  "description": "Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d40759b3-077e-41be-9070-bf351a29b588",  "id": "CVE-2023-53468",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix memory leak in alloc_wbufs()\n\nkmemleak reported a sequence of memory leaks, and show them as following:\n\n  unreferenced object 0xffff8881575f8400 (size 1024):\n    comm \"mount\", pid 19625, jiffies 4297119604 (age 20.383s)\n    hex dump (first 32 bytes):\n      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    backtrace:\n      [<ffffffff8176cecd>] __kmalloc+0x4d/0x150\n      [<ffffffffa0406b2b>] ubifs_mount+0x307b/0x7170 [ubifs]\n      [<ffffffff819fa8fd>] legacy_get_tree+0xed/0x1d0\n      [<ffffffff81936f2d>] vfs_get_tree+0x7d/0x230\n      [<ffffffff819b2bd4>] path_mount+0xdd4/0x17b0\n      [<ffffffff819b37aa>] __x64_sys_mount+0x1fa/0x270\n      [<ffffffff83c14295>] do_syscall_64+0x35/0x80\n      [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\n  unreferenced object 0xffff8881798a6e00 (size 512):\n    comm \"mount\", pid 19677, jiffies 4297121912 (age 37.816s)\n    hex dump (first 32 bytes):\n      6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n      6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk\n    backtrace:\n      [<ffffffff8176cecd>] __kmalloc+0x4d/0x150\n      [<ffffffffa0418342>] ubifs_wbuf_init+0x52/0x480 [ubifs]\n      [<ffffffffa0406ca5>] ubifs_mount+0x31f5/0x7170 [ubifs]\n      [<ffffffff819fa8fd>] legacy_get_tree+0xed/0x1d0\n      [<ffffffff81936f2d>] vfs_get_tree+0x7d/0x230\n      [<ffffffff819b2bd4>] path_mount+0xdd4/0x17b0\n      [<ffffffff819b37aa>] __x64_sys_mount+0x1fa/0x270\n      [<ffffffff83c14295>] do_syscall_64+0x35/0x80\n      [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThe problem is that the ubifs_wbuf_init() returns an error in the\nloop which in the alloc_wbufs(), then the wbuf->buf and wbuf->inodes\nthat were successfully alloced before are not freed.\n\nFix it by adding error hanging path in alloc_wbufs() which frees\nthe memory alloced before when ubifs_wbuf_init() returns an error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6634b0db-4711-46c0-b0bf-768e9756ef8d",  "id": "CVE-2013-0310",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0310"  },  "ratings": [    {      "score": 6.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:S/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The cipso_v4_validate function in net/ipv4/cipso_ipv4.c in the Linux kernel before 3.4.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an IPOPT_CIPSO IP_OPTIONS setsockopt system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5af3ad22-3258-486c-9083-e69d00c439b9",  "id": "CVE-2022-50215",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sg: Allow waiting for commands to complete on removed device\n\nWhen a SCSI device is removed while in active use, currently sg will\nimmediately return -ENODEV on any attempt to wait for active commands that\nwere sent before the removal.  This is problematic for commands that use\nSG_FLAG_DIRECT_IO since the data buffer may still be in use by the kernel\nwhen userspace frees or reuses it after getting ENODEV, leading to\ncorrupted userspace memory (in the case of READ-type commands) or corrupted\ndata being sent to the device (in the case of WRITE-type commands).  This\nhas been seen in practice when logging out of a iscsi_tcp session, where\nthe iSCSI driver may still be processing commands after the device has been\nmarked for removal.\n\nChange the policy to allow userspace to wait for active sg commands even\nwhen the device is being removed.  Return -ENODEV only when there are no\nmore responses to read.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "89dfce43-ca45-4215-ad6a-48458f8b3e39",  "id": "OESA-2024-1147",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2a60b45-5529-4ae7-88ab-695d2df4b3bc",  "id": "CVE-2025-39798",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix the setting of capabilities when automounting a new filesystem\n\nCapabilities cannot be inherited when we cross into a new filesystem.\nThey need to be reset to the minimal defaults, and then probed for\nagain.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bd980ebe-9a42-496d-a046-1ea8525d2e32",  "id": "CVE-2023-52898",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: Fix null pointer dereference when host dies\n\nMake sure xhci_free_dev() and xhci_kill_endpoint_urbs() do not race\nand cause null pointer dereference when host suddenly dies.\n\nUsb core may call xhci_free_dev() which frees the xhci->devs[slot_id]\nvirt device at the same time that xhci_kill_endpoint_urbs() tries to\nloop through all the device's endpoints, checking if there are any\ncancelled urbs left to give back.\n\nhold the xhci spinlock while freeing the virt device",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dad2c776-5284-416e-97ac-33f6a20e4bfd",  "id": "CVE-2011-4108",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4108"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "29acb455-231a-4633-8bb0-728bf1ad7655",  "id": "CVE-2022-49292",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: oss: Fix PCM OSS buffer allocation overflow\n\nWe've got syzbot reports hitting INT_MAX overflow at vmalloc()\nallocation that is called from snd_pcm_plug_alloc().  Although we\napply the restrictions to input parameters, it's based only on the\nhw_params of the underlying PCM device.  Since the PCM OSS layer\nallocates a temporary buffer for the data conversion, the size may\nbecome unexpectedly large when more channels or higher rates is given;\nin the reported case, it went over INT_MAX, hence it hits WARN_ON().\n\nThis patch is an attempt to avoid such an overflow and an allocation\nfor too large buffers.  First off, it adds the limit of 1MB as the\nupper bound for period bytes.  This must be large enough for all use\ncases, and we really don't want to handle a larger temporary buffer\nthan this size.  The size check is performed at two places, where the\noriginal period bytes is calculated and where the plugin buffer size\nis calculated.\n\nIn addition, the driver uses array_size() and array3_size() for\nmultiplications to catch overflows for the converted period size and\nbuffer bytes.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b94b5660-9d04-42f2-9fa8-08b9bc800115",  "id": "CVE-2015-2042",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2042"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    17  ],  "analysis": {    "state": "in_triage"  },  "description": "net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bd1c8253-1b7f-415e-acd8-bef866a4781c",  "id": "CVE-2022-49312",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8712: fix a potential memory leak in r871xu_drv_init()\n\nIn r871xu_drv_init(), if r8712_init_drv_sw() fails, then the memory\nallocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not\nproperly released as there is no action will be performed by\nr8712_usb_dvobj_deinit().\nTo properly release it, we should call r8712_free_io_queue() in\nr8712_usb_dvobj_deinit().\n\nBesides, in r871xu_dev_remove(), r8712_usb_dvobj_deinit() will be called\nby r871x_dev_unload() under condition `padapter->bup` and\nr8712_free_io_queue() is called by r8712_free_drv_sw().\nHowever, r8712_usb_dvobj_deinit() does not rely on `padapter->bup` and\ncalling r8712_free_io_queue() in r8712_free_drv_sw() is negative for\nbetter understading the code.\nSo I move r8712_usb_dvobj_deinit() into r871xu_dev_remove(), and remove\nr8712_free_io_queue() from r8712_free_drv_sw().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "94a41b35-b483-4238-bf14-b9284a2a7ff5",  "id": "CVE-2014-9644",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9644"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    269  ],  "analysis": {    "state": "in_triage"  },  "description": "The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "25484222-3c77-435c-a606-d2f72b529e49",  "id": "SUSE-SU-2016:2387-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4525c532-3f07-42f0-ab61-5e2396a9d474",  "id": "CVE-2014-3687",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3687"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d97ec9fe-ad5c-41ee-b2fc-35332a686ab8",  "id": "CVE-2014-0049",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0049"  },  "ratings": [    {      "score": 7.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:S/C:C/I:C/A:C"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7b7c0ca0-3183-4111-8d06-a21250784351",  "id": "CVE-2024-49890",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: ensure the fw_info is not null before using it\n\nThis resolves the dereference null return value warning\nreported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ba4cf6ef-dc6a-4bf6-b640-5507b1a9efd6",  "id": "CVE-2013-1796",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1796"  },  "ratings": [    {      "score": 6.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0c7d950c-5247-47c5-9dca-11bfa9c2b867",  "id": "CVE-2010-2524",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2524"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user's keyring for the dns_resolver upcall in the cifs.upcall userspace helper, which allows local users to spoof the results of DNS queries and perform arbitrary CIFS mounts via vectors involving an add_key call, related to a \"cache stuffing\" issue and MS-DFS referrals.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5c9eecb9-5a5f-4a88-b1ba-e11a2c4e2b9a",  "id": "CVE-2011-0521",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0521"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2 does not check the sign of a certain integer field, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a negative value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "06d2392d-ae5b-42bb-941f-61fd885341a3",  "id": "CVE-2023-52625",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Refactor DMCUB enter/exit idle interface\n\n[Why]\nWe can hang in place trying to send commands when the DMCUB isn't\npowered on.\n\n[How]\nWe need to exit out of the idle state prior to sending a command,\nbut the process that performs the exit also invokes a command itself.\n\nFixing this issue involves the following:\n\n1. Using a software state to track whether or not we need to start\n   the process to exit idle or notify idle.\n\nIt's possible for the hardware to have exited an idle state without\ndriver knowledge, but entering one is always restricted to a driver\nallow - which makes the SW state vs HW state mismatch issue purely one\nof optimization, which should seldomly be hit, if at all.\n\n2. Refactor any instances of exit/notify idle to use a single wrapper\n   that maintains this SW state.\n\nThis works simialr to dc_allow_idle_optimizations, but works at the\nDMCUB level and makes sure the state is marked prior to any notify/exit\nidle so we don't enter an infinite loop.\n\n3. Make sure we exit out of idle prior to sending any commands or\n   waiting for DMCUB idle.\n\nThis patch takes care of 1/2. A future patch will take care of wrapping\nDMCUB command submission with calls to this new interface.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b99fbea-8303-4c29-b49e-4311ee33d38d",  "id": "RHSA-2025:3666",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "23df9611-9a6d-44b2-8d9f-482d692f0160",  "id": "CVE-2026-43158",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix freemap adjustments when adding xattrs to leaf blocks\n\nxfs/592 and xfs/794 both trip this assertion in the leaf block freemap\nadjustment code after ~20 minutes of running on my test VMs:\n\n ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t)\n\t\t\t\t\t+ xfs_attr3_leaf_hdr_size(leaf));\n\nUpon enabling quite a lot more debugging code, I narrowed this down to\nfsstress trying to set a local extended attribute with namelen=3 and\nvaluelen=71.  This results in an entry size of 80 bytes.\n\nAt the start of xfs_attr3_leaf_add_work, the freemap looks like this:\n\ni 0 base 448 size 0 rhs 448 count 46\ni 1 base 388 size 132 rhs 448 count 46\ni 2 base 2120 size 4 rhs 448 count 46\nfirstused = 520\n\nwhere \"rhs\" is the first byte past the end of the leaf entry array.\nThis is inconsistent -- the entries array ends at byte 448, but\nfreemap[1] says there's free space starting at byte 388!\n\nBy the end of the function, the freemap is in worse shape:\n\ni 0 base 456 size 0 rhs 456 count 47\ni 1 base 388 size 52 rhs 456 count 47\ni 2 base 2120 size 4 rhs 456 count 47\nfirstused = 440\n\nImportant note: 388 is not aligned with the entries array element size\nof 8 bytes.\n\nBased on the incorrect freemap, the name area starts at byte 440, which\nis below the end of the entries array!  That's why the assertion\ntriggers and the filesystem shuts down.\n\nHow did we end up here?  First, recall from the previous patch that the\nfreemap array in an xattr leaf block is not intended to be a\ncomprehensive map of all free space in the leaf block.  In other words,\nit's perfectly legal to have a leaf block with:\n\n * 376 bytes in use by the entries array\n * freemap[0] has [base = 376, size = 8]\n * freemap[1] has [base = 388, size = 1500]\n * the space between 376 and 388 is free, but the freemap stopped\n   tracking that some time ago\n\nIf we add one xattr, the entries array grows to 384 bytes, and\nfreemap[0] becomes [base = 384, size = 0].  So far, so good.  But if we\nadd a second xattr, the entries array grows to 392 bytes, and freemap[0]\ngets pushed up to [base = 392, size = 0].  This is bad, because\nfreemap[1] hasn't been updated, and now the entries array and the free\nspace claim the same space.\n\nThe fix here is to adjust all freemap entries so that none of them\ncollide with the entries array.  Note that this fix relies on commit\n2a2b5932db6758 (\"xfs: fix attr leaf header freemap.size underflow\") and\nthe previous patch that resets zero length freemap entries to have\nbase = 0.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9ed8cb82-0c28-4d4e-a07c-19cc3d95f2d1",  "id": "CVE-2023-4732",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4732"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    366  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "426a57c4-db9f-476a-8815-4a559eb47927",  "id": "CVE-2022-33741",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33741"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4a92e02f-4de5-4f8d-bd08-89bd3c9a89e7",  "id": "CVE-2023-23002",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23002"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.16.3, drivers/bluetooth/hci_qca.c misinterprets the devm_gpiod_get_index_optional return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "167fedb6-b683-4078-948a-cddc6ed9e326",  "id": "CVE-2023-52899",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nAdd exception protection processing for vd in axi_chan_handle_err function\n\nSince there is no protection for vd, a kernel panic will be\ntriggered here in exceptional cases.\n\nYou can refer to the processing of axi_chan_block_xfer_complete function\n\nThe triggered kernel panic is as follows:\n\n[   67.848444] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060\n[   67.848447] Mem abort info:\n[   67.848449]   ESR = 0x96000004\n[   67.848451]   EC = 0x25: DABT (current EL), IL = 32 bits\n[   67.848454]   SET = 0, FnV = 0\n[   67.848456]   EA = 0, S1PTW = 0\n[   67.848458] Data abort info:\n[   67.848460]   ISV = 0, ISS = 0x00000004\n[   67.848462]   CM = 0, WnR = 0\n[   67.848465] user pgtable: 4k pages, 48-bit VAs, pgdp=00000800c4c0b000\n[   67.848468] [0000000000000060] pgd=0000000000000000, p4d=0000000000000000\n[   67.848472] Internal error: Oops: 96000004 [#1] SMP\n[   67.848475] Modules linked in: dmatest\n[   67.848479] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.100-emu_x2rc+ #11\n[   67.848483] pstate: 62000085 (nZCv daIf -PAN -UAO +TCO BTYPE=--)\n[   67.848487] pc : axi_chan_handle_err+0xc4/0x230\n[   67.848491] lr : axi_chan_handle_err+0x30/0x230\n[   67.848493] sp : ffff0803fe55ae50\n[   67.848495] x29: ffff0803fe55ae50 x28: ffff800011212200\n[   67.848500] x27: ffff0800c42c0080 x26: ffff0800c097c080\n[   67.848504] x25: ffff800010d33880 x24: ffff80001139d850\n[   67.848508] x23: ffff0800c097c168 x22: 0000000000000000\n[   67.848512] x21: 0000000000000080 x20: 0000000000002000\n[   67.848517] x19: ffff0800c097c080 x18: 0000000000000000\n[   67.848521] x17: 0000000000000000 x16: 0000000000000000\n[   67.848525] x15: 0000000000000000 x14: 0000000000000000\n[   67.848529] x13: 0000000000000000 x12: 0000000000000040\n[   67.848533] x11: ffff0800c0400248 x10: ffff0800c040024a\n[   67.848538] x9 : ffff800010576cd4 x8 : ffff0800c0400270\n[   67.848542] x7 : 0000000000000000 x6 : ffff0800c04003e0\n[   67.848546] x5 : ffff0800c0400248 x4 : ffff0800c4294480\n[   67.848550] x3 : dead000000000100 x2 : dead000000000122\n[   67.848555] x1 : 0000000000000100 x0 : ffff0800c097c168\n[   67.848559] Call trace:\n[   67.848562]  axi_chan_handle_err+0xc4/0x230\n[   67.848566]  dw_axi_dma_interrupt+0xf4/0x590\n[   67.848569]  __handle_irq_event_percpu+0x60/0x220\n[   67.848573]  handle_irq_event+0x64/0x120\n[   67.848576]  handle_fasteoi_irq+0xc4/0x220\n[   67.848580]  __handle_domain_irq+0x80/0xe0\n[   67.848583]  gic_handle_irq+0xc0/0x138\n[   67.848585]  el1_irq+0xc8/0x180\n[   67.848588]  arch_cpu_idle+0x14/0x2c\n[   67.848591]  default_idle_call+0x40/0x16c\n[   67.848594]  do_idle+0x1f0/0x250\n[   67.848597]  cpu_startup_entry+0x2c/0x60\n[   67.848600]  rest_init+0xc0/0xcc\n[   67.848603]  arch_call_rest_init+0x14/0x1c\n[   67.848606]  start_kernel+0x4cc/0x500\n[   67.848610] Code: eb0002ff 9a9f12d6 f2fbd5a2 f2fbd5a3 (a94602c1)\n[   67.848613] ---[ end trace 585a97036f88203a ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ab19bc98-babb-4e62-a326-6a968c0b5023",  "id": "CVE-2024-0775",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0775"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0f0f08e1-40de-4547-b1d5-7fd1c9cd6f2d",  "id": "RHSA-2019:3700",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db0a24dc-077f-4330-9b19-1df6b6b0afae",  "id": "CVE-2021-3573",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3573"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b29e450d-1aef-4bde-baf1-e1b9976222ad",  "id": "CVE-2026-45944",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Clear Present bit before tearing down context entry\n\nWhen tearing down a context entry, the current implementation zeros the\nentire 128-bit entry using multiple 64-bit writes. This creates a window\nwhere the hardware can fetch a \"torn\" entry — where some fields are\nalready zeroed while the 'Present' bit is still set — leading to\nunpredictable behavior or spurious faults.\n\nWhile x86 provides strong write ordering, the compiler may reorder writes\nto the two 64-bit halves of the context entry. Even without compiler\nreordering, the hardware fetch is not guaranteed to be atomic with\nrespect to multiple CPU writes.\n\nAlign with the \"Guidance to Software for Invalidations\" in the VT-d spec\n(Section 6.5.3.3) by implementing the recommended ownership handshake:\n\n1. Clear only the 'Present' (P) bit of the context entry first to\n   signal the transition of ownership from hardware to software.\n2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU.\n3. Perform the required cache and context-cache invalidation to ensure\n   hardware no longer has cached references to the entry.\n4. Fully zero out the entry only after the invalidation is complete.\n\nAlso, add a dma_wmb() to context_set_present() to ensure the entry\nis fully initialized before the 'Present' bit becomes visible.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a08d8762-8fa5-4de1-8fb6-9edf28b25ee6",  "id": "CVE-2013-6368",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6368"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "278c0263-4613-4860-8922-382bdac7b5fc",  "id": "CVE-2025-38215",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var\n\nIf fb_add_videomode() in do_register_framebuffer() fails to allocate\nmemory for fb_videomode, it will later lead to a null-ptr dereference in\nfb_videomode_to_var(), as the fb_info is registered while not having the\nmode in modelist that is expected to be there, i.e. the one that is\ndescribed in fb_info->var.\n\n================================================================\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901\nCall Trace:\n display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929\n fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071\n resize_screen drivers/tty/vt/vt.c:1176 [inline]\n vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263\n fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720\n fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776\n do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128\n fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203\n vfs_ioctl fs/ioctl.c:48 [inline]\n __do_sys_ioctl fs/ioctl.c:753 [inline]\n __se_sys_ioctl fs/ioctl.c:739 [inline]\n __x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n================================================================\n\nEven though fbcon_init() checks beforehand if fb_match_mode() in\nvar_to_display() fails, it can not prevent the panic because fbcon_init()\ndoes not return error code. Considering this and the comment in the code\nabout fb_match_mode() returning NULL - \"This should not happen\" - it is\nbetter to prevent registering the fb_info if its mode was not set\nsuccessfully. Also move fb_add_videomode() closer to the beginning of\ndo_register_framebuffer() to avoid having to do the cleanup on fail.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "59837723-478c-4a14-9f03-ecce35fd246a",  "id": "CVE-2019-15807",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15807"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will cause a BUG and denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "088c579a-5bab-401d-b448-91423b4cac9a",  "id": "AZL-67980",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ffa42c47-2b19-4bf6-a85f-485f9894e689",  "id": "RHSA-2022:1112",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4fbf0b8c-6db8-4694-b9d3-ee2cb5b63a57",  "id": "CVE-2022-49020",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/9p: Fix a potential socket leak in p9_socket_open\n\nBoth p9_fd_create_tcp() and p9_fd_create_unix() will call\np9_socket_open(). If the creation of p9_trans_fd fails,\np9_fd_create_tcp() and p9_fd_create_unix() will return an\nerror directly instead of releasing the cscoket, which will\nresult in a socket leak.\n\nThis patch adds sock_release() to fix the leak issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f5e3873-30f8-43c8-adca-59c7c6b4cdc6",  "id": "CVE-2023-2124",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2124"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f4dd46ac-337b-4a7a-811c-616899e00ba6",  "id": "ALSA-2026:3042",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b7a43b7-35a5-41f0-898a-f1ee15e1a140",  "id": "MGASA-2022-0246",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cf217cba-e580-4728-83d5-334e88ab024f",  "id": "CVE-2021-47374",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47374"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-debug: prevent an error message from causing runtime problems\n\nFor some drivers, that use the DMA API. This error message can be reached\nseveral millions of times per second, causing spam to the kernel's printk\nbuffer and bringing the CPU usage up to 100% (so, it should be rate\nlimited). However, since there is at least one driver that is in the\nmainline and suffers from the error condition, it is more useful to\nerr_printk() here instead of just rate limiting the error message (in hopes\nthat it will make it easier for other drivers that suffer from this issue\nto be spotted).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8932d7a1-ee9a-4a1a-bcff-892bc7e46cae",  "id": "CVE-2024-26659",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: handle isoc Babble and Buffer Overrun events properly\n\nxHCI 4.9 explicitly forbids assuming that the xHC has released its\nownership of a multi-TRB TD when it reports an error on one of the\nearly TRBs. Yet the driver makes such assumption and releases the TD,\nallowing the remaining TRBs to be freed or overwritten by new TDs.\n\nThe xHC should also report completion of the final TRB due to its IOC\nflag being set by us, regardless of prior errors. This event cannot\nbe recognized if the TD has already been freed earlier, resulting in\n\"Transfer event TRB DMA ptr not part of current TD\" error message.\n\nFix this by reusing the logic for processing isoc Transaction Errors.\nThis also handles hosts which fail to report the final completion.\n\nFix transfer length reporting on Babble errors. They may be caused by\ndevice malfunction, no guarantee that the buffer has been filled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "83d6a276-0e6f-485f-93e1-b165370faad1",  "id": "CVE-2022-49157",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix premature hw access after PCI error\n\nAfter a recoverable PCI error has been detected and recovered, qla driver\nneeds to check to see if the error condition still persist and/or wait\nfor the OS to give the resume signal.\n\nSep  8 22:26:03 localhost kernel: WARNING: CPU: 9 PID: 124606 at qla_tmpl.c:440\nqla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx]\nSep  8 22:26:03 localhost kernel: RIP: 0010:qla27xx_fwdt_entry_t266+0x55/0x60\n[qla2xxx]\nSep  8 22:26:03 localhost kernel: Call Trace:\nSep  8 22:26:03 localhost kernel: ? qla27xx_walk_template+0xb1/0x1b0 [qla2xxx]\nSep  8 22:26:03 localhost kernel: ? qla27xx_execute_fwdt_template+0x12a/0x160\n[qla2xxx]\nSep  8 22:26:03 localhost kernel: ? qla27xx_fwdump+0xa0/0x1c0 [qla2xxx]\nSep  8 22:26:03 localhost kernel: ? qla2xxx_pci_mmio_enabled+0xfb/0x120\n[qla2xxx]\nSep  8 22:26:03 localhost kernel: ? report_mmio_enabled+0x44/0x80\nSep  8 22:26:03 localhost kernel: ? report_slot_reset+0x80/0x80\nSep  8 22:26:03 localhost kernel: ? pci_walk_bus+0x70/0x90\nSep  8 22:26:03 localhost kernel: ? aer_dev_correctable_show+0xc0/0xc0\nSep  8 22:26:03 localhost kernel: ? pcie_do_recovery+0x1bb/0x240\nSep  8 22:26:03 localhost kernel: ? aer_recover_work_func+0xaa/0xd0\nSep  8 22:26:03 localhost kernel: ? process_one_work+0x1a7/0x360\n..\nSep  8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-8041:22: detected PCI\ndisconnect.\nSep  8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22:\nqla27xx_fwdt_entry_t262: dump ram MB failed. Area 5h start 198013h end 198013h\nSep  8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: Unable to\ncapture FW dump\nSep  8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-1015:22: cmd=0x0,\nwaited 5221 msecs\nSep  8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-680d:22: mmio\nenabled returning.\nSep  8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-d04c:22: MBX\nCommand timeout for cmd 0, iocontrol=ffffffff jiffies=10140f2e5\nmb[0-3]=[0xffff 0xffff 0xffff 0xffff]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "529bed01-058e-4458-96e8-4c03dadcd5a8",  "id": "CVE-2022-49137",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj\n\nThis issue takes place in an error path in\namdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into\ndefault case, the function simply returns -EINVAL, forgetting to\ndecrement the reference count of a dma_fence obj, which is bumped\nearlier by amdgpu_cs_get_fence(). This may result in reference count\nleaks.\n\nFix it by decreasing the refcount of specific object before returning\nthe error code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "259bb00a-d855-4914-b187-a2742c4e2d11",  "id": "CVE-2010-4648",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4648"  },  "ratings": [    {      "score": 3.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The orinoco_ioctl_set_auth function in drivers/net/wireless/orinoco/wext.c in the Linux kernel before 2.6.37 does not properly implement a TKIP protection mechanism, which makes it easier for remote attackers to obtain access to a Wi-Fi network by reading Wi-Fi frames.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc833795-0c9e-4140-87b2-dc8f7c7f1c96",  "id": "CVE-2021-28971",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28971"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    755  ],  "analysis": {    "state": "in_triage"  },  "description": "In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS status in a PEBS record is mishandled, aka CID-d88d05a9e0b6.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b0e5cfea-0168-42d3-960e-09dbcbefdfed",  "id": "CVE-2022-2078",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2078"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    120,    121  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and possibly to run code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ada42da6-c097-4454-b6bf-1da1acd61cfd",  "id": "DLA-4176-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8d660825-ef0e-4d1d-9f21-25b61ac4926a",  "id": "DSA-3989-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c65e9c8-f155-4760-b3d3-fe3ead04edd5",  "id": "CVE-2024-36910",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio_hv_generic: Don't free decrypted memory\n\nIn CoCo VMs it is possible for the untrusted host to cause\nset_memory_encrypted() or set_memory_decrypted() to fail such that an\nerror is returned and the resulting memory is shared. Callers need to\ntake care to handle these errors to avoid returning decrypted (shared)\nmemory to the page allocator, which could lead to functional or security\nissues.\n\nThe VMBus device UIO driver could free decrypted/shared pages if\nset_memory_decrypted() fails. Check the decrypted field in the gpadl\nto decide whether to free the memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ae9363b-85b0-45f4-91f5-a758c38a6c58",  "id": "CVE-2022-49139",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix null ptr deref on hci_sync_conn_complete_evt\n\nThis event is just specified for SCO and eSCO link types.\nOn the reception of a HCI_Synchronous_Connection_Complete for a BDADDR\nof an existing LE connection, LE link type and a status that triggers the\nsecond case of the packet processing a NULL pointer dereference happens,\nas conn->link is NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "016da9c4-2fc5-4c66-9156-129f7c103a36",  "id": "CVE-2019-12454",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12454"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in wcd9335_codec_enable_dec in sound/soc/codecs/wcd9335.c in the Linux kernel through 5.1.5. It uses kstrndup instead of kmemdup_nul, which allows attackers to have an unspecified impact via unknown vectors. NOTE: The vendor disputes this issues as not being a vulnerability because switching to kmemdup_nul() would only fix a security issue if the source string wasn't NUL-terminated, which is not the case",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cf5715b3-b223-4e8e-879d-eb918c713d8f",  "id": "CVE-2022-1419",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1419"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created in *vgem_gem_dumb_create*) concurrently, and *vgem_gem_dumb_create *will access the freed drm_vgem_gem_object.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d1c05377-dcad-49f3-8e64-13064efbda67",  "id": "CVE-2026-43085",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator\n\nWhen batching multiple NFLOG messages (inst->qlen > 1), __nfulnl_send()\nappends an NLMSG_DONE terminator with sizeof(struct nfgenmsg) payload via\nnlmsg_put(), but never initializes the nfgenmsg bytes. The nlmsg_put()\nhelper only zeroes alignment padding after the payload, not the payload\nitself, so four bytes of stale kernel heap data are leaked to userspace\nin the NLMSG_DONE message body.\n\nUse nfnl_msg_put() to build the NLMSG_DONE terminator, which initializes\nthe nfgenmsg payload via nfnl_fill_hdr(), consistent with how\n__build_packet_message() already constructs NFULNL_MSG_PACKET headers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "22d5b2f0-31e5-482d-89a4-5b3abd59eae6",  "id": "CVE-2021-28972",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28972"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\\0' termination, aka CID-cc7a0bb058b8.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "873601e5-d8cb-4837-be5f-2fa8cd1a435d",  "id": "ALSA-2026:19158",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2a56398-a249-4149-8209-9f7191aa1a77",  "id": "CVE-2019-15223",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15223"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/driver.c driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "20ecefc8-3495-4c58-badc-fe69246df0d0",  "id": "RHSA-2026:4214",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6cc5a414-7bd4-4b93-a58e-079b68b60e9e",  "id": "CVE-2022-49493",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: rt5645: Fix errorenous cleanup order\n\nThere is a logic error when removing rt5645 device as the function\nrt5645_i2c_remove() first cancel the &rt5645->jack_detect_work and\ndelete the &rt5645->btn_check_timer latter. However, since the timer\nhandler rt5645_btn_check_callback() will re-queue the jack_detect_work,\nthis cleanup order is buggy.\n\nThat is, once the del_timer_sync in rt5645_i2c_remove is concurrently\nrun with the rt5645_btn_check_callback, the canceled jack_detect_work\nwill be rescheduled again, leading to possible use-after-free.\n\nThis patch fix the issue by placing the del_timer_sync function before\nthe cancel_delayed_work_sync.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e97d045e-2f7c-4888-a73c-5f21ddf0e9ab",  "id": "CVE-2024-53057",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT\n\nIn qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed\nto be either root or ingress. This assumption is bogus since it's valid\nto create egress qdiscs with major handle ffff:\nBudimir Markovic found that for qdiscs like DRR that maintain an active\nclass list, it will cause a UAF with a dangling class pointer.\n\nIn 066a3b5b2346, the concern was to avoid iterating over the ingress\nqdisc since its parent is itself. The proper fix is to stop when parent\nTC_H_ROOT is reached because the only way to retrieve ingress is when a\nhierarchy which does not contain a ffff: major handle call into\nqdisc_lookup with TC_H_MAJ(TC_H_ROOT).\n\nIn the scenario where major ffff: is an egress qdisc in any of the tree\nlevels, the updates will also propagate to TC_H_ROOT, which then the\niteration must stop.\n\n\n net/sched/sch_api.c | 2 +-\n 1 file changed, 1 insertion(+), 1 deletion(-)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51b3ec46-e587-4f37-b90e-3ed8e73a118b",  "id": "CVE-2025-37880",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\num: work around sched_yield not yielding in time-travel mode\n\nsched_yield by a userspace may not actually cause scheduling in\ntime-travel mode as no time has passed. In the case seen it appears to\nbe a badly implemented userspace spinlock in ASAN. Unfortunately, with\ntime-travel it causes an extreme slowdown or even deadlock depending on\nthe kernel configuration (CONFIG_UML_MAX_USERSPACE_ITERATIONS).\n\nWork around it by accounting time to the process whenever it executes a\nsched_yield syscall.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "296caaa9-bed6-4190-80c2-2f3b9d17e51b",  "id": "CVE-2024-35896",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: validate user input for expected length\n\nI got multiple syzbot reports showing old bugs exposed\nby BPF after commit 20f2505fb436 (\"bpf: Try to avoid kzalloc\nin cgroup/{s,g}etsockopt\")\n\nsetsockopt() @optlen argument should be taken into account\nbefore copying data.\n\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\n BUG: KASAN: slab-out-of-bounds in do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline]\n BUG: KASAN: slab-out-of-bounds in do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627\nRead of size 96 at addr ffff88802cd73da0 by task syz-executor.4/7238\n\nCPU: 1 PID: 7238 Comm: syz-executor.4 Not tainted 6.9.0-rc2-next-20240403-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n <TASK>\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n  __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\n  do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline]\n  do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627\n  nf_setsockopt+0x295/0x2c0 net/netfilter/nf_sockopt.c:101\n  do_sock_setsockopt+0x3af/0x720 net/socket.c:2311\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x72/0x7a\nRIP: 0033:0x7fd22067dde9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fd21f9ff0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 00007fd2207abf80 RCX: 00007fd22067dde9\nRDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007fd2206ca47a R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000020000880 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007fd2207abf80 R15: 00007ffd2d0170d8\n </TASK>\n\nAllocated by task 7238:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:370 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\n  __do_kmalloc_node mm/slub.c:4069 [inline]\n  __kmalloc_noprof+0x200/0x410 mm/slub.c:4082\n  kmalloc_noprof include/linux/slab.h:664 [inline]\n  __cgroup_bpf_run_filter_setsockopt+0xd47/0x1050 kernel/bpf/cgroup.c:1869\n  do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x72/0x7a\n\nThe buggy address belongs to the object at ffff88802cd73da0\n which belongs to the cache kmalloc-8 of size 8\nThe buggy address is located 0 bytes inside of\n allocated 1-byte region [ffff88802cd73da0, ffff88802cd73da1)\n\nThe buggy address belongs to the physical page:\npage: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802cd73020 pfn:0x2cd73\nflags: 0xfff80000000000(node=0|zone=1|lastcpupid=0xfff)\npage_type: 0xffffefff(slab)\nraw: 00fff80000000000 ffff888015041280 dead000000000100 dead000000000122\nraw: ffff88802cd73020 000000008080007f 00000001ffffefff 00\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c172f462-712f-4b9f-bf43-3911817cf7c3",  "id": "CVE-2026-2163",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2163"  },  "ratings": [    {      "score": 7.2,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    74,    77  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was identified in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulation of the argument HTTP_ST/REMOTE_ADDR/REMOTE_PORT/SERVER_ID leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.",  "affects": [    {      "ref": "0f9017f6-bd13-4064-97b2-6cfc35c2947d",      "versions": [        {          "component": "dir-600_firmware",          "version": "2.14b01"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "de6d2ebc-ec2b-40a4-b9a4-e8af517f131d",  "id": "CVE-2020-29370",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29370"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in kmem_cache_alloc_bulk in mm/slub.c in the Linux kernel before 5.5.11. The slowpath lacks the required TID increment, aka CID-fd4d9c7d0c71.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2884d2bb-eba5-4b8f-809d-f874f30526e3",  "id": "MGASA-2021-0059",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5435511-1c7a-4dc3-a206-c869e96cfd1c",  "id": "CLSA-2025-1760023353",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c8e003f-6602-4e8a-9e89-ad5bd2ce497d",  "id": "CVE-2009-2958",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2958"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a TFTP read (aka RRQ) request with a malformed blksize option.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:9617'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:80896/Core-Security-Technologies-Advisory-2009.0820.html'"    }  ]},{  "bom-ref": "c8e0b742-b5fb-4035-921c-99ed4c5ff264",  "id": "DLA-247-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a44c1d4-dc89-44d9-afb3-c393a91b4d4c",  "id": "CVE-2022-2978",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2978"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3e2b98f5-c9ca-4e86-8016-4f9dc8c955c5",  "id": "CVE-2024-42305",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: check dot and dotdot of dx_root before making dir indexed\n\nSyzbot reports a issue as follows:\n============================================\nBUG: unable to handle page fault for address: ffffed11022e24fe\nPGD 23ffee067 P4D 23ffee067 PUD 0\nOops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0\nCall Trace:\n <TASK>\n make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341\n ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451\n ext4_rename fs/ext4/namei.c:3936 [inline]\n ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214\n[...]\n============================================\n\nThe immediate cause of this problem is that there is only one valid dentry\nfor the block to be split during do_split, so split==0 results in out of\nbounds accesses to the map triggering the issue.\n\n    do_split\n      unsigned split\n      dx_make_map\n       count = 1\n      split = count/2 = 0;\n      continued = hash2 == map[split - 1].hash;\n       ---> map[4294967295]\n\nThe maximum length of a filename is 255 and the minimum block size is 1024,\nso it is always guaranteed that the number of entries is greater than or\nequal to 2 when do_split() is called.\n\nBut syzbot's crafted image has no dot and dotdot in dir, and the dentry\ndistribution in dirblock is as follows:\n\n  bus     dentry1          hole           dentry2           free\n|xx--|xx-------------|...............|xx-------------|...............|\n0   12 (8+248)=256  268     256     524 (8+256)=264 788     236     1024\n\nSo when renaming dentry1 increases its name_len length by 1, neither hole\nnor free is sufficient to hold the new dentry, and make_indexed_dir() is\ncalled.\n\nIn make_indexed_dir() it is assumed that the first two entries of the\ndirblock must be dot and dotdot, so bus and dentry1 are left in dx_root\nbecause they are treated as dot and dotdot, and only dentry2 is moved\nto the new leaf block. That's why count is equal to 1.\n\nTherefore add the ext4_check_dx_root() helper function to add more sanity\nchecks to dot and dotdot before starting the conversion to avoid the above\nissue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4ef89aba-6624-4cf8-97b7-4df2e6660057",  "id": "CVE-2022-49772",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()\n\nsnd_usbmidi_output_open() has a check of the NULL port with\nsnd_BUG_ON().  snd_BUG_ON() was used as this shouldn't have happened,\nbut in reality, the NULL port may be seen when the device gives an\ninvalid endpoint setup at the descriptor, hence the driver skips the\nallocation.  That is, the check itself is valid and snd_BUG_ON()\nshould be dropped from there.  Otherwise it's confusing as if it were\na real bug, as recently syzbot stumbled on it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e334653a-6397-4691-bb4f-fa3df24f0b51",  "id": "CVE-2013-4511",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4511"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted mmap operations, related to the (1) au1100fb_fb_mmap function in drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap function in drivers/video/au1200fb.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db20f628-2a4b-4b03-96a8-11ba0bb2738f",  "id": "CVE-2020-27152",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27152"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9342692-14af-44be-a221-dacf8878b343",  "id": "MGASA-2014-0187",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "359718e8-9871-41d2-8fe0-f4c0e8c789bd",  "id": "SUSE-SU-2023:0584-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bdbc5aa2-3cbc-4459-a058-001f4d7dc6ee",  "id": "RHSA-2023:7877",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0077bafb-df0d-4289-8c26-8246c953fde8",  "id": "AZL-64326",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "89f89225-aec9-42ef-9789-083663f3ddf1",  "id": "CVE-2022-49304",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: tty: serial: Fix deadlock in sa1100_set_termios()\n\nThere is a deadlock in sa1100_set_termios(), which is shown\nbelow:\n\n   (Thread 1)              |      (Thread 2)\n                           | sa1100_enable_ms()\nsa1100_set_termios()       |  mod_timer()\n spin_lock_irqsave() //(1) |  (wait a time)\n ...                       | sa1100_timeout()\n del_timer_sync()          |  spin_lock_irqsave() //(2)\n (wait timer to stop)      |  ...\n\nWe hold sport->port.lock in position (1) of thread 1 and\nuse del_timer_sync() to wait timer to stop, but timer handler\nalso need sport->port.lock in position (2) of thread 2. As a result,\nsa1100_set_termios() will block forever.\n\nThis patch moves del_timer_sync() before spin_lock_irqsave()\nin order to prevent the deadlock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0c7cf474-1cb7-44b2-8922-3e5d63ae4e77",  "id": "CVE-2023-53270",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix i_disksize exceeding i_size problem in paritally written case\n\nIt is possible for i_disksize can exceed i_size, triggering a warning.\n\ngeneric_perform_write\n copied = iov_iter_copy_from_user_atomic(len) // copied < len\n ext4_da_write_end\n | ext4_update_i_disksize\n |  new_i_size = pos + copied;\n |  WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize\n | generic_write_end\n |  copied = block_write_end(copied, len) // copied = 0\n |   if (unlikely(copied < len))\n |    if (!PageUptodate(page))\n |     copied = 0;\n |  if (pos + copied > inode->i_size) // return false\n if (unlikely(copied == 0))\n  goto again;\n if (unlikely(iov_iter_fault_in_readable(i, bytes))) {\n  status = -EFAULT;\n  break;\n }\n\nWe get i_disksize greater than i_size here, which could trigger WARNING\ncheck 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio:\n\next4_dio_write_iter\n iomap_dio_rw\n  __iomap_dio_rw // return err, length is not aligned to 512\n ext4_handle_inode_extension\n  WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops\n\n WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319\n CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2\n RIP: 0010:ext4_file_write_iter+0xbc7\n Call Trace:\n  vfs_write+0x3b1\n  ksys_write+0x77\n  do_syscall_64+0x39\n\nFix it by updating 'copied' value before updating i_disksize just like\next4_write_inline_data_end() does.\n\nA reproducer can be found in the buganizer link below.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eaf9e568-4178-403b-b569-fc04202e8622",  "id": "CVE-2023-47233",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47233"  },  "ratings": [    {      "score": 4.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local access, this \"could be exploited in a real world scenario.\" This is related to brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be8420cd-3436-498a-8d0a-42d0ad62fe22",  "id": "ALBA-2020:4640",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3a8669d1-32cc-4c66-b446-3d7c58208768",      "versions": [        {          "component": "radvd",          "version": "1.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2bfa189-c69f-4da1-91be-146cc2c83b56",  "id": "CVE-2019-12455",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12455"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c in the Linux kernel through 5.1.5. There is an unchecked kstrndup of derived_name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). NOTE: This id is disputed as not being an issue because “The memory allocation that was not checked is part of a code that only runs at boot time, before user processes are started. Therefore, there is no possibility for an unprivileged user to control it, and no denial of service.”",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f450fa83-494a-4adb-abeb-a7fa3e9d8e7a",  "id": "CVE-2024-26706",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Fix random data corruption from exception handler\n\nThe current exception handler implementation, which assists when accessing\nuser space memory, may exhibit random data corruption if the compiler decides\nto use a different register than the specified register %r29 (defined in\nASM_EXCEPTIONTABLE_REG) for the error code. If the compiler choose another\nregister, the fault handler will nevertheless store -EFAULT into %r29 and thus\ntrash whatever this register is used for.\nLooking at the assembly I found that this happens sometimes in emulate_ldd().\n\nTo solve the issue, the easiest solution would be if it somehow is\npossible to tell the fault handler which register is used to hold the error\ncode. Using %0 or %1 in the inline assembly is not posssible as it will show\nup as e.g. %r29 (with the \"%r\" prefix), which the GNU assembler can not\nconvert to an integer.\n\nThis patch takes another, better and more flexible approach:\nWe extend the __ex_table (which is out of the execution path) by one 32-word.\nIn this word we tell the compiler to insert the assembler instruction\n\"or %r0,%r0,%reg\", where %reg references the register which the compiler\nchoosed for the error return code.\nIn case of an access failure, the fault handler finds the __ex_table entry and\ncan examine the opcode. The used register is encoded in the lowest 5 bits, and\nthe fault handler can then store -EFAULT into this register.\n\nSince we extend the __ex_table to 3 words we can't use the BUILDTIME_TABLE_SORT\nconfig option any longer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc9aa3de-7f45-4ac6-8b1f-41c8a56088d5",  "id": "CVE-2017-13082",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13082"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    323,    330  ],  "analysis": {    "state": "in_triage"  },  "description": "Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "df977198-2009-4624-8220-d46ff99b31aa",  "id": "CVE-2024-46707",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3\n\nOn a system with a GICv3, if a guest hasn't been configured with\nGICv3 and that the host is not capable of GICv2 emulation,\na write to any of the ICC_*SGI*_EL1 registers is trapped to EL2.\n\nWe therefore try to emulate the SGI access, only to hit a NULL\npointer as no private interrupt is allocated (no GIC, remember?).\n\nThe obvious fix is to give the guest what it deserves, in the\nshape of a UNDEF exception.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f70b427f-c571-485d-87c4-390e01b4b90f",  "id": "CVE-2024-26671",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix IO hang from sbitmap wakeup race\n\nIn blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered\nwith the following blk_mq_get_driver_tag() in case of getting driver\ntag failure.\n\nThen in __sbitmap_queue_wake_up(), waitqueue_active() may not observe\nthe added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime\nblk_mq_mark_tag_wait() can't get driver tag successfully.\n\nThis issue can be reproduced by running the following test in loop, and\nfio hang can be observed in < 30min when running it on my test VM\nin laptop.\n\n\tmodprobe -r scsi_debug\n\tmodprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4\n\tdev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`\n\tfio --filename=/dev/\"$dev\" --direct=1 --rw=randrw --bs=4k --iodepth=1 \\\n       \t\t--runtime=100 --numjobs=40 --time_based --name=test \\\n        \t--ioengine=libaio\n\nFix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which\nis just fine in case of running out of tag.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c3aa2935-027e-4861-9625-d5d56caaae76",  "id": "CVE-2017-13080",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13080"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    323,    330  ],  "analysis": {    "state": "in_triage"  },  "description": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "726cbd7e-bdda-401d-ac6d-542f35bd27ab",  "id": "OESA-2026-3087",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2723c0b-55aa-4aa3-9fb5-d10d9c8d5bd2",  "id": "CVE-2023-53100",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix WARNING in ext4_update_inline_data\n\nSyzbot found the following issue:\nEXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none.\nfscrypt: AES-256-CTS-CBC using implementation \"cts-cbc-aes-aesni\"\nfscrypt: AES-256-XTS using implementation \"xts-aes-aesni\"\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 5071 at mm/page_alloc.c:5525 __alloc_pages+0x30a/0x560 mm/page_alloc.c:5525\nModules linked in:\nCPU: 1 PID: 5071 Comm: syz-executor263 Not tainted 6.2.0-rc1-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\nRIP: 0010:__alloc_pages+0x30a/0x560 mm/page_alloc.c:5525\nRSP: 0018:ffffc90003c2f1c0 EFLAGS: 00010246\nRAX: ffffc90003c2f220 RBX: 0000000000000014 RCX: 0000000000000000\nRDX: 0000000000000028 RSI: 0000000000000000 RDI: ffffc90003c2f248\nRBP: ffffc90003c2f2d8 R08: dffffc0000000000 R09: ffffc90003c2f220\nR10: fffff52000785e49 R11: 1ffff92000785e44 R12: 0000000000040d40\nR13: 1ffff92000785e40 R14: dffffc0000000000 R15: 1ffff92000785e3c\nFS:  0000555556c0d300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f95d5e04138 CR3: 00000000793aa000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n __alloc_pages_node include/linux/gfp.h:237 [inline]\n alloc_pages_node include/linux/gfp.h:260 [inline]\n __kmalloc_large_node+0x95/0x1e0 mm/slab_common.c:1113\n __do_kmalloc_node mm/slab_common.c:956 [inline]\n __kmalloc+0xfe/0x190 mm/slab_common.c:981\n kmalloc include/linux/slab.h:584 [inline]\n kzalloc include/linux/slab.h:720 [inline]\n ext4_update_inline_data+0x236/0x6b0 fs/ext4/inline.c:346\n ext4_update_inline_dir fs/ext4/inline.c:1115 [inline]\n ext4_try_add_inline_entry+0x328/0x990 fs/ext4/inline.c:1307\n ext4_add_entry+0x5a4/0xeb0 fs/ext4/namei.c:2385\n ext4_add_nondir+0x96/0x260 fs/ext4/namei.c:2772\n ext4_create+0x36c/0x560 fs/ext4/namei.c:2817\n lookup_open fs/namei.c:3413 [inline]\n open_last_lookups fs/namei.c:3481 [inline]\n path_openat+0x12ac/0x2dd0 fs/namei.c:3711\n do_filp_open+0x264/0x4f0 fs/namei.c:3741\n do_sys_openat2+0x124/0x4e0 fs/open.c:1310\n do_sys_open fs/open.c:1326 [inline]\n __do_sys_openat fs/open.c:1342 [inline]\n __se_sys_openat fs/open.c:1337 [inline]\n __x64_sys_openat+0x243/0x290 fs/open.c:1337\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nAbove issue happens as follows:\next4_iget\n   ext4_find_inline_data_nolock ->i_inline_off=164 i_inline_size=60\next4_try_add_inline_entry\n   __ext4_mark_inode_dirty\n      ext4_expand_extra_isize_ea ->i_extra_isize=32 s_want_extra_isize=44\n         ext4_xattr_shift_entries\n\t ->after shift i_inline_off is incorrect, actually is change to 176\next4_try_add_inline_entry\n  ext4_update_inline_dir\n    get_max_inline_xattr_value_size\n      if (EXT4_I(inode)->i_inline_off)\n\tentry = (struct ext4_xattr_entry *)((void *)raw_inode +\n\t\t\tEXT4_I(inode)->i_inline_off);\n        free += EXT4_XATTR_SIZE(le32_to_cpu(entry->e_value_size));\n\t->As entry is incorrect, then 'free' may be negative\n   ext4_update_inline_data\n      value = kzalloc(len, GFP_NOFS);\n      -> len is unsigned int, maybe very large, then trigger warning when\n         'kzalloc()'\n\nTo resolve the above issue we need to update 'i_inline_off' after\n'ext4_xattr_shift_entries()'.  We do not need to set\nEXT4_STATE_MAY_INLINE_DATA flag here, since ext4_mark_inode_dirty()\nalready sets this flag if needed.  Setting EXT4_STATE_MAY_INLINE_DATA\nwhen it is needed may trigger a BUG_ON in ext4_writepages().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3532994f-d5fe-4bb3-973e-8a1eb7500698",  "id": "CVE-2024-26774",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt\n\nDetermine if bb_fragments is 0 instead of determining bb_free to eliminate\nthe risk of dividing by zero when the block bitmap is corrupted.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d514c14-f203-4b73-bdc6-a0ce5fd00cdf",  "id": "CVE-2021-29648",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29648"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    307  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider that resolved_ids and resolved_sizes are intentionally uninitialized in the vmlinux BPF Type Format (BTF), which can cause a system crash upon an unexpected access attempt (in map_create in kernel/bpf/syscall.c or check_btf_info in kernel/bpf/verifier.c), aka CID-350a5c4dd245.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95e9a84d-ab04-4836-a41d-7c5892418742",  "id": "AZL-8964",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a5b4e632-b11f-4dc3-9d9f-9772ec37a661",  "id": "CVE-2011-4621",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4621"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 2.6.37 does not properly implement a certain clock-update optimization, which allows local users to cause a denial of service (system hang) via an application that executes code in a loop.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1fea9706-dfae-44e4-a90a-359f936dc81a",  "id": "CVE-2023-5090",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5090"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    755  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, potentially leading to a denial of service condition.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "49ff4351-5de7-4d50-abba-052bd16f46b0",  "id": "ROOT-OS-ALPINE-315-CVE-2025-69421",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c936458-4538-42f5-bc52-56b5d0fd1281",  "id": "CVE-2024-56587",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: class: Protect brightness_show() with led_cdev->led_access mutex\n\nThere is NULL pointer issue observed if from Process A where hid device\nbeing added which results in adding a led_cdev addition and later a\nanother call to access of led_cdev attribute from Process B can result\nin NULL pointer issue.\n\nUse mutex led_cdev->led_access to protect access to led->cdev and its\nattribute inside brightness_show() and max_brightness_show() and also\nupdate the comment for mutex that it should be used to protect the led\nclass device fields.\n\n\tProcess A \t\t\t\tProcess B\n\n kthread+0x114\n worker_thread+0x244\n process_scheduled_works+0x248\n uhid_device_add_worker+0x24\n hid_add_device+0x120\n device_add+0x268\n bus_probe_device+0x94\n device_initial_probe+0x14\n __device_attach+0xfc\n bus_for_each_drv+0x10c\n __device_attach_driver+0x14c\n driver_probe_device+0x3c\n __driver_probe_device+0xa0\n really_probe+0x190\n hid_device_probe+0x130\n ps_probe+0x990\n ps_led_register+0x94\n devm_led_classdev_register_ext+0x58\n led_classdev_register_ext+0x1f8\n device_create_with_groups+0x48\n device_create_groups_vargs+0xc8\n device_add+0x244\n kobject_uevent+0x14\n kobject_uevent_env[jt]+0x224\n mutex_unlock[jt]+0xc4\n __mutex_unlock_slowpath+0xd4\n wake_up_q+0x70\n try_to_wake_up[jt]+0x48c\n preempt_schedule_common+0x28\n __schedule+0x628\n __switch_to+0x174\n\t\t\t\t\t\tel0t_64_sync+0x1a8/0x1ac\n\t\t\t\t\t\tel0t_64_sync_handler+0x68/0xbc\n\t\t\t\t\t\tel0_svc+0x38/0x68\n\t\t\t\t\t\tdo_el0_svc+0x1c/0x28\n\t\t\t\t\t\tel0_svc_common+0x80/0xe0\n\t\t\t\t\t\tinvoke_syscall+0x58/0x114\n\t\t\t\t\t\t__arm64_sys_read+0x1c/0x2c\n\t\t\t\t\t\tksys_read+0x78/0xe8\n\t\t\t\t\t\tvfs_read+0x1e0/0x2c8\n\t\t\t\t\t\tkernfs_fop_read_iter+0x68/0x1b4\n\t\t\t\t\t\tseq_read_iter+0x158/0x4ec\n\t\t\t\t\t\tkernfs_seq_show+0x44/0x54\n\t\t\t\t\t\tsysfs_kf_seq_show+0xb4/0x130\n\t\t\t\t\t\tdev_attr_show+0x38/0x74\n\t\t\t\t\t\tbrightness_show+0x20/0x4c\n\t\t\t\t\t\tdualshock4_led_get_brightness+0xc/0x74\n\n[ 3313.874295][ T4013] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060\n[ 3313.874301][ T4013] Mem abort info:\n[ 3313.874303][ T4013]   ESR = 0x0000000096000006\n[ 3313.874305][ T4013]   EC = 0x25: DABT (current EL), IL = 32 bits\n[ 3313.874307][ T4013]   SET = 0, FnV = 0\n[ 3313.874309][ T4013]   EA = 0, S1PTW = 0\n[ 3313.874311][ T4013]   FSC = 0x06: level 2 translation fault\n[ 3313.874313][ T4013] Data abort info:\n[ 3313.874314][ T4013]   ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000\n[ 3313.874316][ T4013]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[ 3313.874318][ T4013]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[ 3313.874320][ T4013] user pgtable: 4k pages, 39-bit VAs, pgdp=00000008f2b0a000\n..\n\n[ 3313.874332][ T4013] Dumping ftrace buffer:\n[ 3313.874334][ T4013]    (ftrace buffer empty)\n..\n..\n[ dd3313.874639][ T4013] CPU: 6 PID: 4013 Comm: InputReader\n[ 3313.874648][ T4013] pc : dualshock4_led_get_brightness+0xc/0x74\n[ 3313.874653][ T4013] lr : led_update_brightness+0x38/0x60\n[ 3313.874656][ T4013] sp : ffffffc0b910bbd0\n..\n..\n[ 3313.874685][ T4013] Call trace:\n[ 3313.874687][ T4013]  dualshock4_led_get_brightness+0xc/0x74\n[ 3313.874690][ T4013]  brightness_show+0x20/0x4c\n[ 3313.874692][ T4013]  dev_attr_show+0x38/0x74\n[ 3313.874696][ T4013]  sysfs_kf_seq_show+0xb4/0x130\n[ 3313.874700][ T4013]  kernfs_seq_show+0x44/0x54\n[ 3313.874703][ T4013]  seq_read_iter+0x158/0x4ec\n[ 3313.874705][ T4013]  kernfs_fop_read_iter+0x68/0x1b4\n[ 3313.874708][ T4013]  vfs_read+0x1e0/0x2c8\n[ 3313.874711][ T4013]  ksys_read+0x78/0xe8\n[ 3313.874714][ T4013]  __arm64_sys_read+0x1c/0x2c\n[ 3313.874718][ T4013]  invoke_syscall+0x58/0x114\n[ 3313.874721][ T4013]  el0_svc_common+0x80/0xe0\n[ 3313.874724][ T4013]  do_el0_svc+0x1c/0x28\n[ 3313.874727][ T4013]  el0_svc+0x38/0x68\n[ 3313.874730][ T4013]  el0t_64_sync_handler+0x68/0xbc\n[ 3313.874732][ T4013]  el0t_64_sync+0x1a8/0x1ac",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "87c2cd0a-cf87-4914-8788-c0ab43dee4e5",  "id": "SUSE-SU-2026:0872-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e67e8c23-0dd1-4a9d-a314-e7b7a40b9d30",  "id": "SUSE-SU-2017:2617-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e71941b-baa7-4b63-a2a2-3a9164e21bd1",  "id": "CLSA-2023-1693419971",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e6c9cb00-6bd2-459c-878e-99561ead3fac",  "id": "CVE-2024-35868",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in cifs_stats_proc_write()\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "07ee19e5-be1c-4046-9a2f-6df6595c45ec",  "id": "CVE-2023-23001",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23001"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return value (expects it to be NULL in the error case, whereas it is actually an error pointer).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b1a732a4-4e1f-4aca-8e02-7df43b55f71e",  "id": "CVE-2025-38384",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: spinand: fix memory leak of ECC engine conf\n\nMemory allocated for the ECC engine conf is not released during spinand\ncleanup. Below kmemleak trace is seen for this memory leak:\n\nunreferenced object 0xffffff80064f00e0 (size 8):\n  comm \"swapper/0\", pid 1, jiffies 4294937458\n  hex dump (first 8 bytes):\n    00 00 00 00 00 00 00 00                          ........\n  backtrace (crc 0):\n    kmemleak_alloc+0x30/0x40\n    __kmalloc_cache_noprof+0x208/0x3c0\n    spinand_ondie_ecc_init_ctx+0x114/0x200\n    nand_ecc_init_ctx+0x70/0xa8\n    nanddev_ecc_engine_init+0xec/0x27c\n    spinand_probe+0xa2c/0x1620\n    spi_mem_probe+0x130/0x21c\n    spi_probe+0xf0/0x170\n    really_probe+0x17c/0x6e8\n    __driver_probe_device+0x17c/0x21c\n    driver_probe_device+0x58/0x180\n    __device_attach_driver+0x15c/0x1f8\n    bus_for_each_drv+0xec/0x150\n    __device_attach+0x188/0x24c\n    device_initial_probe+0x10/0x20\n    bus_probe_device+0x11c/0x160\n\nFix the leak by calling nanddev_ecc_engine_cleanup() inside\nspinand_cleanup().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2df2f5c3-353a-411e-9972-ac876b9ede06",  "id": "CVE-2021-47493",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47493"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix race between searching chunks and release journal_head from buffer_head\n\nEncountered a race between ocfs2_test_bg_bit_allocatable() and\njbd2_journal_put_journal_head() resulting in the below vmcore.\n\n  PID: 106879  TASK: ffff880244ba9c00  CPU: 2   COMMAND: \"loop3\"\n  Call trace:\n    panic\n    oops_end\n    no_context\n    __bad_area_nosemaphore\n    bad_area_nosemaphore\n    __do_page_fault\n    do_page_fault\n    page_fault\n      [exception RIP: ocfs2_block_group_find_clear_bits+316]\n    ocfs2_block_group_find_clear_bits [ocfs2]\n    ocfs2_cluster_group_search [ocfs2]\n    ocfs2_search_chain [ocfs2]\n    ocfs2_claim_suballoc_bits [ocfs2]\n    __ocfs2_claim_clusters [ocfs2]\n    ocfs2_claim_clusters [ocfs2]\n    ocfs2_local_alloc_slide_window [ocfs2]\n    ocfs2_reserve_local_alloc_bits [ocfs2]\n    ocfs2_reserve_clusters_with_limit [ocfs2]\n    ocfs2_reserve_clusters [ocfs2]\n    ocfs2_lock_refcount_allocators [ocfs2]\n    ocfs2_make_clusters_writable [ocfs2]\n    ocfs2_replace_cow [ocfs2]\n    ocfs2_refcount_cow [ocfs2]\n    ocfs2_file_write_iter [ocfs2]\n    lo_rw_aio\n    loop_queue_work\n    kthread_worker_fn\n    kthread\n    ret_from_fork\n\nWhen ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the\nbg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and\nreleased the jounal head from the buffer head.  Needed to take bit lock\nfor the bit 'BH_JournalHead' to fix this race.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bab422f4-8074-4570-b1c6-a8875d2f9027",  "id": "CVE-2011-2898",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2898"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "net/packet/af_packet.c in the Linux kernel before 2.6.39.3 does not properly restrict user-space access to certain packet data structures associated with VLAN Tag Control Information, which allows local users to obtain potentially sensitive information via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aafb64be-90e6-465a-a816-c563821d4e6f",  "id": "CVE-2021-4032",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4032"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    459  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected. In this flaw the KVM subsystem may crash the kernel due to mishandling of memory errors that happens during VCPU construction, which allows an attacker with special user privilege to cause a denial of service. This flaw affects kernel versions prior to 5.15 rc7.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3f2d007b-eb1e-4ee4-99a2-25c4ac488d59",  "id": "CVE-2023-52506",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Set all reserved memblocks on Node#0 at initialization\n\nAfter commit 61167ad5fecdea (\"mm: pass nid to reserve_bootmem_region()\")\nwe get a panic if DEFERRED_STRUCT_PAGE_INIT is enabled:\n\n[    0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000000000002b82, era == 90000000040e3f28, ra == 90000000040e3f18\n[    0.000000] Oops[#1]:\n[    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.5.0+ #733\n[    0.000000] pc 90000000040e3f28 ra 90000000040e3f18 tp 90000000046f4000 sp 90000000046f7c90\n[    0.000000] a0 0000000000000001 a1 0000000000200000 a2 0000000000000040 a3 90000000046f7ca0\n[    0.000000] a4 90000000046f7ca4 a5 0000000000000000 a6 90000000046f7c38 a7 0000000000000000\n[    0.000000] t0 0000000000000002 t1 9000000004b00ac8 t2 90000000040e3f18 t3 90000000040f0800\n[    0.000000] t4 00000000000f0000 t5 80000000ffffe07e t6 0000000000000003 t7 900000047fff5e20\n[    0.000000] t8 aaaaaaaaaaaaaaab u0 0000000000000018 s9 0000000000000000 s0 fffffefffe000000\n[    0.000000] s1 0000000000000000 s2 0000000000000080 s3 0000000000000040 s4 0000000000000000\n[    0.000000] s5 0000000000000000 s6 fffffefffe000000 s7 900000000470b740 s8 9000000004ad4000\n[    0.000000]    ra: 90000000040e3f18 reserve_bootmem_region+0xec/0x21c\n[    0.000000]   ERA: 90000000040e3f28 reserve_bootmem_region+0xfc/0x21c\n[    0.000000]  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n[    0.000000]  PRMD: 00000000 (PPLV0 -PIE -PWE)\n[    0.000000]  EUEN: 00000000 (-FPE -SXE -ASXE -BTE)\n[    0.000000]  ECFG: 00070800 (LIE=11 VS=7)\n[    0.000000] ESTAT: 00010800 [PIL] (IS=11 ECode=1 EsubCode=0)\n[    0.000000]  BADV: 0000000000002b82\n[    0.000000]  PRID: 0014d000 (Loongson-64bit, Loongson-3A6000)\n[    0.000000] Modules linked in:\n[    0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____))\n[    0.000000] Stack : 0000000000000000 9000000002eb5430 0000003a00000020 90000000045ccd00\n[    0.000000]         900000000470e000 90000000002c1918 0000000000000000 9000000004110780\n[    0.000000]         00000000fe6c0000 0000000480000000 9000000004b4e368 9000000004110748\n[    0.000000]         0000000000000000 900000000421ca84 9000000004620000 9000000004564970\n[    0.000000]         90000000046f7d78 9000000002cc9f70 90000000002c1918 900000000470e000\n[    0.000000]         9000000004564970 90000000040bc0e0 90000000046f7d78 0000000000000000\n[    0.000000]         0000000000004000 90000000045ccd00 0000000000000000 90000000002c1918\n[    0.000000]         90000000002c1900 900000000470b700 9000000004b4df78 9000000004620000\n[    0.000000]         90000000046200a8 90000000046200a8 0000000000000000 9000000004218b2c\n[    0.000000]         9000000004270008 0000000000000001 0000000000000000 90000000045ccd00\n[    0.000000]         ...\n[    0.000000] Call Trace:\n[    0.000000] [<90000000040e3f28>] reserve_bootmem_region+0xfc/0x21c\n[    0.000000] [<900000000421ca84>] memblock_free_all+0x114/0x350\n[    0.000000] [<9000000004218b2c>] mm_core_init+0x138/0x3cc\n[    0.000000] [<9000000004200e38>] start_kernel+0x488/0x7a4\n[    0.000000] [<90000000040df0d8>] kernel_entry+0xd8/0xdc\n[    0.000000]\n[    0.000000] Code: 02eb21ad  00410f4c  380c31ac <262b818d> 6800b70d  02c1c196  0015001c  57fe4bb1  260002cd\n\nThe reason is early memblock_reserve() in memblock_init() set node id to\nMAX_NUMNODES, making NODE_DATA(nid) a NULL dereference in the call chain\nreserve_bootmem_region() -> init_reserved_page(). After memblock_init(),\nthose late calls of memblock_reserve() operate on subregions of memblock\n.memory regions. As a result, these reserved regions will be set to the\ncorrect node at the first iteration of memmap_init_reserved_pages().\n\nSo set all reserved memblocks on Node#0 at initialization can avoid this\npanic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "35052979-b73e-4293-8067-ea7ec95bfdd0",  "id": "CVE-2011-1093",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1093"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint, which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending a DCCP-Close packet followed by a DCCP-Reset packet.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a1cc4277-5e41-4c39-ad23-02989076e134",  "id": "CVE-2024-46811",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box\n\n[Why]\nCoverity reports OVERRUN warning. soc.num_states could\nbe 40. But array range of bw_params->clk_table.entries is 8.\n\n[How]\nAssert if soc.num_states greater than 8.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eb0c2802-5a40-4109-8569-1cb0b53f5773",  "id": "ROOT-OS-ALPINE-317-CVE-2026-31790",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e88360ac-f608-44c9-bdb7-b1708272e400",  "id": "DSA-5764-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d36b04ce-368a-4de8-a2a9-ebb93af2c945",  "id": "CVE-2025-37963",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: bpf: Only mitigate cBPF programs loaded by unprivileged users\n\nSupport for eBPF programs loaded by unprivileged users is typically\ndisabled. This means only cBPF programs need to be mitigated for BHB.\n\nIn addition, only mitigate cBPF programs that were loaded by an\nunprivileged user. Privileged users can also load the same program\nvia eBPF, making the mitigation pointless.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3adea3e-e3d2-45a4-8dde-cf3ff217fd6a",  "id": "MGASA-2023-0313",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e642a01e-20d8-423f-aa53-95db7b783a25",  "id": "CVE-2024-49932",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't readahead the relocation inode on RST\n\nOn relocation we're doing readahead on the relocation inode, but if the\nfilesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to\npreallocated extents not being mapped in the RST) from the lookup.\n\nBut readahead doesn't handle the error and submits invalid reads to the\ndevice, causing an assertion in the scatter-gather list code:\n\n  BTRFS info (device nvme1n1): balance: start -d -m -s\n  BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0\n  BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0\n  ------------[ cut here ]------------\n  kernel BUG at include/linux/scatterlist.h:115!\n  Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI\n  CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567\n  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\n  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\n  RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\n  RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\n  R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\n  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 000000002cd11000 CR3: 00000001109ea001 CR4: 0000000000370eb0\n  Call Trace:\n   <TASK>\n   ? __die_body.cold+0x14/0x25\n   ? die+0x2e/0x50\n   ? do_trap+0xca/0x110\n   ? do_error_trap+0x65/0x80\n   ? __blk_rq_map_sg+0x339/0x4a0\n   ? exc_invalid_op+0x50/0x70\n   ? __blk_rq_map_sg+0x339/0x4a0\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? __blk_rq_map_sg+0x339/0x4a0\n   nvme_prep_rq.part.0+0x9d/0x770\n   nvme_queue_rq+0x7d/0x1e0\n   __blk_mq_issue_directly+0x2a/0x90\n   ? blk_mq_get_budget_and_tag+0x61/0x90\n   blk_mq_try_issue_list_directly+0x56/0xf0\n   blk_mq_flush_plug_list.part.0+0x52b/0x5d0\n   __blk_flush_plug+0xc6/0x110\n   blk_finish_plug+0x28/0x40\n   read_pages+0x160/0x1c0\n   page_cache_ra_unbounded+0x109/0x180\n   relocate_file_extent_cluster+0x611/0x6a0\n   ? btrfs_search_slot+0xba4/0xd20\n   ? balance_dirty_pages_ratelimited_flags+0x26/0xb00\n   relocate_data_extent.constprop.0+0x134/0x160\n   relocate_block_group+0x3f2/0x500\n   btrfs_relocate_block_group+0x250/0x430\n   btrfs_relocate_chunk+0x3f/0x130\n   btrfs_balance+0x71b/0xef0\n   ? kmalloc_trace_noprof+0x13b/0x280\n   btrfs_ioctl+0x2c2e/0x3030\n   ? kvfree_call_rcu+0x1e6/0x340\n   ? list_lru_add_obj+0x66/0x80\n   ? mntput_no_expire+0x3a/0x220\n   __x64_sys_ioctl+0x96/0xc0\n   do_syscall_64+0x54/0x110\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  RIP: 0033:0x7fcc04514f9b\n  Code: Unable to access opcode bytes at 0x7fcc04514f71.\n  RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcc04514f9b\n  RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000013 R09: 0000000000000001\n  R10: 00007fcc043fbba8 R11: 0000000000000246 R12: 00007ffeba924fc5\n  R13: 00007ffeba923460 R14: 0000000000000002 R15: 00000000004d4bb0\n   </TASK>\n  Modules linked in:\n  ---[ end trace 0000000000000000 ]---\n  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\n  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\n  RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\n  RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\n  R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\n  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fcc04514f71 CR3: 00000001109ea001 CR4: 0000000000370eb0\n  Kernel p\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'SNYK:SNYK-UNMANAGED-TORVALDSLINUX-20697448'"    }  ]},{  "bom-ref": "c041cb81-e2cc-4682-aa63-3361ebb4c171",  "id": "CVE-2025-21909",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: reject cooked mode if it is set along with other flags\n\nIt is possible to set both MONITOR_FLAG_COOK_FRAMES and MONITOR_FLAG_ACTIVE\nflags simultaneously on the same monitor interface from the userspace. This\ncauses a sub-interface to be created with no IEEE80211_SDATA_IN_DRIVER bit\nset because the monitor interface is in the cooked state and it takes\nprecedence over all other states. When the interface is then being deleted\nthe kernel calls WARN_ONCE() from check_sdata_in_driver() because of missing\nthat bit.\n\nFix this by rejecting MONITOR_FLAG_COOK_FRAMES if it is set along with\nother flags.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8fd32ef4-52a6-46dd-99b8-ed09541dbac1",  "id": "CVE-2022-48938",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nCDC-NCM: avoid overflow in sanity checking\n\nA broken device may give an extreme offset like 0xFFF0\nand a reasonable length for a fragment. In the sanity\ncheck as formulated now, this will create an integer\noverflow, defeating the sanity check. Both offset\nand offset + len need to be checked in such a manner\nthat no overflow can occur.\nAnd those quantities should be unsigned.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9a0b68da-c7cf-4a35-9e8c-12f56af5685d",  "id": "ROOT-OS-ALPINE-315-CVE-2026-34180",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2495a6a3-93c4-4900-ad7b-6214ee4fdb83",  "id": "CVE-2023-52617",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    459  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: switchtec: Fix stdev_release() crash after surprise hot remove\n\nA PCI device hot removal may occur while stdev->cdev is held open. The call\nto stdev_release() then happens during close or exit, at a point way past\nswitchtec_pci_remove(). Otherwise the last ref would vanish with the\ntrailing put_device(), just before return.\n\nAt that later point in time, the devm cleanup has already removed the\nstdev->mmio_mrpc mapping. Also, the stdev->pdev reference was not a counted\none. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause\na fatal page fault, and the subsequent dma_free_coherent(), if reached,\nwould pass a stale &stdev->pdev->dev pointer.\n\nFix by moving MRPC DMA shutdown into switchtec_pci_remove(), after\nstdev_kill(). Counting the stdev->pdev ref is now optional, but may prevent\nfuture accidents.\n\nReproducible via the script at\nhttps://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ebdb5cb5-353c-4b0e-9a05-7481a7d12cf9",  "id": "CVE-2021-29264",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29264"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in the Freescale Gianfar Ethernet driver allows attackers to cause a system crash because a negative fragment size is calculated in situations involving an rx queue overrun when jumbo packets are used and NAPI is enabled, aka CID-d8861bab48b6.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6a6dd198-bf0d-48e4-8fee-9e31139f997b",  "id": "CLSA-2023-1693418632",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2e02886-5976-4277-b5de-a6a3cf9da80a",  "id": "CVE-2024-46727",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update\n\n[Why]\nCoverity reports NULL_RETURN warning.\n\n[How]\nAdd otg_master NULL check.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "81236715-5d22-4c99-bddd-bd1763662019",  "id": "CVE-2022-49993",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nloop: Check for overflow while configuring loop\n\nThe userspace can configure a loop using an ioctl call, wherein\na configuration of type loop_config is passed (see lo_ioctl()'s\ncase on line 1550 of drivers/block/loop.c). This proceeds to call\nloop_configure() which in turn calls loop_set_status_from_info()\n(see line 1050 of loop.c), passing &config->info which is of type\nloop_info64*. This function then sets the appropriate values, like\nthe offset.\n\nloop_device has lo_offset of type loff_t (see line 52 of loop.c),\nwhich is typdef-chained to long long, whereas loop_info64 has\nlo_offset of type __u64 (see line 56 of include/uapi/linux/loop.h).\n\nThe function directly copies offset from info to the device as\nfollows (See line 980 of loop.c):\n\tlo->lo_offset = info->lo_offset;\n\nThis results in an overflow, which triggers a warning in iomap_iter()\ndue to a call to iomap_iter_done() which has:\n\tWARN_ON_ONCE(iter->iomap.offset > iter->pos);\n\nThus, check for negative value during loop_set_status_from_info().\n\nBug report: https://syzkaller.appspot.com/bug?id=c620fe14aac810396d3c3edc9ad73848bf69a29e",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "06469ec2-9481-4276-849b-eae0b0700b2f",  "id": "CVE-2024-46774",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()\n\nSmatch warns:\n\n  arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential\n  spectre issue 'args.args' [r] (local cap)\n\nThe 'nargs' and 'nret' locals come directly from a user-supplied\nbuffer and are used as indexes into a small stack-based array and as\ninputs to copy_to_user() after they are subject to bounds checks.\n\nUse array_index_nospec() after the bounds checks to clamp these values\nfor speculative execution.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0da2bf11-3bf5-4485-83b1-a1ce28665348",  "id": "AZL-77603",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2b1e846b-2025-4cee-ba77-9ac3c63d77d3",  "id": "ALSA-2026:22314",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5fee5947-c070-4c13-94b3-c7d314ea909e",  "id": "RHSA-2023:1441",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "82dc1d52-37cd-489e-b9ab-6703f4102bea",  "id": "CVE-2022-50028",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngadgetfs: ep_io - wait until IRQ finishes\n\nafter usb_ep_queue() if wait_for_completion_interruptible() is\ninterrupted we need to wait until IRQ gets finished.\n\nOtherwise complete() from epio_complete() can corrupt stack.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fcaa5953-8e1f-4a0a-a7e7-e1cc3cde6a27",  "id": "CVE-2015-8767",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8767"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does not properly manage the relationship between a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "44358a67-4569-4b2f-b86b-b016d1cb70e6",  "id": "CVE-2023-53035",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()\n\nThe ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a\nmetadata array to/from user space, may copy uninitialized buffer regions\nto user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO\nand NILFS_IOCTL_GET_CPINFO.\n\nThis can occur when the element size of the user space metadata given by\nthe v_size member of the argument nilfs_argv structure is larger than the\nsize of the metadata element (nilfs_suinfo structure or nilfs_cpinfo\nstructure) on the file system side.\n\nKMSAN-enabled kernels detect this issue as follows:\n\n BUG: KMSAN: kernel-infoleak in instrument_copy_to_user\n include/linux/instrumented.h:121 [inline]\n BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33\n  instrument_copy_to_user include/linux/instrumented.h:121 [inline]\n  _copy_to_user+0xc0/0x100 lib/usercopy.c:33\n  copy_to_user include/linux/uaccess.h:169 [inline]\n  nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99\n  nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]\n  nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290\n  nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343\n  __do_compat_sys_ioctl fs/ioctl.c:968 [inline]\n  __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910\n  __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910\n  do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]\n  __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178\n  do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203\n  do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246\n  entry_SYSENTER_compat_after_hwframe+0x70/0x82\n\n Uninit was created at:\n  __alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5572\n  alloc_pages+0xab0/0xd80 mm/mempolicy.c:2287\n  __get_free_pages+0x34/0xc0 mm/page_alloc.c:5599\n  nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74\n  nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline]\n  nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290\n  nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343\n  __do_compat_sys_ioctl fs/ioctl.c:968 [inline]\n  __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910\n  __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910\n  do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]\n  __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178\n  do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203\n  do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246\n  entry_SYSENTER_compat_after_hwframe+0x70/0x82\n\n Bytes 16-127 of 3968 are uninitialized\n ...\n\nThis eliminates the leak issue by initializing the page allocated as\nbuffer using get_zeroed_page().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b32fcc0f-9cc1-4ebd-99f0-f62630749c3e",  "id": "DLA-177-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "26e36fa7-9498-4792-8ae3-a5aa4b6175cb",  "id": "CVE-2023-40791",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40791"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for try_grab_page.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0dd63a8-754d-4ecd-918d-af9333fd4e89",  "id": "CVE-2018-20169",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20169"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "891714b4-873f-449c-8f91-74bb7d424ef2",  "id": "CVE-2020-12695",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12695"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H"    }  ],  "cwes": [    276  ],  "analysis": {    "state": "in_triage"  },  "description": "The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:158051/CallStranger-UPnP-Vulnerability-Checker.html'"    }  ]},{  "bom-ref": "2c9e5bda-fc6c-4583-a436-fefb1f7bf202",  "id": "CVE-2018-13097",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13097"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125,    369  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. There is an out-of-bounds read or a divide-by-zero error for an incorrect user_block_count in a corrupted f2fs image, leading to a denial of service (BUG).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a6ec232-4c44-4a42-b046-5259191f0572",  "id": "CVE-2024-47726",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to wait dio completion\n\nIt should wait all existing dio write IOs before block removal,\notherwise, previous direct write IO may overwrite data in the\nblock which may be reused by other inode.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6a61a8f0-6493-4ba4-9745-8905d7c08a11",  "id": "SUSE-SU-2016:1233-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18c5a85a-a43e-427c-b820-abb6bcb06725",  "id": "CVE-2022-49535",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI\n\nIf lpfc_issue_els_flogi() fails and returns non-zero status, the node\nreference count is decremented to trigger the release of the nodelist\nstructure. However, if there is a prior registration or dev-loss-evt work\npending, the node may be released prematurely.  When dev-loss-evt\ncompletes, the released node is referenced causing a use-after-free null\npointer dereference.\n\nSimilarly, when processing non-zero ELS PLOGI completion status in\nlpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport\nregistration before triggering node removal.  If dev-loss-evt work is\npending, the node may be released prematurely and a subsequent call to\nlpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference.\n\nAdd test for pending dev-loss before decrementing the node reference count\nfor FLOGI, PLOGI, PRLI, and ADISC handling.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "31c223f3-7237-4975-b5a2-e7866c5946b3",  "id": "CVE-2024-56606",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: avoid erroring out after sock_init_data() in packet_create()\n\nAfter sock_init_data() the allocated sk object is attached to the provided\nsock object. On error, packet_create() frees the sk object leaving the\ndangling pointer in the sock object on return. Some other code may try\nto use this pointer and cause use-after-free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c27187ec-2913-4e06-b6f6-0ced3fa4049a",  "id": "CVE-2021-4150",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4150"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in the add_partition in block/partitions/core.c in the Linux kernel. A local attacker with user privileges could cause a denial of service on the system. The issue results from the lack of code cleanup when device_add call fails when adding a partition to the disk.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dfd4e702-09c6-4a7f-85c8-af4b30ea6150",  "id": "CVE-2023-23454",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23454"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    843  ],  "analysis": {    "state": "in_triage"  },  "description": "cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0efdc5b7-3f92-4b4e-b26e-e1190c0dacea",  "id": "CVE-2026-43250",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()\n\nThe ChipIdea UDC driver can encounter \"not page aligned sg buffer\"\nerrors when a USB device is reconnected after being disconnected\nduring an active transfer. This occurs because _ep_nuke() returns\nrequests to the gadget layer without properly unmapping DMA buffers\nor cleaning up scatter-gather bounce buffers.\n\nRoot cause:\nWhen a disconnect happens during a multi-segment DMA transfer, the\nrequest's num_mapped_sgs field and sgt.sgl pointer remain set with\nstale values. The request is returned to the gadget driver with status\n-ESHUTDOWN but still has active DMA state. If the gadget driver reuses\nthis request on reconnect without reinitializing it, the stale DMA\nstate causes _hardware_enqueue() to skip DMA mapping (seeing non-zero\nnum_mapped_sgs) and attempt to use freed/invalid DMA addresses,\nleading to alignment errors and potential memory corruption.\n\nThe normal completion path via _hardware_dequeue() properly calls\nusb_gadget_unmap_request_by_dev() and sglist_do_debounce() before\nreturning the request. The _ep_nuke() path must do the same cleanup\nto ensure requests are returned in a clean, reusable state.\n\nFix:\nAdd DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror\nthe cleanup sequence in _hardware_dequeue():\n- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set\n- Call sglist_do_debounce() with copy=false if bounce buffer exists\n\nThis ensures that when requests are returned due to endpoint shutdown,\nthey don't retain stale DMA mappings. The 'false' parameter to\nsglist_do_debounce() prevents copying data back (appropriate for\nshutdown path where transfer was aborted).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52b5bad0-5250-4179-a2ad-f322faaaf736",  "id": "CVE-2018-6412",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6412"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "In the function sbusfb_ioctl_helper() in drivers/video/fbdev/sbuslib.c in the Linux kernel through 4.15, an integer signedness error allows arbitrary information leakage for the FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC commands.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "71d76b87-a0e8-40df-ab90-de2f3af6e659",  "id": "CVE-2021-47351",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47351"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    617,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: Fix races between xattr_{set|get} and listxattr operations\n\nUBIFS may occur some problems with concurrent xattr_{set|get} and\nlistxattr operations, such as assertion failure, memory corruption,\nstale xattr value[1].\n\nFix it by importing a new rw-lock in @ubifs_inode to serilize write\noperations on xattr, concurrent read operations are still effective,\njust like ext4.\n\n[1] https://lore.kernel.org/linux-mtd/20200630130438.141649-1-houtao1@huawei.com",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aae00292-9526-4c53-8c34-04d19540aaa1",  "id": "CVE-2023-4134",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4134"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device cleanup routine due to a possible rearming of the watchdog_timer from the workqueue. This could allow a local user to crash the system, causing a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "986fb36b-25e4-40c5-b73e-c11d08a5afee",  "id": "CVE-2011-0463",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0463"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The ocfs2_prepare_page_for_write function in fs/ocfs2/aops.c in the Oracle Cluster File System 2 (OCFS2) subsystem in the Linux kernel before 2.6.39-rc1 does not properly handle holes that cross page boundaries, which allows local users to obtain potentially sensitive information from uninitialized disk locations by reading a file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6850071f-1312-45c6-bcf3-6afc2b1ad3f8",  "id": "CVE-2024-56670",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer\n\nConsidering that in some extreme cases,\nwhen u_serial driver is accessed by multiple threads,\nThread A is executing the open operation and calling the gs_open,\nThread B is executing the disconnect operation and calling the\ngserial_disconnect function,The port->port_usb pointer will be set to NULL.\n\nE.g.\n    Thread A                                 Thread B\n    gs_open()                                gadget_unbind_driver()\n    gs_start_io()                            composite_disconnect()\n    gs_start_rx()                            gserial_disconnect()\n    ...                                      ...\n    spin_unlock(&port->port_lock)\n    status = usb_ep_queue()                  spin_lock(&port->port_lock)\n    spin_lock(&port->port_lock)              port->port_usb = NULL\n    gs_free_requests(port->port_usb->in)     spin_unlock(&port->port_lock)\n    Crash\n\nThis causes thread A to access a null pointer (port->port_usb is null)\nwhen calling the gs_free_requests function, causing a crash.\n\nIf port_usb is NULL, the release request will be skipped as it\nwill be done by gserial_disconnect.\n\nSo add a null pointer check to gs_start_io before attempting\nto access the value of the pointer port->port_usb.\n\nCall trace:\n gs_start_io+0x164/0x25c\n gs_open+0x108/0x13c\n tty_open+0x314/0x638\n chrdev_open+0x1b8/0x258\n do_dentry_open+0x2c4/0x700\n vfs_open+0x2c/0x3c\n path_openat+0xa64/0xc60\n do_filp_open+0xb8/0x164\n do_sys_openat2+0x84/0xf0\n __arm64_sys_openat+0x70/0x9c\n invoke_syscall+0x58/0x114\n el0_svc_common+0x80/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x38/0x68",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8256c6f0-3e28-42cf-bf52-69369e7a1328",  "id": "CVE-2011-3191",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3191"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer signedness error in the CIFSFindNext function in fs/cifs/cifssmb.c in the Linux kernel before 3.1 allows remote CIFS servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large length value in a response to a read request for a directory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6487cda6-baa5-42e9-851c-8be4fd71bc9d",  "id": "CVE-2015-8785",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8785"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel before 4.4 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "519a4010-ea65-42f3-abce-756bdd1de55b",  "id": "CVE-2021-47269",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47269"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: ep0: fix NULL pointer exception\n\nThere is no validation of the index from dwc3_wIndex_to_dep() and we might\nbe referring a non-existing ep and trigger a NULL pointer exception. In\ncertain configurations we might use fewer eps and the index might wrongly\nindicate a larger ep index than existing.\n\nBy adding this validation from the patch we can actually report a wrong\nindex back to the caller.\n\nIn our usecase we are using a composite device on an older kernel, but\nupstream might use this fix also. Unfortunately, I cannot describe the\nhardware for others to reproduce the issue as it is a proprietary\nimplementation.\n\n[   82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4\n[   82.966891] Mem abort info:\n[   82.969663]   ESR = 0x96000006\n[   82.972703]   Exception class = DABT (current EL), IL = 32 bits\n[   82.978603]   SET = 0, FnV = 0\n[   82.981642]   EA = 0, S1PTW = 0\n[   82.984765] Data abort info:\n[   82.987631]   ISV = 0, ISS = 0x00000006\n[   82.991449]   CM = 0, WnR = 0\n[   82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc\n[   83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000\n[   83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP\n[   83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)\n[   83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1\n[   83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)\n[   83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c\n[   83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94\n\n...\n\n[   83.141788] Call trace:\n[   83.144227]  dwc3_ep0_handle_feature+0x414/0x43c\n[   83.148823]  dwc3_ep0_interrupt+0x3b4/0xc94\n[   83.181546] ---[ end trace aac6b5267d84c32f ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aaaca140-06d7-4ee4-a89c-01cccbec522b",  "id": "CVE-2017-16939",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16939"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:44049'"    }  ]},{  "bom-ref": "80bcf5c9-67a4-4f84-b824-4b37a4806b43",  "id": "CLSA-2026-1770917492",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2dc45ce7-af74-4d53-b53c-0992932aceac",  "id": "CVE-2020-25687",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25687"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    122  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a denial of service. The highest threat from this vulnerability is to system availability.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4b123de1-1af3-4f1b-8766-160c5b9a0dd9",  "id": "CVE-2025-37801",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-imx: Add check for spi_imx_setupxfer()\n\nAdd check for the return value of spi_imx_setupxfer().\nspi_imx->rx and spi_imx->tx function pointer can be NULL when\nspi_imx_setupxfer() return error, and make NULL pointer dereference.\n\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n Call trace:\n  0x0\n  spi_imx_pio_transfer+0x50/0xd8\n  spi_imx_transfer_one+0x18c/0x858\n  spi_transfer_one_message+0x43c/0x790\n  __spi_pump_transfer_message+0x238/0x5d4\n  __spi_sync+0x2b0/0x454\n  spi_write_then_read+0x11c/0x200",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "25861f1f-b201-4bba-a6eb-df988e781927",  "id": "CVE-2020-27786",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27786"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bc3de8f9-37d6-4758-9a74-969c041fa7a0",  "id": "CVE-2019-15216",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15216"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.14. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/yurex.c driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51f1000b-7916-42b1-bc52-66b38ebb1c65",  "id": "CVE-2017-9059",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9059"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    404  ],  "analysis": {    "state": "in_triage"  },  "description": "The NFSv4 implementation in the Linux kernel through 4.11.1 allows local users to cause a denial of service (resource consumption) by leveraging improper channel callback shutdown when unmounting an NFSv4 filesystem, aka a \"module reference and kernel daemon\" leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3866b8bf-f539-43c6-bacd-c3eae4c28336",  "id": "CVE-2021-3506",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3506"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "39ac99da-a27a-447d-b6a0-e68a273992f8",  "id": "CVE-2022-50206",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: fix oops in concurrently setting insn_emulation sysctls\n\nemulation_proc_handler() changes table->data for proc_dointvec_minmax\nand can generate the following Oops if called concurrently with itself:\n\n | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010\n | Internal error: Oops: 96000006 [#1] SMP\n | Call trace:\n | update_insn_emulation_mode+0xc0/0x148\n | emulation_proc_handler+0x64/0xb8\n | proc_sys_call_handler+0x9c/0xf8\n | proc_sys_write+0x18/0x20\n | __vfs_write+0x20/0x48\n | vfs_write+0xe4/0x1d0\n | ksys_write+0x70/0xf8\n | __arm64_sys_write+0x20/0x28\n | el0_svc_common.constprop.0+0x7c/0x1c0\n | el0_svc_handler+0x2c/0xa0\n | el0_svc+0x8/0x200\n\nTo fix this issue, keep the table->data as &insn->current_mode and\nuse container_of() to retrieve the insn pointer. Another mutex is\nused to protect against the current_mode update but not for retrieving\ninsn_emulation as table->data is no longer changing.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4f158734-878e-4ec7-a98b-638e056d4992",  "id": "CVE-2018-7755",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7755"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "28323284-d549-4622-af89-6641c2b74647",  "id": "CVE-2026-46177",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: Add limits to event and receive message requests\n\nThe driver would just fetch events and receive messages until the\nBMC said it was done.  To avoid issues with BMCs that never say they are\ndone, add a limit of 10 fetches at a time.\n\nIn addition, an si interface has an attn state it can return from the\nhardware which is supposed to cause a flag fetch to see if the driver\nneeds to fetch events or message or a few other things.  If the attn\nbit gets stuck, it's a similar problem.  So allow messages in between\nflag fetches so the driver itself doesn't get stuck.\n\nThis is a more general fix than the previous fix for the specific bad\nBMC, but should fix the more general issue of a BMC that won't stop\nsaying it has data.\n\nThis has been there from the beginning of the driver.  It's not a bug\nper-se, but it is accounting for bugs in BMCs.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "20c889c2-a850-436e-ab31-df4e7c281f1d",  "id": "CVE-2016-2085",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2085"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    19  ],  "analysis": {    "state": "in_triage"  },  "description": "The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc0c71aa-404f-496b-8d1f-292dc1d6c120",  "id": "CVE-2019-19523",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19523"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver, aka CID-44efc269db79.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17b9a5a3-af4e-4f83-b9c2-b5de73d4790d",  "id": "CVE-2021-4159",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4159"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    202  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5ac24332-06c2-4f0b-93d5-92d109c8ff99",  "id": "CVE-2023-53650",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()\n\nIf 'mipid_detect()' fails, we must free 'md' to avoid a memory leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5cd960a3-7966-4ba3-bf48-c6ffcfa5c2e7",  "id": "CVE-2024-0641",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667,    833  ],  "analysis": {    "state": "in_triage"  },  "description": "A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "61b305ec-01f0-4a19-b51f-ff3eb4c29fba",  "id": "CVE-2024-26756",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    459  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: Don't register sync_thread for reshape directly\n\nCurrently, if reshape is interrupted, then reassemble the array will\nregister sync_thread directly from pers->run(), in this case\n'MD_RECOVERY_RUNNING' is set directly, however, there is no guarantee\nthat md_do_sync() will be executed, hence stop_sync_thread() will hang\nbecause 'MD_RECOVERY_RUNNING' can't be cleared.\n\nLast patch make sure that md_do_sync() will set MD_RECOVERY_DONE,\nhowever, following hang can still be triggered by dm-raid test\nshell/lvconvert-raid-reshape.sh occasionally:\n\n[root@fedora ~]# cat /proc/1982/stack\n[<0>] stop_sync_thread+0x1ab/0x270 [md_mod]\n[<0>] md_frozen_sync_thread+0x5c/0xa0 [md_mod]\n[<0>] raid_presuspend+0x1e/0x70 [dm_raid]\n[<0>] dm_table_presuspend_targets+0x40/0xb0 [dm_mod]\n[<0>] __dm_destroy+0x2a5/0x310 [dm_mod]\n[<0>] dm_destroy+0x16/0x30 [dm_mod]\n[<0>] dev_remove+0x165/0x290 [dm_mod]\n[<0>] ctl_ioctl+0x4bb/0x7b0 [dm_mod]\n[<0>] dm_ctl_ioctl+0x11/0x20 [dm_mod]\n[<0>] vfs_ioctl+0x21/0x60\n[<0>] __x64_sys_ioctl+0xb9/0xe0\n[<0>] do_syscall_64+0xc6/0x230\n[<0>] entry_SYSCALL_64_after_hwframe+0x6c/0x74\n\nMeanwhile mddev->recovery is:\nMD_RECOVERY_RUNNING |\nMD_RECOVERY_INTR |\nMD_RECOVERY_RESHAPE |\nMD_RECOVERY_FROZEN\n\nFix this problem by remove the code to register sync_thread directly\nfrom raid10 and raid5. And let md_check_recovery() to register\nsync_thread.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dfb1fb39-69cf-40bc-a970-6d3fcdfc7cdc",  "id": "CVE-2013-2897",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2897"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate attackers to cause a denial of service (heap memory corruption, or NULL pointer dereference and OOPS) via a crafted device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2dff1ef9-7430-4e29-9f53-6dfdeeeb6eac",  "id": "CVE-2025-38457",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Abort __tc_modify_qdisc if parent class does not exist\n\nLion's patch [1] revealed an ancient bug in the qdisc API.\nWhenever a user creates/modifies a qdisc specifying as a parent another\nqdisc, the qdisc API will, during grafting, detect that the user is\nnot trying to attach to a class and reject. However grafting is\nperformed after qdisc_create (and thus the qdiscs' init callback) is\nexecuted. In qdiscs that eventually call qdisc_tree_reduce_backlog\nduring init or change (such as fq, hhf, choke, etc), an issue\narises. For example, executing the following commands:\n\nsudo tc qdisc add dev lo root handle a: htb default 2\nsudo tc qdisc add dev lo parent a: handle beef fq\n\nQdiscs such as fq, hhf, choke, etc unconditionally invoke\nqdisc_tree_reduce_backlog() in their control path init() or change() which\nthen causes a failure to find the child class; however, that does not stop\nthe unconditional invocation of the assumed child qdisc's qlen_notify with\na null class. All these qdiscs make the assumption that class is non-null.\n\nThe solution is ensure that qdisc_leaf() which looks up the parent\nclass, and is invoked prior to qdisc_create(), should return failure on\nnot finding the class.\nIn this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the\nparentid doesn't correspond to a class, so that we can detect it\nearlier on and abort before qdisc_create is called.\n\n[1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "80cd3434-738d-4f21-881a-629bdcccc3db",  "id": "SUSE-SU-2026:22496-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5519fb7-c882-4a11-871f-9e6add865ee0",  "id": "CVE-2015-2922",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2922"  },  "ratings": [    {      "score": 3.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    17  ],  "analysis": {    "state": "in_triage"  },  "description": "The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "37f2fd7b-fefd-4351-97de-2dedc70a6773",  "id": "CVE-2016-4486",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4486"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:46006'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:150840/Linux-Kernel-4.4-rtnetlink-Stack-Memory-Disclosure.html'"    }  ]},{  "bom-ref": "b0dd7416-4e10-499c-aebc-f7435f1ce8b5",  "id": "CVE-2025-21738",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-sff: Ensure that we cannot write outside the allocated buffer\n\nreveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len\nset to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to\nATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to\nwrite outside the allocated buffer, overwriting random memory.\n\nWhile a ATA device is supposed to abort a ATA_NOP command, there does seem\nto be a bug either in libata-sff or QEMU, where either this status is not\nset, or the status is cleared before read by ata_sff_hsm_move().\nAnyway, that is most likely a separate bug.\n\nLooking at __atapi_pio_bytes(), it already has a safety check to ensure\nthat __atapi_pio_bytes() cannot write outside the allocated buffer.\n\nAdd a similar check to ata_pio_sector(), such that also ata_pio_sector()\ncannot write outside the allocated buffer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5f17b64f-3a93-48f6-ac96-4a877994753a",  "id": "CVE-2013-1792",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1792"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "62f2b00d-1161-467d-8185-6139cdd9054b",  "id": "DSA-3125-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "532a8dce-b1e7-4ce4-af62-e79e04bf0a9b",  "id": "CVE-2015-7799",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7799"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel through 4.2.3 does not ensure that certain slot numbers are valid, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f6584cb6-eacc-416f-8ea9-c3909bf3d7b1",  "id": "CVE-2022-48923",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: prevent copying too big compressed lzo segment\n\nCompressed length can be corrupted to be a lot larger than memory\nwe have allocated for buffer.\nThis will cause memcpy in copy_compressed_segment to write outside\nof allocated memory.\n\nThis mostly results in stuck read syscall but sometimes when using\nbtrfs send can get #GP\n\n  kernel: general protection fault, probably for non-canonical address 0x841551d5c1000: 0000 [#1] PREEMPT SMP NOPTI\n  kernel: CPU: 17 PID: 264 Comm: kworker/u256:7 Tainted: P           OE     5.17.0-rc2-1 #12\n  kernel: Workqueue: btrfs-endio btrfs_work_helper [btrfs]\n  kernel: RIP: 0010:lzo_decompress_bio (./include/linux/fortify-string.h:225 fs/btrfs/lzo.c:322 fs/btrfs/lzo.c:394) btrfs\n  Code starting with the faulting instruction\n  ===========================================\n     0:*  48 8b 06                mov    (%rsi),%rax              <-- trapping instruction\n     3:   48 8d 79 08             lea    0x8(%rcx),%rdi\n     7:   48 83 e7 f8             and    $0xfffffffffffffff8,%rdi\n     b:   48 89 01                mov    %rax,(%rcx)\n     e:   44 89 f0                mov    %r14d,%eax\n    11:   48 8b 54 06 f8          mov    -0x8(%rsi,%rax,1),%rdx\n  kernel: RSP: 0018:ffffb110812efd50 EFLAGS: 00010212\n  kernel: RAX: 0000000000001000 RBX: 000000009ca264c8 RCX: ffff98996e6d8ff8\n  kernel: RDX: 0000000000000064 RSI: 000841551d5c1000 RDI: ffffffff9500435d\n  kernel: RBP: ffff989a3be856c0 R08: 0000000000000000 R09: 0000000000000000\n  kernel: R10: 0000000000000000 R11: 0000000000001000 R12: ffff98996e6d8000\n  kernel: R13: 0000000000000008 R14: 0000000000001000 R15: 000841551d5c1000\n  kernel: FS:  0000000000000000(0000) GS:ffff98a09d640000(0000) knlGS:0000000000000000\n  kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  kernel: CR2: 00001e9f984d9ea8 CR3: 000000014971a000 CR4: 00000000003506e0\n  kernel: Call Trace:\n  kernel:  <TASK>\n  kernel: end_compressed_bio_read (fs/btrfs/compression.c:104 fs/btrfs/compression.c:1363 fs/btrfs/compression.c:323) btrfs\n  kernel: end_workqueue_fn (fs/btrfs/disk-io.c:1923) btrfs\n  kernel: btrfs_work_helper (fs/btrfs/async-thread.c:326) btrfs\n  kernel: process_one_work (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:212 ./include/trace/events/workqueue.h:108 kernel/workqueue.c:2312)\n  kernel: worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2455)\n  kernel: ? process_one_work (kernel/workqueue.c:2397)\n  kernel: kthread (kernel/kthread.c:377)\n  kernel: ? kthread_complete_and_exit (kernel/kthread.c:332)\n  kernel: ret_from_fork (arch/x86/entry/entry_64.S:301)\n  kernel:  </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "93c44c19-de00-4a53-b6cf-6cde5afbdc1b",  "id": "CVE-2021-20268",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20268"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190,    20  ],  "analysis": {    "state": "in_triage"  },  "description": "An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running the eBPF script calls dev_map_init_map or sock_map_alloc. This flaw allows a local user to crash the system or possibly escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be4eaa92-fb00-4235-b43e-8ccbfacc64be",  "id": "CVE-2016-10906",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10906"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dc931ef6-31e1-465a-8b2c-c7420cb795ef",  "id": "SUSE-SU-2015:1445-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "85740d64-c417-4a3e-aa88-50f18aeef0a7",  "id": "CVE-2013-2548",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2548"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect length value during a copy operation, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3882f857-8455-4399-bba1-b4e74833f2ad",  "id": "CVE-2016-3672",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3672"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    254  ],  "analysis": {    "state": "in_triage"  },  "description": "The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize the legacy base address, which makes it easier for local users to defeat the intended restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or setgid program, by disabling stack-consumption resource limits.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:39669'"    }  ]},{  "bom-ref": "b9cf4a51-592e-4adb-9270-b9804a1e2da0",  "id": "CVE-2010-2653",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2653"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the hvc_close function in drivers/char/hvc_console.c in the Linux kernel before 2.6.34 allows local users to cause a denial of service or possibly have unspecified other impact by closing a Hypervisor Virtual Console device, related to the hvc_open and hvc_remove functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "148e7378-760d-4e94-8809-306a4e41c3c7",  "id": "CVE-2013-4345",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4345"  },  "ratings": [    {      "score": 5.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Off-by-one error in the get_prng_bytes function in crypto/ansi_cprng.c in the Linux kernel through 3.11.4 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via multiple requests for small amounts of data, leading to improper management of the state of the consumed data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5aaf2cd8-7f43-44b3-bee0-6264d9936353",  "id": "CVE-2020-25705",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25705"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    330  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "838cba61-a27c-462b-8bed-7680144e5ffb",  "id": "CVE-2010-3861",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3861"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize a certain block of heap memory, which allows local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value, a different vulnerability than CVE-2010-2478.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f111f272-46ce-4089-b5eb-e977282ca92e",  "id": "CVE-2022-49751",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nw1: fix WARNING after calling w1_process()\n\nI got the following WARNING message while removing driver(ds2482):\n\n------------[ cut here ]------------\ndo not call blocking ops when !TASK_RUNNING; state=1 set at [<000000002d50bfb6>] w1_process+0x9e/0x1d0 [wire]\nWARNING: CPU: 0 PID: 262 at kernel/sched/core.c:9817 __might_sleep+0x98/0xa0\nCPU: 0 PID: 262 Comm: w1_bus_master1 Tainted: G                 N 6.1.0-rc3+ #307\nRIP: 0010:__might_sleep+0x98/0xa0\nCall Trace:\n exit_signals+0x6c/0x550\n do_exit+0x2b4/0x17e0\n kthread_exit+0x52/0x60\n kthread+0x16d/0x1e0\n ret_from_fork+0x1f/0x30\n\nThe state of task is set to TASK_INTERRUPTIBLE in loop in w1_process(),\nset it to TASK_RUNNING when it breaks out of the loop to avoid the\nwarning.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aefe5c14-bb16-4c68-95a4-d4c2a46925e6",  "id": "CVE-2024-47665",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup\n\nDefinitely condition dma_get_cache_alignment * defined value > 256\nduring driver initialization is not reason to BUG_ON(). Turn that to\ngraceful error out with -EINVAL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "255e4a66-316d-4b17-b473-9f3f03a7f99a",  "id": "CVE-2024-49896",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check stream before comparing them\n\n[WHAT & HOW]\namdgpu_dm can pass a null stream to dc_is_stream_unchanged. It is\nnecessary to check for null before dereferencing them.\n\nThis fixes 1 FORWARD_NULL issue reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b8cec1f-b8f5-446b-8fdc-4fd7b17daa93",  "id": "CVE-2009-3555",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3555"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    295,    300  ],  "analysis": {    "state": "in_triage"  },  "description": "The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a \"plaintext injection\" attack, aka the \"Project Mogul\" issue.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:10071'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:106155/THC-SSL-Denial-Of-Service-Tool-1.4-Windows-Version.html'"    },    {      "name": "EMBA:sbom:3:exploit",      "value": "'PSS:106156/THC-SSL-Denial-Of-Service-Tool-1.4.html'"    },    {      "name": "EMBA:sbom:4:exploit",      "value": "'PSS:84112/TLS-Renegotiation-Exploit.html'"    }  ]},{  "bom-ref": "826cf798-d979-42a4-ac9e-42ace73ea4b2",  "id": "CVE-2017-6353",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6353"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local users to cause a denial of service (invalid unlock and double free) via a multithreaded application.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2b657038-65b2-487a-8c3c-27f216dede60",  "id": "RHSA-2016:0305",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "941dc8ba-9805-4ef6-b98e-560c63dfc0d3",  "id": "CVE-2024-26915",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Reset IH OVERFLOW_CLEAR bit\n\nAllows us to detect subsequent IH ring buffer overflows as well.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd4b20da-fbf2-425c-b48f-193e3ff9cc8e",  "id": "CVE-2024-26700",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix MST Null Ptr for RV\n\nThe change try to fix below error specific to RV platform:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\nPGD 0 P4D 0\nOops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 4 PID: 917 Comm: sway Not tainted 6.3.9-arch1-1 #1 124dc55df4f5272ccb409f39ef4872fc2b3376a2\nHardware name: LENOVO 20NKS01Y00/20NKS01Y00, BIOS R12ET61W(1.31 ) 07/28/2022\nRIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper]\nCode: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 <48> 8>\nRSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224\nRDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280\nRBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850\nR10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000\nR13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224\nFS:  00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000008 CR3: 000000010ddc6000 CR4: 00000000003506e0\nCall Trace:\n <TASK>\n ? __die+0x23/0x70\n ? page_fault_oops+0x171/0x4e0\n ? plist_add+0xbe/0x100\n ? exc_page_fault+0x7c/0x180\n ? asm_exc_page_fault+0x26/0x30\n ? drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]\n ? drm_dp_atomic_find_time_slots+0x28/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026]\n compute_mst_dsc_configs_for_link+0x2ff/0xa40 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n ? fill_plane_buffer_attributes+0x419/0x510 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n compute_mst_dsc_configs_for_state+0x1e1/0x250 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n amdgpu_dm_atomic_check+0xecd/0x1190 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n drm_atomic_check_only+0x5c5/0xa40\n drm_mode_atomic_ioctl+0x76e/0xbc0\n ? _copy_to_user+0x25/0x30\n ? drm_ioctl+0x296/0x4b0\n ? __pfx_drm_mode_atomic_ioctl+0x10/0x10\n drm_ioctl_kernel+0xcd/0x170\n drm_ioctl+0x26d/0x4b0\n ? __pfx_drm_mode_atomic_ioctl+0x10/0x10\n amdgpu_drm_ioctl+0x4e/0x90 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054]\n __x64_sys_ioctl+0x94/0xd0\n do_syscall_64+0x60/0x90\n ? do_syscall_64+0x6c/0x90\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x7f4dad17f76f\nCode: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c>\nRSP: 002b:00007ffd9ae859f0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 000055e255a55900 RCX: 00007f4dad17f76f\nRDX: 00007ffd9ae85a90 RSI: 00000000c03864bc RDI: 000000000000000b\nRBP: 00007ffd9ae85a90 R08: 0000000000000003 R09: 0000000000000003\nR10: 0000000000000000 R11: 0000000000000246 R12: 00000000c03864bc\nR13: 000000000000000b R14: 000055e255a7fc60 R15: 000055e255a01eb0\n </TASK>\nModules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device ccm cmac algif_hash algif_skcipher af_alg joydev mousedev bnep >\n typec libphy k10temp ipmi_msghandler roles i2c_scmi acpi_cpufreq mac_hid nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_mas>\nCR2: 0000000000000008\n---[ end trace 0000000000000000 ]---\nRIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper]\nCode: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 <48> 8>\nRSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224\nRDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280\nRBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850\nR10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000\nR13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224\nFS:  00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04c547c1-7331-4095-88a3-f98a2b1c8fea",  "id": "CVE-2018-12233",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12233"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "50b0f61b-9bb4-4c82-9fa0-9ee301a7c483",  "id": "CVE-2024-26765",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Disable IRQ before init_fn() for nonboot CPUs\n\nDisable IRQ before init_fn() for nonboot CPUs when hotplug, in order to\nsilence such warnings (and also avoid potential errors due to unexpected\ninterrupts):\n\nWARNING: CPU: 1 PID: 0 at kernel/rcu/tree.c:4503 rcu_cpu_starting+0x214/0x280\nCPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.17+ #1198\npc 90000000048e3334 ra 90000000047bd56c tp 900000010039c000 sp 900000010039fdd0\na0 0000000000000001 a1 0000000000000006 a2 900000000802c040 a3 0000000000000000\na4 0000000000000001 a5 0000000000000004 a6 0000000000000000 a7 90000000048e3f4c\nt0 0000000000000001 t1 9000000005c70968 t2 0000000004000000 t3 000000000005e56e\nt4 00000000000002e4 t5 0000000000001000 t6 ffffffff80000000 t7 0000000000040000\nt8 9000000007931638 u0 0000000000000006 s9 0000000000000004 s0 0000000000000001\ns1 9000000006356ac0 s2 9000000007244000 s3 0000000000000001 s4 0000000000000001\ns5 900000000636f000 s6 7fffffffffffffff s7 9000000002123940 s8 9000000001ca55f8\n   ra: 90000000047bd56c tlb_init+0x24c/0x528\n  ERA: 90000000048e3334 rcu_cpu_starting+0x214/0x280\n CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)\n PRMD: 00000000 (PPLV0 -PIE -PWE)\n EUEN: 00000000 (-FPE -SXE -ASXE -BTE)\n ECFG: 00071000 (LIE=12 VS=7)\nESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0)\n PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)\nCPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.17+ #1198\nStack : 0000000000000000 9000000006375000 9000000005b61878 900000010039c000\n        900000010039fa30 0000000000000000 900000010039fa38 900000000619a140\n        9000000006456888 9000000006456880 900000010039f950 0000000000000001\n        0000000000000001 cb0cb028ec7e52e1 0000000002b90000 9000000100348700\n        0000000000000000 0000000000000001 ffffffff916d12f1 0000000000000003\n        0000000000040000 9000000007930370 0000000002b90000 0000000000000004\n        9000000006366000 900000000619a140 0000000000000000 0000000000000004\n        0000000000000000 0000000000000009 ffffffffffc681f2 9000000002123940\n        9000000001ca55f8 9000000006366000 90000000047a4828 00007ffff057ded8\n        00000000000000b0 0000000000000000 0000000000000000 0000000000071000\n        ...\nCall Trace:\n[<90000000047a4828>] show_stack+0x48/0x1a0\n[<9000000005b61874>] dump_stack_lvl+0x84/0xcc\n[<90000000047f60ac>] __warn+0x8c/0x1e0\n[<9000000005b0ab34>] report_bug+0x1b4/0x280\n[<9000000005b63110>] do_bp+0x2d0/0x480\n[<90000000047a2e20>] handle_bp+0x120/0x1c0\n[<90000000048e3334>] rcu_cpu_starting+0x214/0x280\n[<90000000047bd568>] tlb_init+0x248/0x528\n[<90000000047a4c44>] per_cpu_trap_init+0x124/0x160\n[<90000000047a19f4>] cpu_probe+0x494/0xa00\n[<90000000047b551c>] start_secondary+0x3c/0xc0\n[<9000000005b66134>] smpboot_entry+0x50/0x58",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6d0d04b3-2240-4bf9-81a5-afcd6dd8067b",  "id": "CVE-2024-50242",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Additional check in ntfs_file_release",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c88b1a67-60db-4393-b750-57c06141c680",  "id": "CVE-2026-53157",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phonet: free phonet_device after RCU grace period\n\nphonet_device_destroy() removes a phonet_device from the per-net device\nlist with list_del_rcu(), but frees it immediately. RCU readers walking\nthe same list can still hold a pointer to the object after it has been\nremoved, leading to a slab-use-after-free.\n\nUse kfree_rcu(), matching the lifetime rule already used by\nphonet_address_del() for the same object type.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c115db01-0520-4cce-ae71-f0269de23429",  "id": "CVE-2022-49981",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hidraw: fix memory leak in hidraw_release()\n\nFree the buffered reports before deleting the list entry.\n\nBUG: memory leak\nunreferenced object 0xffff88810e72f180 (size 32):\n  comm \"softirq\", pid 0, jiffies 4294945143 (age 16.080s)\n  hex dump (first 32 bytes):\n    64 f3 c6 6a d1 88 07 04 00 00 00 00 00 00 00 00  d..j............\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [<ffffffff814ac6c3>] kmemdup+0x23/0x50 mm/util.c:128\n    [<ffffffff8357c1d2>] kmemdup include/linux/fortify-string.h:440 [inline]\n    [<ffffffff8357c1d2>] hidraw_report_event+0xa2/0x150 drivers/hid/hidraw.c:521\n    [<ffffffff8356ddad>] hid_report_raw_event+0x27d/0x740 drivers/hid/hid-core.c:1992\n    [<ffffffff8356e41e>] hid_input_report+0x1ae/0x270 drivers/hid/hid-core.c:2065\n    [<ffffffff835f0d3f>] hid_irq_in+0x1ff/0x250 drivers/hid/usbhid/hid-core.c:284\n    [<ffffffff82d3c7f9>] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1670\n    [<ffffffff82d3cc26>] usb_hcd_giveback_urb+0x1b6/0x1d0 drivers/usb/core/hcd.c:1747\n    [<ffffffff82ef1e14>] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988\n    [<ffffffff812f50a8>] call_timer_fn+0x38/0x200 kernel/time/timer.c:1474\n    [<ffffffff812f5586>] expire_timers kernel/time/timer.c:1519 [inline]\n    [<ffffffff812f5586>] __run_timers.part.0+0x316/0x430 kernel/time/timer.c:1790\n    [<ffffffff812f56e4>] __run_timers kernel/time/timer.c:1768 [inline]\n    [<ffffffff812f56e4>] run_timer_softirq+0x44/0x90 kernel/time/timer.c:1803\n    [<ffffffff848000e6>] __do_softirq+0xe6/0x2ea kernel/softirq.c:571\n    [<ffffffff81246db0>] invoke_softirq kernel/softirq.c:445 [inline]\n    [<ffffffff81246db0>] __irq_exit_rcu kernel/softirq.c:650 [inline]\n    [<ffffffff81246db0>] irq_exit_rcu+0xc0/0x110 kernel/softirq.c:662\n    [<ffffffff84574f02>] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1106\n    [<ffffffff84600c8b>] asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649\n    [<ffffffff8458a070>] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]\n    [<ffffffff8458a070>] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]\n    [<ffffffff8458a070>] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]\n    [<ffffffff8458a070>] acpi_idle_do_entry+0xc0/0xd0 drivers/acpi/processor_idle.c:554",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1fbdcb45-ec9d-4bcd-a37a-95adf99f2552",  "id": "CVE-2024-42123",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix double free err_addr pointer warnings\n\nIn amdgpu_umc_bad_page_polling_timeout, the amdgpu_umc_handle_bad_pages\nwill be run many times so that double free err_addr in some special case.\nSo set the err_addr to NULL to avoid the warnings.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "594ffb00-eec6-4e70-ac93-f178bb5200e4",  "id": "CVE-2023-53244",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish\n\nWhen the driver calls tw68_risc_buffer() to prepare the buffer, the\nfunction call dma_alloc_coherent may fail, resulting in a empty buffer\nbuf->cpu. Later when we free the buffer or access the buffer, null ptr\nderef is triggered.\n\nThis bug is similar to the following one:\nhttps://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.\n\nWe believe the bug can be also dynamically triggered from user side.\nSimilarly, we fix this by checking the return value of tw68_risc_buffer()\nand the value of buf->cpu before buffer free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7fb315be-03c6-4d2d-a33e-384a2ee79626",  "id": "OESA-2025-1883",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b716b331-acc2-410c-9a17-64875e85c509",  "id": "CVE-2014-9731",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9731"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    17  ],  "analysis": {    "state": "in_triage"  },  "description": "The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is available for storing a symlink target's name along with a trailing \\0 character, which allows local users to obtain sensitive information via a crafted filesystem image, related to fs/udf/symlink.c and fs/udf/unicode.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9f056b64-a7ca-4965-a57e-80c85844a41f",  "id": "CVE-2021-47433",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47433"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix abort logic in btrfs_replace_file_extents\n\nError injection testing uncovered a case where we'd end up with a\ncorrupt file system with a missing extent in the middle of a file.  This\noccurs because the if statement to decide if we should abort is wrong.\n\nThe only way we would abort in this case is if we got a ret !=\n-EOPNOTSUPP and we called from the file clone code.  However the\nprealloc code uses this path too.  Instead we need to abort if there is\nan error, and the only error we _don't_ abort on is -EOPNOTSUPP and only\nif we came from the clone file code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f960871f-be52-442c-a377-5f0b2f818949",  "id": "CVE-2015-8899",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8899"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "60d76435-a604-4af4-9b5a-52a7e02563a9",  "id": "CVE-2016-2545",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2545"  },  "ratings": [    {      "score": 5.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The snd_timer_interrupt function in sound/core/timer.c in the Linux kernel before 4.4.1 does not properly maintain a certain linked list, which allows local users to cause a denial of service (race condition and system crash) via a crafted ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d6abc8a1-3c5c-4707-80de-1f429d8543ad",  "id": "CVE-2017-7187",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7187"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aece9be8-ff3d-4438-8099-71677e6e3cd3",  "id": "CVE-2014-5207",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5207"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    269  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind mount, which allows local users to gain privileges, interfere with backups and auditing on systems that had atime enabled, or cause a denial of service (excessive filesystem updating) on systems that had atime disabled via a \"mount -o remount\" command within a user namespace.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:34923'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:128595/Linux-Kernel-3.16.1-FUSE-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "62f9880d-7f84-4345-b20d-1ff9d6209043",  "id": "CVE-2022-49102",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhabanalabs: fix possible memory leak in MMU DR fini\n\nThis patch fixes what seems to be copy paste error.\n\nWe will have a memory leak if the host-resident shadow is NULL (which\nwill likely happen as the DR and HR are not dependent).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a345f340-224e-4195-800a-6478d373a8c2",  "id": "CVE-2021-20321",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20321"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "27db8e99-3c52-434c-87a6-cb6ef5a8a9f4",  "id": "CVE-2021-43389",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43389"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c9bfff41-5ac8-4973-943f-64332f08f598",  "id": "CVE-2011-1082",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1082"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:35404'"    }  ]},{  "bom-ref": "58fab99b-cf0e-4cc9-ae5a-c02526c6aca5",  "id": "RHSA-2020:4514",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "741b061d-126f-4873-bb13-ae939238af77",  "id": "openSUSE-SU-2026:11172-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7bb39f81-2d9b-4eb2-843e-651dca23b395",  "id": "CVE-2022-48826",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Fix deadlock on DSI device attach error\n\nDSI device attach to DSI host will be done with host device's lock\nheld.\n\nUn-registering host in \"device attach\" error path (ex: probe retry)\nwill result in deadlock with below call trace and non operational\nDSI display.\n\nStartup Call trace:\n[   35.043036]  rt_mutex_slowlock.constprop.21+0x184/0x1b8\n[   35.043048]  mutex_lock_nested+0x7c/0xc8\n[   35.043060]  device_del+0x4c/0x3e8\n[   35.043075]  device_unregister+0x20/0x40\n[   35.043082]  mipi_dsi_remove_device_fn+0x18/0x28\n[   35.043093]  device_for_each_child+0x68/0xb0\n[   35.043105]  mipi_dsi_host_unregister+0x40/0x90\n[   35.043115]  vc4_dsi_host_attach+0xf0/0x120 [vc4]\n[   35.043199]  mipi_dsi_attach+0x30/0x48\n[   35.043209]  tc358762_probe+0x128/0x164 [tc358762]\n[   35.043225]  mipi_dsi_drv_probe+0x28/0x38\n[   35.043234]  really_probe+0xc0/0x318\n[   35.043244]  __driver_probe_device+0x80/0xe8\n[   35.043254]  driver_probe_device+0xb8/0x118\n[   35.043263]  __device_attach_driver+0x98/0xe8\n[   35.043273]  bus_for_each_drv+0x84/0xd8\n[   35.043281]  __device_attach+0xf0/0x150\n[   35.043290]  device_initial_probe+0x1c/0x28\n[   35.043300]  bus_probe_device+0xa4/0xb0\n[   35.043308]  deferred_probe_work_func+0xa0/0xe0\n[   35.043318]  process_one_work+0x254/0x700\n[   35.043330]  worker_thread+0x4c/0x448\n[   35.043339]  kthread+0x19c/0x1a8\n[   35.043348]  ret_from_fork+0x10/0x20\n\nShutdown Call trace:\n[  365.565417] Call trace:\n[  365.565423]  __switch_to+0x148/0x200\n[  365.565452]  __schedule+0x340/0x9c8\n[  365.565467]  schedule+0x48/0x110\n[  365.565479]  schedule_timeout+0x3b0/0x448\n[  365.565496]  wait_for_completion+0xac/0x138\n[  365.565509]  __flush_work+0x218/0x4e0\n[  365.565523]  flush_work+0x1c/0x28\n[  365.565536]  wait_for_device_probe+0x68/0x158\n[  365.565550]  device_shutdown+0x24/0x348\n[  365.565561]  kernel_restart_prepare+0x40/0x50\n[  365.565578]  kernel_restart+0x20/0x70\n[  365.565591]  __do_sys_reboot+0x10c/0x220\n[  365.565605]  __arm64_sys_reboot+0x2c/0x38\n[  365.565619]  invoke_syscall+0x4c/0x110\n[  365.565634]  el0_svc_common.constprop.3+0xfc/0x120\n[  365.565648]  do_el0_svc+0x2c/0x90\n[  365.565661]  el0_svc+0x4c/0xf0\n[  365.565671]  el0t_64_sync_handler+0x90/0xb8\n[  365.565682]  el0t_64_sync+0x180/0x184",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d6b70527-3ec3-4ead-81ee-fa778169bd45",  "id": "AZL-8960",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b3191321-839e-4ba7-9fbf-3d121acd7732",  "id": "CLSA-2022-1657816793",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c307bbce-082a-40e9-89a5-0a0fc7eafca0",  "id": "CVE-2013-2128",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2128"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7009a696-2ce2-4dfa-ab5d-5832e0e1b01d",  "id": "CLSA-2026-1779437608",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5a57fc6-231d-454e-ba87-efca0427d855",  "id": "ROOT-OS-UBUNTU-2004-CVE-2026-45447",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b0597c5-cead-4971-9dce-272312f39f29",  "id": "CVE-2016-2187",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2187"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6a669aa4-5a91-4f0d-a41d-f8f41766c3be",  "id": "CVE-2023-0160",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0160"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667,    833  ],  "analysis": {    "state": "in_triage"  },  "description": "A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "63ce57ad-ae91-4698-90af-ec9469fa8c02",  "id": "CVE-2022-49502",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rga: fix possible memory leak in rga_probe\n\nrga->m2m_dev needs to be freed when rga_probe fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f1b3468-2254-42fb-a828-cbc4370b65a6",  "id": "CVE-2011-1577",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1577"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38 and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cce00b8d-7053-4648-b3a0-abde31bd0f69",  "id": "CVE-2022-49831",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: initialize device's zone info for seeding\n\nWhen performing seeding on a zoned filesystem it is necessary to\ninitialize each zoned device's btrfs_zoned_device_info structure,\notherwise mounting the filesystem will cause a NULL pointer dereference.\n\nThis was uncovered by fstests' testcase btrfs/163.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c42b24ac-8f4d-423a-a576-7d02624f875a",  "id": "CVE-2021-42327",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42327"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parse_write_buffer_into_params when it uses the size of copy_from_user to copy a userspace buffer into a 40-byte heap buffer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e77455a8-8911-4f2c-8c94-a928ee96885e",  "id": "AZL-33494",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2a06fdd-9d2c-480f-8b77-d47b82c7da78",  "id": "CVE-2021-47250",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47250"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: fix memory leak in netlbl_cipsov4_add_std\n\nReported by syzkaller:\nBUG: memory leak\nunreferenced object 0xffff888105df7000 (size 64):\ncomm \"syz-executor842\", pid 360, jiffies 4294824824 (age 22.546s)\nhex dump (first 32 bytes):\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\nbacktrace:\n[<00000000e67ed558>] kmalloc include/linux/slab.h:590 [inline]\n[<00000000e67ed558>] kzalloc include/linux/slab.h:720 [inline]\n[<00000000e67ed558>] netlbl_cipsov4_add_std net/netlabel/netlabel_cipso_v4.c:145 [inline]\n[<00000000e67ed558>] netlbl_cipsov4_add+0x390/0x2340 net/netlabel/netlabel_cipso_v4.c:416\n[<0000000006040154>] genl_family_rcv_msg_doit.isra.0+0x20e/0x320 net/netlink/genetlink.c:739\n[<00000000204d7a1c>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]\n[<00000000204d7a1c>] genl_rcv_msg+0x2bf/0x4f0 net/netlink/genetlink.c:800\n[<00000000c0d6a995>] netlink_rcv_skb+0x134/0x3d0 net/netlink/af_netlink.c:2504\n[<00000000d78b9d2c>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811\n[<000000009733081b>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]\n[<000000009733081b>] netlink_unicast+0x4a0/0x6a0 net/netlink/af_netlink.c:1340\n[<00000000d5fd43b8>] netlink_sendmsg+0x789/0xc70 net/netlink/af_netlink.c:1929\n[<000000000a2d1e40>] sock_sendmsg_nosec net/socket.c:654 [inline]\n[<000000000a2d1e40>] sock_sendmsg+0x139/0x170 net/socket.c:674\n[<00000000321d1969>] ____sys_sendmsg+0x658/0x7d0 net/socket.c:2350\n[<00000000964e16bc>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2404\n[<000000001615e288>] __sys_sendmsg+0xd3/0x190 net/socket.c:2433\n[<000000004ee8b6a5>] do_syscall_64+0x37/0x90 arch/x86/entry/common.c:47\n[<00000000171c7cee>] entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nThe memory of doi_def->map.std pointing is allocated in\nnetlbl_cipsov4_add_std, but no place has freed it. It should be\nfreed in cipso_v4_doi_free which frees the cipso DOI resource.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b1e746bb-bb08-4ed1-a823-76c5f20f8cda",  "id": "CVE-2018-7191",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7191"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "81708a65-023f-4525-8c46-b7ccc5e1dcbe",  "id": "CVE-2020-12768",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12768"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.6. svm_cpu_uninit in arch/x86/kvm/svm.c has a memory leak, aka CID-d80b64ff297e. NOTE: third parties dispute this issue because it's a one-time leak at the boot, the size is negligible, and it can't be triggered at will",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "90ce412e-debe-4ecc-9960-c61954b011a5",  "id": "CVE-2024-49929",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: avoid NULL pointer dereference\n\niwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta\npointer is not NULL.\nIt retrieves this pointer using iwl_mvm_sta_from_mac80211, which is\ndereferencing the ieee80211_sta pointer.\nIf sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL\npointer.\nFix this by checking the sta pointer before retrieving the mvmsta\nfrom it. If sta is not NULL, then mvmsta isn't either.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "637baaaa-e3a9-4666-8d6b-2572e20cfd92",  "id": "CVE-2026-43314",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    772  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: remove fake timeout to avoid leak request\n\nSince commit 15f73f5b3e59 (\"blk-mq: move failure injection out of\nblk_mq_complete_request\"), drivers are responsible for calling\nblk_should_fake_timeout() at appropriate code paths and opportunities.\n\nHowever, the dm driver does not implement its own timeout handler and\nrelies on the timeout handling of its slave devices.\n\nIf an io-timeout-fail error is injected to a dm device, the request\nwill be leaked and never completed, causing tasks to hang indefinitely.\n\nReproduce:\n1. prepare dm which has iscsi slave device\n2. inject io-timeout-fail to dm\n   echo 1 >/sys/class/block/dm-0/io-timeout-fail\n   echo 100 >/sys/kernel/debug/fail_io_timeout/probability\n   echo 10 >/sys/kernel/debug/fail_io_timeout/times\n3. read/write dm\n4. iscsiadm -m node -u\n\nResult: hang task like below\n[  862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds.\n[  862.244133]       Tainted: G            E       6.19.0-rc1+ #51\n[  862.244337] \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n[  862.244718] task:kworker/u514:2  state:D stack:0     pid:151   tgid:151   ppid:2      task_flags:0x4288060 flags:0x00080000\n[  862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi]\n[  862.245264] Call Trace:\n[  862.245587]  <TASK>\n[  862.245814]  __schedule+0x810/0x15c0\n[  862.246557]  schedule+0x69/0x180\n[  862.246760]  blk_mq_freeze_queue_wait+0xde/0x120\n[  862.247688]  elevator_change+0x16d/0x460\n[  862.247893]  elevator_set_none+0x87/0xf0\n[  862.248798]  blk_unregister_queue+0x12e/0x2a0\n[  862.248995]  __del_gendisk+0x231/0x7e0\n[  862.250143]  del_gendisk+0x12f/0x1d0\n[  862.250339]  sd_remove+0x85/0x130 [sd_mod]\n[  862.250650]  device_release_driver_internal+0x36d/0x530\n[  862.250849]  bus_remove_device+0x1dd/0x3f0\n[  862.251042]  device_del+0x38a/0x930\n[  862.252095]  __scsi_remove_device+0x293/0x360\n[  862.252291]  scsi_remove_target+0x486/0x760\n[  862.252654]  __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi]\n[  862.252886]  process_one_work+0x633/0xe50\n[  862.253101]  worker_thread+0x6df/0xf10\n[  862.253647]  kthread+0x36d/0x720\n[  862.254533]  ret_from_fork+0x2a6/0x470\n[  862.255852]  ret_from_fork_asm+0x1a/0x30\n[  862.256037]  </TASK>\n\nRemove the blk_should_fake_timeout() check from dm, as dm has no\nnative timeout handling and should not attempt to fake timeouts.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "76182d0e-3746-4d4c-ab35-16ac39e6e731",  "id": "CVE-2022-49915",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: fix possible memory leak in mISDN_register_device()\n\nAfer commit 1fa5ae857bb1 (\"driver core: get rid of struct device's\nbus_id string array\"), the name of device is allocated dynamically,\nadd put_device() to give up the reference, so that the name can be\nfreed in kobject_cleanup() when the refcount is 0.\n\nSet device class before put_device() to avoid null release() function\nWARN message in device_release().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d951deed-1e71-4072-8f8c-4054e0b31c40",  "id": "CVE-2021-47577",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47577"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio-wq: check for wq exit after adding new worker task_work\n\nWe check IO_WQ_BIT_EXIT before attempting to create a new worker, and\nwq exit cancels pending work if we have any. But it's possible to have\na race between the two, where creation checks exit finding it not set,\nbut we're in the process of exiting. The exit side will cancel pending\ncreation task_work, but there's a gap where we add task_work after we've\ncanceled existing creations at exit time.\n\nFix this by checking the EXIT bit post adding the creation task_work.\nIf it's set, run the same cancelation that exit does.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b43a751c-308f-4630-b537-f06e371c64a6",  "id": "RHSA-2025:22794",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "96071f26-4580-4ea7-8109-0d2f32dd22c4",  "id": "CVE-2024-50168",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sun3_82586: fix potential memory leak in sun3_82586_send_packet()\n\nThe sun3_82586_send_packet() returns NETDEV_TX_OK without freeing skb\nin case of skb->len being too long, add dev_kfree_skb() to fix it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f292980a-e064-4314-99e9-a28ab1461256",  "id": "CVE-2014-3535",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3535"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "include/linux/netdevice.h in the Linux kernel before 2.6.36 incorrectly uses macros for netdev_printk and its related logging implementation, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) by sending invalid packets to a VxLAN interface.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a4bc0c6-df63-48e1-abca-54caa755ecc3",  "id": "CVE-2022-49097",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Avoid writeback threads getting stuck in mempool_alloc()\n\nIn a low memory situation, allow the NFS writeback code to fail without\ngetting stuck in infinite loops in mempool_alloc().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d06cf62c-d0c0-47d3-9be2-4b0983d1df33",  "id": "AZL-61539",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e299013a-aa2a-4c4e-a3b2-a69ff98347b4",  "id": "CVE-2022-48982",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix crash when replugging CSR fake controllers\n\nIt seems fake CSR 5.0 clones can cause the suspend notifier to be\nregistered twice causing the following kernel panic:\n\n[   71.986122] Call Trace:\n[   71.986124]  <TASK>\n[   71.986125]  blocking_notifier_chain_register+0x33/0x60\n[   71.986130]  hci_register_dev+0x316/0x3d0 [bluetooth 99b5497ea3d09708fa1366c1dc03288bf3cca8da]\n[   71.986154]  btusb_probe+0x979/0xd85 [btusb e1e0605a4f4c01984a4b9c8ac58c3666ae287477]\n[   71.986159]  ? __pm_runtime_set_status+0x1a9/0x300\n[   71.986162]  ? ktime_get_mono_fast_ns+0x3e/0x90\n[   71.986167]  usb_probe_interface+0xe3/0x2b0\n[   71.986171]  really_probe+0xdb/0x380\n[   71.986174]  ? pm_runtime_barrier+0x54/0x90\n[   71.986177]  __driver_probe_device+0x78/0x170\n[   71.986180]  driver_probe_device+0x1f/0x90\n[   71.986183]  __device_attach_driver+0x89/0x110\n[   71.986186]  ? driver_allows_async_probing+0x70/0x70\n[   71.986189]  bus_for_each_drv+0x8c/0xe0\n[   71.986192]  __device_attach+0xb2/0x1e0\n[   71.986195]  bus_probe_device+0x92/0xb0\n[   71.986198]  device_add+0x422/0x9a0\n[   71.986201]  ? sysfs_merge_group+0xd4/0x110\n[   71.986205]  usb_set_configuration+0x57a/0x820\n[   71.986208]  usb_generic_driver_probe+0x4f/0x70\n[   71.986211]  usb_probe_device+0x3a/0x110\n[   71.986213]  really_probe+0xdb/0x380\n[   71.986216]  ? pm_runtime_barrier+0x54/0x90\n[   71.986219]  __driver_probe_device+0x78/0x170\n[   71.986221]  driver_probe_device+0x1f/0x90\n[   71.986224]  __device_attach_driver+0x89/0x110\n[   71.986227]  ? driver_allows_async_probing+0x70/0x70\n[   71.986230]  bus_for_each_drv+0x8c/0xe0\n[   71.986232]  __device_attach+0xb2/0x1e0\n[   71.986235]  bus_probe_device+0x92/0xb0\n[   71.986237]  device_add+0x422/0x9a0\n[   71.986239]  ? _dev_info+0x7d/0x98\n[   71.986242]  ? blake2s_update+0x4c/0xc0\n[   71.986246]  usb_new_device.cold+0x148/0x36d\n[   71.986250]  hub_event+0xa8a/0x1910\n[   71.986255]  process_one_work+0x1c4/0x380\n[   71.986259]  worker_thread+0x51/0x390\n[   71.986262]  ? rescuer_thread+0x3b0/0x3b0\n[   71.986264]  kthread+0xdb/0x110\n[   71.986266]  ? kthread_complete_and_exit+0x20/0x20\n[   71.986268]  ret_from_fork+0x1f/0x30\n[   71.986273]  </TASK>\n[   71.986274] ---[ end trace 0000000000000000 ]---\n[   71.986284] btusb: probe of 2-1.6:1.0 failed with error -17",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef9a81ca-f01b-42a9-8401-ec1f1b922e19",  "id": "CVE-2012-2100",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2100"  },  "ratings": [    {      "score": 7.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 3.2.2, on the x86 platform and unspecified other platforms, allows user-assisted remote attackers to trigger inconsistent filesystem-groups data and possibly cause a denial of service via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).  NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-4307.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "923d33b2-cf24-4879-a2a9-9eee7d3edd14",  "id": "CVE-2026-64271",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: touchwin - reset the packet index on every complete packet\n\ntw_interrupt() accumulates each non-zero serial byte into a fixed\nthree-byte buffer with a running index that is only reset once a full\npacket has been received *and* the device's two Y bytes agree:\n\n\ttw->data[tw->idx++] = data;\n\tif (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) {\n\t\t...\n\t\ttw->idx = 0;\n\t}\n\nThe reset is gated on tw->data[1] == tw->data[2], a value the device\ncontrols.  A malicious, malfunctioning or counterfeit Touchwindow\nperipheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the\nindex reaches TW_LENGTH without the equality holding, is never reset, and\nkeeps growing, so tw->data[tw->idx++] walks off the end of the three-byte\narray and the rest of the heap-allocated struct tw, one attacker-chosen\nbyte at a time -- an unbounded, device-driven heap out-of-bounds write.\n\nReset the index on every completed packet and report an event only when\nthe two Y bytes match, like the other serio touchscreen drivers do.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3cfc27f1-9b19-42a9-8e5a-c0d063cc695a",  "id": "CVE-2018-5750",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5750"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address information by reading dmesg data from an SBS HC printk call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "008a5fa7-cd1f-4070-a5d5-6c017125af19",  "id": "CVE-2026-23474",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: Avoid boot crash in RedBoot partition table parser\n\nGiven CONFIG_FORTIFY_SOURCE=y and a recent compiler,\ncommit 439a1bcac648 (\"fortify: Use __builtin_dynamic_object_size() when\navailable\") produces the warning below and an oops.\n\n    Searching for RedBoot partition table in 50000000.flash at offset 0x7e0000\n    ------------[ cut here ]------------\n    WARNING: lib/string_helpers.c:1035 at 0xc029e04c, CPU#0: swapper/0/1\n    memcmp: detected buffer overflow: 15 byte read of buffer size 14\n    Modules linked in:\n    CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0 #1 NONE\n\nAs Kees said, \"'names' is pointing to the final 'namelen' many bytes\nof the allocation ... 'namelen' could be basically any length at all.\nThis fortify warning looks legit to me -- this code used to be reading\nbeyond the end of the allocation.\"\n\nSince the size of the dynamic allocation is calculated with strlen()\nwe can use strcmp() instead of memcmp() and remain within bounds.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "87fdc6b0-1378-4e2f-97d8-bf6953c0b13d",  "id": "CVE-2023-53453",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: free iio for atombios when driver shutdown\n\nFix below kmemleak when unload radeon driver:\n\nunreferenced object 0xffff9f8608ede200 (size 512):\n  comm \"systemd-udevd\", pid 326, jiffies 4294682822 (age 716.338s)\n  hex dump (first 32 bytes):\n    00 00 00 00 c4 aa ec aa 14 ab 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [<0000000062fadebe>] kmem_cache_alloc_trace+0x2f1/0x500\n    [<00000000b6883cea>] atom_parse+0x117/0x230 [radeon]\n    [<00000000158c23fd>] radeon_atombios_init+0xab/0x170 [radeon]\n    [<00000000683f672e>] si_init+0x57/0x750 [radeon]\n    [<00000000566cc31f>] radeon_device_init+0x559/0x9c0 [radeon]\n    [<0000000046efabb3>] radeon_driver_load_kms+0xc1/0x1a0 [radeon]\n    [<00000000b5155064>] drm_dev_register+0xdd/0x1d0\n    [<0000000045fec835>] radeon_pci_probe+0xbd/0x100 [radeon]\n    [<00000000e69ecca3>] pci_device_probe+0xe1/0x160\n    [<0000000019484b76>] really_probe.part.0+0xc1/0x2c0\n    [<000000003f2649da>] __driver_probe_device+0x96/0x130\n    [<00000000231c5bb1>] driver_probe_device+0x24/0xf0\n    [<0000000000a42377>] __driver_attach+0x77/0x190\n    [<00000000d7574da6>] bus_for_each_dev+0x7f/0xd0\n    [<00000000633166d2>] driver_attach+0x1e/0x30\n    [<00000000313b05b8>] bus_add_driver+0x12c/0x1e0\n\niio was allocated in atom_index_iio() called by atom_parse(),\nbut it doesn't got released when the dirver is shutdown.\nFix this kmemleak by free it in radeon_atombios_fini().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9212b4ba-7f8d-47af-8e08-8661f1c85991",  "id": "CLSA-2026-1777541792",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6c610f50-4991-42cd-b680-1b8f3a173daa",  "id": "CVE-2015-1791",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1791"  },  "ratings": [    {      "score": 6.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8a758814-db45-472f-8cc9-de67f97dc8da",  "id": "DSA-1379-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ea73de0-5245-406c-8f2a-136a28d05509",  "id": "CVE-2016-7917",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7917"  },  "ratings": [    {      "score": 5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125,    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not check whether a batch message's length field is large enough, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (infinite loop or out-of-bounds read) by leveraging the CAP_NET_ADMIN capability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1e81fe85-ee49-4e40-b465-ff1c84592eb0",  "id": "openSUSE-SU-2026:10649-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "e52e445b-24d0-4150-822b-d76563b46e68",      "versions": [        {          "component": "sed",          "version": "4.0"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "78cee582-7ce4-49a0-a508-2872d90d289e",  "id": "CVE-2019-19524",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19524"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "47c223f1-61a9-41be-8971-45b576122950",  "id": "CVE-2022-49982",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix memory leak in pvr_probe\n\nThe error handling code in pvr2_hdw_create forgets to unregister the\nv4l2 device. When pvr2_hdw_create returns back to pvr2_context_create,\nit calls pvr2_context_destroy to destroy context, but mp->hdw is NULL,\nwhich leads to that pvr2_hdw_destroy directly returns.\n\nFix this by adding v4l2_device_unregister to decrease the refcount of\nusb interface.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "33729205-2275-45a9-9856-f5e430ac79b3",  "id": "CVE-2022-49496",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: prevent kernel crash when rmmod mtk-vcodec-dec.ko\n\nIf the driver support subdev mode, the parameter \"dev->pm.dev\" will be\nNULL in mtk_vcodec_dec_remove. Kernel will crash when try to rmmod\nmtk-vcodec-dec.ko.\n\n[ 4380.702726] pc : do_raw_spin_trylock+0x4/0x80\n[ 4380.707075] lr : _raw_spin_lock_irq+0x90/0x14c\n[ 4380.711509] sp : ffff80000819bc10\n[ 4380.714811] x29: ffff80000819bc10 x28: ffff3600c03e4000 x27: 0000000000000000\n[ 4380.721934] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000\n[ 4380.729057] x23: ffff3600c0f34930 x22: ffffd5e923549000 x21: 0000000000000220\n[ 4380.736179] x20: 0000000000000208 x19: ffffd5e9213e8ebc x18: 0000000000000020\n[ 4380.743298] x17: 0000002000000000 x16: ffffd5e9213e8e90 x15: 696c346f65646976\n[ 4380.750420] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000040\n[ 4380.757542] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000\n[ 4380.764664] x8 : 0000000000000000 x7 : ffff3600c7273ae8 x6 : ffffd5e9213e8ebc\n[ 4380.771786] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000\n[ 4380.778908] x2 : 0000000000000000 x1 : ffff3600c03e4000 x0 : 0000000000000208\n[ 4380.786031] Call trace:\n[ 4380.788465]  do_raw_spin_trylock+0x4/0x80\n[ 4380.792462]  __pm_runtime_disable+0x2c/0x1b0\n[ 4380.796723]  mtk_vcodec_dec_remove+0x5c/0xa0 [mtk_vcodec_dec]\n[ 4380.802466]  platform_remove+0x2c/0x60\n[ 4380.806204]  __device_release_driver+0x194/0x250\n[ 4380.810810]  driver_detach+0xc8/0x15c\n[ 4380.814462]  bus_remove_driver+0x5c/0xb0\n[ 4380.818375]  driver_unregister+0x34/0x64\n[ 4380.822288]  platform_driver_unregister+0x18/0x24\n[ 4380.826979]  mtk_vcodec_dec_driver_exit+0x1c/0x888 [mtk_vcodec_dec]\n[ 4380.833240]  __arm64_sys_delete_module+0x190/0x224\n[ 4380.838020]  invoke_syscall+0x48/0x114\n[ 4380.841760]  el0_svc_common.constprop.0+0x60/0x11c\n[ 4380.846540]  do_el0_svc+0x28/0x90\n[ 4380.849844]  el0_svc+0x4c/0x100\n[ 4380.852975]  el0t_64_sync_handler+0xec/0xf0\n[ 4380.857148]  el0t_64_sync+0x190/0x194\n[ 4380.860801] Code: 94431515 17ffffca d503201f d503245f (b9400004)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cdded864-d0e3-4b83-9fc7-3a98b0357b83",  "id": "DSA-2125-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "03f52ca4-f323-4941-9596-b99aa7813003",  "id": "CVE-2017-5669",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5669"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e8304b36-835a-4bf3-9c57-47f07ea6cc82",  "id": "CLSA-2025-1759865619",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c5b868af-2264-4a45-a644-4e54c56014d4",  "id": "CVE-2017-17807",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17807"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    862  ],  "analysis": {    "state": "in_triage"  },  "description": "The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's \"default request-key keyring\" via the request_key() system call, allowing a local user to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "83358084-1961-498b-8bd2-594300650940",  "id": "CVE-2022-49828",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhugetlbfs: don't delete error page from pagecache\n\nThis change is very similar to the change that was made for shmem [1], and\nit solves the same problem but for HugeTLBFS instead.\n\nCurrently, when poison is found in a HugeTLB page, the page is removed\nfrom the page cache.  That means that attempting to map or read that\nhugepage in the future will result in a new hugepage being allocated\ninstead of notifying the user that the page was poisoned.  As [1] states,\nthis is effectively memory corruption.\n\nThe fix is to leave the page in the page cache.  If the user attempts to\nuse a poisoned HugeTLB page with a syscall, the syscall will fail with\nEIO, the same error code that shmem uses.  For attempts to map the page,\nthe thread will get a BUS_MCEERR_AR SIGBUS.\n\n[1]: commit a76054266661 (\"mm: shmem: don't truncate page if memory failure happens\")",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9fc7662-af1f-4e88-a8b1-0286eed0ad75",  "id": "CVE-2023-4569",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4569"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401,    402  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e3b857ea-bad6-4060-8131-625954f46b5d",  "id": "CVE-2022-1789",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1789"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c1a5b39-cfc1-4fdf-ba7b-8a88b014a074",  "id": "CVE-2023-1077",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1077"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    843  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cc596743-3b1b-42a7-b910-0e8ad322a89e",  "id": "AZL-25317",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ac92c808-69fd-4c9e-8353-4efbb8f29007",  "id": "CVE-2023-52508",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid()\n\nThe nvme_fc_fcp_op structure describing an AEN operation is initialized with a\nnull request structure pointer. An FC LLDD may make a call to\nnvme_fc_io_getuuid passing a pointer to an nvmefc_fcp_req for an AEN operation.\n\nAdd validation of the request structure pointer before dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9ed4d0f-406c-4d84-928e-63cc0c0f1ada",  "id": "CVE-2024-50143",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: fix uninit-value use in udf_get_fileshortad\n\nCheck for overflow when computing alen in udf_current_aext to mitigate\nlater uninit-value use in udf_get_fileshortad KMSAN bug[1].\nAfter applying the patch reproducer did not trigger any issue[2].\n\n[1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df\n[2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "89f62d68-0b36-4166-9278-b782e4edcb96",  "id": "CVE-2022-0171",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0171"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    212,    459  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "55cb4a57-3938-49e3-bc37-3f8ff73a15bb",  "id": "SUSE-SU-2020:0516-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0251edbf-9b0b-4886-af7a-6451ac1c56e1",  "id": "SUSE-SU-2017:3343-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff341d89-9b90-4e77-b4ea-d081500808c6",  "id": "CVE-2014-4027",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4027"  },  "ratings": [    {      "score": 2.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:S/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9a2449ce-bc81-4f75-ac83-4c07ae54a846",  "id": "CVE-2020-14385",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14385"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    131  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9b725f0a-3c16-492b-aa5c-5525e525cb5b",  "id": "CVE-2022-3606",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3606"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    404  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier VDB-211749 was assigned to this vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6d9ccb05-0eae-4b63-a425-3f81935ed2f9",  "id": "CVE-2022-48794",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ieee802154: at86rf230: Stop leaking skb's\n\nUpon error the ieee802154_xmit_complete() helper is not called. Only\nieee802154_wake_queue() is called manually. In the Tx case we then leak\nthe skb structure.\n\nFree the skb structure upon error before returning when appropriate.\n\nAs the 'is_tx = 0' cannot be moved in the complete handler because of a\npossible race between the delay in switching to STATE_RX_AACK_ON and a\nnew interrupt, we introduce an intermediate 'was_tx' boolean just for\nthis purpose.\n\nThere is no Fixes tag applying here, many changes have been made on this\narea and the issue kind of always existed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2cf57dbc-d622-4f1f-b080-2108e73c0c83",  "id": "SUSE-SU-2023:0684-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2adf6209-d701-4864-8646-efae2f921003",  "id": "CVE-2025-21993",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()\n\nWhen performing an iSCSI boot using IPv6, iscsistart still reads the\n/sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix\nlength is 64, this causes the shift exponent to become negative,\ntriggering a UBSAN warning. As the concept of a subnet mask does not\napply to IPv6, the value is set to ~0 to suppress the warning message.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a5335786-9e55-4b65-bf28-d0169c6554bc",  "id": "RHSA-2020:5639",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a58de0f-28ce-496b-9893-8b356a5bca17",  "id": "CVE-2018-13405",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13405"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    269  ],  "analysis": {    "state": "in_triage"  },  "description": "The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:45033'"    }  ]},{  "bom-ref": "32eb4dbf-f6e1-4105-a54d-78f07dfc28b0",  "id": "CVE-2013-1798",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1798"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:H/Au:N/C:C/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "36a9cb64-dc35-4b3c-a5a3-af895c60076a",  "id": "CVE-2024-22386",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22386"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was found in the Linux kernel's drm/exynos device driver in exynos_drm_crtc_atomic_disable() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0be6a8f8-3d0e-4427-8346-b11b90e8c884",  "id": "CVE-2015-7513",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7513"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c63aac38-5d32-4c9d-84c7-604f14d72b84",  "id": "CVE-2015-3290",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3290"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:37722'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:132994/Linux-Nested-NMIs-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "68b4b8de-5a98-4f6e-a734-9b906cbc9809",  "id": "CVE-2022-48829",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes\n\niattr::ia_size is a loff_t, so these NFSv3 procedures must be\ncareful to deal with incoming client size values that are larger\nthan s64_max without corrupting the value.\n\nSilently capping the value results in storing a different value\nthan the client passed in which is unexpected behavior, so remove\nthe min_t() check in decode_sattr3().\n\nNote that RFC 1813 permits only the WRITE procedure to return\nNFS3ERR_FBIG. We believe that NFSv3 reference implementations\nalso return NFS3ERR_FBIG when ia_size is too large.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "44c78df0-2cbd-4b97-bcb7-8f3a1f39d0da",  "id": "AZL-92835",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2bee96dc-337b-4e57-8811-177623b9b1b2",  "id": "openSUSE-SU-2024:13707-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "919d6ad3-90e9-4a34-9000-d88caf192513",  "id": "CVE-2022-49035",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE\n\nI expect that the hardware will have limited this to 16, but just in\ncase it hasn't, check for this corner case.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fbedd7fa-9c8d-4b92-8183-d9d44f2a0807",  "id": "CVE-2023-53038",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read()\n\nIf kzalloc() fails in lpfc_sli4_cgn_params_read(), then we rely on\nlpfc_read_object()'s routine to NULL check pdata.\n\nCurrently, an early return error is thrown from lpfc_read_object() to\nprotect us from NULL ptr dereference, but the errno code is -ENODEV.\n\nChange the errno code to a more appropriate -ENOMEM.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17d2c34e-f2ef-4493-b526-9da9c38daafc",  "id": "DSA-2833-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3e902c31-6cd5-451b-8a87-5882bea29b03",  "id": "CVE-2019-10638",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10638"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    326  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c3469257-341f-4018-9bde-1d5f9b1ddca5",  "id": "CVE-2022-49066",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: Ensure eth header is in skb's linear part\n\nAfter feeding a decapsulated packet to a veth device with act_mirred,\nskb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(),\nwhich expects at least ETH_HLEN byte of linear data (as\n__dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes\nunconditionally).\n\nUse pskb_may_pull() to ensure veth_xmit() respects this constraint.\n\nkernel BUG at include/linux/skbuff.h:2328!\nRIP: 0010:eth_type_trans+0xcf/0x140\nCall Trace:\n <IRQ>\n __dev_forward_skb2+0xe3/0x160\n veth_xmit+0x6e/0x250 [veth]\n dev_hard_start_xmit+0xc7/0x200\n __dev_queue_xmit+0x47f/0x520\n ? skb_ensure_writable+0x85/0xa0\n ? skb_mpls_pop+0x98/0x1c0\n tcf_mirred_act+0x442/0x47e [act_mirred]\n tcf_action_exec+0x86/0x140\n fl_classify+0x1d8/0x1e0 [cls_flower]\n ? dma_pte_clear_level+0x129/0x1a0\n ? dma_pte_clear_level+0x129/0x1a0\n ? prb_fill_curr_block+0x2f/0xc0\n ? skb_copy_bits+0x11a/0x220\n __tcf_classify+0x58/0x110\n tcf_classify_ingress+0x6b/0x140\n __netif_receive_skb_core.constprop.0+0x47d/0xfd0\n ? __iommu_dma_unmap_swiotlb+0x44/0x90\n __netif_receive_skb_one_core+0x3d/0xa0\n netif_receive_skb+0x116/0x170\n be_process_rx+0x22f/0x330 [be2net]\n be_poll+0x13c/0x370 [be2net]\n __napi_poll+0x2a/0x170\n net_rx_action+0x22f/0x2f0\n __do_softirq+0xca/0x2a8\n __irq_exit_rcu+0xc1/0xe0\n common_interrupt+0x83/0xa0",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d64bb8e-3cd6-4437-b007-d0089136b6ad",  "id": "SUSE-SU-2022:4253-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d9fa65bc-5af0-4882-a033-c9629f1996cc",  "id": "CVE-2018-13098",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13098"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/f2fs/inode.c in the Linux kernel through 4.17.3. A denial of service (slab out-of-bounds read and BUG) can occur for a modified f2fs filesystem image in which FI_EXTRA_ATTR is set in an inode.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "98ffb21f-87f2-40ec-8de5-55079efa5dc5",  "id": "CVE-2022-49110",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: revisit gc autotuning\n\nas of commit 4608fdfc07e1\n(\"netfilter: conntrack: collect all entries in one cycle\")\nconntrack gc was changed to run every 2 minutes.\n\nOn systems where conntrack hash table is set to large value, most evictions\nhappen from gc worker rather than the packet path due to hash table\ndistribution.\n\nThis causes netlink event overflows when events are collected.\n\nThis change collects average expiry of scanned entries and\nreschedules to the average remaining value, within 1 to 60 second interval.\n\nTo avoid event overflows, reschedule after each bucket and add a\nlimit for both run time and number of evictions per run.\n\nIf more entries have to be evicted, reschedule and restart 1 jiffy\ninto the future.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ead3b3c3-d33a-473d-a006-4fc800c260a7",  "id": "CVE-2021-47211",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47211"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix null pointer dereference on pointer cs_desc\n\nThe pointer cs_desc return from snd_usb_find_clock_source could\nbe null, so there is a potential null pointer dereference issue.\nFix this by adding a null check before dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "904f9ff9-eaec-4d2b-b23f-b795f093938d",  "id": "CVE-2017-16535",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16535"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "689a036c-cff9-4e80-a1e4-adc75000e239",  "id": "CVE-2010-4649",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4649"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large value of a certain structure member.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e1b279ea-4690-4505-b511-a8148a17925a",  "id": "CVE-2010-2521",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2521"  },  "ratings": [    {      "score": 10,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel before 2.6.34-rc6 allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2aa2dee-9cbb-4a0b-a505-a9f46a286464",  "id": "CVE-2016-1237",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1237"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    284  ],  "analysis": {    "state": "in_triage"  },  "description": "nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32fe06b8-febf-4059-a06a-c41bf3ff7726",  "id": "CVE-2025-22008",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: check that dummy regulator has been probed before using it\n\nDue to asynchronous driver probing there is a chance that the dummy\nregulator hasn't already been probed when first accessing it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a114c9b7-2013-45b4-8083-c91eed46b992",  "id": "MGASA-2017-0364",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "412c93d5-6f20-4f3d-a67a-03e6ec1b2dff",  "id": "AZL-8959",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "533b526b-da46-4736-b67d-dad8ebd30fad",  "id": "CVE-2017-9076",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9076"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The dccp_v6_request_recv_sock function in net/dccp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7fa43b8d-3429-4243-b399-bb38bdb2cf67",  "id": "CVE-2024-35828",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()\n\nIn the for statement of lbs_allocate_cmd_buffer(), if the allocation of\ncmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to\nbe freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee559888-9e58-45e9-9081-c9824e027a04",  "id": "CVE-2025-37878",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix WARN_ON(!ctx) in __free_event() for partial init\n\nMove the get_ctx(child_ctx) call and the child_event->ctx assignment to\noccur immediately after the child event is allocated. Ensure that\nchild_event->ctx is non-NULL before any subsequent error path within\ninherit_event calls free_event(), satisfying the assumptions of the\ncleanup code.\n\nDetails:\n\nThere's no clear Fixes tag, because this bug is a side-effect of\nmultiple interacting commits over time (up to 15 years old), not\na single regression.\n\nThe code initially incremented refcount then assigned context\nimmediately after the child_event was created. Later, an early\nvalidity check for child_event was added before the\nrefcount/assignment. Even later, a WARN_ON_ONCE() cleanup check was\nadded, assuming event->ctx is valid if the pmu_ctx is valid.\nThe problem is that the WARN_ON_ONCE() could trigger after the initial\ncheck passed but before child_event->ctx was assigned, violating its\nprecondition. The solution is to assign child_event->ctx right after\nits initial validation. This ensures the context exists for any\nsubsequent checks or cleanup routines, resolving the WARN_ON_ONCE().\n\nTo resolve it, defer the refcount update and child_event->ctx assignment\ndirectly after child_event->pmu_ctx is set but before checking if the\nparent event is orphaned. The cleanup routine depends on\nevent->pmu_ctx being non-NULL before it verifies event->ctx is\nnon-NULL. This also maintains the author's original intent of passing\nin child_ctx to find_get_pmu_context before its refcount/assignment.\n\n[ mingo: Expanded the changelog from another email by Gabriel Shahrouzi. ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52effd24-07b6-4a5d-bf11-7e18ca3d776e",  "id": "CVE-2025-21971",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: Prevent creation of classes with TC_H_ROOT\n\nThe function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination\ncondition when traversing up the qdisc tree to update parent backlog\ncounters. However, if a class is created with classid TC_H_ROOT, the\ntraversal terminates prematurely at this class instead of reaching the\nactual root qdisc, causing parent statistics to be incorrectly maintained.\nIn case of DRR, this could lead to a crash as reported by Mingi Cho.\n\nPrevent the creation of any Qdisc class with classid TC_H_ROOT\n(0xFFFFFFFF) across all qdisc types, as suggested by Jamal.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7f3a5f98-8ee6-47ba-ac95-57151ebbbb42",  "id": "CVE-2024-56603",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: af_can: do not leave a dangling sk pointer in can_create()\n\nOn error can_create() frees the allocated sk object, but sock_init_data()\nhas already attached it to the provided sock object. This will leave a\ndangling sk pointer in the sock object and may cause use-after-free later.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5247e55-38ae-4d64-92e2-64132205b71f",  "id": "CVE-2017-16544",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16544"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    94  ],  "analysis": {    "state": "in_triage"  },  "description": "In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ba30c2fa-1a45-4ea0-861c-35a31ce3d0e4",  "id": "CVE-2014-9729",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9729"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.18.2 does not ensure a certain data-structure size consistency, which allows local users to cause a denial of service (system crash) via a crafted UDF filesystem image.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1122143d-9228-44bd-a8f3-c56e430c9b7d",  "id": "CVE-2018-19985",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19985"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d06b18da-674c-4849-9988-c39cc745e1b9",  "id": "CVE-2022-48761",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci-plat: fix crash when suspend if remote wake enable\n\nCrashed at i.mx8qm platform when suspend if enable remote wakeup\n\nInternal error: synchronous external abort: 96000210 [#1] PREEMPT SMP\nModules linked in:\nCPU: 2 PID: 244 Comm: kworker/u12:6 Not tainted 5.15.5-dirty #12\nHardware name: Freescale i.MX8QM MEK (DT)\nWorkqueue: events_unbound async_run_entry_fn\npstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : xhci_disable_hub_port_wake.isra.62+0x60/0xf8\nlr : xhci_disable_hub_port_wake.isra.62+0x34/0xf8\nsp : ffff80001394bbf0\nx29: ffff80001394bbf0 x28: 0000000000000000 x27: ffff00081193b578\nx26: ffff00081193b570 x25: 0000000000000000 x24: 0000000000000000\nx23: ffff00081193a29c x22: 0000000000020001 x21: 0000000000000001\nx20: 0000000000000000 x19: ffff800014e90490 x18: 0000000000000000\nx17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\nx14: 0000000000000000 x13: 0000000000000002 x12: 0000000000000000\nx11: 0000000000000000 x10: 0000000000000960 x9 : ffff80001394baa0\nx8 : ffff0008145d1780 x7 : ffff0008f95b8e80 x6 : 000000001853b453\nx5 : 0000000000000496 x4 : 0000000000000000 x3 : ffff00081193a29c\nx2 : 0000000000000001 x1 : 0000000000000000 x0 : ffff000814591620\nCall trace:\n xhci_disable_hub_port_wake.isra.62+0x60/0xf8\n xhci_suspend+0x58/0x510\n xhci_plat_suspend+0x50/0x78\n platform_pm_suspend+0x2c/0x78\n dpm_run_callback.isra.25+0x50/0xe8\n __device_suspend+0x108/0x3c0\n\nThe basic flow:\n\t1. run time suspend call xhci_suspend, xhci parent devices gate the clock.\n        2. echo mem >/sys/power/state, system _device_suspend call xhci_suspend\n        3. xhci_suspend call xhci_disable_hub_port_wake, which access register,\n\t   but clock already gated by run time suspend.\n\nThis problem was hidden by power domain driver, which call run time resume before it.\n\nBut the below commit remove it and make this issue happen.\n\tcommit c1df456d0f06e (\"PM: domains: Don't runtime resume devices at genpd_prepare()\")\n\nThis patch call run time resume before suspend to make sure clock is on\nbefore access register.\n\nTesteb-by: Abel Vesa <abel.vesa@nxp.com>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "40f2478b-c9db-4445-886f-bc60b488f060",  "id": "CVE-2021-47283",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47283"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    772  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet:sfc: fix non-freed irq in legacy irq mode\n\nSFC driver can be configured via modparam to work using MSI-X, MSI or\nlegacy IRQ interrupts. In the last one, the interrupt was not properly\nreleased on module remove.\n\nIt was not freed because the flag irqs_hooked was not set during\ninitialization in the case of using legacy IRQ.\n\nExample of (trimmed) trace during module remove without this fix:\n\nremove_proc_entry: removing non-empty directory 'irq/125', leaking at least '0000:3b:00.1'\nWARNING: CPU: 39 PID: 3658 at fs/proc/generic.c:715 remove_proc_entry+0x15c/0x170\n...trimmed...\nCall Trace:\n unregister_irq_proc+0xe3/0x100\n free_desc+0x29/0x70\n irq_free_descs+0x47/0x70\n mp_unmap_irq+0x58/0x60\n acpi_unregister_gsi_ioapic+0x2a/0x40\n acpi_pci_irq_disable+0x78/0xb0\n pci_disable_device+0xd1/0x100\n efx_pci_remove+0xa1/0x1e0 [sfc]\n pci_device_remove+0x38/0xa0\n __device_release_driver+0x177/0x230\n driver_detach+0xcb/0x110\n bus_remove_driver+0x58/0xd0\n pci_unregister_driver+0x2a/0xb0\n efx_exit_module+0x24/0xf40 [sfc]\n __do_sys_delete_module.constprop.0+0x171/0x280\n ? exit_to_user_mode_prepare+0x83/0x1d0\n do_syscall_64+0x3d/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f9f9385800b\n...trimmed...",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "df8118e1-60db-4b13-8120-ca1b8f30e77e",  "id": "CVE-2026-53292",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind\n\nsyzbot reported a kernel BUG triggered from pn_socket_sendmsg() via\npn_socket_autobind():\n\n  kernel BUG at net/phonet/socket.c:213!\n  RIP: 0010:pn_socket_autobind net/phonet/socket.c:213 [inline]\n  RIP: 0010:pn_socket_sendmsg+0x240/0x250 net/phonet/socket.c:421\n  Call Trace:\n   sock_sendmsg_nosec+0x112/0x150 net/socket.c:797\n   __sock_sendmsg net/socket.c:812 [inline]\n   __sys_sendto+0x402/0x590 net/socket.c:2280\n   ...\n\npn_socket_autobind() calls pn_socket_bind() with port 0 and, on\n-EINVAL, assumes the socket was already bound and asserts that the\nport is non-zero:\n\n  err = pn_socket_bind(sock, ..., sizeof(struct sockaddr_pn));\n  if (err != -EINVAL)\n          return err;\n  BUG_ON(!pn_port(pn_sk(sock->sk)->sobject));\n  return 0; /* socket was already bound */\n\nHowever pn_socket_bind() also returns -EINVAL when sk->sk_state is not\nTCP_CLOSE, even when the socket has never been bound and pn_port() is\nstill 0.  In that case the BUG_ON() fires and panics the kernel from a\nuser-triggerable path.\n\nTreat the \"bind returned -EINVAL but pn_port() is still 0\" case as a\nregular error and propagate -EINVAL to the caller instead of crashing.\nExisting callers already translate a non-zero return from\npn_socket_autobind() into -ENOBUFS/-EAGAIN, so returning -EINVAL here\nonly changes behaviour from panic to a normal errno.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "09d8a1de-2154-42d6-97bc-51eafa1f4bed",  "id": "CVE-2023-52599",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds in diNewExt\n\n[Syz report]\nUBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2\nindex -878706688 is out of range for type 'struct iagctl[128]'\nCPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:217 [inline]\n __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348\n diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360\n diAllocExt fs/jfs/jfs_imap.c:1949 [inline]\n diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666\n diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587\n ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56\n jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225\n vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106\n do_mkdirat+0x264/0x3a0 fs/namei.c:4129\n __do_sys_mkdir fs/namei.c:4149 [inline]\n __se_sys_mkdir fs/namei.c:4147 [inline]\n __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\nRIP: 0033:0x7fcb7e6a0b57\nCode: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053\nRAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57\nRDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140\nRBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n\n[Analysis]\nWhen the agstart is too large, it can cause agno overflow.\n\n[Fix]\nAfter obtaining agno, if the value is invalid, exit the subsequent process.\n\n\nModified the test from agno > MAXAG to agno >= MAXAG based on linux-next\nreport by kernel test robot (Dan Carpenter).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b968687b-3805-4ec0-ae43-cd9822d70eee",  "id": "DSA-6113-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a9b50eaf-2074-418e-8f5b-4741f8b5feca",  "id": "CVE-2011-2494",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2494"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/taskstats.c in the Linux kernel before 3.1 allows local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another user's password.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c801c3d8-f911-4ee1-b096-99b101c84d5a",  "id": "CVE-2015-1573",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1573"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    19  ],  "analysis": {    "state": "in_triage"  },  "description": "The nft_flush_table function in net/netfilter/nf_tables_api.c in the Linux kernel before 3.18.5 mishandles the interaction between cross-chain jumps and ruleset flushes, which allows local users to cause a denial of service (panic) by leveraging the CAP_NET_ADMIN capability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "83f22785-e9b1-4ccb-afcb-cdff223731e4",  "id": "RHSA-2025:21255",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "624e8bd3-1066-491e-8b42-36de819e79c7",  "id": "CVE-2026-23281",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix use-after-free in lbs_free_adapter()\n\nThe lbs_free_adapter() function uses timer_delete() (non-synchronous)\nfor both command_timer and tx_lockup_timer before the structure is\nfreed. This is incorrect because timer_delete() does not wait for\nany running timer callback to complete.\n\nIf a timer callback is executing when lbs_free_adapter() is called,\nthe callback will access freed memory since lbs_cfg_free() frees the\ncontaining structure immediately after lbs_free_adapter() returns.\n\nBoth timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler)\naccess priv->driver_lock, priv->cur_cmd, priv->dev, and other fields,\nwhich would all be use-after-free violations.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning.\n\nThis bug was introduced in commit 8f641d93c38a (\"libertas: detect TX\nlockups and reset hardware\") where del_timer() was used instead of\ndel_timer_sync() in the cleanup path. The command_timer has had the\nsame issue since the driver was first written.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e66e3504-27d9-4520-8203-fdc2bb555375",  "id": "GHSA-xp3w-r5p5-63rr",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "079e1f9b-ff45-4595-8df4-5a1b382037a1",  "id": "CVE-2026-23456",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.199999999999999,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case\n\nIn decode_int(), the CONS case calls get_bits(bs, 2) to read a length\nvalue, then calls get_uint(bs, len) without checking that len bytes\nremain in the buffer. The existing boundary check only validates the\n2 bits for get_bits(), not the subsequent 1-4 bytes that get_uint()\nreads. This allows a malformed H.323/RAS packet to cause a 1-4 byte\nslab-out-of-bounds read.\n\nAdd a boundary check for len bytes after get_bits() and before\nget_uint().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b7f0a967-4fa9-4367-b505-c86c9e3c3f7e",  "id": "CVE-2014-3610",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3610"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "089a1998-c13e-4078-b53a-335f3012d82c",  "id": "CVE-2026-53275",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: Fix use-after-free when processing MLD queries\n\nWhen processing an MLD query, a pointer to the multicast group address\nis retrieved when initially parsing the packet. This pointer is later\ndereferenced without being reloaded despite the fact that the skb header\nmight have been reallocated following the pskb_may_pull() calls, leading\nto a use-after-free [1].\n\nFix by copying the multicast group address when the packet is initially\nparsed.\n\n[1]\nBUG: KASAN: slab-use-after-free in __mld_query_work (net/ipv6/mcast.c:1512)\nRead of size 8 at addr ffff8881154b8e90 by task kworker/4:1/118\n\nWorkqueue: mld mld_query_work\nCall Trace:\n<TASK>\ndump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\nprint_address_description.constprop.0 (mm/kasan/report.c:378)\nprint_report (mm/kasan/report.c:482)\nkasan_report (mm/kasan/report.c:595)\n__mld_query_work (net/ipv6/mcast.c:1512)\nmld_query_work (net/ipv6/mcast.c:1563)\nprocess_one_work (kernel/workqueue.c:3314)\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\nkthread (kernel/kthread.c:436)\nret_from_fork (arch/x86/kernel/process.c:158)\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n</TASK>\n\n[...]\n\nFreed by task 118:\nkasan_save_stack (mm/kasan/common.c:57)\nkasan_save_track (mm/kasan/common.c:78)\nkasan_save_free_info (mm/kasan/generic.c:584)\n__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)\nkfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)\npskb_expand_head (net/core/skbuff.c:2335)\n__pskb_pull_tail (net/core/skbuff.c:2878 (discriminator 4))\n__mld_query_work (net/ipv6/mcast.c:1495 (discriminator 1))\nmld_query_work (net/ipv6/mcast.c:1563)\nprocess_one_work (kernel/workqueue.c:3314)\nworker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\nkthread (kernel/kthread.c:436)\nret_from_fork (arch/x86/kernel/process.c:158)\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7b553fa3-3dde-43b5-8d2c-212154c65be6",  "id": "CVE-2023-52481",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: errata: Add Cortex-A520 speculative unprivileged load workaround\n\nImplement the workaround for ARM Cortex-A520 erratum 2966298. On an\naffected Cortex-A520 core, a speculatively executed unprivileged load\nmight leak data from a privileged load via a cache side channel. The\nissue only exists for loads within a translation regime with the same\ntranslation (e.g. same ASID and VMID). Therefore, the issue only affects\nthe return to EL0.\n\nThe workaround is to execute a TLBI before returning to EL0 after all\nloads of privileged data. A non-shareable TLBI to any address is\nsufficient.\n\nThe workaround isn't necessary if page table isolation (KPTI) is\nenabled, but for simplicity it will be. Page table isolation should\nnormally be disabled for Cortex-A520 as it supports the CSV3 feature\nand the E0PD feature (used when KASLR is enabled).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c04e206-29a9-4476-a355-db4aefc4c863",  "id": "CVE-2024-35944",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nVMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()\n\nSyzkaller hit 'WARNING in dg_dispatch_as_host' bug.\n\nmemcpy: detected field-spanning write (size 56) of single field \"&dg_info->msg\"\nat drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24)\n\nWARNING: CPU: 0 PID: 1555 at drivers/misc/vmw_vmci/vmci_datagram.c:237\ndg_dispatch_as_host+0x88e/0xa60 drivers/misc/vmw_vmci/vmci_datagram.c:237\n\nSome code commentry, based on my understanding:\n\n544 #define VMCI_DG_SIZE(_dg) (VMCI_DG_HEADERSIZE + (size_t)(_dg)->payload_size)\n/// This is 24 + payload_size\n\nmemcpy(&dg_info->msg, dg, dg_size);\n\tDestination = dg_info->msg ---> this is a 24 byte\n\t\t\t\t\tstructure(struct vmci_datagram)\n\tSource = dg --> this is a 24 byte structure (struct vmci_datagram)\n\tSize = dg_size = 24 + payload_size\n\n{payload_size = 56-24 =32} -- Syzkaller managed to set payload_size to 32.\n\n 35 struct delayed_datagram_info {\n 36         struct datagram_entry *entry;\n 37         struct work_struct work;\n 38         bool in_dg_host_queue;\n 39         /* msg and msg_payload must be together. */\n 40         struct vmci_datagram msg;\n 41         u8 msg_payload[];\n 42 };\n\nSo those extra bytes of payload are copied into msg_payload[], a run time\nwarning is seen while fuzzing with Syzkaller.\n\nOne possible way to fix the warning is to split the memcpy() into\ntwo parts -- one -- direct assignment of msg and second taking care of payload.\n\nGustavo quoted:\n\"Under FORTIFY_SOURCE we should not copy data across multiple members\nin a structure.\"",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "136b9d16-6a57-413b-af72-36ec67502a9b",  "id": "CVE-2019-19530",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19530"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka CID-c52873e5a1ef.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7200af49-0c74-46f7-ab94-b301313fa60f",  "id": "SUSE-SU-2022:4309-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95c0fa23-d2c9-47be-987f-d43e24864f3c",  "id": "CVE-2013-1819",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1819"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The _xfs_buf_find function in fs/xfs/xfs_buf.c in the Linux kernel before 3.7.6 does not validate block numbers, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the ability to mount an XFS filesystem containing a metadata inode with an invalid extent map.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "71813cd0-7259-4281-83a7-31023cdbcf57",  "id": "CVE-2023-3776",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation.\n\nIf tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.\n\nWe recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1ff02f8a-260f-4a5f-ad09-6136fadf43a8",  "id": "CVE-2021-20317",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20317"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    665  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and eventually stopping the system while running OSP.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cead2d39-bc1a-4632-bd26-dcac9f70871e",  "id": "CVE-2024-35809",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/PM: Drain runtime-idle callbacks before driver removal\n\nA race condition between the .runtime_idle() callback and the .remove()\ncallback in the rtsx_pcr PCI driver leads to a kernel crash due to an\nunhandled page fault [1].\n\nThe problem is that rtsx_pci_runtime_idle() is not expected to be running\nafter pm_runtime_get_sync() has been called, but the latter doesn't really\nguarantee that.  It only guarantees that the suspend and resume callbacks\nwill not be running when it returns.\n\nHowever, if a .runtime_idle() callback is already running when\npm_runtime_get_sync() is called, the latter will notice that the runtime PM\nstatus of the device is RPM_ACTIVE and it will return right away without\nwaiting for the former to complete.  In fact, it cannot wait for\n.runtime_idle() to complete because it may be called from that callback (it\narguably does not make much sense to do that, but it is not strictly\nprohibited).\n\nThus in general, whoever is providing a .runtime_idle() callback needs\nto protect it from running in parallel with whatever code runs after\npm_runtime_get_sync().  [Note that .runtime_idle() will not start after\npm_runtime_get_sync() has returned, but it may continue running then if it\nhas started earlier.]\n\nOne way to address that race condition is to call pm_runtime_barrier()\nafter pm_runtime_get_sync() (not before it, because a nonzero value of the\nruntime PM usage counter is necessary to prevent runtime PM callbacks from\nbeing invoked) to wait for the .runtime_idle() callback to complete should\nit be running at that point.  A suitable place for doing that is in\npci_device_remove() which calls pm_runtime_get_sync() before removing the\ndriver, so it may as well call pm_runtime_barrier() subsequently, which\nwill prevent the race in question from occurring, not just in the rtsx_pcr\ndriver, but in any PCI drivers providing .runtime_idle() callbacks.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1b36106f-799d-412c-8617-9793091c2ea6",  "id": "CVE-2024-53210",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()\n\nPassing MSG_PEEK flag to skb_recv_datagram() increments skb refcount\n(skb->users) and iucv_sock_recvmsg() does not decrement skb refcount\nat exit.\nThis results in skb memory leak in skb_queue_purge() and WARN_ON in\niucv_sock_destruct() during socket close. To fix this decrease\nskb refcount by one if MSG_PEEK is set in order to prevent memory\nleak and WARN_ON.\n\nWARNING: CPU: 2 PID: 6292 at net/iucv/af_iucv.c:286 iucv_sock_destruct+0x144/0x1a0 [af_iucv]\nCPU: 2 PID: 6292 Comm: afiucv_test_msg Kdump: loaded Tainted: G        W          6.10.0-rc7 #1\nHardware name: IBM 3931 A01 704 (z/VM 7.3.0)\nCall Trace:\n        [<001587c682c4aa98>] iucv_sock_destruct+0x148/0x1a0 [af_iucv]\n        [<001587c682c4a9d0>] iucv_sock_destruct+0x80/0x1a0 [af_iucv]\n        [<001587c704117a32>] __sk_destruct+0x52/0x550\n        [<001587c704104a54>] __sock_release+0xa4/0x230\n        [<001587c704104c0c>] sock_close+0x2c/0x40\n        [<001587c702c5f5a8>] __fput+0x2e8/0x970\n        [<001587c7024148c4>] task_work_run+0x1c4/0x2c0\n        [<001587c7023b0716>] do_exit+0x996/0x1050\n        [<001587c7023b13aa>] do_group_exit+0x13a/0x360\n        [<001587c7023b1626>] __s390x_sys_exit_group+0x56/0x60\n        [<001587c7022bccca>] do_syscall+0x27a/0x380\n        [<001587c7049a6a0c>] __do_syscall+0x9c/0x160\n        [<001587c7049ce8a8>] system_call+0x70/0x98\n        Last Breaking-Event-Address:\n        [<001587c682c4a9d4>] iucv_sock_destruct+0x84/0x1a0 [af_iucv]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f16af39b-1d66-407a-a78e-90a0d5e31f61",  "id": "CVE-2013-0343",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0343"  },  "ratings": [    {      "score": 3.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:H/Au:N/C:P/I:N/A:P"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information, via ICMPv6 Router Advertisement (RA) messages.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1b625e03-06d9-4ae4-a1ba-38e936d11336",  "id": "SUSE-SU-2023:1960-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d6de73b-9b1a-4bb1-b2da-f375131339a3",  "id": "MGASA-2020-0244",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "76e1d5b2-d13a-4e0c-b6a9-2e75d2da475e",  "id": "CVE-2021-47308",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47308"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libfc: Fix array index out of bound exception\n\nFix array index out of bound exception in fc_rport_prli_resp().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "257d4c48-1f76-44d9-8040-fd67e649c990",  "id": "CVE-2024-35949",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: make sure that WRITTEN is set on all metadata blocks\n\nWe previously would call btrfs_check_leaf() if we had the check\nintegrity code enabled, which meant that we could only run the extended\nleaf checks if we had WRITTEN set on the header flags.\n\nThis leaves a gap in our checking, because we could end up with\ncorruption on disk where WRITTEN isn't set on the leaf, and then the\nextended leaf checks don't get run which we rely on to validate all of\nthe item pointers to make sure we don't access memory outside of the\nextent buffer.\n\nHowever, since 732fab95abe2 (\"btrfs: check-integrity: remove\nCONFIG_BTRFS_FS_CHECK_INTEGRITY option\") we no longer call\nbtrfs_check_leaf() from btrfs_mark_buffer_dirty(), which means we only\never call it on blocks that are being written out, and thus have WRITTEN\nset, or that are being read in, which should have WRITTEN set.\n\nAdd checks to make sure we have WRITTEN set appropriately, and then make\nsure __btrfs_check_leaf() always does the item checking.  This will\nprotect us from file systems that have been corrupted and no longer have\nWRITTEN set on some of the blocks.\n\nThis was hit on a crafted image tweaking the WRITTEN bit and reported by\nKASAN as out-of-bound access in the eb accessors. The example is a dir\nitem at the end of an eb.\n\n  [2.042] BTRFS warning (device loop1): bad eb member start: ptr 0x3fff start 30572544 member offset 16410 size 2\n  [2.040] general protection fault, probably for non-canonical address 0xe0009d1000000003: 0000 [#1] PREEMPT SMP KASAN NOPTI\n  [2.537] KASAN: maybe wild-memory-access in range [0x0005088000000018-0x000508800000001f]\n  [2.729] CPU: 0 PID: 2587 Comm: mount Not tainted 6.8.2 #1\n  [2.729] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  [2.621] RIP: 0010:btrfs_get_16+0x34b/0x6d0\n  [2.621] RSP: 0018:ffff88810871fab8 EFLAGS: 00000206\n  [2.621] RAX: 0000a11000000003 RBX: ffff888104ff8720 RCX: ffff88811b2288c0\n  [2.621] RDX: dffffc0000000000 RSI: ffffffff81dd8aca RDI: ffff88810871f748\n  [2.621] RBP: 000000000000401a R08: 0000000000000001 R09: ffffed10210e3ee9\n  [2.621] R10: ffff88810871f74f R11: 205d323430333737 R12: 000000000000001a\n  [2.621] R13: 000508800000001a R14: 1ffff110210e3f5d R15: ffffffff850011e8\n  [2.621] FS:  00007f56ea275840(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000\n  [2.621] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [2.621] CR2: 00007febd13b75c0 CR3: 000000010bb50000 CR4: 00000000000006f0\n  [2.621] Call Trace:\n  [2.621]  <TASK>\n  [2.621]  ? show_regs+0x74/0x80\n  [2.621]  ? die_addr+0x46/0xc0\n  [2.621]  ? exc_general_protection+0x161/0x2a0\n  [2.621]  ? asm_exc_general_protection+0x26/0x30\n  [2.621]  ? btrfs_get_16+0x33a/0x6d0\n  [2.621]  ? btrfs_get_16+0x34b/0x6d0\n  [2.621]  ? btrfs_get_16+0x33a/0x6d0\n  [2.621]  ? __pfx_btrfs_get_16+0x10/0x10\n  [2.621]  ? __pfx_mutex_unlock+0x10/0x10\n  [2.621]  btrfs_match_dir_item_name+0x101/0x1a0\n  [2.621]  btrfs_lookup_dir_item+0x1f3/0x280\n  [2.621]  ? __pfx_btrfs_lookup_dir_item+0x10/0x10\n  [2.621]  btrfs_get_tree+0xd25/0x1910\n\n[ copy more details from report ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "275dbfed-6916-450c-8fa3-175793f218ec",  "id": "CVE-2017-18270",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18270"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands, setting unwanted defaults or causing a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "16bb06dc-c752-4392-8c14-3247e2fd9fe4",  "id": "CVE-2021-47002",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47002"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix null pointer dereference in svc_rqst_free()\n\nWhen alloc_pages_node() returns null in svc_rqst_alloc(), the\nnull rq_scratch_page pointer will be dereferenced when calling\nput_page() in svc_rqst_free(). Fix it by adding a null check.\n\nAddresses-Coverity: (\"Dereference after null check\")",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8111af79-3db8-4eb7-be9c-c48fc489eda7",  "id": "CVE-2024-49931",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix array out-of-bound access in SoC stats\n\nCurrently, the ath12k_soc_dp_stats::hal_reo_error array is defined with a\nmaximum size of DP_REO_DST_RING_MAX. However, the ath12k_dp_rx_process()\nfunction access ath12k_soc_dp_stats::hal_reo_error using the REO\ndestination SRNG ring ID, which is incorrect. SRNG ring ID differ from\nnormal ring ID, and this usage leads to out-of-bounds array access. To\nfix this issue, modify ath12k_dp_rx_process() to use the normal ring ID\ndirectly instead of the SRNG ring ID to avoid out-of-bounds array access.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1267e11f-d7f8-4835-b38e-04c58bdd5e6c",  "id": "CVE-2021-47339",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47339"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-core: explicitly clear ioctl input data\n\nAs seen from a recent syzbot bug report, mistakes in the compat ioctl\nimplementation can lead to uninitialized kernel stack data getting used\nas input for driver ioctl handlers.\n\nThe reported bug is now fixed, but it's possible that other related\nbugs are still present or get added in the future. As the drivers need\nto check user input already, the possible impact is fairly low, but it\nmight still cause an information leak.\n\nTo be on the safe side, always clear the entire ioctl buffer before\ncalling the conversion handler functions that are meant to initialize\nthem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8d50a9c6-4c2f-4695-9e5d-48756bf7e5ec",  "id": "CVE-2021-47203",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47203"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()\n\nWhen parsing the txq list in lpfc_drain_txq(), the driver attempts to pass\nthe requests to the adapter. If such an attempt fails, a local \"fail_msg\"\nstring is set and a log message output.  The job is then added to a\ncompletions list for cancellation.\n\nProcessing of any further jobs from the txq list continues, but since\n\"fail_msg\" remains set, jobs are added to the completions list regardless\nof whether a wqe was passed to the adapter.  If successfully added to\ntxcmplq, jobs are added to both lists resulting in list corruption.\n\nFix by clearing the fail_msg string after adding a job to the completions\nlist. This stops the subsequent jobs from being added to the completions\nlist unless they had an appropriate failure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a6552d74-ee21-4225-8488-b44f32fa7266",  "id": "DLA-2559-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fbd3863d-374b-45ee-927b-0a9f742455c4",  "id": "CVE-2016-6786",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6786"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 30955111.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a180a351-71b0-40ce-b7f3-9f169279de38",  "id": "CVE-2024-46813",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check link_index before accessing dc->links[]\n\n[WHY & HOW]\ndc->links[] has max size of MAX_LINKS and NULL is return when trying to\naccess with out-of-bound index.\n\nThis fixes 3 OVERRUN and 1 RESOURCE_LEAK issues reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e43511ec-713a-4cd5-b907-ddc2ea995ad2",  "id": "CVE-2010-3859",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3859"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple integer signedness errors in the TIPC implementation in the Linux kernel before 2.6.36.2 allow local users to gain privileges via a crafted sendmsg call that triggers a heap-based buffer overflow, related to the tipc_msg_build function in net/tipc/msg.c and the verify_iovec function in net/core/iovec.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f356fc90-3a11-4dc8-887a-20dd49b85cf7",  "id": "CVE-2025-37983",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nqibfs: fix _another_ leak\n\nfailure to allocate inode => leaked dentry...\n\nthis one had been there since the initial merge; to be fair,\nif we are that far OOM, the odds of failing at that particular\nallocation are low...",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4c0bce18-109a-4a1a-96e1-3cdc874c70d2",  "id": "CVE-2010-4256",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4256"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The pipe_fcntl function in fs/pipe.c in the Linux kernel before 2.6.37 does not properly determine whether a file is a named pipe, which allows local users to cause a denial of service via an F_SETPIPE_SZ fcntl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "23c2105c-8d8f-42a6-a520-d26a790e7f97",  "id": "CVE-2025-37884",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix deadlock between rcu_tasks_trace and event_mutex.\n\nFix the following deadlock:\nCPU A\n_free_event()\n  perf_kprobe_destroy()\n    mutex_lock(&event_mutex)\n      perf_trace_event_unreg()\n        synchronize_rcu_tasks_trace()\n\nThere are several paths where _free_event() grabs event_mutex\nand calls sync_rcu_tasks_trace. Above is one such case.\n\nCPU B\nbpf_prog_test_run_syscall()\n  rcu_read_lock_trace()\n    bpf_prog_run_pin_on_cpu()\n      bpf_prog_load()\n        bpf_tracing_func_proto()\n          trace_set_clr_event()\n            mutex_lock(&event_mutex)\n\nDelegate trace_set_clr_event() to workqueue to avoid\nsuch lock dependency.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e3bc9b68-a142-4eba-b392-517b6be1c22e",  "id": "DSA-2950-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5d08e01b-0720-4a3c-8029-eb63a4f08717",  "id": "CVE-2021-34981",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34981"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux Kernel Bluetooth CMTP Module Double Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the CMTP module. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11977.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c792fe60-36a6-4afb-bdae-6f213ca8d7ea",  "id": "CVE-2022-48631",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0\n\nWhen walking through an inode extents, the ext4_ext_binsearch_idx() function\nassumes that the extent header has been previously validated.  However, there\nare no checks that verify that the number of entries (eh->eh_entries) is\nnon-zero when depth is > 0.  And this will lead to problems because the\nEXT_FIRST_INDEX() and EXT_LAST_INDEX() will return garbage and result in this:\n\n[  135.245946] ------------[ cut here ]------------\n[  135.247579] kernel BUG at fs/ext4/extents.c:2258!\n[  135.249045] invalid opcode: 0000 [#1] PREEMPT SMP\n[  135.250320] CPU: 2 PID: 238 Comm: tmp118 Not tainted 5.19.0-rc8+ #4\n[  135.252067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014\n[  135.255065] RIP: 0010:ext4_ext_map_blocks+0xc20/0xcb0\n[  135.256475] Code:\n[  135.261433] RSP: 0018:ffffc900005939f8 EFLAGS: 00010246\n[  135.262847] RAX: 0000000000000024 RBX: ffffc90000593b70 RCX: 0000000000000023\n[  135.264765] RDX: ffff8880038e5f10 RSI: 0000000000000003 RDI: ffff8880046e922c\n[  135.266670] RBP: ffff8880046e9348 R08: 0000000000000001 R09: ffff888002ca580c\n[  135.268576] R10: 0000000000002602 R11: 0000000000000000 R12: 0000000000000024\n[  135.270477] R13: 0000000000000000 R14: 0000000000000024 R15: 0000000000000000\n[  135.272394] FS:  00007fdabdc56740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000\n[  135.274510] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  135.276075] CR2: 00007ffc26bd4f00 CR3: 0000000006261004 CR4: 0000000000170ea0\n[  135.277952] Call Trace:\n[  135.278635]  <TASK>\n[  135.279247]  ? preempt_count_add+0x6d/0xa0\n[  135.280358]  ? percpu_counter_add_batch+0x55/0xb0\n[  135.281612]  ? _raw_read_unlock+0x18/0x30\n[  135.282704]  ext4_map_blocks+0x294/0x5a0\n[  135.283745]  ? xa_load+0x6f/0xa0\n[  135.284562]  ext4_mpage_readpages+0x3d6/0x770\n[  135.285646]  read_pages+0x67/0x1d0\n[  135.286492]  ? folio_add_lru+0x51/0x80\n[  135.287441]  page_cache_ra_unbounded+0x124/0x170\n[  135.288510]  filemap_get_pages+0x23d/0x5a0\n[  135.289457]  ? path_openat+0xa72/0xdd0\n[  135.290332]  filemap_read+0xbf/0x300\n[  135.291158]  ? _raw_spin_lock_irqsave+0x17/0x40\n[  135.292192]  new_sync_read+0x103/0x170\n[  135.293014]  vfs_read+0x15d/0x180\n[  135.293745]  ksys_read+0xa1/0xe0\n[  135.294461]  do_syscall_64+0x3c/0x80\n[  135.295284]  entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThis patch simply adds an extra check in __ext4_ext_check(), verifying that\neh_entries is not 0 when eh_depth is > 0.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9149af32-68a7-479f-bec4-68c546e415a6",  "id": "CVE-2024-58012",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params\n\nEach cpu DAI should associate with a widget. However, the topology might\nnot create the right number of DAI widgets for aggregated amps. And it\nwill cause NULL pointer deference.\nCheck that the DAI widget associated with the CPU DAI is valid to prevent\nNULL pointer deference due to missing DAI widgets in topologies with\naggregated amps.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d7acf38b-95ce-4f70-98e4-414cbaba01eb",  "id": "CVE-2024-53084",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Break an object reference loop\n\nWhen remaining resources are being cleaned up on driver close,\noutstanding VM mappings may result in resources being leaked, due\nto an object reference loop, as shown below, with each object (or\nset of objects) referencing the object below it:\n\n    PVR GEM Object\n    GPU scheduler \"finished\" fence\n    GPU scheduler “scheduled” fence\n    PVR driver “done” fence\n    PVR Context\n    PVR VM Context\n    PVR VM Mappings\n    PVR GEM Object\n\nThe reference that the PVR VM Context has on the VM mappings is a\nsoft one, in the sense that the freeing of outstanding VM mappings\nis done as part of VM context destruction; no reference counts are\ninvolved, as is the case for all the other references in the loop.\n\nTo break the reference loop during cleanup, free the outstanding\nVM mappings before destroying the PVR Context associated with the\nVM context.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd801713-e516-46f7-9b84-01147b2f5f8e",  "id": "CVE-2019-5108",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5108"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    287,    440  ],  "analysis": {    "state": "in_triage"  },  "description": "An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4df9d253-0c15-4b65-bc43-2424495034c9",  "id": "CVE-2022-49033",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()\n\nSyzkaller reported BUG as follows:\n\n  BUG: sleeping function called from invalid context at\n       include/linux/sched/mm.h:274\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0xcd/0x134\n   __might_resched.cold+0x222/0x26b\n   kmem_cache_alloc+0x2e7/0x3c0\n   update_qgroup_limit_item+0xe1/0x390\n   btrfs_qgroup_inherit+0x147b/0x1ee0\n   create_subvol+0x4eb/0x1710\n   btrfs_mksubvol+0xfe5/0x13f0\n   __btrfs_ioctl_snap_create+0x2b0/0x430\n   btrfs_ioctl_snap_create_v2+0x25a/0x520\n   btrfs_ioctl+0x2a1c/0x5ce0\n   __x64_sys_ioctl+0x193/0x200\n   do_syscall_64+0x35/0x80\n\nFix this by calling qgroup_dirty() on @dstqgroup, and update limit item in\nbtrfs_run_qgroups() later outside of the spinlock context.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eb670dd1-e8ff-4da1-a77d-8d6b5f67d6c2",  "id": "AZL-86766",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3bdc93ca-a5eb-4487-813f-51e19312cf15",  "id": "CVE-2013-6449",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6449"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c184ae91-6084-44fd-a2b3-44b818dea4ba",  "id": "CVE-2024-42153",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr\n\nWhen del_timer_sync() is called in an interrupt context it throws a warning\nbecause of potential deadlock. The timer is used only to exit from\nwait_for_completion() after a timeout so replacing the call with\nwait_for_completion_timeout() allows to remove the problematic timer and\nits related functions altogether.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1a85ee95-d052-4e2d-bf6c-3be22dfa5689",  "id": "CVE-2019-7222",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7222"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:151712/KVM-kvm_inject_page_fault-Uninitialized-Memory-Leak.html'"    }  ]},{  "bom-ref": "6238b810-ee5a-4e4f-aeab-02cf4399f5cc",  "id": "AZL-9051",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3e375d25-bed5-4121-be6f-9ae8b94bdcec",  "id": "CVE-2023-52566",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential use after free in nilfs_gccache_submit_read_data()\n\nIn nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the\nreference count of bh when the call to nilfs_dat_translate() fails.  If\nthe reference count hits 0 and its owner page gets unlocked, bh may be\nfreed.  However, bh->b_page is dereferenced to put the page after that,\nwhich may result in a use-after-free bug.  This patch moves the release\noperation after unlocking and putting the page.\n\nNOTE: The function in question is only called in GC, and in combination\nwith current userland tools, address translation using DAT does not occur\nin that function, so the code path that causes this issue will not be\nexecuted.  However, it is possible to run that code path by intentionally\nmodifying the userland GC library or by calling the GC ioctl directly.\n\n[konishi.ryusuke@gmail.com: NOTE added to the commit log]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f99ee0b8-ed78-48f7-97a3-c80f83a3e03a",  "id": "CVE-2024-46806",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix the warning division or modulo by zero\n\nChecks the partition mode and returns an error for an invalid mode.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d9b07f26-5499-46ac-9922-2313a36722b5",  "id": "CLSA-2025-1744628407",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51124ad5-e4d0-4302-a7e3-d44319cfafec",  "id": "CVE-2006-2194",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-2194"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The winbind plugin in pppd for ppp 2.4.4 and earlier does not check the return code from the setuid function call, which might allow local users to gain privileges by causing setuid to fail, such as exceeding PAM limits for the maximum number of user processes, which prevents the winbind NTLM authentication helper from dropping privileges.",  "affects": [    {      "ref": "73881d6c-a776-4513-80a9-27bcf656c60d",      "versions": [        {          "component": "point-to-point_protocol",          "version": "2.4.2b3"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d66bed7b-004d-4a5b-beb2-0d876ed8e21d",  "id": "CVE-2024-39474",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    770  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL\n\ncommit a421ef303008 (\"mm: allow !GFP_KERNEL allocations for kvmalloc\")\nincludes support for __GFP_NOFAIL, but it presents a conflict with commit\ndd544141b9eb (\"vmalloc: back off when the current task is OOM-killed\").  A\npossible scenario is as follows:\n\nprocess-a\n__vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL)\n    __vmalloc_area_node()\n        vm_area_alloc_pages()\n\t\t--> oom-killer send SIGKILL to process-a\n        if (fatal_signal_pending(current)) break;\n--> return NULL;\n\nTo fix this, do not check fatal_signal_pending() in vm_area_alloc_pages()\nif __GFP_NOFAIL set.\n\nThis issue occurred during OPLUS KASAN TEST. Below is part of the log\n-> oom-killer sends signal to process\n[65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198\n\n[65731.259685] [T32454] Call trace:\n[65731.259698] [T32454]  dump_backtrace+0xf4/0x118\n[65731.259734] [T32454]  show_stack+0x18/0x24\n[65731.259756] [T32454]  dump_stack_lvl+0x60/0x7c\n[65731.259781] [T32454]  dump_stack+0x18/0x38\n[65731.259800] [T32454]  mrdump_common_die+0x250/0x39c [mrdump]\n[65731.259936] [T32454]  ipanic_die+0x20/0x34 [mrdump]\n[65731.260019] [T32454]  atomic_notifier_call_chain+0xb4/0xfc\n[65731.260047] [T32454]  notify_die+0x114/0x198\n[65731.260073] [T32454]  die+0xf4/0x5b4\n[65731.260098] [T32454]  die_kernel_fault+0x80/0x98\n[65731.260124] [T32454]  __do_kernel_fault+0x160/0x2a8\n[65731.260146] [T32454]  do_bad_area+0x68/0x148\n[65731.260174] [T32454]  do_mem_abort+0x151c/0x1b34\n[65731.260204] [T32454]  el1_abort+0x3c/0x5c\n[65731.260227] [T32454]  el1h_64_sync_handler+0x54/0x90\n[65731.260248] [T32454]  el1h_64_sync+0x68/0x6c\n\n[65731.260269] [T32454]  z_erofs_decompress_queue+0x7f0/0x2258\n--> be->decompressed_pages = kvcalloc(be->nr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL);\n\tkernel panic by NULL pointer dereference.\n\terofs assume kvmalloc with __GFP_NOFAIL never return NULL.\n[65731.260293] [T32454]  z_erofs_runqueue+0xf30/0x104c\n[65731.260314] [T32454]  z_erofs_readahead+0x4f0/0x968\n[65731.260339] [T32454]  read_pages+0x170/0xadc\n[65731.260364] [T32454]  page_cache_ra_unbounded+0x874/0xf30\n[65731.260388] [T32454]  page_cache_ra_order+0x24c/0x714\n[65731.260411] [T32454]  filemap_fault+0xbf0/0x1a74\n[65731.260437] [T32454]  __do_fault+0xd0/0x33c\n[65731.260462] [T32454]  handle_mm_fault+0xf74/0x3fe0\n[65731.260486] [T32454]  do_mem_abort+0x54c/0x1b34\n[65731.260509] [T32454]  el0_da+0x44/0x94\n[65731.260531] [T32454]  el0t_64_sync_handler+0x98/0xb4\n[65731.260553] [T32454]  el0t_64_sync+0x198/0x19c",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "381561de-c3f9-4292-8c3d-4dc8be84a8f1",  "id": "CVE-2025-38204",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds read in add_missing_indices\n\nstbl is s8 but it must contain offsets into slot which can go from 0 to\n127.\n\nAdded a bound check for that error and return -EIO if the check fails.\nAlso make jfs_readdir return with error if add_missing_indices returns\nwith an error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f4501378-1996-47d5-b5c3-90a268e68db9",  "id": "CVE-2024-35937",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: check A-MSDU format more carefully\n\nIf it looks like there's another subframe in the A-MSDU\nbut the header isn't fully there, we can end up reading\ndata out of bounds, only to discard later. Make this a\nbit more careful and check if the subframe header can\neven be present.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "96df03cf-b078-488c-a456-a551f71fbf85",  "id": "CVE-2026-45850",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: skip ipv6 extension headers for csum checks\n\nProtocol checksum validation fails for IPv6 if there are extension\nheaders before the protocol header. iph->len already contains its\noffset, so use it to fix the problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b98cb5ee-ecd4-4025-a92a-0e5bbdf8961d",  "id": "AZL-6351",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.2,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff40c171-81c0-44e3-b512-1731ae408ff0",  "id": "MGASA-2014-0255",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "722dd210-a17c-4530-b529-527a5622f387",  "id": "CVE-2017-18216",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18216"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In fs/ocfs2/cluster/nodemanager.c in the Linux kernel before 4.15, local users can cause a denial of service (NULL pointer dereference and BUG) because a required mutex is not used.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48846a8f-031f-4a03-b026-6033fe57445b",  "id": "SUSE-SU-2023:3308-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "edaac8b1-c023-45a1-b598-9c3f6ad80b25",  "id": "CVE-2025-22073",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspufs: fix a leak on spufs_new_file() failure\n\nIt's called from spufs_fill_dir(), and caller of that will do\nspufs_rmdir() in case of failure.  That does remove everything\nwe'd managed to create, but... the problem dentry is still\nnegative.  IOW, it needs to be explicitly dropped.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f63d4ad6-a994-4792-ab3b-33831327c0b0",  "id": "CVE-2017-16527",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16527"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "855b934e-3cb7-42d2-a04c-53a0e009b6d6",  "id": "CVE-2025-38193",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: reject invalid perturb period\n\nGerrard Tai reported that SFQ perturb_period has no range check yet,\nand this can be used to trigger a race condition fixed in a separate patch.\n\nWe want to make sure ctl->perturb_period * HZ will not overflow\nand is positive.\n\n\ntc qd add dev lo root sfq perturb -10   # negative value : error\nError: sch_sfq: invalid perturb period.\n\ntc qd add dev lo root sfq perturb 1000000000 # too big : error\nError: sch_sfq: invalid perturb period.\n\ntc qd add dev lo root sfq perturb 2000000 # acceptable value\ntc -s -d qd sh dev lo\nqdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 perturb 2000000sec\n Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)\n backlog 0b 0p requeues 0",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "662fab17-cd5d-4b2e-a8b0-98c8075a0d68",  "id": "CVE-2021-4001",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4001"  },  "ratings": [    {      "score": 4.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    367  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel versions prior to 5.16 rc2.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5426c01-b2a8-4593-992f-92c15cb986b7",  "id": "CVE-2020-36386",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36386"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f907600-153c-4a5c-9c58-56e07dc00278",  "id": "RHSA-2017:0286",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "211b0366-5896-46cd-805e-3185e9dd2e69",  "id": "CVE-2025-38710",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Validate i_depth for exhash directories\n\nA fuzzer test introduced corruption that ends up with a depth of 0 in\ndir_e_read(), causing an undefined shift by 32 at:\n\n  index = hash >> (32 - dip->i_depth);\n\nAs calculated in an open-coded way in dir_make_exhash(), the minimum\ndepth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is\ninvalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time.\n\nSo we can avoid the undefined behaviour by checking for depth values\nlower than the minimum in gfs2_dinode_in(). Values greater than the\nmaximum are already being checked for there.\n\nAlso switch the calculation in dir_make_exhash() to use ilog2() to\nclarify how the depth is calculated.\n\nTested with the syzkaller repro.c and xfstests '-g quick'.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ea2472e0-7338-4829-9a04-56db7b4855e4",  "id": "OESA-2025-2326",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b7f44cf1-4a77-4b98-808d-e2b84c323128",  "id": "CVE-2021-38160",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38160"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e3afc1db-d2dc-4378-a051-e889f6a4b7f6",  "id": "CVE-2018-16395",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16395"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "68a9955d-c431-41e4-b4b0-89ea472c1cad",  "id": "CVE-2023-1611",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1611"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c228c13-2dbf-42f6-be3d-a1d9e772e271",  "id": "RHSA-2024:0208",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4cd3500b-7358-4366-bc38-a1c343d8f235",  "id": "CVE-2012-4461",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4461"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without XSAVE, allows local users to cause a denial of service (kernel OOPS) by using the KVM_SET_SREGS ioctl to set the X86_CR4_OSXSAVE bit in the guest cr4 register, then calling the KVM_RUN ioctl.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f9b90b85-6c36-47d1-a46f-c4b7a1f2aec0",  "id": "CVE-2024-24857",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24857"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    190,    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a233c42-7e28-48b4-975e-10216a9e023d",  "id": "CVE-2021-34556",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34556"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    203  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "720c51a0-5439-474e-b09c-d495b65c438c",  "id": "CVE-2017-5577",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5577"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    388  ],  "analysis": {    "state": "in_triage"  },  "description": "The vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 does not set an errno value upon certain overflow detections, which allows local users to cause a denial of service (incorrect pointer dereference and OOPS) via inconsistent size values in a VC4_SUBMIT_CL ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c6126177-69fa-4b2a-8219-06f89d8950ff",  "id": "CVE-2010-4074",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4074"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The USB subsystem in the Linux kernel before 2.6.36-rc5 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to TIOCGICOUNT ioctl calls, and the (1) mos7720_ioctl function in drivers/usb/serial/mos7720.c and (2) mos7840_ioctl function in drivers/usb/serial/mos7840.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "016bf584-5032-4a70-85b2-934fe02c20f5",  "id": "CVE-2015-0286",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0286"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    17  ],  "analysis": {    "state": "in_triage"  },  "description": "The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "09dce877-0fe1-4045-a32f-d147b7239269",  "id": "CVE-2025-39716",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nparisc: Revise __get_user() to probe user read access\n\nBecause of the way read access support is implemented, read access\ninterruptions are only triggered at privilege levels 2 and 3. The\nkernel executes at privilege level 0, so __get_user() never triggers\na read access interruption (code 26). Thus, it is currently possible\nfor user code to access a read protected address via a system call.\n\nFix this by probing read access rights at privilege level 3 (PRIV_USER)\nand setting __gu_err to -EFAULT (-14) if access isn't allowed.\n\nNote the cmpiclr instruction does a 32-bit compare because COND macro\ndoesn't work inside asm.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0927a667-5929-4897-be93-de81a1ca7cd6",  "id": "CVE-2014-7975",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7975"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "75f4e70c-6996-47cc-bcd7-2e1c68c932e5",  "id": "CVE-2018-16658",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16658"  },  "ratings": [    {      "score": 6.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d644c57a-d400-4e31-9bd0-6e86cbc30511",  "id": "OESA-2023-1107",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff6869e9-d782-465a-a6ae-8edbe710c942",  "id": "CVE-2022-2991",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2991"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    122,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged code on the target system to exploit this vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10074a5c-6272-4f31-9a17-84ade28f1b28",  "id": "SUSE-SU-2017:2618-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b08a75a4-20d2-40c7-a9b1-308276f136c3",  "id": "CVE-2021-38206",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38206"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The mac80211 subsystem in the Linux kernel before 5.12.13, when a device supporting only 5 GHz is used, allows attackers to cause a denial of service (NULL pointer dereference in the radiotap parser) by injecting a frame with 802.11a rates.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ee8efed5-124c-4979-8a95-5c1c71277036",  "id": "CVE-2022-49175",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPM: core: keep irq flags in device_pm_check_callbacks()\n\nThe function device_pm_check_callbacks() can be called under the spin\nlock (in the reported case it happens from genpd_add_device() ->\ndev_pm_domain_set(), when the genpd uses spinlocks rather than mutexes.\n\nHowever this function uncoditionally uses spin_lock_irq() /\nspin_unlock_irq(), thus not preserving the CPU flags. Use the\nirqsave/irqrestore instead.\n\nThe backtrace for the reference:\n[    2.752010] ------------[ cut here ]------------\n[    2.756769] raw_local_irq_restore() called with IRQs enabled\n[    2.762596] WARNING: CPU: 4 PID: 1 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x34/0x50\n[    2.772338] Modules linked in:\n[    2.775487] CPU: 4 PID: 1 Comm: swapper/0 Tainted: G S                5.17.0-rc6-00384-ge330d0d82eff-dirty #684\n[    2.781384] Freeing initrd memory: 46024K\n[    2.785839] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[    2.785841] pc : warn_bogus_irq_restore+0x34/0x50\n[    2.785844] lr : warn_bogus_irq_restore+0x34/0x50\n[    2.785846] sp : ffff80000805b7d0\n[    2.785847] x29: ffff80000805b7d0 x28: 0000000000000000 x27: 0000000000000002\n[    2.785850] x26: ffffd40e80930b18 x25: ffff7ee2329192b8 x24: ffff7edfc9f60800\n[    2.785853] x23: ffffd40e80930b18 x22: ffffd40e80930d30 x21: ffff7edfc0dffa00\n[    2.785856] x20: ffff7edfc09e3768 x19: 0000000000000000 x18: ffffffffffffffff\n[    2.845775] x17: 6572206f74206465 x16: 6c696166203a3030 x15: ffff80008805b4f7\n[    2.853108] x14: 0000000000000000 x13: ffffd40e809550b0 x12: 00000000000003d8\n[    2.860441] x11: 0000000000000148 x10: ffffd40e809550b0 x9 : ffffd40e809550b0\n[    2.867774] x8 : 00000000ffffefff x7 : ffffd40e809ad0b0 x6 : ffffd40e809ad0b0\n[    2.875107] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000\n[    2.882440] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff7edfc03a8000\n[    2.889774] Call trace:\n[    2.892290]  warn_bogus_irq_restore+0x34/0x50\n[    2.896770]  _raw_spin_unlock_irqrestore+0x94/0xa0\n[    2.901690]  genpd_unlock_spin+0x20/0x30\n[    2.905724]  genpd_add_device+0x100/0x2d0\n[    2.909850]  __genpd_dev_pm_attach+0xa8/0x23c\n[    2.914329]  genpd_dev_pm_attach_by_id+0xc4/0x190\n[    2.919167]  genpd_dev_pm_attach_by_name+0x3c/0xd0\n[    2.924086]  dev_pm_domain_attach_by_name+0x24/0x30\n[    2.929102]  psci_dt_attach_cpu+0x24/0x90\n[    2.933230]  psci_cpuidle_probe+0x2d4/0x46c\n[    2.937534]  platform_probe+0x68/0xe0\n[    2.941304]  really_probe.part.0+0x9c/0x2fc\n[    2.945605]  __driver_probe_device+0x98/0x144\n[    2.950085]  driver_probe_device+0x44/0x15c\n[    2.954385]  __device_attach_driver+0xb8/0x120\n[    2.958950]  bus_for_each_drv+0x78/0xd0\n[    2.962896]  __device_attach+0xd8/0x180\n[    2.966843]  device_initial_probe+0x14/0x20\n[    2.971144]  bus_probe_device+0x9c/0xa4\n[    2.975092]  device_add+0x380/0x88c\n[    2.978679]  platform_device_add+0x114/0x234\n[    2.983067]  platform_device_register_full+0x100/0x190\n[    2.988344]  psci_idle_init+0x6c/0xb0\n[    2.992113]  do_one_initcall+0x74/0x3a0\n[    2.996060]  kernel_init_freeable+0x2fc/0x384\n[    3.000543]  kernel_init+0x28/0x130\n[    3.004132]  ret_from_fork+0x10/0x20\n[    3.007817] irq event stamp: 319826\n[    3.011404] hardirqs last  enabled at (319825): [<ffffd40e7eda0268>] __up_console_sem+0x78/0x84\n[    3.020332] hardirqs last disabled at (319826): [<ffffd40e7fd6d9d8>] el1_dbg+0x24/0x8c\n[    3.028458] softirqs last  enabled at (318312): [<ffffd40e7ec90410>] _stext+0x410/0x588\n[    3.036678] softirqs last disabled at (318299): [<ffffd40e7ed1bf68>] __irq_exit_rcu+0x158/0x174\n[    3.045607] ---[ end trace 0000000000000000 ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32222fa6-134a-4d1c-b1f6-1ac9250e485a",  "id": "CVE-2013-2893",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2893"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device, related to (1) drivers/hid/hid-lgff.c, (2) drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c065162-4e79-41be-9d5b-5f105f991419",  "id": "OESA-2026-1413",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d01dbe7-f1f3-42bc-9852-10ba68981d75",  "id": "CVE-2024-50003",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix system hang while resume with TBT monitor\n\n[Why]\nConnected with a Thunderbolt monitor and do the suspend and the system\nmay hang while resume.\n\nThe TBT monitor HPD will be triggered during the resume procedure\nand call the drm_client_modeset_probe() while\nstruct drm_connector connector->dev->master is NULL.\n\nIt will mess up the pipe topology after resume.\n\n[How]\nSkip the TBT monitor HPD during the resume procedure because we\ncurrently will probe the connectors after resume by default.\n\n(cherry picked from commit 453f86a26945207a16b8f66aaed5962dc2b95b85)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f78527e4-bed6-4a04-9d88-a4833453ed16",  "id": "OESA-2025-2489",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c9e9632-dd13-412c-b1d7-4860066a167c",  "id": "CVE-2025-38697",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: upper bound check of tree index in dbAllocAG\n\nWhen computing the tree index in dbAllocAG, we never check if we are\nout of bounds realative to the size of the stree.\nThis could happen in a scenario where the filesystem metadata are\ncorrupted.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0554a84c-f35f-4bf6-965a-458ec9dec2d4",  "id": "CVE-2017-13078",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13078"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    323,    330  ],  "analysis": {    "state": "in_triage"  },  "description": "Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6a44a45f-7d59-45f4-b04e-0c6e0608e33e",  "id": "CVE-2022-23304",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23304"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    203  ],  "analysis": {    "state": "in_triage"  },  "description": "The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "01d40df4-5910-4d1a-9d2c-4a479bc38dbc",  "id": "CVE-2016-4569",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4569"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d4b8f9bf-9358-4f81-9399-827fb4e0ce00",  "id": "CVE-2020-35501",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35501"  },  "ratings": [    {      "score": 3.4,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"    }  ],  "cwes": [    863  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cb0456ec-6841-49fc-a822-44337fc36237",  "id": "CVE-2011-4354",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4354"  },  "ratings": [    {      "score": 5.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b1c8f243-f81d-416e-82b3-e8a533ff4d1f",  "id": "CLSA-2025-1759865876",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "be827504-3367-4fca-ad3e-bd769ccfd8c1",  "id": "OESA-2024-1698",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d1f8f6e-2f0c-4585-9617-a0e496a6610e",  "id": "CVE-2006-7250",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-7250"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2aa3331-b01a-4395-bd04-bf899db328f1",  "id": "CVE-2024-50058",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: protect uart_port_dtr_rts() in uart_shutdown() too\n\nCommit af224ca2df29 (serial: core: Prevent unsafe uart port access, part\n3) added few uport == NULL checks. It added one to uart_shutdown(), so\nthe commit assumes, uport can be NULL in there. But right after that\nprotection, there is an unprotected \"uart_port_dtr_rts(uport, false);\"\ncall. That is invoked only if HUPCL is set, so I assume that is the\nreason why we do not see lots of these reports.\n\nOr it cannot be NULL at this point at all for some reason :P.\n\nUntil the above is investigated, stay on the safe side and move this\ndereference to the if too.\n\nI got this inconsistency from Coverity under CID 1585130. Thanks.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "332a1509-fa6b-465b-b9d9-afa86e9175df",  "id": "openSUSE-SU-2021:1408-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "07916a07-89dd-4d71-88c3-f41bb0417748",  "id": "CVE-2015-2150",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2150"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e7ee04cf-86cc-429f-ba9f-360e2d998f48",  "id": "SUSE-SU-2025:20118-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "524c5444-eebd-4a0f-a398-370d9c884ddf",  "id": "CVE-2019-19046",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19046"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of this because an attacker cannot realistically control this failure at probe time",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a07cd09a-5be4-4a88-a0fc-4e2ad6ad480d",  "id": "CVE-2024-35822",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: udc: remove warning when queue disabled ep\n\nIt is possible trigger below warning message from mass storage function,\n\nWARNING: CPU: 6 PID: 3839 at drivers/usb/gadget/udc/core.c:294 usb_ep_queue+0x7c/0x104\npc : usb_ep_queue+0x7c/0x104\nlr : fsg_main_thread+0x494/0x1b3c\n\nRoot cause is mass storage function try to queue request from main thread,\nbut other thread may already disable ep when function disable.\n\nAs there is no function failure in the driver, in order to avoid effort\nto fix warning, change WARN_ON_ONCE() in usb_ep_queue() to pr_debug().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff01b2d2-7756-4ee1-abbc-4005563463b5",  "id": "ROOT-OS-ALPINE-324-CVE-2026-7383",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ded4f987-f4ca-4bf6-9512-b5258d97aff8",  "id": "CVE-2021-46906",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46906"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    668  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: usbhid: fix info leak in hid_submit_ctrl\n\nIn hid_submit_ctrl(), the way of calculating the report length doesn't\ntake into account that report->size can be zero. When running the\nsyzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to\ncalculate transfer_buffer_length as 16384. When this urb is passed to\nthe usb core layer, KMSAN reports an info leak of 16384 bytes.\n\nTo fix this, first modify hid_report_len() to account for the zero\nreport size case by using DIV_ROUND_UP for the division. Then, call it\nfrom hid_submit_ctrl().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0535b9dd-6e7c-48f5-8533-3f962badd8b2",  "id": "CVE-2023-52596",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsysctl: Fix out of bounds access for empty sysctl registers\n\nWhen registering tables to the sysctl subsystem there is a check to see\nif header is a permanently empty directory (used for mounts). This check\nevaluates the first element of the ctl_table. This results in an out of\nbounds evaluation when registering empty directories.\n\nThe function register_sysctl_mount_point now passes a ctl_table of size\n1 instead of size 0. It now relies solely on the type to identify\na permanently empty register.\n\nMake sure that the ctl_table has at least one element before testing for\npermanent emptiness.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2c045b2b-8542-4beb-9651-63af1db8358c",  "id": "CVE-2022-49126",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Fix memory leaks\n\nFix memory leaks related to operational reply queue's memory segments which\nare not getting freed while unloading the driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b9b71e5b-07c6-4edf-8d1e-999e8010d725",  "id": "CVE-2022-48760",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Fix hang in usb_kill_urb by adding memory barriers\n\nThe syzbot fuzzer has identified a bug in which processes hang waiting\nfor usb_kill_urb() to return.  It turns out the issue is not unlinking\nthe URB; that works just fine.  Rather, the problem arises when the\nwakeup notification that the URB has completed is not received.\n\nThe reason is memory-access ordering on SMP systems.  In outline form,\nusb_kill_urb() and __usb_hcd_giveback_urb() operating concurrently on\ndifferent CPUs perform the following actions:\n\nCPU 0\t\t\t\t\tCPU 1\n----------------------------\t\t---------------------------------\nusb_kill_urb():\t\t\t\t__usb_hcd_giveback_urb():\n  ...\t\t\t\t\t  ...\n  atomic_inc(&urb->reject);\t\t  atomic_dec(&urb->use_count);\n  ...\t\t\t\t\t  ...\n  wait_event(usb_kill_urb_queue,\n\tatomic_read(&urb->use_count) == 0);\n\t\t\t\t\t  if (atomic_read(&urb->reject))\n\t\t\t\t\t\twake_up(&usb_kill_urb_queue);\n\nConfining your attention to urb->reject and urb->use_count, you can\nsee that the overall pattern of accesses on CPU 0 is:\n\n\twrite urb->reject, then read urb->use_count;\n\nwhereas the overall pattern of accesses on CPU 1 is:\n\n\twrite urb->use_count, then read urb->reject.\n\nThis pattern is referred to in memory-model circles as SB (for \"Store\nBuffering\"), and it is well known that without suitable enforcement of\nthe desired order of accesses -- in the form of memory barriers -- it\nis entirely possible for one or both CPUs to execute their reads ahead\nof their writes.  The end result will be that sometimes CPU 0 sees the\nold un-decremented value of urb->use_count while CPU 1 sees the old\nun-incremented value of urb->reject.  Consequently CPU 0 ends up on\nthe wait queue and never gets woken up, leading to the observed hang\nin usb_kill_urb().\n\nThe same pattern of accesses occurs in usb_poison_urb() and the\nfailure pathway of usb_hcd_submit_urb().\n\nThe problem is fixed by adding suitable memory barriers.  To provide\nproper memory-access ordering in the SB pattern, a full barrier is\nrequired on both CPUs.  The atomic_inc() and atomic_dec() accesses\nthemselves don't provide any memory ordering, but since they are\npresent, we can use the optimized smp_mb__after_atomic() memory\nbarrier in the various routines to obtain the desired effect.\n\nThis patch adds the necessary memory barriers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5dc747db-fe3b-4ce8-83cf-52e68d3ebea2",  "id": "CVE-2026-46147",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()\n\nTwo bugs exist in the vCPU initialisation path:\n\n1. If a check fails after hyp_pin_shared_mem() succeeds, the cleanup\n   path jumps to 'unlock' without calling unpin_host_vcpu() or\n   unpin_host_sve_state(), permanently leaking pin references on the\n   host vCPU and SVE state pages.\n\n   Extract a register_hyp_vcpu() helper that performs the checks and\n   the store. When register_hyp_vcpu() returns an error, call\n   unpin_host_vcpu() and unpin_host_sve_state() inline before falling\n   through to the existing 'unlock' label.\n\n2. register_hyp_vcpu() publishes the new vCPU pointer into\n   'hyp_vm->vcpus[]' with a bare store, allowing a concurrent caller\n   of pkvm_load_hyp_vcpu() to observe a partially initialised vCPU\n   object.\n\n   Ensure the store uses smp_store_release() and the load uses\n   smp_load_acquire(). While 'vm_table_lock' currently serialises the\n   store and the load, these barriers ensure the reader sees the fully\n   initialised 'hyp_vcpu' object even if there were a lockless path or\n   if the lock's own ordering guarantees were insufficient for nested\n   object initialization.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "efd5db2a-97db-4c85-8313-6d9fd6830d78",  "id": "AZL-9967",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "114ae3ad-7ae1-4842-be72-0738c35e5d8b",  "id": "CVE-2022-48788",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-rdma: fix possible use-after-free in transport error_recovery work\n\nWhile nvme_rdma_submit_async_event_work is checking the ctrl and queue\nstate before preparing the AER command and scheduling io_work, in order\nto fully prevent a race where this check is not reliable the error\nrecovery work must flush async_event_work before continuing to destroy\nthe admin queue after setting the ctrl state to RESETTING such that\nthere is no race .submit_async_event and the error recovery handler\nitself changing the ctrl state.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "65170de5-dd9b-4f87-b32c-8b03e93f1446",  "id": "CVE-2014-4611",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4611"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "67b5c2de-5dd8-465e-b7d7-1825fb3d28db",  "id": "CVE-2021-3501",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3501"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "28ac6168-9449-4c1b-80e4-e072ffc691a2",  "id": "CVE-2023-4133",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4133"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, causing a denial of service condition.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cadce8b8-3332-431e-b9db-3ad939e7a30a",  "id": "CVE-2022-2380",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2380"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers being able to crash the kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b5ed812c-f3a0-4683-9802-d8ad400ac853",  "id": "CVE-2022-49297",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: fix io hung while disconnecting device\n\nIn our tests, \"qemu-nbd\" triggers a io hung:\n\nINFO: task qemu-nbd:11445 blocked for more than 368 seconds.\n      Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca #884\n\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:qemu-nbd        state:D stack:    0 pid:11445 ppid:     1 flags:0x00000000\nCall Trace:\n <TASK>\n __schedule+0x480/0x1050\n ? _raw_spin_lock_irqsave+0x3e/0xb0\n schedule+0x9c/0x1b0\n blk_mq_freeze_queue_wait+0x9d/0xf0\n ? ipi_rseq+0x70/0x70\n blk_mq_freeze_queue+0x2b/0x40\n nbd_add_socket+0x6b/0x270 [nbd]\n nbd_ioctl+0x383/0x510 [nbd]\n blkdev_ioctl+0x18e/0x3e0\n __x64_sys_ioctl+0xac/0x120\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7fd8ff706577\nRSP: 002b:00007fd8fcdfebf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 0000000040000000 RCX: 00007fd8ff706577\nRDX: 000000000000000d RSI: 000000000000ab00 RDI: 000000000000000f\nRBP: 000000000000000f R08: 000000000000fbe8 R09: 000055fe497c62b0\nR10: 00000002aff20000 R11: 0000000000000246 R12: 000000000000006d\nR13: 0000000000000000 R14: 00007ffe82dc5e70 R15: 00007fd8fcdff9c0\n\n\"qemu-ndb -d\" will call ioctl 'NBD_DISCONNECT' first, however, following\nmessage was found:\n\nblock nbd0: Send disconnect failed -32\n\nWhich indicate that something is wrong with the server. Then,\n\"qemu-nbd -d\" will call ioctl 'NBD_CLEAR_SOCK', however ioctl can't clear\nrequests after commit 2516ab1543fd(\"nbd: only clear the queue on device\nteardown\"). And in the meantime, request can't complete through timeout\nbecause nbd_xmit_timeout() will always return 'BLK_EH_RESET_TIMER', which\nmeans such request will never be completed in this situation.\n\nNow that the flag 'NBD_CMD_INFLIGHT' can make sure requests won't\ncomplete multiple times, switch back to call nbd_clear_sock() in\nnbd_clear_sock_ioctl(), so that inflight requests can be cleared.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dcd6932f-374f-4ffc-b9b0-97bb7e6adffe",  "id": "CVE-2024-50009",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: amd-pstate: add check for cpufreq_cpu_get's return value\n\ncpufreq_cpu_get may return NULL. To avoid NULL-dereference check it\nand return in case of error.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d9bd8151-86be-4d2b-85df-1ed6b8e00d12",  "id": "CVE-2023-53223",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dsi: Add missing check for alloc_ordered_workqueue\n\nAdd check for the return value of alloc_ordered_workqueue as it may return\nNULL pointer and cause NULL pointer dereference.\n\nPatchwork: https://patchwork.freedesktop.org/patch/517646/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d5ae648-ce91-4d6f-87df-99e4f8adbe8e",  "id": "CVE-2011-0709",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0709"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The br_mdb_ip_get function in net/bridge/br_multicast.c in the Linux kernel before 2.6.35-rc5 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an IGMP packet, related to lack of a multicast table.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f61bad94-a07d-4e31-951f-74f2670c956b",  "id": "CVE-2026-23286",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: lec: fix null-ptr-deref in lec_arp_clear_vccs\n\nsyzkaller reported a null-ptr-deref in lec_arp_clear_vccs().\nThis issue can be easily reproduced using the syzkaller reproducer.\n\nIn the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by\nmultiple lec_arp_table entries (e.g., via entry->vcc or entry->recv_vcc).\nWhen the underlying VCC is closed, lec_vcc_close() iterates over all\nARP entries and calls lec_arp_clear_vccs() for each matched entry.\n\nFor example, when lec_vcc_close() iterates through the hlists in\npriv->lec_arp_empty_ones or other ARP tables:\n\n1. In the first iteration, for the first matched ARP entry sharing the VCC,\nlec_arp_clear_vccs() frees the associated vpriv (which is vcc->user_back)\nand sets vcc->user_back to NULL.\n2. In the second iteration, for the next matched ARP entry sharing the same\nVCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from\nvcc->user_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it\nvia `vcc->pop = vpriv->old_pop`, leading to a null-ptr-deref crash.\n\nFix this by adding a null check for vpriv before dereferencing\nit. If vpriv is already NULL, it means the VCC has been cleared\nby a previous call, so we can safely skip the cleanup and just\nclear the entry's vcc/recv_vcc pointers.\n\nThe entire cleanup block (including vcc_release_async()) is placed inside\nthe vpriv guard because a NULL vpriv indicates the VCC has already been\nfully released by a prior iteration — repeating the teardown would\nredundantly set flags and trigger callbacks on an already-closing socket.\n\nThe Fixes tag points to the initial commit because the entry->vcc path has\nbeen vulnerable since the original code. The entry->recv_vcc path was later\nadded by commit 8d9f73c0ad2f (\"atm: fix a memory leak of vcc->user_back\")\nwith the same pattern, and both paths are fixed here.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ec7ece3d-6adc-4f1a-93d2-14a243dcae3a",  "id": "CVE-2024-57974",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Deal with race between UDP socket address change and rehash\n\nIf a UDP socket changes its local address while it's receiving\ndatagrams, as a result of connect(), there is a period during which\na lookup operation might fail to find it, after the address is changed\nbut before the secondary hash (port and address) and the four-tuple\nhash (local and remote ports and addresses) are updated.\n\nSecondary hash chains were introduced by commit 30fff9231fad (\"udp:\nbind() optimisation\") and, as a result, a rehash operation became\nneeded to make a bound socket reachable again after a connect().\n\nThis operation was introduced by commit 719f835853a9 (\"udp: add\nrehash on connect()\") which isn't however a complete fix: the\nsocket will be found once the rehashing completes, but not while\nit's pending.\n\nThis is noticeable with a socat(1) server in UDP4-LISTEN mode, and a\nclient sending datagrams to it. After the server receives the first\ndatagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to\nthe address of the sender, in order to set up a directed flow.\n\nNow, if the client, running on a different CPU thread, happens to\nsend a (subsequent) datagram while the server's socket changes its\naddress, but is not rehashed yet, this will result in a failed\nlookup and a port unreachable error delivered to the client, as\napparent from the following reproducer:\n\n  LEN=$(($(cat /proc/sys/net/core/wmem_default) / 4))\n  dd if=/dev/urandom bs=1 count=${LEN} of=tmp.in\n\n  while :; do\n  \ttaskset -c 1 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc &\n  \tsleep 0.1 || sleep 1\n  \ttaskset -c 2 socat OPEN:tmp.in UDP4:localhost:1337,shut-null\n  \twait\n  done\n\nwhere the client will eventually get ECONNREFUSED on a write()\n(typically the second or third one of a given iteration):\n\n  2024/11/13 21:28:23 socat[46901] E write(6, 0x556db2e3c000, 8192): Connection refused\n\nThis issue was first observed as a seldom failure in Podman's tests\nchecking UDP functionality while using pasta(1) to connect the\ncontainer's network namespace, which leads us to a reproducer with\nthe lookup error resulting in an ICMP packet on a tap device:\n\n  LOCAL_ADDR=\"$(ip -j -4 addr show|jq -rM '.[] | .addr_info[0] | select(.scope == \"global\").local')\"\n\n  while :; do\n  \t./pasta --config-net -p pasta.pcap -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc &\n  \tsleep 0.2 || sleep 1\n  \tsocat OPEN:tmp.in UDP4:${LOCAL_ADDR}:1337,shut-null\n  \twait\n  \tcmp tmp.in tmp.out\n  done\n\nOnce this fails:\n\n  tmp.in tmp.out differ: char 8193, line 29\n\nwe can finally have a look at what's going on:\n\n  $ tshark -r pasta.pcap\n      1   0.000000           :: ? ff02::16     ICMPv6 110 Multicast Listener Report Message v2\n      2   0.168690 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      3   0.168767 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      4   0.168806 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      5   0.168827 c6:47:05:8d:dc:04 ? Broadcast    ARP 42 Who has 88.198.0.161? Tell 88.198.0.164\n      6   0.168851 9a:55:9a:55:9a:55 ? c6:47:05:8d:dc:04 ARP 42 88.198.0.161 is at 9a:55:9a:55:9a:55\n      7   0.168875 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      8   0.168896 88.198.0.164 ? 88.198.0.161 ICMP 590 Destination unreachable (Port unreachable)\n      9   0.168926 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n     10   0.168959 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n     11   0.168989 88.198.0.161 ? 88.198.0.164 UDP 4138 60260 ? 1337 Len=4096\n     12   0.169010 88.198.0.161 ? 88.198.0.164 UDP 42 60260 ? 1337 Len=0\n\nOn the third datagram received, the network namespace of the container\ninitiates an ARP lookup to deliver the ICMP message.\n\nIn another variant of this reproducer, starting the client with:\n\n  strace -f pasta --config-net -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,tru\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d5f3ce9e-9171-478f-bc5a-9f2e7463ddf5",  "id": "CVE-2025-21969",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd\n\nAfter the hci sync command releases l2cap_conn, the hci receive data work\nqueue references the released l2cap_conn when sending to the upper layer.\nAdd hci dev lock to the hci receive data work queue to synchronize the two.\n\n[1]\nBUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954\nRead of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837\n\nCPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nWorkqueue: hci1 hci_rx_work\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:489\n kasan_report+0x143/0x180 mm/kasan/report.c:602\n l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]\n l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954\n l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]\n l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]\n l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817\n hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]\n hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n </TASK>\n\nAllocated by task 5837:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329\n kmalloc_noprof include/linux/slab.h:901 [inline]\n kzalloc_noprof include/linux/slab.h:1037 [inline]\n l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860\n l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239\n hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]\n hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726\n hci_event_func net/bluetooth/hci_event.c:7473 [inline]\n hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525\n hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\nFreed by task 54:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:233 [inline]\n slab_free_hook mm/slub.c:2353 [inline]\n slab_free mm/slub.c:4613 [inline]\n kfree+0x196/0x430 mm/slub.c:4761\n l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235\n hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]\n hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266\n hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603\n hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entr\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "872a28c8-ba8e-4e25-a8b9-bae637c2f828",  "id": "CVE-2024-47674",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    459  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: avoid leaving partial pfn mappings around in error case\n\nAs Jann points out, PFN mappings are special, because unlike normal\nmemory mappings, there is no lifetime information associated with the\nmapping - it is just a raw mapping of PFNs with no reference counting of\na 'struct page'.\n\nThat's all very much intentional, but it does mean that it's easy to\nmess up the cleanup in case of errors.  Yes, a failed mmap() will always\neventually clean up any partial mappings, but without any explicit\nlifetime in the page table mapping itself, it's very easy to do the\nerror handling in the wrong order.\n\nIn particular, it's easy to mistakenly free the physical backing store\nbefore the page tables are actually cleaned up and (temporarily) have\nstale dangling PTE entries.\n\nTo make this situation less error-prone, just make sure that any partial\npfn mapping is torn down early, before any other error handling.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:182298/Linux-Dangling-PFN-Mapping-Use-After-Free.html'"    }  ]},{  "bom-ref": "f98325d1-6dbf-4d1a-817e-240ba15bcc78",  "id": "CVE-2017-5549",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5549"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    532  ],  "analysis": {    "state": "in_triage"  },  "description": "The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which allows local users to obtain sensitive information by reading the log.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4668c24f-ae84-4b0a-9cf7-bb87abc51349",  "id": "CVE-2016-8633",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8633"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119,    284  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via crafted fragmented packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2e08765-7cc3-4da6-9979-f1cd55725093",  "id": "CVE-2013-3302",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3302"  },  "ratings": [    {      "score": 4.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the smb_send_rqst function in fs/cifs/transport.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via vectors involving a reconnection event.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "44edae96-e2fd-4b94-a539-a17e7bc7768a",  "id": "CVE-2016-7798",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7798"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    326  ],  "analysis": {    "state": "in_triage"  },  "description": "The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f385bc14-37cb-4dd9-9781-12c006d5c97f",  "id": "CVE-2017-15128",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15128"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the hugetlb_mcopy_atomic_pte function in mm/hugetlb.c in the Linux kernel before 4.13.12. A lack of size check could cause a denial of service (BUG).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "72955241-c715-485e-b292-8d5e1635445c",  "id": "CVE-2023-28866",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28866"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to have an intentionally invalid element, but do not.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2ad1290b-bc7f-4a81-b1c7-f111cc1faaa3",  "id": "CVE-2026-46157",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger\n\nCurrently the runtime.oss.trigger field may be accessed concurrently\nwithout protection, which may lead to the data race.  And, in this\ncase, it may lead to more severe problem because it's a bit field; as\nwriting the data, it may overwrite other bit fields as well, which\nconfuses the operation completely, as spotted by fuzzing.\n\nFix it by covering runtime.oss.trigger bit fled also with the existing\nparams_lock mutex in both snd_pcm_oss_get_trigger() and\nsnd_pcm_oss_poll().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "43286881-af05-4400-92b2-6a1aef4c112b",  "id": "CVE-2024-49888",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a sdiv overflow issue\n\nZac Ecob reported a problem where a bpf program may cause kernel crash due\nto the following error:\n  Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI\n\nThe failure is due to the below signed divide:\n  LLONG_MIN/-1 where LLONG_MIN equals to -9,223,372,036,854,775,808.\nLLONG_MIN/-1 is supposed to give a positive number 9,223,372,036,854,775,808,\nbut it is impossible since for 64-bit system, the maximum positive\nnumber is 9,223,372,036,854,775,807. On x86_64, LLONG_MIN/-1 will\ncause a kernel exception. On arm64, the result for LLONG_MIN/-1 is\nLLONG_MIN.\n\nFurther investigation found all the following sdiv/smod cases may trigger\nan exception when bpf program is running on x86_64 platform:\n  - LLONG_MIN/-1 for 64bit operation\n  - INT_MIN/-1 for 32bit operation\n  - LLONG_MIN%-1 for 64bit operation\n  - INT_MIN%-1 for 32bit operation\nwhere -1 can be an immediate or in a register.\n\nOn arm64, there are no exceptions:\n  - LLONG_MIN/-1 = LLONG_MIN\n  - INT_MIN/-1 = INT_MIN\n  - LLONG_MIN%-1 = 0\n  - INT_MIN%-1 = 0\nwhere -1 can be an immediate or in a register.\n\nInsn patching is needed to handle the above cases and the patched codes\nproduced results aligned with above arm64 result. The below are pseudo\ncodes to handle sdiv/smod exceptions including both divisor -1 and divisor 0\nand the divisor is stored in a register.\n\nsdiv:\n      tmp = rX\n      tmp += 1 /* [-1, 0] -> [0, 1]\n      if tmp >(unsigned) 1 goto L2\n      if tmp == 0 goto L1\n      rY = 0\n  L1:\n      rY = -rY;\n      goto L3\n  L2:\n      rY /= rX\n  L3:\n\nsmod:\n      tmp = rX\n      tmp += 1 /* [-1, 0] -> [0, 1]\n      if tmp >(unsigned) 1 goto L1\n      if tmp == 1 (is64 ? goto L2 : goto L3)\n      rY = 0;\n      goto L2\n  L1:\n      rY %= rX\n  L2:\n      goto L4  // only when !is64\n  L3:\n      wY = wY  // only when !is64\n  L4:\n\n  [1] https://lore.kernel.org/bpf/tPJLTEh7S_DxFEqAI2Ji5MBSoZVg7_G-Py2iaZpAaWtM961fFTWtsnlzwvTbzBzaUzwQAoNATXKUlt0LZOFgnDcIyKCswAnAGdUF3LBrhGQ=@protonmail.com/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "de77aa2a-a863-4730-ac8e-7b92bafd7231",  "id": "CVE-2024-26777",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: sis: Error out if pixclock equals zero\n\nThe userspace program could pass any values to the driver through\nioctl() interface. If the driver doesn't check the value of pixclock,\nit may cause divide-by-zero error.\n\nIn sisfb_check_var(), var->pixclock is used as a divisor to caculate\ndrate before it is checked against zero. Fix this by checking it\nat the beginning.\n\nThis is similar to CVE-2022-3061 in i740fb which was fixed by\ncommit 15cf0b8.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a0ab16e4-0114-4276-b911-e2bd4ab900eb",  "id": "CVE-2012-3375",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3375"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:19605'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:114481/Linux-Kernel-Local-Denial-Of-Service.html'"    }  ]},{  "bom-ref": "47df03b8-ca70-4be4-a890-2692656c6aeb",  "id": "CVE-2023-52754",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: imon: fix access to invalid resource for the second interface\n\nimon driver probes two USB interfaces, and at the probe of the second\ninterface, the driver assumes blindly that the first interface got\nbound with the same imon driver.  It's usually true, but it's still\npossible that the first interface is bound with another driver via a\nmalformed descriptor.  Then it may lead to a memory corruption, as\nspotted by syzkaller; imon driver accesses the data from drvdata as\nstruct imon_context object although it's a completely different one\nthat was assigned by another driver.\n\nThis patch adds a sanity check -- whether the first interface is\nreally bound with the imon driver or not -- for avoiding the problem\nabove at the probe time.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8d073ce9-b982-44e3-aabd-c6f74d6967fb",  "id": "CVE-2022-49303",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: staging: rtl8192eu: Fix deadlock in rtw_joinbss_event_prehandle\n\nThere is a deadlock in rtw_joinbss_event_prehandle(), which is shown below:\n\n   (Thread 1)                |      (Thread 2)\n                             | _set_timer()\nrtw_joinbss_event_prehandle()|  mod_timer()\n spin_lock_bh() //(1)        |  (wait a time)\n ...                         | rtw_join_timeout_handler()\n                             |  _rtw_join_timeout_handler()\n del_timer_sync()            |   spin_lock_bh() //(2)\n (wait timer to stop)        |   ...\n\nWe hold pmlmepriv->lock in position (1) of thread 1 and\nuse del_timer_sync() to wait timer to stop, but timer handler\nalso need pmlmepriv->lock in position (2) of thread 2.\nAs a result, rtw_joinbss_event_prehandle() will block forever.\n\nThis patch extracts del_timer_sync() from the protection of\nspin_lock_bh(), which could let timer handler to obtain\nthe needed lock. What`s more, we change spin_lock_bh() to\nspin_lock_irq() in _rtw_join_timeout_handler() in order to\nprevent deadlock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "41f14f78-5717-477d-a49f-50aa70c182a0",  "id": "CVE-2024-46744",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    59  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: sanity check symbolic link size\n\nSyzkiller reports a \"KMSAN: uninit-value in pick_link\" bug.\n\nThis is caused by an uninitialised page, which is ultimately caused\nby a corrupted symbolic link size read from disk.\n\nThe reason why the corrupted symlink size causes an uninitialised\npage is due to the following sequence of events:\n\n1. squashfs_read_inode() is called to read the symbolic\n   link from disk.  This assigns the corrupted value\n   3875536935 to inode->i_size.\n\n2. Later squashfs_symlink_read_folio() is called, which assigns\n   this corrupted value to the length variable, which being a\n   signed int, overflows producing a negative number.\n\n3. The following loop that fills in the page contents checks that\n   the copied bytes is less than length, which being negative means\n   the loop is skipped, producing an uninitialised page.\n\nThis patch adds a sanity check which checks that the symbolic\nlink size is not larger than expected.\n\n--\n\nV2: fix spelling mistake.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a1db9d60-0857-4454-8a43-2532d0ea24b9",  "id": "CVE-2022-50228",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0\n\nDon't BUG/WARN on interrupt injection due to GIF being cleared,\nsince it's trivial for userspace to force the situation via\nKVM_SET_VCPU_EVENTS (even if having at least a WARN there would be correct\nfor KVM internally generated injections).\n\n  kernel BUG at arch/x86/kvm/svm/svm.c:3386!\n  invalid opcode: 0000 [#1] SMP\n  CPU: 15 PID: 926 Comm: smm_test Not tainted 5.17.0-rc3+ #264\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:svm_inject_irq+0xab/0xb0 [kvm_amd]\n  Code: <0f> 0b 0f 1f 00 0f 1f 44 00 00 80 3d ac b3 01 00 00 55 48 89 f5 53\n  RSP: 0018:ffffc90000b37d88 EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: ffff88810a234ac0 RCX: 0000000000000006\n  RDX: 0000000000000000 RSI: ffffc90000b37df7 RDI: ffff88810a234ac0\n  RBP: ffffc90000b37df7 R08: ffff88810a1fa410 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n  R13: ffff888109571000 R14: ffff88810a234ac0 R15: 0000000000000000\n  FS:  0000000001821380(0000) GS:ffff88846fdc0000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f74fc550008 CR3: 000000010a6fe000 CR4: 0000000000350ea0\n  Call Trace:\n   <TASK>\n   inject_pending_event+0x2f7/0x4c0 [kvm]\n   kvm_arch_vcpu_ioctl_run+0x791/0x17a0 [kvm]\n   kvm_vcpu_ioctl+0x26d/0x650 [kvm]\n   __x64_sys_ioctl+0x82/0xb0\n   do_syscall_64+0x3b/0xc0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n   </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d265b28f-7981-459f-8f1b-893a8fb685bf",  "id": "CVE-2017-7308",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7308"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    681,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data, which allows local users to cause a denial of service (integer signedness error and out-of-bounds write), or gain privileges (if the CAP_NET_RAW capability is held), via crafted system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:44654'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'MSF:af_packet_packet_set_ring_priv_esc'"    }  ]},{  "bom-ref": "832efbc9-2daf-4cc6-a2c4-82c1fc2b3f8c",  "id": "ROOT-OS-ALPINE-315-CVE-2022-48174",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cef615c4-9870-4125-89b4-83466859aeae",  "id": "DSA-1970-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf8232d6-ae2d-40c3-a80a-366b562c096b",  "id": "CVE-2016-7916",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7916"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the environ_read function in fs/proc/base.c in the Linux kernel before 4.5.4 allows local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file during a process-setup time interval in which environment-variable copying is incomplete.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4fe0aedf-4419-438f-9dbc-c17c44f47bbe",  "id": "CVE-2022-48766",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wrap dcn301_calculate_wm_and_dlg for FPU.\n\nMirrors the logic for dcn30. Cue lots of WARNs and some\nkernel panics without this fix.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8b3444bb-b476-4980-9fa4-1fb5d3ccc2b0",  "id": "CVE-2013-2930",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2930"  },  "ratings": [    {      "score": 3.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The perf_trace_event_perm function in kernel/trace/trace_event_perf.c in the Linux kernel before 3.12.2 does not properly restrict access to the perf subsystem, which allows local users to enable function tracing via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "218cf0ca-9fc3-45a2-9c99-cf16b2047dbb",  "id": "CVE-2023-53403",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntime/debug: Fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic at\nonce.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "24459ab7-6714-491c-ae18-2a33b7192c95",  "id": "CVE-2022-3106",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3106"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b5b19956-0ce3-4b02-8188-f54d82ed366b",  "id": "ROOT-OS-DEBIAN-11-CVE-2026-63072",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2fc9ec9-169e-4899-b1c3-6a461cd7c7fc",  "id": "CVE-2014-8559",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8559"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock, which allows local users to cause a denial of service (deadlock and system hang) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "254eb736-8c8a-4a44-84dc-ad6e3c0a245a",  "id": "CVE-2026-31692",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtnetlink: add missing netlink_ns_capable() check for peer netns\n\nrtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer\nnetwork namespace when creating paired devices (veth, vxcan,\nnetkit). This allows an unprivileged user with a user namespace\nto create interfaces in arbitrary network namespaces, including\ninit_net.\n\nAdd a netlink_ns_capable() check for CAP_NET_ADMIN in the peer\nnamespace before allowing device creation to proceed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "504fe7dc-6cf2-4dd9-bccd-ce4b4b01b8f8",  "id": "SUSE-SU-2015:1410-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5bee802d-5366-4429-994a-2143760eec26",  "id": "RLSA-2026:3042",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "554fbc39-c248-4b46-8179-4b70d936757d",  "id": "CVE-2024-46695",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    276  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux,smack: don't bypass permissions check in inode_setsecctx hook\n\nMarek Gresko reports that the root user on an NFS client is able to\nchange the security labels on files on an NFS filesystem that is\nexported with root squashing enabled.\n\nThe end of the kerneldoc comment for __vfs_setxattr_noperm() states:\n\n *  This function requires the caller to lock the inode's i_mutex before it\n *  is executed. It also assumes that the caller will make the appropriate\n *  permission checks.\n\nnfsd_setattr() does do permissions checking via fh_verify() and\nnfsd_permission(), but those don't do all the same permissions checks\nthat are done by security_inode_setxattr() and its related LSM hooks do.\n\nSince nfsd_setattr() is the only consumer of security_inode_setsecctx(),\nsimplest solution appears to be to replace the call to\n__vfs_setxattr_noperm() with a call to __vfs_setxattr_locked().  This\nfixes the above issue and has the added benefit of causing nfsd to\nrecall conflicting delegations on a file when a client tries to change\nits security label.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e19f8d90-0154-4af7-bc97-93c9cdb0e0fd",  "id": "CVE-2019-18809",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18809"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "345a4a02-6918-412c-aee1-0ad82096371b",  "id": "DSA-2454-2",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dddca7e1-5459-4cd4-832c-fea99438d914",  "id": "CVE-2024-53050",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hdcp: Add encoder check in hdcp2_get_capability\n\nAdd encoder check in intel_hdcp2_get_capability to avoid\nnull pointer error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aa5e1d1b-a592-4fcf-865f-f22c158e9b05",  "id": "CVE-2010-3880",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3880"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "net/ipv4/inet_diag.c in the Linux kernel before 2.6.37-rc2 does not properly audit INET_DIAG bytecode, which allows local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message that contains multiple attribute elements, as demonstrated by INET_DIAG_BC_JMP instructions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2b281fe-9252-4234-98a6-bae81d9f518b",  "id": "CVE-2022-49323",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe()\n\nIt will cause null-ptr-deref when using 'res', if platform_get_resource()\nreturns NULL, so move using 'res' after devm_ioremap_resource() that\nwill check it to avoid null-ptr-deref.\nAnd use devm_platform_get_and_ioremap_resource() to simplify code.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fb4a0652-08fe-4d71-b1bf-fb4c328a6c2d",  "id": "CVE-2010-4251",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4251"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service (memory consumption) by sending a large amount of network traffic, as demonstrated by netperf UDP tests.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc686d71-23d4-409a-8582-c6d5b5624188",  "id": "CVE-2024-26648",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix variable deferencing before NULL check in edp_setup_replay()\n\nIn edp_setup_replay(), 'struct dc *dc' & 'struct dmub_replay *replay'\nwas dereferenced before the pointer 'link' & 'replay' NULL check.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c:947 edp_setup_replay() warn: variable dereferenced before check 'link' (see line 933)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b12ab33b-2d90-4e66-9cb9-bcc80a1b8525",  "id": "CVE-2026-43116",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: ensure safe access to master conntrack\n\nHolding reference on the expectation is not sufficient, the master\nconntrack object can just go away, making exp->master invalid.\n\nTo access exp->master safely:\n\n- Grab the nf_conntrack_expect_lock, this gets serialized with\n  clean_from_lists() which also holds this lock when the master\n  conntrack goes away.\n\n- Hold reference on master conntrack via nf_conntrack_find_get().\n  Not so easy since the master tuple to look up for the master conntrack\n  is not available in the existing problematic paths.\n\nThis patch goes for extending the nf_conntrack_expect_lock section\nto address this issue for simplicity, in the cases that are described\nbelow this is just slightly extending the lock section.\n\nThe add expectation command already holds a reference to the master\nconntrack from ctnetlink_create_expect().\n\nHowever, the delete expectation command needs to grab the spinlock\nbefore looking up for the expectation. Expand the existing spinlock\nsection to address this to cover the expectation lookup. Note that,\nthe nf_ct_expect_iterate_net() calls already grabs the spinlock while\niterating over the expectation table, which is correct.\n\nThe get expectation command needs to grab the spinlock to ensure master\nconntrack does not go away. This also expands the existing spinlock\nsection to cover the expectation lookup too. I needed to move the\nnetlink skb allocation out of the spinlock to keep it GFP_KERNEL.\n\nFor the expectation events, the IPEXP_DESTROY event is already delivered\nunder the spinlock, just move the delivery of IPEXP_NEW under the\nspinlock too because the master conntrack event cache is reached through\nexp->master.\n\nWhile at it, add lockdep notations to help identify what codepaths need\nto grab the spinlock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8c0250b5-dbc9-41c5-96bc-695a9a7429bd",  "id": "CVE-2026-23336",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel rfkill_block work in wiphy_unregister()\n\nThere is a use-after-free error in cfg80211_shutdown_all_interfaces found\nby syzkaller:\n\nBUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220\nRead of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326\nCPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nWorkqueue: events cfg80211_rfkill_block_work\nCall Trace:\n <TASK>\n dump_stack_lvl+0x116/0x1f0\n print_report+0xcd/0x630\n kasan_report+0xe0/0x110\n cfg80211_shutdown_all_interfaces+0x213/0x220\n cfg80211_rfkill_block_work+0x1e/0x30\n process_one_work+0x9cf/0x1b70\n worker_thread+0x6c8/0xf10\n kthread+0x3c5/0x780\n ret_from_fork+0x56d/0x700\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nThe problem arises due to the rfkill_block work is not cancelled when wiphy\nis being unregistered. In order to fix the issue cancel the corresponding\nwork in wiphy_unregister().\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "486f3796-2fee-4a2c-8b45-5e378b45a183",  "id": "CVE-2024-41078",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: qgroup: fix quota root leak after quota disable failure\n\nIf during the quota disable we fail when cleaning the quota tree or when\ndeleting the root from the root tree, we jump to the 'out' label without\never dropping the reference on the quota root, resulting in a leak of the\nroot since fs_info->quota_root is no longer pointing to the root (we have\nset it to NULL just before those steps).\n\nFix this by always doing a btrfs_put_root() call under the 'out' label.\nThis is a problem that exists since qgroups were first added in 2012 by\ncommit bed92eae26cc (\"Btrfs: qgroup implementation and prototypes\"), but\nback then we missed a kfree on the quota root and free_extent_buffer()\ncalls on its root and commit root nodes, since back then roots were not\nyet reference counted.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1f636af1-17ae-4905-8a0a-6d8767dcb559",  "id": "CVE-2025-38336",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330\n\nThe controller has a hardware bug that can hard hang the system when\ndoing ATAPI DMAs without any trace of what happened. Depending on the\ndevice attached, it can also prevent the system from booting.\n\nIn this case, the system hangs when reading the ATIP from optical media\nwith cdrecord -vvv -atip on an _NEC DVD_RW ND-4571A 1-01 and an\nOptiarc DVD RW AD-7200A 1.06 attached to an ASRock 990FX Extreme 4,\nrunning at UDMA/33.\n\nThe issue can be reproduced by running the same command with a cygwin\nbuild of cdrecord on WinXP, although it requires more attempts to cause\nit. The hang in that case is also resolved by forcing PIO. It doesn't\nappear that VIA has produced any drivers for that OS, thus no known\nworkaround exists.\n\nHDDs attached to the controller do not suffer from any DMA issues.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e146d8f5-9ddf-45d3-907a-0dae2d198ecb",  "id": "CVE-2013-7026",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7026"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple race conditions in ipc/shm.c in the Linux kernel before 3.12.2 allow local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted application that uses shmctl IPC_RMID operations in conjunction with other shm system calls.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9c766e64-52b9-4fd3-874a-89958dfc74ec",  "id": "CVE-2023-53314",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev/ep93xx-fb: Do not assign to struct fb_info.dev\n\nDo not assing the Linux device to struct fb_info.dev. The call to\nregister_framebuffer() initializes the field to the fbdev device.\nDrivers should not override its value.\n\nFixes a bug where the driver incorrectly decreases the hardware\ndevice's reference counter and leaks the fbdev device.\n\nv2:\n\t* add Fixes tag (Dan)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c3fb86fd-feeb-4224-a745-3bf4002cc87c",  "id": "CVE-2017-1000253",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000253"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the \"gap\" between the stack and the binary.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:42887'"    }  ]},{  "bom-ref": "38621bb5-e081-4a61-92b7-539bbc0e7b57",  "id": "CVE-2026-31664",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: clear trailing padding in build_polexpire()\n\nbuild_expire() clears the trailing padding bytes of struct\nxfrm_user_expire after setting the hard field via memset_after(),\nbut the analogous function build_polexpire() does not do this for\nstruct xfrm_user_polexpire.\n\nThe padding bytes after the __u8 hard field are left\nuninitialized from the heap allocation, and are then sent to\nuserspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,\nleaking kernel heap memory contents.\n\nAdd the missing memset_after() call, matching build_expire().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d16ec62-888e-4749-832f-bdbb83dabeaa",  "id": "CVE-2024-49990",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/hdcp: Check GSC structure validity\n\nSometimes xe_gsc is not initialized when checked at HDCP capability\ncheck. Add gsc structure check to avoid null pointer error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "94fbe6c2-2395-4019-9e59-89350955b9cd",  "id": "CVE-2024-49907",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check null pointers before using dc->clk_mgr\n\n[WHY & HOW]\ndc->clk_mgr is null checked previously in the same function, indicating\nit might be null.\n\nPassing \"dc\" to \"dc->hwss.apply_idle_power_optimizations\", which\ndereferences null \"dc->clk_mgr\". (The function pointer resolves to\n\"dcn35_apply_idle_power_optimizations\".)\n\nThis fixes 1 FORWARD_NULL issue reported by Coverity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a77622d3-053c-4ff5-a550-5ed8fc046eb4",  "id": "AZL-75299",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "23dbde2d-5fb2-49b8-8746-744ec2d340b2",  "id": "DLA-637-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "01466eab-4369-491f-a4b8-7c8a56faa6c6",  "id": "CVE-2021-47407",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47407"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Handle SRCU initialization failure during page track init\n\nCheck the return of init_srcu_struct(), which can fail due to OOM, when\ninitializing the page track mechanism.  Lack of checking leads to a NULL\npointer deref found by a modified syzkaller.\n\n[Move the call towards the beginning of kvm_arch_init_vm. - Paolo]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a74f9976-ec5b-4b51-bc85-d0cc59989f02",  "id": "CVE-2023-2008",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2008"  },  "ratings": [    {      "score": 8.199999999999999,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's udmabuf device driver, within a fault handler. This issue occurs due to the lack of proper validation of user-supplied data, which can result in memory access past the end of an array. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "968474b7-2a45-4537-8ddb-cc22bd705632",  "id": "CVE-2024-40965",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: lpi2c: Avoid calling clk_get_rate during transfer\n\nInstead of repeatedly calling clk_get_rate for each transfer, lock\nthe clock rate and cache the value.\nA deadlock has been observed while adding tlv320aic32x4 audio codec to\nthe system. When this clock provider adds its clock, the clk mutex is\nlocked already, it needs to access i2c, which in return needs the mutex\nfor clk_get_rate as well.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "230af651-9434-4571-8020-a124b0532c60",  "id": "CVE-2024-49911",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func\n\nThis commit adds a null check for the set_output_gamma function pointer\nin the dcn20_set_output_transfer_func function. Previously,\nset_output_gamma was being checked for null at line 1030, but then it\nwas being dereferenced without any null check at line 1048. This could\npotentially lead to a null pointer dereference error if set_output_gamma\nis null.\n\nTo fix this, we now ensure that set_output_gamma is not null before\ndereferencing it. We do this by adding a null check for set_output_gamma\nbefore the call to set_output_gamma at line 1048.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9216723e-f9d2-45e1-ac8c-72398ca39469",  "id": "CVE-2022-49763",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: fix use-after-free in ntfs_attr_find()\n\nPatch series \"ntfs: fix bugs about Attribute\", v2.\n\nThis patchset fixes three bugs relative to Attribute in record:\n\nPatch 1 adds a sanity check to ensure that, attrs_offset field in first\nmft record loading from disk is within bounds.\n\nPatch 2 moves the ATTR_RECORD's bounds checking earlier, to avoid\ndereferencing ATTR_RECORD before checking this ATTR_RECORD is within\nbounds.\n\nPatch 3 adds an overflow checking to avoid possible forever loop in\nntfs_attr_find().\n\nWithout patch 1 and patch 2, the kernel triggersa KASAN use-after-free\ndetection as reported by Syzkaller.\n\nAlthough one of patch 1 or patch 2 can fix this, we still need both of\nthem.  Because patch 1 fixes the root cause, and patch 2 not only fixes\nthe direct cause, but also fixes the potential out-of-bounds bug.\n\n\nThis patch (of 3):\n\nSyzkaller reported use-after-free read as follows:\n==================================================================\nBUG: KASAN: use-after-free in ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597\nRead of size 2 at addr ffff88807e352009 by task syz-executor153/3607\n\n[...]\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:317 [inline]\n print_report.cold+0x2ba/0x719 mm/kasan/report.c:433\n kasan_report+0xb1/0x1e0 mm/kasan/report.c:495\n ntfs_attr_find+0xc02/0xce0 fs/ntfs/attrib.c:597\n ntfs_attr_lookup+0x1056/0x2070 fs/ntfs/attrib.c:1193\n ntfs_read_inode_mount+0x89a/0x2580 fs/ntfs/inode.c:1845\n ntfs_fill_super+0x1799/0x9320 fs/ntfs/super.c:2854\n mount_bdev+0x34d/0x410 fs/super.c:1400\n legacy_get_tree+0x105/0x220 fs/fs_context.c:610\n vfs_get_tree+0x89/0x2f0 fs/super.c:1530\n do_new_mount fs/namespace.c:3040 [inline]\n path_mount+0x1326/0x1e20 fs/namespace.c:3370\n do_mount fs/namespace.c:3383 [inline]\n __do_sys_mount fs/namespace.c:3591 [inline]\n __se_sys_mount fs/namespace.c:3568 [inline]\n __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n [...]\n </TASK>\n\nThe buggy address belongs to the physical page:\npage:ffffea0001f8d400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7e350\nhead:ffffea0001f8d400 order:3 compound_mapcount:0 compound_pincount:0\nflags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)\nraw: 00fff00000010200 0000000000000000 dead000000000122 ffff888011842140\nraw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\nMemory state around the buggy address:\n ffff88807e351f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff88807e351f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n>ffff88807e352000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                      ^\n ffff88807e352080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff88807e352100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n==================================================================\n\nKernel will loads $MFT/$DATA's first mft record in\nntfs_read_inode_mount().\n\nYet the problem is that after loading, kernel doesn't check whether\nattrs_offset field is a valid value.\n\nTo be more specific, if attrs_offset field is larger than bytes_allocated\nfield, then it may trigger the out-of-bounds read bug(reported as\nuse-after-free bug) in ntfs_attr_find(), when kernel tries to access the\ncorresponding mft record's attribute.\n\nThis patch solves it by adding the sanity check between attrs_offset field\nand bytes_allocated field, after loading the first mft record.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "750a2ebe-6a59-4cc2-87d4-887bee1e4aa0",  "id": "CVE-2024-53187",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: check for overflows in io_pin_pages\n\nWARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144\nCPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0\nCall Trace:\n <TASK>\n __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183\n io_rings_map io_uring/io_uring.c:2611 [inline]\n io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470\n io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692\n io_uring_setup io_uring/io_uring.c:3781 [inline]\n ...\n </TASK>\n\nio_pin_pages()'s uaddr parameter came directly from the user and can be\ngarbage. Don't just add size to it as it can overflow.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c35afee-906e-4dd5-92d8-6f82101d92d7",  "id": "CLSA-2023-1687269849",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e9ddaf6d-8edb-43e8-be3c-fe0adf243c2f",  "id": "CVE-2025-38058",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\n__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock\n\n... or we risk stealing final mntput from sync umount - raising mnt_count\nafter umount(2) has verified that victim is not busy, but before it\nhas set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see\nthat it's safe to quietly undo mnt_count increment and leaves dropping\nthe reference to caller, where it'll be a full-blown mntput().\n\nCheck under mount_lock is needed; leaving the current one done before\ntaking that makes no sense - it's nowhere near common enough to bother\nwith.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95390a25-3ca7-45eb-aa88-7b0e7fbdb056",  "id": "CVE-2019-12819",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12819"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in drivers/net/phy/mdio_bus.c calls put_device(), which will trigger a fixed_mdio_bus_init use-after-free. This will cause a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f7c448ce-f681-4b50-bcbc-411df2656276",  "id": "CVE-2024-56782",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()\n\nacpi_dev_hid_match() does not check for adev == NULL, dereferencing\nit unconditional.\n\nAdd a check for adev being NULL before calling acpi_dev_hid_match().\n\nAt the moment acpi_quirk_skip_serdev_enumeration() is never called with\na controller_parent without an ACPI companion, but better safe than sorry.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "451706f1-a026-4cb1-ad20-0bad93f46f24",  "id": "CVE-2025-38663",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: reject invalid file types when reading inodes\n\nTo prevent inodes with invalid file types from tripping through the vfs\nand causing malfunctions or assertion failures, add a missing sanity check\nwhen reading an inode from a block device.  If the file type is not valid,\ntreat it as a filesystem error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10ad1323-4d81-4b1d-bd9d-9092f822cbd4",  "id": "CVE-2019-18811",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18811"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering sof_get_ctrl_copy_params() failures, aka CID-45c1380358b1.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db2f00f5-0caf-43a2-aa3f-cfa81e589885",  "id": "AZL-81950",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3c1ab7e9-f22d-4575-b70b-a87542b8de55",  "id": "CVE-2013-7269",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7269"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "360102f2-4e3e-4ac3-b640-807fcff215db",  "id": "CVE-2022-48850",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet-sysfs: add check for netdevice being present to speed_show\n\nWhen bringing down the netdevice or system shutdown, a panic can be\ntriggered while accessing the sysfs path because the device is already\nremoved.\n\n    [  755.549084] mlx5_core 0000:12:00.1: Shutdown was called\n    [  756.404455] mlx5_core 0000:12:00.0: Shutdown was called\n    ...\n    [  757.937260] BUG: unable to handle kernel NULL pointer dereference at           (null)\n    [  758.031397] IP: [<ffffffff8ee11acb>] dma_pool_alloc+0x1ab/0x280\n\n    crash> bt\n    ...\n    PID: 12649  TASK: ffff8924108f2100  CPU: 1   COMMAND: \"amsd\"\n    ...\n     #9 [ffff89240e1a38b0] page_fault at ffffffff8f38c778\n        [exception RIP: dma_pool_alloc+0x1ab]\n        RIP: ffffffff8ee11acb  RSP: ffff89240e1a3968  RFLAGS: 00010046\n        RAX: 0000000000000246  RBX: ffff89243d874100  RCX: 0000000000001000\n        RDX: 0000000000000000  RSI: 0000000000000246  RDI: ffff89243d874090\n        RBP: ffff89240e1a39c0   R8: 000000000001f080   R9: ffff8905ffc03c00\n        R10: ffffffffc04680d4  R11: ffffffff8edde9fd  R12: 00000000000080d0\n        R13: ffff89243d874090  R14: ffff89243d874080  R15: 0000000000000000\n        ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n    #10 [ffff89240e1a39c8] mlx5_alloc_cmd_msg at ffffffffc04680f3 [mlx5_core]\n    #11 [ffff89240e1a3a18] cmd_exec at ffffffffc046ad62 [mlx5_core]\n    #12 [ffff89240e1a3ab8] mlx5_cmd_exec at ffffffffc046b4fb [mlx5_core]\n    #13 [ffff89240e1a3ae8] mlx5_core_access_reg at ffffffffc0475434 [mlx5_core]\n    #14 [ffff89240e1a3b40] mlx5e_get_fec_caps at ffffffffc04a7348 [mlx5_core]\n    #15 [ffff89240e1a3bb0] get_fec_supported_advertised at ffffffffc04992bf [mlx5_core]\n    #16 [ffff89240e1a3c08] mlx5e_get_link_ksettings at ffffffffc049ab36 [mlx5_core]\n    #17 [ffff89240e1a3ce8] __ethtool_get_link_ksettings at ffffffff8f25db46\n    #18 [ffff89240e1a3d48] speed_show at ffffffff8f277208\n    #19 [ffff89240e1a3dd8] dev_attr_show at ffffffff8f0b70e3\n    #20 [ffff89240e1a3df8] sysfs_kf_seq_show at ffffffff8eedbedf\n    #21 [ffff89240e1a3e18] kernfs_seq_show at ffffffff8eeda596\n    #22 [ffff89240e1a3e28] seq_read at ffffffff8ee76d10\n    #23 [ffff89240e1a3e98] kernfs_fop_read at ffffffff8eedaef5\n    #24 [ffff89240e1a3ed8] vfs_read at ffffffff8ee4e3ff\n    #25 [ffff89240e1a3f08] sys_read at ffffffff8ee4f27f\n    #26 [ffff89240e1a3f50] system_call_fastpath at ffffffff8f395f92\n\n    crash> net_device.state ffff89443b0c0000\n      state = 0x5  (__LINK_STATE_START| __LINK_STATE_NOCARRIER)\n\nTo prevent this scenario, we also make sure that the netdevice is present.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0cd70534-a0db-4463-80ed-e9a02624ffdb",  "id": "CVE-2010-4563",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4563"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel, when using IPv6, allows remote attackers to determine whether a host is sniffing the network by sending an ICMPv6 Echo Request to a multicast address and determining whether an Echo Reply is sent, as demonstrated by thcping.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a9c7b60-ebc9-4310-8bf3-8b8cf202a3b5",  "id": "OESA-2024-2480",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd1712c0-df95-43b6-87e8-3834b6c1afce",  "id": "CVE-2024-42097",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: emux: improve patch ioctl data validation\n\nIn load_data(), make the validation of and skipping over the main info\nblock match that in load_guspatch().\n\nIn load_guspatch(), add checking that the specified patch length matches\nthe actually supplied data, like load_data() already did.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "14f783df-b5be-435e-a067-649d54d7d6fb",  "id": "CVE-2022-50289",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix memory leak in ocfs2_stack_glue_init()\n\nocfs2_table_header should be free in ocfs2_stack_glue_init() if\nocfs2_sysfs_init() failed, otherwise kmemleak will report memleak.\n\nBUG: memory leak\nunreferenced object 0xffff88810eeb5800 (size 128):\n  comm \"modprobe\", pid 4507, jiffies 4296182506 (age 55.888s)\n  hex dump (first 32 bytes):\n    c0 40 14 a0 ff ff ff ff 00 00 00 00 01 00 00 00  .@..............\n    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [<000000001e59e1cd>] __register_sysctl_table+0xca/0xef0\n    [<00000000c04f70f7>] 0xffffffffa0050037\n    [<000000001bd12912>] do_one_initcall+0xdb/0x480\n    [<0000000064f766c9>] do_init_module+0x1cf/0x680\n    [<000000002ba52db0>] load_module+0x6441/0x6f20\n    [<000000009772580d>] __do_sys_finit_module+0x12f/0x1c0\n    [<00000000380c1f22>] do_syscall_64+0x3f/0x90\n    [<000000004cf473bc>] entry_SYSCALL_64_after_hwframe+0x63/0xcd",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3264ba45-1949-451a-a736-c7cfb6a75855",  "id": "CVE-2009-1377",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1377"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service (memory consumption) via a large series of \"future epoch\" DTLS records that are buffered in a queue, aka \"DTLS record buffer limitation bug.\"",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5af8bf77-79c6-4cb8-a7b3-6de9bb0844c5",  "id": "CVE-2024-53150",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix out of bounds reads when finding clock sources\n\nThe current USB-audio driver code doesn't check bLength of each\ndescriptor at traversing for clock descriptors.  That is, when a\ndevice provides a bogus descriptor with a shorter bLength, the driver\nmight hit out-of-bounds reads.\n\nFor addressing it, this patch adds sanity checks to the validator\nfunctions for the clock descriptor traversal.  When the descriptor\nlength is shorter than expected, it's skipped in the loop.\n\nFor the clock source and clock multiplier descriptors, we can just\ncheck bLength against the sizeof() of each descriptor type.\nOTOH, the clock selector descriptor of UAC2 and UAC3 has an array\nof bNrInPins elements and two more fields at its tail, hence those\nhave to be checked in addition to the sizeof() check.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "88e607f4-5fda-427a-88c4-4ae3c9f888a5",  "id": "MGASA-2015-0466",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9fdb4680-15ef-4061-8589-2232b95c7016",  "id": "CVE-2020-29371",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29371"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bea7c9b8-1bf2-4fe1-a5d9-914a3fcc538c",  "id": "CVE-2026-45983",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: never defer requests during idmap lookup\n\nDuring v4 request compound arg decoding, some ops (e.g. SETATTR)\ncan trigger idmap lookup upcalls. When those upcall responses get\ndelayed beyond the allowed time limit, cache_check() will mark the\nrequest for deferral and cause it to be dropped.\n\nThis prevents nfs4svc_encode_compoundres from being executed, and\nthus the session slot flag NFSD4_SLOT_INUSE never gets cleared.\nSubsequent client requests will fail with NFSERR_JUKEBOX, given\nthat the slot will be marked as in-use, making the SEQUENCE op\nfail.\n\nFix this by making sure that the RQ_USEDEFERRAL flag is always\nclear during nfs4svc_decode_compoundargs(), since no v4 request\nshould ever be deferred.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c859e12e-0a7f-4087-b2ed-17035b429ef6",  "id": "CVE-2013-4516",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4516"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The mp_get_count function in drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "14f01398-fc31-4917-9017-bfac34d3d8d1",  "id": "CVE-2023-28327",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28327"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "913179b5-3a5a-4408-b5c8-eb4e3e26d083",  "id": "CVE-2023-53222",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: jfs_dmap: Validate db_l2nbperpage while mounting\n\nIn jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block\nnumber inside dbFree(). db_l2nbperpage, which is the log2 number of\nblocks per page, is passed as an argument to BLKTODMAP which uses it\nfor shifting.\n\nSyzbot reported a shift out-of-bounds crash because db_l2nbperpage is\ntoo big. This happens because the large value is set without any\nvalidation in dbMount() at line 181.\n\nThus, make sure that db_l2nbperpage is correct while mounting.\n\nMax number of blocks per page = Page size / Min block size\n=> log2(Max num_block per page) = log2(Page size / Min block size)\n\t\t\t\t= log2(Page size) - log2(Min block size)\n\n=> Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c58c8f45-2818-44bf-a0d9-942457405686",  "id": "CVE-2022-49739",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Always check inode size of inline inodes\n\nCheck if the inode size of stuffed (inline) inodes is within the allowed\nrange when reading inodes from disk (gfs2_dinode_in()).  This prevents\nus from on-disk corruption.\n\nThe two checks in stuffed_readpage() and gfs2_unstuffer_page() that just\ntruncate inline data to the maximum allowed size don't actually make\nsense, and they can be removed now as well.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "609338b9-c1c0-481b-b096-f1f428793161",  "id": "CVE-2024-49926",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()\n\nFor kernels built with CONFIG_FORCE_NR_CPUS=y, the nr_cpu_ids is\ndefined as NR_CPUS instead of the number of possible cpus, this\nwill cause the following system panic:\n\nsmpboot: Allowing 4 CPUs, 0 hotplug CPUs\n...\nsetup_percpu: NR_CPUS:512 nr_cpumask_bits:512 nr_cpu_ids:512 nr_node_ids:1\n...\nBUG: unable to handle page fault for address: ffffffff9911c8c8\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 0 PID: 15 Comm: rcu_tasks_trace Tainted: G W\n6.6.21 #1 5dc7acf91a5e8e9ac9dcfc35bee0245691283ea6\nRIP: 0010:rcu_tasks_need_gpcb+0x25d/0x2c0\nRSP: 0018:ffffa371c00a3e60 EFLAGS: 00010082\nCR2: ffffffff9911c8c8 CR3: 000000040fa20005 CR4: 00000000001706f0\nCall Trace:\n<TASK>\n? __die+0x23/0x80\n? page_fault_oops+0xa4/0x180\n? exc_page_fault+0x152/0x180\n? asm_exc_page_fault+0x26/0x40\n? rcu_tasks_need_gpcb+0x25d/0x2c0\n? __pfx_rcu_tasks_kthread+0x40/0x40\nrcu_tasks_one_gp+0x69/0x180\nrcu_tasks_kthread+0x94/0xc0\nkthread+0xe8/0x140\n? __pfx_kthread+0x40/0x40\nret_from_fork+0x34/0x80\n? __pfx_kthread+0x40/0x40\nret_from_fork_asm+0x1b/0x80\n</TASK>\n\nConsidering that there may be holes in the CPU numbers, use the\nmaximum possible cpu number, instead of nr_cpu_ids, for configuring\nenqueue and dequeue limits.\n\n[ neeraj.upadhyay: Fix htmldocs build error reported by Stephen Rothwell ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f904489-9aa3-45ff-b7a9-5532964f8384",  "id": "CVE-2022-48893",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    459  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Cleanup partial engine discovery failures\n\nIf we abort driver initialisation in the middle of gt/engine discovery,\nsome engines will be fully setup and some not. Those incompletely setup\nengines only have 'engine->release == NULL' and so will leak any of the\ncommon objects allocated.\n\nv2:\n - Drop the destroy_pinned_context() helper for now.  It's not really\n   worth it with just a single callsite at the moment.  (Janusz)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "871c18fa-62f9-4d3c-a67e-e6c3eb1cdab7",  "id": "CLSA-2022-1647550812",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8793d400-9b02-4850-93c3-7e4c479a8e4f",  "id": "CVE-2014-4943",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4943"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    269  ],  "analysis": {    "state": "in_triage"  },  "description": "The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:36267'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:130592/Linux-CVE-2014-4943-Proof-Of-Concept.html'"    }  ]},{  "bom-ref": "5250d8f3-8ade-4d9c-a51e-3bb04cf8fd8e",  "id": "SUSE-SU-2019:14190-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "70714df4-deff-4952-ba08-ea1589c93576",  "id": "CVE-2016-10318",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10318"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "A missing authorization check in the fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and f2fs filesystem encryption support in the Linux kernel before 4.7.4 allows a user to assign an encryption policy to a directory owned by a different user, potentially creating a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "27035a07-6680-463a-a3fd-aa13d4b0ebfd",  "id": "CVE-2025-38269",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: exit after state insertion failure at btrfs_convert_extent_bit()\n\nIf insert_state() state failed it returns an error pointer and we call\nextent_io_tree_panic() which will trigger a BUG() call. However if\nCONFIG_BUG is disabled, which is an uncommon and exotic scenario, then\nwe fallthrough and call cache_state() which will dereference the error\npointer, resulting in an invalid memory access.\n\nSo jump to the 'out' label after calling extent_io_tree_panic(), it also\nmakes the code more clear besides dealing with the exotic scenario where\nCONFIG_BUG is disabled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4c851479-6d5b-4419-9600-7038d15b70ab",  "id": "CVE-2021-30178",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30178"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dereference for certain accesses to the SynIC Hyper-V context, aka CID-919f4ebc5987.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fb259e5c-b6be-41f1-968e-e125a3370e7c",  "id": "CVE-2012-2373",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2373"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 3.4.5 on the x86 platform, when Physical Address Extension (PAE) is enabled, does not properly use the Page Middle Directory (PMD), which allows local users to cause a denial of service (panic) via a crafted application that triggers a race condition.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2bb8d743-9e79-4ced-939c-9602830211de",  "id": "CVE-2022-4662",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4662"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    455  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "090f4e60-5bc5-4593-a45e-f897a4a07f33",  "id": "CVE-2024-42105",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix inode number range checks\n\nPatch series \"nilfs2: fix potential issues related to reserved inodes\".\n\nThis series fixes one use-after-free issue reported by syzbot, caused by\nnilfs2's internal inode being exposed in the namespace on a corrupted\nfilesystem, and a couple of flaws that cause problems if the starting\nnumber of non-reserved inodes written in the on-disk super block is\nintentionally (or corruptly) changed from its default value.  \n\n\nThis patch (of 3):\n\nIn the current implementation of nilfs2, \"nilfs->ns_first_ino\", which\ngives the first non-reserved inode number, is read from the superblock,\nbut its lower limit is not checked.\n\nAs a result, if a number that overlaps with the inode number range of\nreserved inodes such as the root directory or metadata files is set in the\nsuper block parameter, the inode number test macros (NILFS_MDT_INODE and\nNILFS_VALID_INODE) will not function properly.\n\nIn addition, these test macros use left bit-shift calculations using with\nthe inode number as the shift count via the BIT macro, but the result of a\nshift calculation that exceeds the bit width of an integer is undefined in\nthe C specification, so if \"ns_first_ino\" is set to a large value other\nthan the default value NILFS_USER_INO (=11), the macros may potentially\nmalfunction depending on the environment.\n\nFix these issues by checking the lower bound of \"nilfs->ns_first_ino\" and\nby preventing bit shifts equal to or greater than the NILFS_USER_INO\nconstant in the inode number test macros.\n\nAlso, change the type of \"ns_first_ino\" from signed integer to unsigned\ninteger to avoid the need for type casting in comparisons such as the\nlower bound check introduced this time.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "041939ab-1e21-41c7-abfe-3be3766e9107",  "id": "CVE-2018-1068",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1068"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a1595f0f-e8e3-4223-a9e9-58628a1755ce",  "id": "CVE-2015-4001",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4001"  },  "ratings": [    {      "score": 9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "831b345f-015a-439d-96a0-f5866128e15c",  "id": "CVE-2016-4565",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4565"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cdd938ae-35dd-406e-ac9a-19e1a26f7213",  "id": "CVE-2017-13079",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13079"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    323,    330  ],  "analysis": {    "state": "in_triage"  },  "description": "Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "28709225-1088-4dc8-88f6-4d14ecbb7ed6",  "id": "CVE-2022-25265",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25265"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    913  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of bytes located in supposedly non-executable regions of a file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6868876c-0fc8-4e08-832f-1527c2491cc5",  "id": "OESA-2025-1885",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aff814a2-7ee9-48b0-9bfd-224695fe7f9c",  "id": "CVE-2023-52817",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL\n\nIn certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresponding exception log:\n\n1. Navigate to the directory: /sys/kernel/debug/dri/0\n2. Execute command: cat amdgpu_regs_smc\n3. Exception Log::\n[4005007.702554] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[4005007.702562] #PF: supervisor instruction fetch in kernel mode\n[4005007.702567] #PF: error_code(0x0010) - not-present page\n[4005007.702570] PGD 0 P4D 0\n[4005007.702576] Oops: 0010 [#1] SMP NOPTI\n[4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G           OE     5.15.0-43-generic #46-Ubunt       u\n[4005007.702590] RIP: 0010:0x0\n[4005007.702598] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.\n[4005007.702600] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206\n[4005007.702605] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68\n[4005007.702609] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000\n[4005007.702612] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980\n[4005007.702615] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000\n[4005007.702618] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000\n[4005007.702622] FS:  00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000\n[4005007.702626] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[4005007.702629] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0\n[4005007.702633] Call Trace:\n[4005007.702636]  <TASK>\n[4005007.702640]  amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu]\n[4005007.703002]  full_proxy_read+0x5c/0x80\n[4005007.703011]  vfs_read+0x9f/0x1a0\n[4005007.703019]  ksys_read+0x67/0xe0\n[4005007.703023]  __x64_sys_read+0x19/0x20\n[4005007.703028]  do_syscall_64+0x5c/0xc0\n[4005007.703034]  ? do_user_addr_fault+0x1e3/0x670\n[4005007.703040]  ? exit_to_user_mode_prepare+0x37/0xb0\n[4005007.703047]  ? irqentry_exit_to_user_mode+0x9/0x20\n[4005007.703052]  ? irqentry_exit+0x19/0x30\n[4005007.703057]  ? exc_page_fault+0x89/0x160\n[4005007.703062]  ? asm_exc_page_fault+0x8/0x30\n[4005007.703068]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[4005007.703075] RIP: 0033:0x7f5e07672992\n[4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 0f 1f 44 00 00 f3 0f        1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e       c 28 48 89 54 24\n[4005007.703083] RSP: 002b:00007ffe03097898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\n[4005007.703088] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5e07672992\n[4005007.703091] RDX: 0000000000020000 RSI: 00007f5e06753000 RDI: 0000000000000003\n[4005007.703094] RBP: 00007f5e06753000 R08: 00007f5e06752010 R09: 00007f5e06752010\n[4005007.703096] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000022000\n[4005007.703099] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000\n[4005007.703105]  </TASK>\n[4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash af_alg binfmt_misc nls_       iso8859_1 ipmi_ssif ast intel_rapl_msr intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t       tm edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl sch_fq_codel ipmi_devintf ipm       i_msghandler msr parport_pc ppdev lp parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo       mon ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) amdttm(OE) iommu_v       2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec rc_core        drm igb ahci xhci_pci libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca\n[4005007.703184] CR2: 0000000000000000\n[4005007.703188] ---[ en\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ac181b4-bbd9-4b21-9d9e-d2a8d14e1414",  "id": "CVE-2023-52588",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to tag gcing flag on page during block migration\n\nIt needs to add missing gcing flag on page during block migration,\nin order to garantee migrated data be persisted during checkpoint,\notherwise out-of-order persistency between data and node may cause\ndata corruption after SPOR.\n\nSimilar issue was fixed by commit 2d1fe8a86bf5 (\"f2fs: fix to tag\ngcing flag on page during file defragment\").",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7597c3f5-6176-4203-822b-961fc427556d",  "id": "CVE-2021-45402",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45402"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    668  ],  "analysis": {    "state": "in_triage"  },  "description": "The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a \"pointer leak.\"",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "affb687e-01e4-4357-a340-93ceb4bb7194",  "id": "CVE-2023-52832",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    920  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don't return unset power in ieee80211_get_tx_power()\n\nWe can get a UBSAN warning if ieee80211_get_tx_power() returns the\nINT_MIN value mac80211 internally uses for \"unset power level\".\n\n UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5\n -2147483648 * 100 cannot be represented in type 'int'\n CPU: 0 PID: 20433 Comm: insmod Tainted: G        WC OE\n Call Trace:\n  dump_stack+0x74/0x92\n  ubsan_epilogue+0x9/0x50\n  handle_overflow+0x8d/0xd0\n  __ubsan_handle_mul_overflow+0xe/0x10\n  nl80211_send_iface+0x688/0x6b0 [cfg80211]\n  [...]\n  cfg80211_register_wdev+0x78/0xb0 [cfg80211]\n  cfg80211_netdev_notifier_call+0x200/0x620 [cfg80211]\n  [...]\n  ieee80211_if_add+0x60e/0x8f0 [mac80211]\n  ieee80211_register_hw+0xda5/0x1170 [mac80211]\n\nIn this case, simply return an error instead, to indicate\nthat no data is available.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "926cf402-1106-44df-ad12-2c31699172e9",  "id": "CVE-2011-1163",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1163"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "842d564f-2ed1-427f-8ea7-e1a07669e782",  "id": "CVE-2015-8944",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8944"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The ioresources_init function in kernel/resource.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices, uses weak permissions for /proc/iomem, which allows local users to obtain sensitive information by reading this file, aka Android internal bug 28814213 and Qualcomm internal bug CR786116. NOTE: the permissions may be intentional in most non-Android contexts.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "85e40604-21ec-4709-b80f-14cef17edf69",  "id": "CVE-2021-4149",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4149"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e22d4e80-f713-4f9f-b2e4-6982647566fd",  "id": "CVE-2022-49457",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: versatile: Add missing of_node_put in dcscb_init\n\nThe device_node pointer is returned by of_find_compatible_node\nwith refcount incremented. We should use of_node_put() to avoid\nthe refcount leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "feee34a3-760f-446d-98ba-11189f528d4e",  "id": "CVE-2026-63806",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()\n\nDrop a BUG_ON() that has been reachable since it was first added, way back\nin 2009, and instead use get_unaligned() to perform potentially-unaligned\naccesses.\n\nFor a given store, KVM x86's emulator tracks the entire value in the\ndestination operand, x86_emulate_ctxt.dst.  If the destination is memory,\nand the target splits multiple pages and/or is emulated MMIO, then KVM\nhandles each fragment independently.  E.g. on a page split starting at page\noffset 0xffc, KVM writes 4 bytes to the first page, then the remaining\nbytes to the second page, using ctxt->dst as the source for both (with\nappropriate offsets).\n\nIf the destination splits a page *and* hits emulated MMIO on the second\npage, then KVM will complete the write to the first page, then emulate the\nMMIO access to the second page.  If there is a datamatch-enabled ioeventfd\nat offset 0 of the second page, then KVM will process the remainder of the\nstore as a potential ioeventfd signal.\n\nPutting it all together, if the guest emits a store that splits a page\nstarting at page offset N, and the second page has a datamatch-enabled\nioeventfd at offset 0, then KVM will check for datamatch using\n&dst.valptr[N] as the source.  Due to dst (and thus dst.valptr) being\n32-byte aligned, if N is not aligned to @len, the BUG_ON() fires.\n\nE.g. with a 16-byte store at page offset 0xffc, to an ioeventfd of len 8,\nall initial checks in ioeventfd_in_range() will succeed, and the BUG_ON()\nfires due to @val being 4-byte aligned, but not 8-byte aligned.\n\n  ------------[ cut here ]------------\n  kernel BUG at arch/x86/kvm/../../../virt/kvm/eventfd.c:783!\n  Oops: invalid opcode: 0000 [#1] SMP\n  CPU: 0 UID: 1000 PID: 615 Comm: repro Not tainted 7.1.0-rc2-ff238429d1ea #365 PREEMPT\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:ioeventfd_write+0x6c/0x70 [kvm]\n  Call Trace:\n   <TASK>\n   __kvm_io_bus_write+0x85/0xb0 [kvm]\n   kvm_io_bus_write+0x53/0x80 [kvm]\n   vcpu_mmio_write+0x66/0xf0 [kvm]\n   emulator_read_write_onepage+0x12a/0x540 [kvm]\n   emulator_read_write+0x109/0x2b0 [kvm]\n   x86_emulate_insn+0x4f8/0xfb0 [kvm]\n   x86_emulate_instruction+0x181/0x790 [kvm]\n   kvm_mmu_page_fault+0x313/0x630 [kvm]\n   vmx_handle_exit+0x18a/0x590 [kvm_intel]\n   kvm_arch_vcpu_ioctl_run+0xc81/0x1c90 [kvm]\n   kvm_vcpu_ioctl+0x2d5/0x970 [kvm]\n   __x64_sys_ioctl+0x8a/0xd0\n   do_syscall_64+0xb7/0x890\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f19c931a9bf\n   </TASK>\n  Modules linked in: kvm_intel kvm irqbypass\n  ---[ end trace 0000000000000000 ]---\n\nIn a perfect world, the fix would be to simply delete the BUG_ON(), as KVM\nx86 doesn't perform alignment checks on \"normal\" memory accesses at CPL0.\nSadly, C99 ruins all the fun; while the x86 architecture plays nice,\ndereferencing an unaligned pointer directly is undefined behavior in C,\ne.g. triggers splats when running with CONFIG_UBSAN_ALIGNMENT=y.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "61c59d1f-27eb-4ac7-aff1-df4c909243a6",  "id": "ALBA-2022:1839",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ad55359b-de13-424f-a1f4-f1b8b45bdb6f",  "id": "CVE-2015-8104",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8104"  },  "ratings": [    {      "score": 10,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "41e230bf-487a-4076-80c6-1075a1b3a9ac",  "id": "CVE-2024-39471",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: add error handle to avoid out-of-bounds\n\nif the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should\nbe stop to avoid out-of-bounds read, so directly return -EINVAL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eeb6c096-9d2d-435d-a37b-398e37ffabe9",  "id": "CVE-2013-7268",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7268"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The ipx_recvmsg function in net/ipx/af_ipx.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5c5a2ba4-440a-450d-97f5-1a3c81277963",  "id": "CVE-2021-47224",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47224"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ll_temac: Make sure to free skb when it is completely used\n\nWith the skb pointer piggy-backed on the TX BD, we have a simple and\nefficient way to free the skb buffer when the frame has been transmitted.\nBut in order to avoid freeing the skb while there are still fragments from\nthe skb in use, we need to piggy-back on the TX BD of the skb, not the\nfirst.\n\nWithout this, we are doing use-after-free on the DMA side, when the first\nBD of a multi TX BD packet is seen as completed in xmit_done, and the\nremaining BDs are still being processed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2c249f3-febb-45cc-a676-2a9a17b3c642",  "id": "CVE-2017-7616",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7616"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    388  ],  "analysis": {    "state": "in_triage"  },  "description": "Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel through 4.10.9 allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4e575eb8-0ca4-483d-91ba-aef6b3289777",  "id": "MGASA-2023-0130",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "46973e1f-9ed4-4ac5-824a-16426d25ebb3",  "id": "CVE-2024-42094",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: Avoid explicit cpumask var allocation on stack\n\nFor CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask\nvariable on stack is not recommended since it can cause potential stack\noverflow.\n\nInstead, kernel code should always use *cpumask_var API(s) to allocate\ncpumask var in config-neutral way, leaving allocation strategy to\nCONFIG_CPUMASK_OFFSTACK.\n\nUse *cpumask_var API(s) to address it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "66dcfbf7-e82b-408f-a6bd-c42ff13058ac",  "id": "CVE-2024-50180",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: sisfb: Fix strbuf array overflow\n\nThe values of the variables xres and yres are placed in strbuf.\nThese variables are obtained from strbuf1.\nThe strbuf1 array contains digit characters\nand a space if the array contains non-digit characters.\nThen, when executing sprintf(strbuf, \"%ux%ux8\", xres, yres);\nmore than 16 bytes will be written to strbuf.\nIt is suggested to increase the size of the strbuf array to 24.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e4f36266-3d15-4388-bcb0-58a5ca472b03",  "id": "CLSA-2025-1741787087",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4e37db5e-a0ed-412a-ae01-57ba6db3b8b0",  "id": "CVE-2022-50029",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: ipq8074: dont disable gcc_sleep_clk_src\n\nOnce the usb sleep clocks are disabled, clock framework is trying to\ndisable the sleep clock source also.\n\nHowever, it seems that it cannot be disabled and trying to do so produces:\n[  245.436390] ------------[ cut here ]------------\n[  245.441233] gcc_sleep_clk_src status stuck at 'on'\n[  245.441254] WARNING: CPU: 2 PID: 223 at clk_branch_wait+0x130/0x140\n[  245.450435] Modules linked in: xhci_plat_hcd xhci_hcd dwc3 dwc3_qcom leds_gpio\n[  245.456601] CPU: 2 PID: 223 Comm: sh Not tainted 5.18.0-rc4 #215\n[  245.463889] Hardware name: Xiaomi AX9000 (DT)\n[  245.470050] pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  245.474307] pc : clk_branch_wait+0x130/0x140\n[  245.481073] lr : clk_branch_wait+0x130/0x140\n[  245.485588] sp : ffffffc009f2bad0\n[  245.489838] x29: ffffffc009f2bad0 x28: ffffff8003e6c800 x27: 0000000000000000\n[  245.493057] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800226ef20\n[  245.500175] x23: ffffffc0089ff550 x22: 0000000000000000 x21: ffffffc008476ad0\n[  245.507294] x20: 0000000000000000 x19: ffffffc00965ac70 x18: fffffffffffc51a7\n[  245.514413] x17: 68702e3030303837 x16: 3a6d726f6674616c x15: ffffffc089f2b777\n[  245.521531] x14: ffffffc0095c9d18 x13: 0000000000000129 x12: 0000000000000129\n[  245.528649] x11: 00000000ffffffea x10: ffffffc009621d18 x9 : 0000000000000001\n[  245.535767] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : 0000000000000001\n[  245.542885] x5 : ffffff803fdca6d8 x4 : 0000000000000000 x3 : 0000000000000027\n[  245.550002] x2 : 0000000000000027 x1 : 0000000000000023 x0 : 0000000000000026\n[  245.557122] Call trace:\n[  245.564229]  clk_branch_wait+0x130/0x140\n[  245.566490]  clk_branch2_disable+0x2c/0x40\n[  245.570656]  clk_core_disable+0x60/0xb0\n[  245.574561]  clk_core_disable+0x68/0xb0\n[  245.578293]  clk_disable+0x30/0x50\n[  245.582113]  dwc3_qcom_remove+0x60/0xc0 [dwc3_qcom]\n[  245.585588]  platform_remove+0x28/0x60\n[  245.590361]  device_remove+0x4c/0x80\n[  245.594179]  device_release_driver_internal+0x1dc/0x230\n[  245.597914]  device_driver_detach+0x18/0x30\n[  245.602861]  unbind_store+0xec/0x110\n[  245.607027]  drv_attr_store+0x24/0x40\n[  245.610847]  sysfs_kf_write+0x44/0x60\n[  245.614405]  kernfs_fop_write_iter+0x128/0x1c0\n[  245.618052]  new_sync_write+0xc0/0x130\n[  245.622391]  vfs_write+0x1d4/0x2a0\n[  245.626123]  ksys_write+0x58/0xe0\n[  245.629508]  __arm64_sys_write+0x1c/0x30\n[  245.632895]  invoke_syscall.constprop.0+0x5c/0x110\n[  245.636890]  do_el0_svc+0xa0/0x150\n[  245.641488]  el0_svc+0x18/0x60\n[  245.644872]  el0t_64_sync_handler+0xa4/0x130\n[  245.647914]  el0t_64_sync+0x174/0x178\n[  245.652340] ---[ end trace 0000000000000000 ]---\n\nSo, add CLK_IS_CRITICAL flag to the clock so that the kernel won't try\nto disable the sleep clock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "29d0017d-7489-4c1e-9bb6-d3f1fdca005a",  "id": "CVE-2024-26844",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: Fix WARNING in _copy_from_iter\n\nSyzkaller reports a warning in _copy_from_iter because an\niov_iter is supposedly used in the wrong direction. The reason\nis that syzcaller managed to generate a request with\na transfer direction of SG_DXFER_TO_FROM_DEV. This instructs\nthe kernel to copy user buffers into the kernel, read into\nthe copied buffers and then copy the data back to user space.\n\nThus the iovec is used in both directions.\n\nDetect this situation in the block layer and construct a new\niterator with the correct direction for the copy-in.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e0fff25f-e6e6-4a0b-aae8-ac4a4153fe55",  "id": "CVE-2014-1738",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1738"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "236365d7-6e86-4026-98eb-ff53c587f931",  "id": "RHSA-2015:2617",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c71a2f16-fc51-4e48-b215-b3e3a7d1982b",  "id": "CVE-2022-49526",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/bitmap: don't set sb values if can't pass sanity check\n\nIf bitmap area contains invalid data, kernel will crash then mdadm\ntriggers \"Segmentation fault\".\nThis is cluster-md speical bug. In non-clustered env, mdadm will\nhandle broken metadata case. In clustered array, only kernel space\nhandles bitmap slot info. But even this bug only happened in clustered\nenv, current sanity check is wrong, the code should be changed.\n\nHow to trigger: (faulty injection)\n\ndd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sda\ndd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sdb\nmdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sda /dev/sdb\nmdadm -Ss\necho aaa > magic.txt\n == below modifying slot 2 bitmap data ==\ndd if=magic.txt of=/dev/sda seek=16384 bs=1 count=3 <== destroy magic\ndd if=/dev/zero of=/dev/sda seek=16436 bs=1 count=4 <== ZERO chunksize\nmdadm -A /dev/md0 /dev/sda /dev/sdb\n == kernel crashes. mdadm outputs \"Segmentation fault\" ==\n\nReason of kernel crash:\n\nIn md_bitmap_read_sb (called by md_bitmap_create), bad bitmap magic didn't\nblock chunksize assignment, and zero value made DIV_ROUND_UP_SECTOR_T()\ntrigger \"divide error\".\n\nCrash log:\n\nkernel: md: md0 stopped.\nkernel: md/raid1:md0: not clean -- starting background reconstruction\nkernel: md/raid1:md0: active with 2 out of 2 mirrors\nkernel: dlm: ... ...\nkernel: md-cluster: Joined cluster 44810aba-38bb-e6b8-daca-bc97a0b254aa slot 1\nkernel: md0: invalid bitmap file superblock: bad magic\nkernel: md_bitmap_copy_from_slot can't get bitmap from slot 2\nkernel: md-cluster: Could not gather bitmaps from slot 2\nkernel: divide error: 0000 [#1] SMP NOPTI\nkernel: CPU: 0 PID: 1603 Comm: mdadm Not tainted 5.14.6-1-default\nkernel: Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\nkernel: RIP: 0010:md_bitmap_create+0x1d1/0x850 [md_mod]\nkernel: RSP: 0018:ffffc22ac0843ba0 EFLAGS: 00010246\nkernel: ... ...\nkernel: Call Trace:\nkernel:  ? dlm_lock_sync+0xd0/0xd0 [md_cluster 77fe..7a0]\nkernel:  md_bitmap_copy_from_slot+0x2c/0x290 [md_mod 24ea..d3a]\nkernel:  load_bitmaps+0xec/0x210 [md_cluster 77fe..7a0]\nkernel:  md_bitmap_load+0x81/0x1e0 [md_mod 24ea..d3a]\nkernel:  do_md_run+0x30/0x100 [md_mod 24ea..d3a]\nkernel:  md_ioctl+0x1290/0x15a0 [md_mod 24ea....d3a]\nkernel:  ? mddev_unlock+0xaa/0x130 [md_mod 24ea..d3a]\nkernel:  ? blkdev_ioctl+0xb1/0x2b0\nkernel:  block_ioctl+0x3b/0x40\nkernel:  __x64_sys_ioctl+0x7f/0xb0\nkernel:  do_syscall_64+0x59/0x80\nkernel:  ? exit_to_user_mode_prepare+0x1ab/0x230\nkernel:  ? syscall_exit_to_user_mode+0x18/0x40\nkernel:  ? do_syscall_64+0x69/0x80\nkernel:  entry_SYSCALL_64_after_hwframe+0x44/0xae\nkernel: RIP: 0033:0x7f4a15fa722b\nkernel: ... ...\nkernel: ---[ end trace 8afa7612f559c868 ]---\nkernel: RIP: 0010:md_bitmap_create+0x1d1/0x850 [md_mod]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "36a0a807-f96f-49bc-adc7-158a824b361c",  "id": "CVE-2017-1000112",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000112"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 (\"[IPv4/IPv6]: UFO Scatter-gather approach\") on Oct 18 2005.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:45147'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'MSF:ufo_privilege_escalation'"    }  ]},{  "bom-ref": "36407150-ae01-4601-aaa0-e93a5a68881d",  "id": "CVE-2023-52445",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix use after free on context disconnection\n\nUpon module load, a kthread is created targeting the\npvr2_context_thread_func function, which may call pvr2_context_destroy\nand thus call kfree() on the context object. However, that might happen\nbefore the usb hub_event handler is able to notify the driver. This\npatch adds a sanity check before the invalid read reported by syzbot,\nwithin the context disconnection call stack.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7e5bb0f3-7325-4f84-ac56-1436729c0a00",  "id": "CVE-2021-38199",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38199"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for those servers to be unreachable during trunking detection.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "561d7ada-5375-42a7-8adc-760e0d060249",  "id": "CVE-2025-38721",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: fix refcount leak on table dump\n\nThere is a reference count leak in ctnetlink_dump_table():\n      if (res < 0) {\n                nf_conntrack_get(&ct->ct_general); // HERE\n                cb->args[1] = (unsigned long)ct;\n                ...\n\nWhile its very unlikely, its possible that ct == last.\nIf this happens, then the refcount of ct was already incremented.\nThis 2nd increment is never undone.\n\nThis prevents the conntrack object from being released, which in turn\nkeeps prevents cnet->count from dropping back to 0.\n\nThis will then block the netns dismantle (or conntrack rmmod) as\nnf_conntrack_cleanup_net_list() will wait forever.\n\nThis can be reproduced by running conntrack_resize.sh selftest in a loop.\nIt takes ~20 minutes for me on a preemptible kernel on average before\nI see a runaway kworker spinning in nf_conntrack_cleanup_net_list.\n\nOne fix would to change this to:\n        if (res < 0) {\n\t\tif (ct != last)\n\t                nf_conntrack_get(&ct->ct_general);\n\nBut this reference counting isn't needed in the first place.\nWe can just store a cookie value instead.\n\nA followup patch will do the same for ctnetlink_exp_dump_table,\nit looks to me as if this has the same problem and like\nctnetlink_dump_table, we only need a 'skip hint', not the actual\nobject so we can apply the same cookie strategy there as well.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "953d4544-bd6f-4243-bc4a-20c5b9df6c89",  "id": "CVE-2024-47660",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsnotify: clear PARENT_WATCHED flags lazily\n\nIn some setups directories can have many (usually negative) dentries.\nHence __fsnotify_update_child_dentry_flags() function can take a\nsignificant amount of time. Since the bulk of this function happens\nunder inode->i_lock this causes a significant contention on the lock\nwhen we remove the watch from the directory as the\n__fsnotify_update_child_dentry_flags() call from fsnotify_recalc_mask()\nraces with __fsnotify_update_child_dentry_flags() calls from\n__fsnotify_parent() happening on children. This can lead upto softlockup\nreports reported by users.\n\nFix the problem by calling fsnotify_update_children_dentry_flags() to\nset PARENT_WATCHED flags only when parent starts watching children.\n\nWhen parent stops watching children, clear false positive PARENT_WATCHED\nflags lazily in __fsnotify_parent() for each accessed child.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cab8f999-33df-4241-ad44-91984b423e4f",  "id": "CVE-2021-47116",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47116"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix memory leak in ext4_mb_init_backend on error path.\n\nFix a memory leak discovered by syzbot when a file system is corrupted\nwith an illegally large s_log_groups_per_flex.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "70a693af-70ea-4e6f-b1f0-3e0bd42e8a68",  "id": "CVE-2014-4656",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4656"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c9f5e8b2-8b45-4dfb-a72f-1777aa76a5e6",  "id": "CVE-2023-3863",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3863"  },  "ratings": [    {      "score": 4.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel. This flaw allows a local user with special privileges to impact a kernel information leak issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "913c42aa-f693-4d0a-be88-3cec357bfed9",  "id": "CVE-2022-1011",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1011"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:166772/Linux-FUSE-Use-After-Free.html'"    }  ]},{  "bom-ref": "e639ecba-ec52-4405-9295-f9746ad144f7",  "id": "CVE-2021-47267",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47267"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: fix various gadget panics on 10gbps cabling\n\nusb_assign_descriptors() is called with 5 parameters,\nthe last 4 of which are the usb_descriptor_header for:\n  full-speed (USB1.1 - 12Mbps [including USB1.0 low-speed @ 1.5Mbps),\n  high-speed (USB2.0 - 480Mbps),\n  super-speed (USB3.0 - 5Gbps),\n  super-speed-plus (USB3.1 - 10Gbps).\n\nThe differences between full/high/super-speed descriptors are usually\nsubstantial (due to changes in the maximum usb block size from 64 to 512\nto 1024 bytes and other differences in the specs), while the difference\nbetween 5 and 10Gbps descriptors may be as little as nothing\n(in many cases the same tuning is simply good enough).\n\nHowever if a gadget driver calls usb_assign_descriptors() with\na NULL descriptor for super-speed-plus and is then used on a max 10gbps\nconfiguration, the kernel will crash with a null pointer dereference,\nwhen a 10gbps capable device port + cable + host port combination shows up.\n(This wouldn't happen if the gadget max-speed was set to 5gbps, but\nit of course defaults to the maximum, and there's no real reason to\nartificially limit it)\n\nThe fix is to simply use the 5gbps descriptor as the 10gbps descriptor,\nif a 10gbps descriptor wasn't provided.\n\nObviously this won't fix the problem if the 5gbps descriptor is also\nNULL, but such cases can't be so trivially solved (and any such gadgets\nare unlikely to be used with USB3 ports any way).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b97ea9b-7328-498b-a5d0-3561792a5b76",  "id": "CVE-2024-42227",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix overlapping copy within dml_core_mode_programming\n\n[WHY]\n&mode_lib->mp.Watermark and &locals->Watermark are\nthe same address. memcpy may lead to unexpected behavior.\n\n[HOW]\nmemmove should be used.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84f5d92e-5bc8-4ce3-bd87-1a7ed9054747",  "id": "SUSE-SU-2025:03205-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff726ccb-f36e-4901-8ae0-da5fd6b76354",  "id": "OESA-2026-2651",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fc8b2089-4f7f-4d53-8378-de9765d660f2",  "id": "CVE-2024-46832",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed\n\nThis avoids warning:\n\n[    0.118053] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283\n\nCaused by get_c0_compare_int on secondary CPU.\n\nWe also skipped saving IRQ number to struct clock_event_device *cd as\nit's never used by clockevent core, as per comments it's only meant\nfor \"non CPU local devices\".",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5d645327-5fb5-4795-b7e4-4c6ab17acddc",  "id": "CVE-2026-53186",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: bound SRP_RSP sense copy by the received length\n\nsrp_process_rsp() copies sense data from rsp->data + resp_data_len,\nwhere resp_data_len is the full 32-bit value supplied by the SRP target\nand is never checked against the number of bytes actually received\n(wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so\nat most 96 bytes are copied, but the source offset is not bounded.\n\nA malicious or compromised SRP target on the InfiniBand/RoCE fabric that\nthe initiator has logged into can return an SRP_RSP with\nSRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer\nis allocated at the target-chosen max_ti_iu_len, so the source of the\nsense copy lands past the bytes actually received; with resp_data_len\nnear 0xFFFFFFFF it is gigabytes past the buffer and the read faults.\n\nCopy the sense data only if it has not been truncated, that is, only if\nthe response header, the response data, and the sense region fit within\nthe bytes actually received; otherwise drop the sense and log. The\nin-tree iSER and NVMe-RDMA receive paths already bound their parse by\nwc->byte_len; this brings ib_srp into line with them.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7352137c-69b1-49cd-b95c-c324d7dc3861",  "id": "CVE-2013-1059",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1059"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an auth_reply message that triggers an attempted build_request operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "37340acd-c9de-4100-a7f0-52fa0be97637",  "id": "CVE-2021-4083",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4083"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:165504/Linux-Garbage-Collection-Memory-Corruption.html'"    }  ]},{  "bom-ref": "d31cc935-e074-4fe4-8673-62796eae188f",  "id": "CVE-2024-35930",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()\n\nThe call to lpfc_sli4_resume_rpi() in lpfc_rcv_padisc() may return an\nunsuccessful status.  In such cases, the elsiocb is not issued, the\ncompletion is not called, and thus the elsiocb resource is leaked.\n\nCheck return value after calling lpfc_sli4_resume_rpi() and conditionally\nrelease the elsiocb resource.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2c6dfc2-01ba-4478-9347-362ef56c9b48",  "id": "CVE-2026-23212",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    367  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: annotate data-races around slave->last_rx\n\nslave->last_rx and slave->target_last_arp_rx[...] can be read and written\nlocklessly. Add READ_ONCE() and WRITE_ONCE() annotations.\n\nsyzbot reported:\n\nBUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate\n\nwrite to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1:\n  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335\n  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533\n  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039\n  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]\n  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265\n  netif_receive_skb_internal net/core/dev.c:6351 [inline]\n  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410\n...\n\nwrite to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0:\n  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335\n  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533\n  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039\n  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]\n  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265\n  netif_receive_skb_internal net/core/dev.c:6351 [inline]\n  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410\n  br_netif_receive_skb net/bridge/br_input.c:30 [inline]\n  NF_HOOK include/linux/netfilter.h:318 [inline]\n...\n\nvalue changed: 0x0000000100005365 -> 0x0000000100005366",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6950a340-046c-44a0-bac2-e77f0f5a89d3",  "id": "CVE-2018-1000026",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000026"  },  "ratings": [    {      "score": 7.7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM..",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "089c3d5c-a3ef-4f9d-87ec-59f3edd95b21",  "id": "RHSA-2015:1072",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 3.7,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4079d111-7a3b-4930-828b-d246ddf847b0",  "id": "CVE-2022-49681",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxtensa: xtfpga: Fix refcount leak bug in setup\n\nIn machine_setup(), of_find_compatible_node() will return a node\npointer with refcount incremented. We should use of_node_put() when\nit is not used anymore.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e71b8799-a24b-4ff8-933c-cf35c9a9dd46",  "id": "RHSA-2026:1472",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a51ff4e1-803e-4d09-9d73-7e6148143aac",  "id": "CVE-2022-50427",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ac97: fix possible memory leak in snd_ac97_dev_register()\n\nIf device_register() fails in snd_ac97_dev_register(), it should\ncall put_device() to give up reference, or the name allocated in\ndev_set_name() is leaked.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b114cbd6-10c1-4bd2-aa00-0cbbd4ad37d5",  "id": "CVE-2014-8176",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8176"  },  "ratings": [    {      "score": 7.5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5de29c66-d46f-461f-9b4a-ffc1e0e8a1a5",  "id": "CVE-2023-53481",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed\n\nFollowing process will trigger an infinite loop in ubi_wl_put_peb():\n\n\tubifs_bgt\t\tubi_bgt\nubifs_leb_unmap\n  ubi_leb_unmap\n    ubi_eba_unmap_leb\n      ubi_wl_put_peb\twear_leveling_worker\n                          e1 = rb_entry(rb_first(&ubi->used)\n\t\t\t  e2 = get_peb_for_wl(ubi)\n\t\t\t  ubi_io_read_vid_hdr  // return err (flash fault)\n\t\t\t  out_error:\n\t\t\t    ubi->move_from = ubi->move_to = NULL\n\t\t\t    wl_entry_destroy(ubi, e1)\n\t\t\t      ubi->lookuptbl[e->pnum] = NULL\n      retry:\n        e = ubi->lookuptbl[pnum];\t// return NULL\n\tif (e == ubi->move_from) {\t// NULL == NULL gets true\n\t  goto retry;\t\t\t// infinite loop !!!\n\n$ top\n  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     COMMAND\n  7676 root     20   0       0      0      0 R 100.0  0.0  ubifs_bgt0_0\n\nFix it by:\n 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has\n    been removed from 'ubi->lookuptbl'.\n 2) Using 'ubi->wl_lock' protecting wl entry deletion to preventing an\n    use-after-free problem for wl entry in ubi_wl_put_peb().\n\nFetch a reproducer in [Link].",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "078934c1-65f5-42d8-a859-7efc20ef1d6b",  "id": "CVE-2019-16089",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16089"  },  "ratings": [    {      "score": 4.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 5.2.13. nbd_genl_status in drivers/block/nbd.c does not check the nla_nest_start_noflag return value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "151cc03f-15d7-4f32-adf8-f4e3a015c87f",  "id": "AZL-75269",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff9d6d18-8215-456b-9946-ce8a2ba7e427",  "id": "CVE-2024-46743",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.3,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/irq: Prevent device address out-of-bounds read in interrupt map walk\n\nWhen of_irq_parse_raw() is invoked with a device address smaller than\nthe interrupt parent node (from #address-cells property), KASAN detects\nthe following out-of-bounds read when populating the initial match table\n(dyndbg=\"func of_irq_parse_* +p\"):\n\n  OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0\n  OF:  parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2\n  OF:  intspec=4\n  OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2\n  OF:  -> addrsize=3\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0\n  Read of size 4 at addr ffffff81beca5608 by task bash/764\n\n  CPU: 1 PID: 764 Comm: bash Tainted: G           O       6.1.67-484c613561-nokia_sm_arm64 #1\n  Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023\n  Call trace:\n   dump_backtrace+0xdc/0x130\n   show_stack+0x1c/0x30\n   dump_stack_lvl+0x6c/0x84\n   print_report+0x150/0x448\n   kasan_report+0x98/0x140\n   __asan_load4+0x78/0xa0\n   of_irq_parse_raw+0x2b8/0x8d0\n   of_irq_parse_one+0x24c/0x270\n   parse_interrupts+0xc0/0x120\n   of_fwnode_add_links+0x100/0x2d0\n   fw_devlink_parse_fwtree+0x64/0xc0\n   device_add+0xb38/0xc30\n   of_device_add+0x64/0x90\n   of_platform_device_create_pdata+0xd0/0x170\n   of_platform_bus_create+0x244/0x600\n   of_platform_notify+0x1b0/0x254\n   blocking_notifier_call_chain+0x9c/0xd0\n   __of_changeset_entry_notify+0x1b8/0x230\n   __of_changeset_apply_notify+0x54/0xe4\n   of_overlay_fdt_apply+0xc04/0xd94\n   ...\n\n  The buggy address belongs to the object at ffffff81beca5600\n   which belongs to the cache kmalloc-128 of size 128\n  The buggy address is located 8 bytes inside of\n   128-byte region [ffffff81beca5600, ffffff81beca5680)\n\n  The buggy address belongs to the physical page:\n  page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4\n  head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0\n  flags: 0x8000000000010200(slab|head|zone=2)\n  raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300\n  raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000\n  page dumped because: kasan: bad access detected\n\n  Memory state around the buggy address:\n   ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n   ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  >ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n                        ^\n   ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n   ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc\n  ==================================================================\n  OF:  -> got it !\n\nPrevent the out-of-bounds read by copying the device address into a\nbuffer of sufficient size.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b4d5deb-0a49-44a9-b8a6-ff4ebc7a981d",  "id": "CVE-2010-3876",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3876"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "net/packet/af_packet.c in the Linux kernel before 2.6.37-rc2 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_RAW capability to read copies of the applicable structures.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "540abddc-d0cd-46d5-a36c-29d033de7446",  "id": "RHSA-2015:0716",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d9e26fb8-c9e1-4c23-8481-72f70cac17f4",  "id": "CVE-2010-3442",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3442"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel before 2.6.36-rc5-next-20100929 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8450528f-1f8a-4e05-aa13-77533434a65e",  "id": "CVE-2017-17806",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17806"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e74fdc14-4212-49c8-a5c6-12f998d6627f",  "id": "CVE-2016-3156",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3156"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "72e5ba77-0d9c-4dfd-acac-6cb94159c89c",  "id": "CVE-2026-43313",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()\n\nIn acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE\ndevice and then reassigned an ISA device:\n\n  dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);\n  dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);\n\nIf the first lookup succeeds but the second fails, dev becomes NULL. This\nleads to a potential null-pointer dereference when dev_dbg() is called:\n\n  if (errata.piix4.bmisx)\n    dev_dbg(&dev->dev, ...);\n\nTo prevent this, use two temporary pointers and retrieve each device\nindependently, avoiding overwriting dev with a possible NULL value.\n\n[ rjw: Subject adjustment, added an empty code line ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10298627-81c7-43ac-a839-85d9a72fa1a5",  "id": "CVE-2026-31634",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix reference count leak in rxrpc_server_keyring()\n\nThis patch fixes a reference count leak in rxrpc_server_keyring()\nby checking if rx->securities is already set.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4f5c3780-20d0-468a-93cb-4d98fa4afedf",  "id": "CVE-2021-47385",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47385"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field\n\nIf driver read val value sufficient for\n(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7))\nfrom device then Null pointer dereference occurs.\n(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)\nAlso lm75[] does not serve a purpose anymore after switching to\ndevm_i2c_new_dummy_device() in w83791d_detect_subclients().\n\nThe patch fixes possible NULL pointer dereference by removing lm75[].\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[groeck: Dropped unnecessary continuation lines, fixed multipline alignment]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "81fde673-2364-4261-a5ea-e58da5f37c7b",  "id": "CVE-2024-53103",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer\n\nWhen hvs is released, there is a possibility that vsk->trans may not\nbe initialized to NULL, which could lead to a dangling pointer.\nThis issue is resolved by initializing vsk->trans to NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a8f17f00-2406-4340-b753-eb36312fb1c5",  "id": "CVE-2024-41059",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix uninit-value in copy_name\n\n[syzbot reported]\nBUG: KMSAN: uninit-value in sized_strscpy+0xc4/0x160\n sized_strscpy+0xc4/0x160\n copy_name+0x2af/0x320 fs/hfsplus/xattr.c:411\n hfsplus_listxattr+0x11e9/0x1a50 fs/hfsplus/xattr.c:750\n vfs_listxattr fs/xattr.c:493 [inline]\n listxattr+0x1f3/0x6b0 fs/xattr.c:840\n path_listxattr fs/xattr.c:864 [inline]\n __do_sys_listxattr fs/xattr.c:876 [inline]\n __se_sys_listxattr fs/xattr.c:873 [inline]\n __x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873\n x64_sys_call+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:195\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:3877 [inline]\n slab_alloc_node mm/slub.c:3918 [inline]\n kmalloc_trace+0x57b/0xbe0 mm/slub.c:4065\n kmalloc include/linux/slab.h:628 [inline]\n hfsplus_listxattr+0x4cc/0x1a50 fs/hfsplus/xattr.c:699\n vfs_listxattr fs/xattr.c:493 [inline]\n listxattr+0x1f3/0x6b0 fs/xattr.c:840\n path_listxattr fs/xattr.c:864 [inline]\n __do_sys_listxattr fs/xattr.c:876 [inline]\n __se_sys_listxattr fs/xattr.c:873 [inline]\n __x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873\n x64_sys_call+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:195\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[Fix]\nWhen allocating memory to strbuf, initialize memory to 0.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5a6100c1-4ebf-4462-a47b-15520a41e042",  "id": "CVE-2022-49319",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu-v3: check return value after calling platform_get_resource()\n\nIt will cause null-ptr-deref if platform_get_resource() returns NULL,\nwe need check the return value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d9b17899-ef0e-450f-904f-d37f59838899",  "id": "CVE-2024-41098",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-core: Fix null pointer dereference on error\n\nIf the ata_port_alloc() call in ata_host_alloc() fails,\nata_host_release() will get called.\n\nHowever, the code in ata_host_release() tries to free ata_port struct\nmembers unconditionally, which can lead to the following:\n\nBUG: unable to handle page fault for address: 0000000000003990\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 10 PID: 594 Comm: (udev-worker) Not tainted 6.10.0-rc5 #44\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:ata_host_release.cold+0x2f/0x6e [libata]\nCode: e4 4d 63 f4 44 89 e2 48 c7 c6 90 ad 32 c0 48 c7 c7 d0 70 33 c0 49 83 c6 0e 41\nRSP: 0018:ffffc90000ebb968 EFLAGS: 00010246\nRAX: 0000000000000041 RBX: ffff88810fb52e78 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff88813b3218c0 RDI: ffff88813b3218c0\nRBP: ffff88810fb52e40 R08: 0000000000000000 R09: 6c65725f74736f68\nR10: ffffc90000ebb738 R11: 73692033203a746e R12: 0000000000000004\nR13: 0000000000000000 R14: 0000000000000011 R15: 0000000000000006\nFS:  00007f6cc55b9980(0000) GS:ffff88813b300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000003990 CR3: 00000001122a2000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n <TASK>\n ? __die_body.cold+0x19/0x27\n ? page_fault_oops+0x15a/0x2f0\n ? exc_page_fault+0x7e/0x180\n ? asm_exc_page_fault+0x26/0x30\n ? ata_host_release.cold+0x2f/0x6e [libata]\n ? ata_host_release.cold+0x2f/0x6e [libata]\n release_nodes+0x35/0xb0\n devres_release_group+0x113/0x140\n ata_host_alloc+0xed/0x120 [libata]\n ata_host_alloc_pinfo+0x14/0xa0 [libata]\n ahci_init_one+0x6c9/0xd20 [ahci]\n\nDo not access ata_port struct members unconditionally.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c69c632b-90b4-45c6-900b-db8f6a1dc2b8",  "id": "ROOT-OS-ALPINE-317-CVE-2026-31789",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d480bbfd-c8ea-424a-8f67-8889d2029789",  "id": "CVE-2022-50032",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: renesas: Fix refcount leak bug\n\nIn usbhs_rza1_hardware_init(), of_find_node_by_name() will return\na node pointer with refcount incremented. We should use of_node_put()\nwhen it is not used anymore.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9fb3f95f-0ddb-4a13-a485-ca4225c88364",  "id": "CVE-2025-38262",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: uartlite: register uart driver in init\n\nWhen two instances of uart devices are probing, a concurrency race can\noccur. If one thread calls uart_register_driver function, which first\nallocates and assigns memory to 'uart_state' member of uart_driver\nstructure, the other instance can bypass uart driver registration and\ncall ulite_assign. This calls uart_add_one_port, which expects the uart\ndriver to be fully initialized. This leads to a kernel panic due to a\nnull pointer dereference:\n\n[    8.143581] BUG: kernel NULL pointer dereference, address: 00000000000002b8\n[    8.156982] #PF: supervisor write access in kernel mode\n[    8.156984] #PF: error_code(0x0002) - not-present page\n[    8.156986] PGD 0 P4D 0\n...\n[    8.180668] RIP: 0010:mutex_lock+0x19/0x30\n[    8.188624] Call Trace:\n[    8.188629]  ? __die_body.cold+0x1a/0x1f\n[    8.195260]  ? page_fault_oops+0x15c/0x290\n[    8.209183]  ? __irq_resolve_mapping+0x47/0x80\n[    8.209187]  ? exc_page_fault+0x64/0x140\n[    8.209190]  ? asm_exc_page_fault+0x22/0x30\n[    8.209196]  ? mutex_lock+0x19/0x30\n[    8.223116]  uart_add_one_port+0x60/0x440\n[    8.223122]  ? proc_tty_register_driver+0x43/0x50\n[    8.223126]  ? tty_register_driver+0x1ca/0x1e0\n[    8.246250]  ulite_probe+0x357/0x4b0 [uartlite]\n\nTo prevent it, move uart driver registration in to init function. This\nwill ensure that uart_driver is always registered when probe function\nis called.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ff5522f2-c439-469a-8c73-7621e9459bb9",  "id": "OESA-2024-2439",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "65705e3c-734e-4317-a284-493f266d0c8b",  "id": "CVE-2019-19047",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19047"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the mlx5_fw_fatal_reporter_dump() function in drivers/net/ethernet/mellanox/mlx5/core/health.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_crdump_collect() failures, aka CID-c7ed6d0183d5.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3cc7f88f-10f2-4b9d-b35b-4108f60baa9f",  "id": "CVE-2022-49903",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix WARNING in ip6_route_net_exit_late()\n\nDuring the initialization of ip6_route_net_init_late(), if file\nipv6_route or rt6_stats fails to be created, the initialization is\nsuccessful by default. Therefore, the ipv6_route or rt6_stats file\ndoesn't be found during the remove in ip6_route_net_exit_late(). It\nwill cause WRNING.\n\nThe following is the stack information:\nname 'rt6_stats'\nWARNING: CPU: 0 PID: 9 at fs/proc/generic.c:712 remove_proc_entry+0x389/0x460\nModules linked in:\nWorkqueue: netns cleanup_net\nRIP: 0010:remove_proc_entry+0x389/0x460\nPKRU: 55555554\nCall Trace:\n<TASK>\nops_exit_list+0xb0/0x170\ncleanup_net+0x4ea/0xb00\nprocess_one_work+0x9bf/0x1710\nworker_thread+0x665/0x1080\nkthread+0x2e4/0x3a0\nret_from_fork+0x1f/0x30\n</TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e1249da3-b979-4b52-99e5-7c4519d67ba2",  "id": "CVE-2013-4515",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4515"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d0234ed3-788d-4053-96a7-cedb488b7c69",  "id": "CVE-2019-18885",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18885"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer dereference via a crafted btrfs image because fs_devices->devices is mishandled within find_device, aka CID-09ba3bc9dd15.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "67410948-8729-47e7-bdba-564c41f6eccb",  "id": "CVE-2013-2635",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2635"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "411cfaae-e945-4462-bc72-dfda33dfeb15",  "id": "CVE-2025-38513",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()\n\nThere is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For\nexample, the following is possible:\n\n    \tT0\t\t\t    \t\tT1\nzd_mac_tx_to_dev()\n  /* len == skb_queue_len(q) */\n  while (len > ZD_MAC_MAX_ACK_WAITERS) {\n\n\t\t\t\t\t  filter_ack()\n\t\t\t\t\t    spin_lock_irqsave(&q->lock, flags);\n\t\t\t\t\t    /* position == skb_queue_len(q) */\n\t\t\t\t\t    for (i=1; i<position; i++)\n\t\t\t\t    \t      skb = __skb_dequeue(q)\n\n\t\t\t\t\t    if (mac->type == NL80211_IFTYPE_AP)\n\t\t\t\t\t      skb = __skb_dequeue(q);\n\t\t\t\t\t    spin_unlock_irqrestore(&q->lock, flags);\n\n    skb_dequeue() -> NULL\n\nSince there is a small gap between checking skb queue length and skb being\nunconditionally dequeued in zd_mac_tx_to_dev(), skb_dequeue() can return NULL.\nThen the pointer is passed to zd_mac_tx_status() where it is dereferenced.\n\nIn order to avoid potential NULL pointer dereference due to situations like\nabove, check if skb is not NULL before passing it to zd_mac_tx_status().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "48b75c30-932f-4544-9f8e-b1c4bbc1a982",  "id": "CVE-2023-53443",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak\n\nIn arizona_clk32k_enable(), we should use pm_runtime_resume_and_get()\nas pm_runtime_get_sync() will increase the refcnt even when it\nreturns an error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bed9d3fa-7317-44ae-a349-2a0d34413be3",  "id": "SUSE-SU-2026:0758-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b529c7ae-04a6-4d5f-8187-fbbc5c6cb208",  "id": "CVE-2018-14646",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14646"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netlink.c file. A local attacker could exploit this when a net namespace with a netnsid is assigned to cause a kernel panic and a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c0c8b6e8-6e4d-44e0-a930-4b0d46f2c799",  "id": "CVE-2026-23472",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    835  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN\n\nuart_write_room() and uart_write() behave inconsistently when\nxmit_buf is NULL (which happens for PORT_UNKNOWN ports that were\nnever properly initialized):\n\n- uart_write_room() returns kfifo_avail() which can be > 0\n- uart_write() checks xmit_buf and returns 0 if NULL\n\nThis inconsistency causes an infinite loop in drivers that rely on\ntty_write_room() to determine if they can write:\n\n  while (tty_write_room(tty) > 0) {\n      written = tty->ops->write(...);\n      // written is always 0, loop never exits\n  }\n\nFor example, caif_serial's handle_tx() enters an infinite loop when\nused with PORT_UNKNOWN serial ports, causing system hangs.\n\nFix by making uart_write_room() also check xmit_buf and return 0 if\nit's NULL, consistent with uart_write().\n\nReproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c3221b2f-1aa1-443d-8441-4c3df4aefc07",  "id": "CVE-2016-2108",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2108"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the \"negative zero\" issue.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6a14b111-8eb6-43fd-aa8a-e46c28acf993",  "id": "CVE-2023-52607",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/mm: Fix null-pointer dereference in pgtable_cache_add\n\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure. Ensure the allocation was successful\nby checking the pointer validity.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4de1021a-afff-41b2-b119-f8df860e2a1b",  "id": "CVE-2019-19534",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19534"  },  "ratings": [    {      "score": 2.4,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    909  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a1337f0d29.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d1a652ee-2cd2-4561-bd37-f3bccaec619b",  "id": "CVE-2024-41034",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix kernel bug on rename operation of broken directory\n\nSyzbot reported that in rename directory operation on broken directory on\nnilfs2, __block_write_begin_int() called to prepare block write may fail\nBUG_ON check for access exceeding the folio/page size.\n\nThis is because nilfs_dotdot(), which gets parent directory reference\nentry (\"..\") of the directory to be moved or renamed, does not check\nconsistency enough, and may return location exceeding folio/page size for\nbroken directories.\n\nFix this issue by checking required directory entries (\".\" and \"..\") in\nthe first chunk of the directory in nilfs_dotdot().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "37d2c56e-d94a-4086-a8ed-7cbc419d6476",  "id": "CVE-2014-9419",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9419"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3280c713-7127-4f09-8c8e-a96d03fca5cd",  "id": "CVE-2023-53101",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: zero i_disksize when initializing the bootloader inode\n\nIf the boot loader inode has never been used before, the\nEXT4_IOC_SWAP_BOOT inode will initialize it, including setting the\ni_size to 0.  However, if the \"never before used\" boot loader has a\nnon-zero i_size, then i_disksize will be non-zero, and the\ninconsistency between i_size and i_disksize can trigger a kernel\nwarning:\n\n WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319\n CPU: 0 PID: 2580 Comm: bb Not tainted 6.3.0-rc1-00004-g703695902cfa\n RIP: 0010:ext4_file_write_iter+0xbc7/0xd10\n Call Trace:\n  vfs_write+0x3b1/0x5c0\n  ksys_write+0x77/0x160\n  __x64_sys_write+0x22/0x30\n  do_syscall_64+0x39/0x80\n\nReproducer:\n 1. create corrupted image and mount it:\n       mke2fs -t ext4 /tmp/foo.img 200\n       debugfs -wR \"sif <5> size 25700\" /tmp/foo.img\n       mount -t ext4 /tmp/foo.img /mnt\n       cd /mnt\n       echo 123 > file\n 2. Run the reproducer program:\n       posix_memalign(&buf, 1024, 1024)\n       fd = open(\"file\", O_RDWR | O_DIRECT);\n       ioctl(fd, EXT4_IOC_SWAP_BOOT);\n       write(fd, buf, 1024);\n\nFix this by setting i_disksize as well as i_size to zero when\ninitiaizing the boot loader inode.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "35f19f4e-a241-4c50-950b-4d446c0b5436",  "id": "CVE-2024-46821",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Fix negative array index read\n\nAvoid using the negative values\nfor clk_idex as an index into an array pptable->DpmDescriptor.\n\nV2: fix clk_index return check (Tim Huang)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e819c76b-fcaf-4a45-819f-8dbd37134161",  "id": "CVE-2023-1249",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1249"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 (\"coredump: Use the vma snapshot in fill_files_note\") not applied yet, then kernel could be affected.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:171912/CentOS-Stream-9-Missing-Kernel-Security-Fix.html'"    }  ]},{  "bom-ref": "7ac8e4f8-b59f-4a67-9fd3-221fb6ad6236",  "id": "CVE-2014-5471",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5471"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7d245874-1502-402c-8508-e730686301ed",  "id": "CVE-2024-35933",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: Fix null ptr deref in btintel_read_version\n\nIf hci_cmd_sync_complete() is triggered and skb is NULL, then\nhdev->req_skb is NULL, which will cause this issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c052193-fbf4-4293-b8d4-1dbb9e565ab4",  "id": "CLSA-2024-1719925589",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b9ba0598-1fd4-41ae-9c52-bb91ebf7c483",  "id": "CVE-2024-50289",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: av7110: fix a spectre vulnerability\n\nAs warned by smatch:\n\tdrivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap)\n\nThere is a spectre-related vulnerability at the code. Fix it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "374ef1ec-d103-4904-9a00-7e99de044be7",  "id": "AZL-13310",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "689d6900-42e3-41d4-ab33-8c68e5b53e3e",  "id": "SUSE-SU-2018:2207-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3018e8d9-ad00-49d8-9ea0-37f7a524c5ec",  "id": "CVE-2025-38665",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode\n\nAndrei Lalaev reported a NULL pointer deref when a CAN device is\nrestarted from Bus Off and the driver does not implement the struct\ncan_priv::do_set_mode callback.\n\nThere are 2 code path that call struct can_priv::do_set_mode:\n- directly by a manual restart from the user space, via\n  can_changelink()\n- delayed automatic restart after bus off (deactivated by default)\n\nTo prevent the NULL pointer deference, refuse a manual restart or\nconfigure the automatic restart delay in can_changelink() and report\nthe error via extack to user space.\n\nAs an additional safety measure let can_restart() return an error if\ncan_priv::do_set_mode is not set instead of dereferencing it\nunchecked.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "51e9d839-7325-4b39-8be8-1acd6889b7fb",  "id": "CVE-2020-8649",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8649"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5b321272-b332-4664-94b5-07f4cda61d2c",  "id": "CVE-2026-31428",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD\n\n__build_packet_message() manually constructs the NFULA_PAYLOAD netlink\nattribute using skb_put() and skb_copy_bits(), bypassing the standard\nnla_reserve()/nla_put() helpers. While nla_total_size(data_len) bytes\nare allocated (including NLA alignment padding), only data_len bytes\nof actual packet data are copied. The trailing nla_padlen(data_len)\nbytes (1-3 when data_len is not 4-byte aligned) are never initialized,\nleaking stale heap contents to userspace via the NFLOG netlink socket.\n\nReplace the manual attribute construction with nla_reserve(), which\nhandles the tailroom check, header setup, and padding zeroing via\n__nla_reserve(). The subsequent skb_copy_bits() fills in the payload\ndata on top of the properly initialized attribute.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "14cd87a6-3810-4ab5-b46b-086744e7a3c4",  "id": "CVE-2022-49119",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req()\n\nIn pm8001_chip_fw_flash_update_build(), if\npm8001_chip_fw_flash_update_build() fails, the struct fw_control_ex\nallocated must be freed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d3792e8e-9c06-41ba-993f-2622a8163402",  "id": "CVE-2018-13093",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13093"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that cached inodes are free during allocation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "538537d7-438c-48ab-962b-a0b5cf27dfb3",  "id": "CVE-2024-38634",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: max3100: Lock port->lock when calling uart_handle_cts_change()\n\nuart_handle_cts_change() has to be called with port lock taken,\nSince we run it in a separate work, the lock may not be taken at\nthe time of running. Make sure that it's taken by explicitly doing\nthat. Without it we got a splat:\n\n  WARNING: CPU: 0 PID: 10 at drivers/tty/serial/serial_core.c:3491 uart_handle_cts_change+0xa6/0xb0\n  ...\n  Workqueue: max3100-0 max3100_work [max3100]\n  RIP: 0010:uart_handle_cts_change+0xa6/0xb0\n  ...\n   max3100_handlerx+0xc5/0x110 [max3100]\n   max3100_work+0x12a/0x340 [max3100]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5bb3976b-9642-45c1-a0e4-4aa5e4170fd3",  "id": "CVE-2024-36902",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()\n\nsyzbot is able to trigger the following crash [1],\ncaused by unsafe ip6_dst_idev() use.\n\nIndeed ip6_dst_idev() can return NULL, and must always be checked.\n\n[1]\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 0 PID: 31648 Comm: syz-executor.0 Not tainted 6.9.0-rc4-next-20240417-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:__fib6_rule_action net/ipv6/fib6_rules.c:237 [inline]\n RIP: 0010:fib6_rule_action+0x241/0x7b0 net/ipv6/fib6_rules.c:267\nCode: 02 00 00 49 8d 9f d8 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 f9 32 bf f7 48 8b 1b 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 e0 32 bf f7 4c 8b 03 48 89 ef 4c\nRSP: 0018:ffffc9000fc1f2f0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 1a772f98c8186700\nRDX: 0000000000000003 RSI: ffffffff8bcac4e0 RDI: ffffffff8c1f9760\nRBP: ffff8880673fb980 R08: ffffffff8fac15ef R09: 1ffffffff1f582bd\nR10: dffffc0000000000 R11: fffffbfff1f582be R12: dffffc0000000000\nR13: 0000000000000080 R14: ffff888076509000 R15: ffff88807a029a00\nFS:  00007f55e82ca6c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b31d23000 CR3: 0000000022b66000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n  fib_rules_lookup+0x62c/0xdb0 net/core/fib_rules.c:317\n  fib6_rule_lookup+0x1fd/0x790 net/ipv6/fib6_rules.c:108\n  ip6_route_output_flags_noref net/ipv6/route.c:2637 [inline]\n  ip6_route_output_flags+0x38e/0x610 net/ipv6/route.c:2649\n  ip6_route_output include/net/ip6_route.h:93 [inline]\n  ip6_dst_lookup_tail+0x189/0x11a0 net/ipv6/ip6_output.c:1120\n  ip6_dst_lookup_flow+0xb9/0x180 net/ipv6/ip6_output.c:1250\n  sctp_v6_get_dst+0x792/0x1e20 net/sctp/ipv6.c:326\n  sctp_transport_route+0x12c/0x2e0 net/sctp/transport.c:455\n  sctp_assoc_add_peer+0x614/0x15c0 net/sctp/associola.c:662\n  sctp_connect_new_asoc+0x31d/0x6c0 net/sctp/socket.c:1099\n  __sctp_connect+0x66d/0xe30 net/sctp/socket.c:1197\n  sctp_connect net/sctp/socket.c:4819 [inline]\n  sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834\n  __sys_connect_file net/socket.c:2048 [inline]\n  __sys_connect+0x2df/0x310 net/socket.c:2065\n  __do_sys_connect net/socket.c:2075 [inline]\n  __se_sys_connect net/socket.c:2072 [inline]\n  __x64_sys_connect+0x7a/0x90 net/socket.c:2072\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "13e20005-b3d8-42b5-b73b-07e7df53f6df",  "id": "CVE-2026-43011",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/x25: Fix potential double free of skb\n\nWhen alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at\nline 48 and returns 1 (error).\nThis error propagates back through the call chain:\n\nx25_queue_rx_frame returns 1\n    |\n    v\nx25_state3_machine receives the return value 1 and takes the else\nbranch at line 278, setting queued=0 and returning 0\n    |\n    v\nx25_process_rx_frame returns queued=0\n    |\n    v\nx25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb)\nagain\n\nThis would free the same skb twice. Looking at x25_backlog_rcv:\n\nnet/x25/x25_in.c:x25_backlog_rcv() {\n    ...\n    queued = x25_process_rx_frame(sk, skb);\n    ...\n    if (!queued)\n        kfree_skb(skb);\n}",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3272ebd8-257b-4ce7-8834-86efc28f3b9f",  "id": "CVE-2021-47478",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47478"  },  "ratings": [    {      "score": 9.1,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: Fix out of bound access for corrupted isofs image\n\nWhen isofs image is suitably corrupted isofs_read_inode() can read data\nbeyond the end of buffer. Sanity-check the directory entry length before\nusing it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c19b681-45da-4849-99b1-36d45d5cf926",  "id": "CVE-2023-35827",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35827"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b1895042-5ed9-4ce5-b9fc-50d76dbcfe7c",  "id": "CVE-2024-26775",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naoe: avoid potential deadlock at set_capacity\n\nMove set_capacity() outside of the section procected by (&d->lock).\nTo avoid possible interrupt unsafe locking scenario:\n\n        CPU0                    CPU1\n        ----                    ----\n[1] lock(&bdev->bd_size_lock);\n                                local_irq_disable();\n                            [2] lock(&d->lock);\n                            [3] lock(&bdev->bd_size_lock);\n   <Interrupt>\n[4]  lock(&d->lock);\n\n  *** DEADLOCK ***\n\nWhere [1](&bdev->bd_size_lock) hold by zram_add()->set_capacity().\n[2]lock(&d->lock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc()\nis trying to acquire [3](&bdev->bd_size_lock) at set_capacity() call.\nIn this situation an attempt to acquire [4]lock(&d->lock) from\naoecmd_cfg_rsp() will lead to deadlock.\n\nSo the simplest solution is breaking lock dependency\n[2](&d->lock) -> [3](&bdev->bd_size_lock) by moving set_capacity()\noutside.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "06774f2e-440d-4069-8a51-9e6e70565b50",  "id": "CVE-2021-47547",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47547"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound\n\nIn line 5001, if all id in the array 'lp->phy[8]' is not 0, when the\n'for' end, the 'k' is 8.\n\nAt this time, the array 'lp->phy[8]' may be out of bound.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6130a9b1-3f32-4e37-9a0c-b3011ed1ebba",  "id": "CVE-2021-45485",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45485"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    327  ],  "analysis": {    "state": "in_triage"  },  "description": "In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d644b45f-9e7c-4dd7-a7bb-51ea24284abb",  "id": "CVE-2025-37851",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    674  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: omapfb: Add 'plane' value check\n\nFunction dispc_ovl_setup is not intended to work with the value OMAP_DSS_WB\nof the enum parameter plane.\n\nThe value of this parameter is initialized in dss_init_overlays and in the\ncurrent state of the code it cannot take this value so it's not a real\nproblem.\n\nFor the purposes of defensive coding it wouldn't be superfluous to check\nthe parameter value, because some functions down the call stack process\nthis value correctly and some not.\n\nFor example, in dispc_ovl_setup_global_alpha it may lead to buffer\noverflow.\n\nAdd check for this value.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE static\nanalysis tool.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "901492e3-661a-445d-a292-1d67575838ad",  "id": "OESA-2026-2438",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7b877951-95a0-4f72-ab0b-f865332215d9",  "id": "CVE-2024-26763",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-crypt: don't modify the data when using authenticated encryption\n\nIt was said that authenticated encryption could produce invalid tag when\nthe data that is being encrypted is modified [1]. So, fix this problem by\ncopying the data into the clone bio first and then encrypt them inside the\nclone bio.\n\nThis may reduce performance, but it is needed to prevent the user from\ncorrupting the device by writing data with O_DIRECT and modifying them at\nthe same time.\n\n[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b4ef785a-d2d2-45ad-a266-8ab3fbd5abec",  "id": "CLSA-2023-1702495193",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e872511-c7fa-4f12-a921-deb3d3f0ba93",  "id": "CVE-2025-21786",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Put the pwq after detaching the rescuer from the pool\n\nThe commit 68f83057b913(\"workqueue: Reap workers via kthread_stop() and\nremove detach_completion\") adds code to reap the normal workers but\nmistakenly does not handle the rescuer and also removes the code waiting\nfor the rescuer in put_unbound_pool(), which caused a use-after-free bug\nreported by Cheung Wall.\n\nTo avoid the use-after-free bug, the pool’s reference must be held until\nthe detachment is complete. Therefore, move the code that puts the pwq\nafter detaching the rescuer from the pool.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6832e38e-b7d3-4670-ac2b-ef73260ecaa7",  "id": "CVE-2025-38344",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: fix acpi parse and parseext cache leaks\n\nACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5\n\nI'm Seunghun Han, and I work for National Security Research Institute of\nSouth Korea.\n\nI have been doing a research on ACPI and found an ACPI cache leak in ACPI\nearly abort cases.\n\nBoot log of ACPI cache leak is as follows:\n[    0.352414] ACPI: Added _OSI(Module Device)\n[    0.353182] ACPI: Added _OSI(Processor Device)\n[    0.353182] ACPI: Added _OSI(3.0 _SCP Extensions)\n[    0.353182] ACPI: Added _OSI(Processor Aggregator Device)\n[    0.356028] ACPI: Unable to start the ACPI Interpreter\n[    0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n[    0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects\n[    0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #10\n[    0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.361873] Call Trace:\n[    0.362243]  ? dump_stack+0x5c/0x81\n[    0.362591]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.362944]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.363296]  ? acpi_os_delete_cache+0xa/0x10\n[    0.363646]  ? acpi_ut_delete_caches+0x6d/0x7b\n[    0.364000]  ? acpi_terminate+0xa/0x14\n[    0.364000]  ? acpi_init+0x2af/0x34f\n[    0.364000]  ? __class_create+0x4c/0x80\n[    0.364000]  ? video_setup+0x7f/0x7f\n[    0.364000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.364000]  ? do_one_initcall+0x4e/0x1a0\n[    0.364000]  ? kernel_init_freeable+0x189/0x20a\n[    0.364000]  ? rest_init+0xc0/0xc0\n[    0.364000]  ? kernel_init+0xa/0x100\n[    0.364000]  ? ret_from_fork+0x25/0x30\n\nI analyzed this memory leak in detail. I found that “Acpi-State” cache and\n“Acpi-Parse” cache were merged because the size of cache objects was same\nslab cache size.\n\nI finally found “Acpi-Parse” cache and “Acpi-parse_ext” cache were leaked\nusing SLAB_NEVER_MERGE flag in kmem_cache_create() function.\n\nReal ACPI cache leak point is as follows:\n[    0.360101] ACPI: Added _OSI(Module Device)\n[    0.360101] ACPI: Added _OSI(Processor Device)\n[    0.360101] ACPI: Added _OSI(3.0 _SCP Extensions)\n[    0.361043] ACPI: Added _OSI(Processor Aggregator Device)\n[    0.364016] ACPI: Unable to start the ACPI Interpreter\n[    0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n[    0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects\n[    0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #8\n[    0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.372000] Call Trace:\n[    0.372000]  ? dump_stack+0x5c/0x81\n[    0.372000]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.372000]  ? acpi_os_delete_cache+0xa/0x10\n[    0.372000]  ? acpi_ut_delete_caches+0x56/0x7b\n[    0.372000]  ? acpi_terminate+0xa/0x14\n[    0.372000]  ? acpi_init+0x2af/0x34f\n[    0.372000]  ? __class_create+0x4c/0x80\n[    0.372000]  ? video_setup+0x7f/0x7f\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.372000]  ? do_one_initcall+0x4e/0x1a0\n[    0.372000]  ? kernel_init_freeable+0x189/0x20a\n[    0.372000]  ? rest_init+0xc0/0xc0\n[    0.372000]  ? kernel_init+0xa/0x100\n[    0.372000]  ? ret_from_fork+0x25/0x30\n[    0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects\n[    0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #8\n[    0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.392000] Call Trace:\n[    0.392000]  ? dump_stack+0x5c/0x81\n[    0.392000]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.392000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.392000]  ? acpi_os_delete_cache+0xa/0x10\n[    0.392000]  ? acpi_ut_delete_caches+0x6d/0x7b\n[    0.392000]  ? acpi_terminate+0xa/0x14\n[    0.392000]  ? acpi_init+0x2af/0x3\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6c48e135-7d12-4871-ad15-e49fa9781a50",  "id": "CVE-2025-38064",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: break and reset virtio devices on device_shutdown()\n\nHongyu reported a hang on kexec in a VM. QEMU reported invalid memory\naccesses during the hang.\n\n\tInvalid read at addr 0x102877002, size 2, region '(null)', reason: rejected\n\tInvalid write at addr 0x102877A44, size 2, region '(null)', reason: rejected\n\t...\n\nIt was traced down to virtio-console. Kexec works fine if virtio-console\nis not in use.\n\nThe issue is that virtio-console continues to write to the MMIO even after\nunderlying virtio-pci device is reset.\n\nAdditionally, Eric noticed that IOMMUs are reset before devices, if\ndevices are not reset on shutdown they continue to poke at guest memory\nand get errors from the IOMMU. Some devices get wedged then.\n\nThe problem can be solved by breaking all virtio devices on virtio\nbus shutdown, then resetting them.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd041b5f-e6e0-48f1-9b9d-aa9f0d64dac9",  "id": "CVE-2026-46294",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix a buffer overflow in ioctl processing\n\nTony Asleson (using Claude) found a buffer overflow in dm-ioctl in the\nfunction retrieve_status:\n\n1. The code in retrieve_status checks that the output string fits into\n   the output buffer and writes the output string there\n2. Then, the code aligns the \"outptr\" variable to the next 8-byte\n   boundary:\n\toutptr = align_ptr(outptr);\n3. The alignment doesn't check overflow, so outptr could point past the\n   buffer end\n4. The \"for\" loop is iterated again, it executes:\n\tremaining = len - (outptr - outbuf);\n5. If \"outptr\" points past \"outbuf + len\", the arithmetics wraps around\n   and the variable \"remaining\" contains unusually high number\n6. With \"remaining\" being high, the code writes more data past the end of\n   the buffer\n\nLuckily, this bug has no security implications because:\n1. Only root can issue device mapper ioctls\n2. The commonly used libraries that communicate with device mapper\n   (libdevmapper and devicemapper-rs) use buffer size that is aligned to\n   8 bytes - thus, \"outptr = align_ptr(outptr)\" can't overshoot the input\n   buffer and the bug can't happen accidentally",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "40e347f9-ee06-47c5-8ba0-cc9ed5056b34",  "id": "CVE-2022-49134",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum: Guard against invalid local ports\n\nWhen processing events generated by the device's firmware, the driver\nprotects itself from events reported for non-existent local ports, but\nnot for the CPU port (local port 0), which exists, but does not have all\nthe fields as any local port.\n\nThis can result in a NULL pointer dereference when trying access\n'struct mlxsw_sp_port' fields which are not initialized for CPU port.\n\nCommit 63b08b1f6834 (\"mlxsw: spectrum: Protect driver from buggy firmware\")\nalready handled such issue by bailing early when processing a PUDE event\nreported for the CPU port.\n\nGeneralize the approach by moving the check to a common function and\nmaking use of it in all relevant places.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b3758533-48a0-4ed2-ace5-7495031cd3de",  "id": "CVE-2022-48772",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: lgdt3306a: Add a check against null-pointer-def\n\nThe driver should check whether the client provides the platform_data.\n\nThe following log reveals it:\n\n[   29.610324] BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40\n[   29.610730] Read of size 40 at addr 0000000000000000 by task bash/414\n[   29.612820] Call Trace:\n[   29.613030]  <TASK>\n[   29.613201]  dump_stack_lvl+0x56/0x6f\n[   29.613496]  ? kmemdup+0x30/0x40\n[   29.613754]  print_report.cold+0x494/0x6b7\n[   29.614082]  ? kmemdup+0x30/0x40\n[   29.614340]  kasan_report+0x8a/0x190\n[   29.614628]  ? kmemdup+0x30/0x40\n[   29.614888]  kasan_check_range+0x14d/0x1d0\n[   29.615213]  memcpy+0x20/0x60\n[   29.615454]  kmemdup+0x30/0x40\n[   29.615700]  lgdt3306a_probe+0x52/0x310\n[   29.616339]  i2c_device_probe+0x951/0xa90",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1436183b-cd3b-48ab-97e1-ff130d06b253",  "id": "CVE-2025-22026",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    252  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: don't ignore the return code of svc_proc_register()\n\nCurrently, nfsd_proc_stat_init() ignores the return value of\nsvc_proc_register(). If the procfile creation fails, then the kernel\nwill WARN when it tries to remove the entry later.\n\nFix nfsd_proc_stat_init() to return the same type of pointer as\nsvc_proc_register(), and fix up nfsd_net_init() to check that and fail\nthe nfsd_net construction if it occurs.\n\nsvc_proc_register() can fail if the dentry can't be allocated, or if an\nidentical dentry already exists. The second case is pretty unlikely in\nthe nfsd_net construction codepath, so if this happens, return -ENOMEM.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "66f62e40-64f2-4e3b-a54a-9f30eebefbd4",  "id": "CVE-2024-49989",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix double free issue during amdgpu module unload\n\nFlexible endpoints use DIGs from available inflexible endpoints,\nso only the encoders of inflexible links need to be freed.\nOtherwise, a double free issue may occur when unloading the\namdgpu module.\n\n[  279.190523] RIP: 0010:__slab_free+0x152/0x2f0\n[  279.190577] Call Trace:\n[  279.190580]  <TASK>\n[  279.190582]  ? show_regs+0x69/0x80\n[  279.190590]  ? die+0x3b/0x90\n[  279.190595]  ? do_trap+0xc8/0xe0\n[  279.190601]  ? do_error_trap+0x73/0xa0\n[  279.190605]  ? __slab_free+0x152/0x2f0\n[  279.190609]  ? exc_invalid_op+0x56/0x70\n[  279.190616]  ? __slab_free+0x152/0x2f0\n[  279.190642]  ? asm_exc_invalid_op+0x1f/0x30\n[  279.190648]  ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]\n[  279.191096]  ? __slab_free+0x152/0x2f0\n[  279.191102]  ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]\n[  279.191469]  kfree+0x260/0x2b0\n[  279.191474]  dcn10_link_encoder_destroy+0x19/0x30 [amdgpu]\n[  279.191821]  link_destroy+0xd7/0x130 [amdgpu]\n[  279.192248]  dc_destruct+0x90/0x270 [amdgpu]\n[  279.192666]  dc_destroy+0x19/0x40 [amdgpu]\n[  279.193020]  amdgpu_dm_fini+0x16e/0x200 [amdgpu]\n[  279.193432]  dm_hw_fini+0x26/0x40 [amdgpu]\n[  279.193795]  amdgpu_device_fini_hw+0x24c/0x400 [amdgpu]\n[  279.194108]  amdgpu_driver_unload_kms+0x4f/0x70 [amdgpu]\n[  279.194436]  amdgpu_pci_remove+0x40/0x80 [amdgpu]\n[  279.194632]  pci_device_remove+0x3a/0xa0\n[  279.194638]  device_remove+0x40/0x70\n[  279.194642]  device_release_driver_internal+0x1ad/0x210\n[  279.194647]  driver_detach+0x4e/0xa0\n[  279.194650]  bus_remove_driver+0x6f/0xf0\n[  279.194653]  driver_unregister+0x33/0x60\n[  279.194657]  pci_unregister_driver+0x44/0x90\n[  279.194662]  amdgpu_exit+0x19/0x1f0 [amdgpu]\n[  279.194939]  __do_sys_delete_module.isra.0+0x198/0x2f0\n[  279.194946]  __x64_sys_delete_module+0x16/0x20\n[  279.194950]  do_syscall_64+0x58/0x120\n[  279.194954]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[  279.194980]  </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "861d68fd-d69a-4371-b252-cf4d4f1915da",  "id": "CVE-2024-56623",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix use after free on unload\n\nSystem crash is observed with stack trace warning of use after\nfree. There are 2 signals to tell dpc_thread to terminate (UNLOADING\nflag and kthread_stop).\n\nOn setting the UNLOADING flag when dpc_thread happens to run at the time\nand sees the flag, this causes dpc_thread to exit and clean up\nitself. When kthread_stop is called for final cleanup, this causes use\nafter free.\n\nRemove UNLOADING signal to terminate dpc_thread.  Use the kthread_stop\nas the main signal to exit dpc_thread.\n\n[596663.812935] kernel BUG at mm/slub.c:294!\n[596663.812950] invalid opcode: 0000 [#1] SMP PTI\n[596663.812957] CPU: 13 PID: 1475935 Comm: rmmod Kdump: loaded Tainted: G          IOE    --------- -  - 4.18.0-240.el8.x86_64 #1\n[596663.812960] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/20/2012\n[596663.812974] RIP: 0010:__slab_free+0x17d/0x360\n\n...\n[596663.813008] Call Trace:\n[596663.813022]  ? __dentry_kill+0x121/0x170\n[596663.813030]  ? _cond_resched+0x15/0x30\n[596663.813034]  ? _cond_resched+0x15/0x30\n[596663.813039]  ? wait_for_completion+0x35/0x190\n[596663.813048]  ? try_to_wake_up+0x63/0x540\n[596663.813055]  free_task+0x5a/0x60\n[596663.813061]  kthread_stop+0xf3/0x100\n[596663.813103]  qla2x00_remove_one+0x284/0x440 [qla2xxx]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "aa76f56a-1ab9-4dc3-9446-98d861a2d20b",  "id": "CVE-2023-0469",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0469"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    191,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Linux Kernel during call cleanup. This flaw may lead to a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52b5dc9a-bfeb-460e-a704-496660db2ec1",  "id": "CVE-2023-52602",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix slab-out-of-bounds Read in dtSearch\n\nCurrently while searching for current page in the sorted entry table\nof the page there is a out of bound access. Added a bound check to fix\nthe error.\n\nDave:\nSet return code to -EIO",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fed0436e-599c-48f7-98de-58394e582423",  "id": "CVE-2025-37738",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: ignore xattrs past end\n\nOnce inside 'ext4_xattr_inode_dec_ref_all' we should\nignore xattrs entries past the 'end' entry.\n\nThis fixes the following KASAN reported issue:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in ext4_xattr_inode_dec_ref_all+0xb8c/0xe90\nRead of size 4 at addr ffff888012c120c4 by task repro/2065\n\nCPU: 1 UID: 0 PID: 2065 Comm: repro Not tainted 6.13.0-rc2+ #11\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nCall Trace:\n <TASK>\n dump_stack_lvl+0x1fd/0x300\n ? tcp_gro_dev_warn+0x260/0x260\n ? _printk+0xc0/0x100\n ? read_lock_is_recursive+0x10/0x10\n ? irq_work_queue+0x72/0xf0\n ? __virt_addr_valid+0x17b/0x4b0\n print_address_description+0x78/0x390\n print_report+0x107/0x1f0\n ? __virt_addr_valid+0x17b/0x4b0\n ? __virt_addr_valid+0x3ff/0x4b0\n ? __phys_addr+0xb5/0x160\n ? ext4_xattr_inode_dec_ref_all+0xb8c/0xe90\n kasan_report+0xcc/0x100\n ? ext4_xattr_inode_dec_ref_all+0xb8c/0xe90\n ext4_xattr_inode_dec_ref_all+0xb8c/0xe90\n ? ext4_xattr_delete_inode+0xd30/0xd30\n ? __ext4_journal_ensure_credits+0x5f0/0x5f0\n ? __ext4_journal_ensure_credits+0x2b/0x5f0\n ? inode_update_timestamps+0x410/0x410\n ext4_xattr_delete_inode+0xb64/0xd30\n ? ext4_truncate+0xb70/0xdc0\n ? ext4_expand_extra_isize_ea+0x1d20/0x1d20\n ? __ext4_mark_inode_dirty+0x670/0x670\n ? ext4_journal_check_start+0x16f/0x240\n ? ext4_inode_is_fast_symlink+0x2f2/0x3a0\n ext4_evict_inode+0xc8c/0xff0\n ? ext4_inode_is_fast_symlink+0x3a0/0x3a0\n ? do_raw_spin_unlock+0x53/0x8a0\n ? ext4_inode_is_fast_symlink+0x3a0/0x3a0\n evict+0x4ac/0x950\n ? proc_nr_inodes+0x310/0x310\n ? trace_ext4_drop_inode+0xa2/0x220\n ? _raw_spin_unlock+0x1a/0x30\n ? iput+0x4cb/0x7e0\n do_unlinkat+0x495/0x7c0\n ? try_break_deleg+0x120/0x120\n ? 0xffffffff81000000\n ? __check_object_size+0x15a/0x210\n ? strncpy_from_user+0x13e/0x250\n ? getname_flags+0x1dc/0x530\n __x64_sys_unlinkat+0xc8/0xf0\n do_syscall_64+0x65/0x110\n entry_SYSCALL_64_after_hwframe+0x67/0x6f\nRIP: 0033:0x434ffd\nCode: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 8\nRSP: 002b:00007ffc50fa7b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000107\nRAX: ffffffffffffffda RBX: 00007ffc50fa7e18 RCX: 0000000000434ffd\nRDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005\nRBP: 00007ffc50fa7be0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001\nR13: 00007ffc50fa7e08 R14: 00000000004bbf30 R15: 0000000000000001\n </TASK>\n\nThe buggy address belongs to the object at ffff888012c12000\n which belongs to the cache filp of size 360\nThe buggy address is located 196 bytes inside of\n freed 360-byte region [ffff888012c12000, ffff888012c12168)\n\nThe buggy address belongs to the physical page:\npage: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12c12\nhead: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\nflags: 0x40(head|node=0|zone=0)\npage_type: f5(slab)\nraw: 0000000000000040 ffff888000ad7640 ffffea0000497a00 dead000000000004\nraw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000\nhead: 0000000000000040 ffff888000ad7640 ffffea0000497a00 dead000000000004\nhead: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000\nhead: 0000000000000001 ffffea00004b0481 ffffffffffffffff 0000000000000000\nhead: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff888012c11f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff888012c12000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n> ffff888012c12080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                           ^\n ffff888012c12100: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc\n ffff888012c12180: fc fc fc fc fc fc fc fc fc\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "806110af-6424-4da5-b49d-fde2b2fecdb9",  "id": "CVE-2024-49918",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer\n\nThis commit addresses a potential null pointer dereference issue in the\n`dcn32_acquire_idle_pipe_for_head_pipe_in_layer` function. The issue\ncould occur when `head_pipe` is null.\n\nThe fix adds a check to ensure `head_pipe` is not null before asserting\nit. If `head_pipe` is null, the function returns NULL to prevent a\npotential null pointer dereference.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn32/dcn32_resource.c:2690 dcn32_acquire_idle_pipe_for_head_pipe_in_layer() error: we previously assumed 'head_pipe' could be null (see line 2681)",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a60d0a96-cd84-49ed-9ff1-c44c647553d2",  "id": "CVE-2023-52572",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix UAF in cifs_demultiplex_thread()\n\nThere is a UAF when xfstests on cifs:\n\n  BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160\n  Read of size 4 at addr ffff88810103fc08 by task cifsd/923\n\n  CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45\n  ...\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x34/0x44\n   print_report+0x171/0x472\n   kasan_report+0xad/0x130\n   kasan_check_range+0x145/0x1a0\n   smb2_is_network_name_deleted+0x27/0x160\n   cifs_demultiplex_thread.cold+0x172/0x5a4\n   kthread+0x165/0x1a0\n   ret_from_fork+0x1f/0x30\n   </TASK>\n\n  Allocated by task 923:\n   kasan_save_stack+0x1e/0x40\n   kasan_set_track+0x21/0x30\n   __kasan_slab_alloc+0x54/0x60\n   kmem_cache_alloc+0x147/0x320\n   mempool_alloc+0xe1/0x260\n   cifs_small_buf_get+0x24/0x60\n   allocate_buffers+0xa1/0x1c0\n   cifs_demultiplex_thread+0x199/0x10d0\n   kthread+0x165/0x1a0\n   ret_from_fork+0x1f/0x30\n\n  Freed by task 921:\n   kasan_save_stack+0x1e/0x40\n   kasan_set_track+0x21/0x30\n   kasan_save_free_info+0x2a/0x40\n   ____kasan_slab_free+0x143/0x1b0\n   kmem_cache_free+0xe3/0x4d0\n   cifs_small_buf_release+0x29/0x90\n   SMB2_negotiate+0x8b7/0x1c60\n   smb2_negotiate+0x51/0x70\n   cifs_negotiate_protocol+0xf0/0x160\n   cifs_get_smb_ses+0x5fa/0x13c0\n   mount_get_conns+0x7a/0x750\n   cifs_mount+0x103/0xd00\n   cifs_smb3_do_mount+0x1dd/0xcb0\n   smb3_get_tree+0x1d5/0x300\n   vfs_get_tree+0x41/0xf0\n   path_mount+0x9b3/0xdd0\n   __x64_sys_mount+0x190/0x1d0\n   do_syscall_64+0x35/0x80\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThe UAF is because:\n\n mount(pid: 921)               | cifsd(pid: 923)\n-------------------------------|-------------------------------\n                               | cifs_demultiplex_thread\nSMB2_negotiate                 |\n cifs_send_recv                |\n  compound_send_recv           |\n   smb_send_rqst               |\n    wait_for_response          |\n     wait_event_state      [1] |\n                               |  standard_receive3\n                               |   cifs_handle_standard\n                               |    handle_mid\n                               |     mid->resp_buf = buf;  [2]\n                               |     dequeue_mid           [3]\n     KILL the process      [4] |\n    resp_iov[i].iov_base = buf |\n free_rsp_buf              [5] |\n                               |   is_network_name_deleted [6]\n                               |   callback\n\n1. After send request to server, wait the response until\n    mid->mid_state != SUBMITTED;\n2. Receive response from server, and set it to mid;\n3. Set the mid state to RECEIVED;\n4. Kill the process, the mid state already RECEIVED, get 0;\n5. Handle and release the negotiate response;\n6. UAF.\n\nIt can be easily reproduce with add some delay in [3] - [6].\n\nOnly sync call has the problem since async call's callback is\nexecuted in cifsd process.\n\nAdd an extra state to mark the mid state to READY before wakeup the\nwaitter, then it can get the resp safely.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1be02aa9-637b-4d7c-8c89-8a6fa39479c9",  "id": "CVE-2021-3659",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3659"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    252,    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ac354a40-b52d-45be-a2fd-7dc765afc5bd",  "id": "CVE-2024-35875",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/coco: Require seeding RNG with RDRAND on CoCo systems\n\nThere are few uses of CoCo that don't rely on working cryptography and\nhence a working RNG. Unfortunately, the CoCo threat model means that the\nVM host cannot be trusted and may actively work against guests to\nextract secrets or manipulate computation. Since a malicious host can\nmodify or observe nearly all inputs to guests, the only remaining source\nof entropy for CoCo guests is RDRAND.\n\nIf RDRAND is broken -- due to CPU hardware fault -- the RNG as a whole\nis meant to gracefully continue on gathering entropy from other sources,\nbut since there aren't other sources on CoCo, this is catastrophic.\nThis is mostly a concern at boot time when initially seeding the RNG, as\nafter that the consequences of a broken RDRAND are much more\ntheoretical.\n\nSo, try at boot to seed the RNG using 256 bits of RDRAND output. If this\nfails, panic(). This will also trigger if the system is booted without\nRDRAND, as RDRAND is essential for a safe CoCo boot.\n\nAdd this deliberately to be \"just a CoCo x86 driver feature\" and not\npart of the RNG itself. Many device drivers and platforms have some\ndesire to contribute something to the RNG, and add_device_randomness()\nis specifically meant for this purpose.\n\nAny driver can call it with seed data of any quality, or even garbage\nquality, and it can only possibly make the quality of the RNG better or\nhave no effect, but can never make it worse.\n\nRather than trying to build something into the core of the RNG, consider\nthe particular CoCo issue just a CoCo issue, and therefore separate it\nall out into driver (well, arch/platform) code.\n\n  [ bp: Massage commit message. ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d67104da-fb65-424f-9739-cf5439808fa2",  "id": "CVE-2024-27056",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: ensure offloading TID queue exists\n\nThe resume code path assumes that the TX queue for the offloading TID\nhas been configured. At resume time it then tries to sync the write\npointer as it may have been updated by the firmware.\n\nIn the unusual event that no packets have been send on TID 0, the queue\nwill not have been allocated and this causes a crash. Fix this by\nensuring the queue exist at suspend time.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "81bf5252-ba02-4d0a-9307-01e9e8f3469e",  "id": "CVE-2024-49901",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs\n\nThere are some cases, such as the one uncovered by Commit 46d4efcccc68\n(\"drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails\")\nwhere\n\nmsm_gpu_cleanup() : platform_set_drvdata(gpu->pdev, NULL);\n\nis called on gpu->pdev == NULL, as the GPU device has not been fully\ninitialized yet.\n\nTurns out that there's more than just the aforementioned path that\ncauses this to happen (e.g. the case when there's speedbin data in the\ncatalog, but opp-supported-hw is missing in DT).\n\nAssigning msm_gpu->pdev earlier seems like the least painful solution\nto this, therefore do so.\n\nPatchwork: https://patchwork.freedesktop.org/patch/602742/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "01698f43-c012-49d8-91c0-21e67a1522eb",  "id": "CVE-2010-4347",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4347"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    269  ],  "analysis": {    "state": "in_triage"  },  "description": "The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom_method file, which allows local users to gain privileges by placing a custom ACPI method in the ACPI interpreter tables, related to the acpi_debugfs_init function in drivers/acpi/debugfs.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:15774'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:96792/Linux-2.6-Kernel-ACPI-custom_method-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "cbe2cd15-e1d2-494a-b2cd-e8d1301a3871",  "id": "CVE-2024-53093",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: defer partition scanning\n\nWe need to suppress the partition scan from occuring within the\ncontroller's scan_work context. If a path error occurs here, the IO will\nwait until a path becomes available or all paths are torn down, but that\naction also occurs within scan_work, so it would deadlock. Defer the\npartion scan to a different context that does not block scan_work.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "463342ed-21e2-4373-85b9-3e6290538347",  "id": "CVE-2018-5995",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5995"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The pcpu_embed_first_chunk function in mm/percpu.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dmesg data from a \"pages/cpu\" printk call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6ad6fcbc-9ef7-4e2e-8934-e469edde1b69",  "id": "AZL-27815",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9642743c-76c2-432a-be4c-7707dc6c5f8c",  "id": "CLSA-2026-1778157268",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8d8cf69c-c8f8-48cb-b9bc-d7c26008f7e7",  "id": "CVE-2019-18806",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18806"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux kernel before 5.3.5 allows local users to cause a denial of service (memory consumption) by triggering pci_dma_mapping_error() failures, aka CID-1acb8f2a7a9f.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "26625011-60aa-4eb8-8293-5456ea271c3a",  "id": "CVE-2022-49430",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: gpio-keys - cancel delayed work only in case of GPIO\n\ngpio_keys module can either accept gpios or interrupts. The module\ninitializes delayed work in case of gpios only and is only used if\ndebounce timer is not used, so make sure cancel_delayed_work_sync()\nis called only when its gpio-backed and debounce_use_hrtimer is false.\n\nThis fixes the issue seen below when the gpio_keys module is unloaded and\nan interrupt pin is used instead of GPIO:\n\n[  360.297569] ------------[ cut here ]------------\n[  360.302303] WARNING: CPU: 0 PID: 237 at kernel/workqueue.c:3066 __flush_work+0x414/0x470\n[  360.310531] Modules linked in: gpio_keys(-)\n[  360.314797] CPU: 0 PID: 237 Comm: rmmod Not tainted 5.18.0-rc5-arm64-renesas-00116-g73636105874d-dirty #166\n[  360.324662] Hardware name: Renesas SMARC EVK based on r9a07g054l2 (DT)\n[  360.331270] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  360.338318] pc : __flush_work+0x414/0x470\n[  360.342385] lr : __cancel_work_timer+0x140/0x1b0\n[  360.347065] sp : ffff80000a7fba00\n[  360.350423] x29: ffff80000a7fba00 x28: ffff000012b9c5c0 x27: 0000000000000000\n[  360.357664] x26: ffff80000a7fbb80 x25: ffff80000954d0a8 x24: 0000000000000001\n[  360.364904] x23: ffff800009757000 x22: 0000000000000000 x21: ffff80000919b000\n[  360.372143] x20: ffff00000f5974e0 x19: ffff00000f5974e0 x18: ffff8000097fcf48\n[  360.379382] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000053f40\n[  360.386622] x14: ffff800009850e88 x13: 0000000000000002 x12: 000000000000a60c\n[  360.393861] x11: 000000000000a610 x10: 0000000000000000 x9 : 0000000000000008\n[  360.401100] x8 : 0101010101010101 x7 : 00000000a473c394 x6 : 0080808080808080\n[  360.408339] x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff80000919b458\n[  360.415578] x2 : ffff8000097577f0 x1 : 0000000000000001 x0 : 0000000000000000\n[  360.422818] Call trace:\n[  360.425299]  __flush_work+0x414/0x470\n[  360.429012]  __cancel_work_timer+0x140/0x1b0\n[  360.433340]  cancel_delayed_work_sync+0x10/0x18\n[  360.437931]  gpio_keys_quiesce_key+0x28/0x58 [gpio_keys]\n[  360.443327]  devm_action_release+0x10/0x18\n[  360.447481]  release_nodes+0x8c/0x1a0\n[  360.451194]  devres_release_all+0x90/0x100\n[  360.455346]  device_unbind_cleanup+0x14/0x60\n[  360.459677]  device_release_driver_internal+0xe8/0x168\n[  360.464883]  driver_detach+0x4c/0x90\n[  360.468509]  bus_remove_driver+0x54/0xb0\n[  360.472485]  driver_unregister+0x2c/0x58\n[  360.476462]  platform_driver_unregister+0x10/0x18\n[  360.481230]  gpio_keys_exit+0x14/0x828 [gpio_keys]\n[  360.486088]  __arm64_sys_delete_module+0x1e0/0x270\n[  360.490945]  invoke_syscall+0x40/0xf8\n[  360.494661]  el0_svc_common.constprop.3+0xf0/0x110\n[  360.499515]  do_el0_svc+0x20/0x78\n[  360.502877]  el0_svc+0x48/0xf8\n[  360.505977]  el0t_64_sync_handler+0x88/0xb0\n[  360.510216]  el0t_64_sync+0x148/0x14c\n[  360.513930] irq event stamp: 4306\n[  360.517288] hardirqs last  enabled at (4305): [<ffff8000080b0300>] __cancel_work_timer+0x130/0x1b0\n[  360.526359] hardirqs last disabled at (4306): [<ffff800008d194fc>] el1_dbg+0x24/0x88\n[  360.534204] softirqs last  enabled at (4278): [<ffff8000080104a0>] _stext+0x4a0/0x5e0\n[  360.542133] softirqs last disabled at (4267): [<ffff8000080932ac>] irq_exit_rcu+0x18c/0x1b0\n[  360.550591] ---[ end trace 0000000000000000 ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "93291870-fc99-49fc-9365-f96f94a41fc1",  "id": "CVE-2024-26691",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix circular locking dependency\n\nThe rule inside kvm enforces that the vcpu->mutex is taken *inside*\nkvm->lock. The rule is violated by the pkvm_create_hyp_vm() which acquires\nthe kvm->lock while already holding the vcpu->mutex lock from\nkvm_vcpu_ioctl(). Avoid the circular locking dependency altogether by\nprotecting the hyp vm handle with the config_lock, much like we already\ndo for other forms of VM-scoped data.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "07fa00e9-f3f2-40ee-a368-c562b616f90e",  "id": "CVE-2022-2153",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2153"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "480117d8-1bb5-42c4-9d21-4d23ebcf9fff",  "id": "OESA-2023-1481",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a0082cfc-6526-478a-a68e-1a467b0a26e3",  "id": "CVE-2024-35946",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: fix null pointer access when abort scan\n\nDuring cancel scan we might use vif that weren't scanning.\nFix this by using the actual scanning vif.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1af40c34-3e12-49a4-9cd0-69d098b910b3",  "id": "CVE-2021-31829",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31829"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    863  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via side-channel attacks, aka CID-801c6058d14a. The specific concern is not protecting the BPF stack area against speculative loads. Also, the BPF stack can contain uninitialized data that might represent sensitive information previously operated on by the kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e333b00a-d1fe-4221-b9e0-84cf95f52265",  "id": "CVE-2024-42237",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    834  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: cs_dsp: Validate payload length before processing block\n\nMove the payload length check in cs_dsp_load() and cs_dsp_coeff_load()\nto be done before the block is processed.\n\nThe check that the length of a block payload does not exceed the number\nof remaining bytes in the firwmware file buffer was being done near the\nend of the loop iteration. However, some code before that check used the\nlength field without validating it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cdc1a68c-05fb-4102-9724-349c773c1d73",  "id": "CVE-2024-49939",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: avoid to add interface to list twice when SER\n\nIf SER L2 occurs during the WoWLAN resume flow, the add interface flow\nis triggered by ieee80211_reconfig(). However, due to\nrtw89_wow_resume() return failure, it will cause the add interface flow\nto be executed again, resulting in a double add list and causing a kernel\npanic. Therefore, we have added a check to prevent double adding of the\nlist.\n\nlist_add double add: new=ffff99d6992e2010, prev=ffff99d6992e2010, next=ffff99d695302628.\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:37!\ninvalid opcode: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G        W  O       6.6.30-02659-gc18865c4dfbd #1 770df2933251a0e3c888ba69d1053a817a6376a7\nHardware name: HP Grunt/Grunt, BIOS Google_Grunt.11031.169.0 06/24/2021\nWorkqueue: events_freezable ieee80211_restart_work [mac80211]\nRIP: 0010:__list_add_valid_or_report+0x5e/0xb0\nCode: c7 74 18 48 39 ce 74 13 b0 01 59 5a 5e 5f 41 58 41 59 41 5a 5d e9 e2 d6 03 00 cc 48 c7 c7 8d 4f 17 83 48 89 c2 e8 02 c0 00 00 <0f> 0b 48 c7 c7 aa 8c 1c 83 e8 f4 bf 00 00 0f 0b 48 c7 c7 c8 bc 12\nRSP: 0018:ffffa91b8007bc50 EFLAGS: 00010246\nRAX: 0000000000000058 RBX: ffff99d6992e0900 RCX: a014d76c70ef3900\nRDX: ffffa91b8007bae8 RSI: 00000000ffffdfff RDI: 0000000000000001\nRBP: ffffa91b8007bc88 R08: 0000000000000000 R09: ffffa91b8007bae0\nR10: 00000000ffffdfff R11: ffffffff83a79800 R12: ffff99d695302060\nR13: ffff99d695300900 R14: ffff99d6992e1be0 R15: ffff99d6992e2010\nFS:  0000000000000000(0000) GS:ffff99d6aac00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000078fbdba43480 CR3: 000000010e464000 CR4: 00000000001506f0\nCall Trace:\n <TASK>\n ? __die_body+0x1f/0x70\n ? die+0x3d/0x60\n ? do_trap+0xa4/0x110\n ? __list_add_valid_or_report+0x5e/0xb0\n ? do_error_trap+0x6d/0x90\n ? __list_add_valid_or_report+0x5e/0xb0\n ? handle_invalid_op+0x30/0x40\n ? __list_add_valid_or_report+0x5e/0xb0\n ? exc_invalid_op+0x3c/0x50\n ? asm_exc_invalid_op+0x16/0x20\n ? __list_add_valid_or_report+0x5e/0xb0\n rtw89_ops_add_interface+0x309/0x310 [rtw89_core 7c32b1ee6854761c0321027c8a58c5160e41f48f]\n drv_add_interface+0x5c/0x130 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc]\n ieee80211_reconfig+0x241/0x13d0 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc]\n ? finish_wait+0x3e/0x90\n ? synchronize_rcu_expedited+0x174/0x260\n ? sync_rcu_exp_done_unlocked+0x50/0x50\n ? wake_bit_function+0x40/0x40\n ieee80211_restart_work+0xf0/0x140 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc]\n process_scheduled_works+0x1e5/0x480\n worker_thread+0xea/0x1e0\n kthread+0xdb/0x110\n ? move_linked_works+0x90/0x90\n ? kthread_associate_blkcg+0xa0/0xa0\n ret_from_fork+0x3b/0x50\n ? kthread_associate_blkcg+0xa0/0xa0\n ret_from_fork_asm+0x11/0x20\n </TASK>\nModules linked in: dm_integrity async_xor xor async_tx lz4 lz4_compress zstd zstd_compress zram zsmalloc rfcomm cmac uinput algif_hash algif_skcipher af_alg btusb btrtl iio_trig_hrtimer industrialio_sw_trigger btmtk industrialio_configfs btbcm btintel uvcvideo videobuf2_vmalloc iio_trig_sysfs videobuf2_memops videobuf2_v4l2 videobuf2_common uvc snd_hda_codec_hdmi veth snd_hda_intel snd_intel_dspcfg acpi_als snd_hda_codec industrialio_triggered_buffer kfifo_buf snd_hwdep industrialio i2c_piix4 snd_hda_core designware_i2s ip6table_nat snd_soc_max98357a xt_MASQUERADE xt_cgroup snd_soc_acp_rt5682_mach fuse rtw89_8922ae(O) rtw89_8922a(O) rtw89_pci(O) rtw89_core(O) 8021q mac80211(O) bluetooth ecdh_generic ecc cfg80211 r8152 mii joydev\ngsmi: Log Shutdown Reason 0x03\n---[ end trace 0000000000000000 ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2c43b2d-3568-4ff8-ac95-97391ef6e162",  "id": "CVE-2024-35932",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: don't check if plane->state->fb == state->fb\n\nCurrently, when using non-blocking commits, we can see the following\nkernel warning:\n\n[  110.908514] ------------[ cut here ]------------\n[  110.908529] refcount_t: underflow; use-after-free.\n[  110.908620] WARNING: CPU: 0 PID: 1866 at lib/refcount.c:87 refcount_dec_not_one+0xb8/0xc0\n[  110.908664] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device cmac algif_hash aes_arm64 aes_generic algif_skcipher af_alg bnep hid_logitech_hidpp vc4 brcmfmac hci_uart btbcm brcmutil bluetooth snd_soc_hdmi_codec cfg80211 cec drm_display_helper drm_dma_helper drm_kms_helper snd_soc_core snd_compress snd_pcm_dmaengine fb_sys_fops sysimgblt syscopyarea sysfillrect raspberrypi_hwmon ecdh_generic ecc rfkill libaes i2c_bcm2835 binfmt_misc joydev snd_bcm2835(C) bcm2835_codec(C) bcm2835_isp(C) v4l2_mem2mem videobuf2_dma_contig snd_pcm bcm2835_v4l2(C) raspberrypi_gpiomem bcm2835_mmal_vchiq(C) videobuf2_v4l2 snd_timer videobuf2_vmalloc videobuf2_memops videobuf2_common snd videodev vc_sm_cma(C) mc hid_logitech_dj uio_pdrv_genirq uio i2c_dev drm fuse dm_mod drm_panel_orientation_quirks backlight ip_tables x_tables ipv6\n[  110.909086] CPU: 0 PID: 1866 Comm: kodi.bin Tainted: G         C         6.1.66-v8+ #32\n[  110.909104] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT)\n[  110.909114] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  110.909132] pc : refcount_dec_not_one+0xb8/0xc0\n[  110.909152] lr : refcount_dec_not_one+0xb4/0xc0\n[  110.909170] sp : ffffffc00913b9c0\n[  110.909177] x29: ffffffc00913b9c0 x28: 000000556969bbb0 x27: 000000556990df60\n[  110.909205] x26: 0000000000000002 x25: 0000000000000004 x24: ffffff8004448480\n[  110.909230] x23: ffffff800570b500 x22: ffffff802e03a7bc x21: ffffffecfca68c78\n[  110.909257] x20: ffffff8002b42000 x19: ffffff802e03a600 x18: 0000000000000000\n[  110.909283] x17: 0000000000000011 x16: ffffffffffffffff x15: 0000000000000004\n[  110.909308] x14: 0000000000000fff x13: ffffffed577e47e0 x12: 0000000000000003\n[  110.909333] x11: 0000000000000000 x10: 0000000000000027 x9 : c912d0d083728c00\n[  110.909359] x8 : c912d0d083728c00 x7 : 65646e75203a745f x6 : 746e756f63666572\n[  110.909384] x5 : ffffffed579f62ee x4 : ffffffed579eb01e x3 : 0000000000000000\n[  110.909409] x2 : 0000000000000000 x1 : ffffffc00913b750 x0 : 0000000000000001\n[  110.909434] Call trace:\n[  110.909441]  refcount_dec_not_one+0xb8/0xc0\n[  110.909461]  vc4_bo_dec_usecnt+0x4c/0x1b0 [vc4]\n[  110.909903]  vc4_cleanup_fb+0x44/0x50 [vc4]\n[  110.910315]  drm_atomic_helper_cleanup_planes+0x88/0xa4 [drm_kms_helper]\n[  110.910669]  vc4_atomic_commit_tail+0x390/0x9dc [vc4]\n[  110.911079]  commit_tail+0xb0/0x164 [drm_kms_helper]\n[  110.911397]  drm_atomic_helper_commit+0x1d0/0x1f0 [drm_kms_helper]\n[  110.911716]  drm_atomic_commit+0xb0/0xdc [drm]\n[  110.912569]  drm_mode_atomic_ioctl+0x348/0x4b8 [drm]\n[  110.913330]  drm_ioctl_kernel+0xec/0x15c [drm]\n[  110.914091]  drm_ioctl+0x24c/0x3b0 [drm]\n[  110.914850]  __arm64_sys_ioctl+0x9c/0xd4\n[  110.914873]  invoke_syscall+0x4c/0x114\n[  110.914897]  el0_svc_common+0xd0/0x118\n[  110.914917]  do_el0_svc+0x38/0xd0\n[  110.914936]  el0_svc+0x30/0x8c\n[  110.914958]  el0t_64_sync_handler+0x84/0xf0\n[  110.914979]  el0t_64_sync+0x18c/0x190\n[  110.914996] ---[ end trace 0000000000000000 ]---\n\nThis happens because, although `prepare_fb` and `cleanup_fb` are\nperfectly balanced, we cannot guarantee consistency in the check\nplane->state->fb == state->fb. This means that sometimes we can increase\nthe refcount in `prepare_fb` and don't decrease it in `cleanup_fb`. The\nopposite can also be true.\n\nIn fact, the struct drm_plane .state shouldn't be accessed directly\nbut instead, the `drm_atomic_get_new_plane_state()` helper function should\nbe used. So, we could stick to this check, but using\n`drm_atomic_get_new_plane_state()`. But actually, this check is not re\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "080d41f0-d5ab-4608-8e0e-75b6f3188e0d",  "id": "CVE-2020-27171",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27171"  },  "ratings": [    {      "score": 6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    193  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "898bb08f-2345-4629-aeb0-406228d886f4",  "id": "CVE-2019-20054",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20054"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "65da1373-0294-47ed-bd5f-787294fabddb",  "id": "openSUSE-SU-2024:10022-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b672cb2-c6df-4adb-9ee7-99246095a1d0",  "id": "CVE-2024-49891",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths\n\nWhen the HBA is undergoing a reset or is handling an errata event, NULL ptr\ndereference crashes may occur in routines such as\nlpfc_sli_flush_io_rings(), lpfc_dev_loss_tmo_callbk(), or\nlpfc_abort_handler().\n\nAdd NULL ptr checks before dereferencing hdwq pointers that may have been\nfreed due to operations colliding with a reset or errata event handler.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "53aec866-93d7-4491-9c7f-c445b809595b",  "id": "RHSA-2021:1063",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8c9193da-6f36-409f-afd3-9233e34a85a1",  "id": "CVE-2024-26773",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\n\nDetermine if the group block bitmap is corrupted before using ac_b_ex in\next4_mb_try_best_found() to avoid allocating blocks from a group with a\ncorrupted block bitmap in the following concurrency and making the\nsituation worse.\n\next4_mb_regular_allocator\n  ext4_lock_group(sb, group)\n  ext4_mb_good_group\n   // check if the group bbitmap is corrupted\n  ext4_mb_complex_scan_group\n   // Scan group gets ac_b_ex but doesn't use it\n  ext4_unlock_group(sb, group)\n                           ext4_mark_group_bitmap_corrupted(group)\n                           // The block bitmap was corrupted during\n                           // the group unlock gap.\n  ext4_mb_try_best_found\n    ext4_lock_group(ac->ac_sb, group)\n    ext4_mb_use_best_found\n      mb_mark_used\n      // Allocating blocks in block bitmap corrupted group",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd4908fb-b64b-4001-8f4a-b4e446c74eea",  "id": "CVE-2012-3520",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3520"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N"    }  ],  "cwes": [    287  ],  "analysis": {    "state": "in_triage"  },  "description": "The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d97b07c6-f45c-4459-9f4b-32d7dd31bfb2",  "id": "CVE-2019-19526",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19526"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka CID-6af3aa57a098.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "09bffd8a-658c-4d04-a884-e5840e03d15f",  "id": "CVE-2023-1989",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1989"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in btsdio_remove in drivers\\bluetooth\\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2f1e7596-300c-49f5-a39e-f64f0d454da4",  "id": "CVE-2024-40968",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    754  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: Octeon: Add PCIe link status check\n\nThe standard PCIe configuration read-write interface is used to\naccess the configuration space of the peripheral PCIe devices\nof the mips processor after the PCIe link surprise down, it can\ngenerate kernel panic caused by \"Data bus error\". So it is\nnecessary to add PCIe link status check for system protection.\nWhen the PCIe link is down or in training, assigning a value\nof 0 to the configuration address can prevent read-write behavior\nto the configuration space of peripheral PCIe devices, thereby\npreventing kernel panic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a2a5379-d83a-46c6-a546-24c3ac7f8104",  "id": "CVE-2016-6130",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6130"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the sclp_ctl_ioctl_sccb function in drivers/s390/char/sclp_ctl.c in the Linux kernel before 4.6 allows local users to obtain sensitive information from kernel memory by changing a certain length value, aka a \"double fetch\" vulnerability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7c5e8dd0-c1c3-4f71-a10c-ee483bf4b88d",  "id": "CVE-2024-46827",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix firmware crash due to invalid peer nss\n\nCurrently, if the access point receives an association\nrequest containing an Extended HE Capabilities Information\nElement with an invalid MCS-NSS, it triggers a firmware\ncrash.\n\nThis issue arises when EHT-PHY capabilities shows support\nfor a bandwidth and MCS-NSS set for that particular\nbandwidth is filled by zeros and due to this, driver obtains\npeer_nss as 0 and sending this value to firmware causes\ncrash.\n\nAddress this issue by implementing a validation step for\nthe peer_nss value before passing it to the firmware. If\nthe value is greater than zero, proceed with forwarding\nit to the firmware. However, if the value is invalid,\nreject the association request to prevent potential\nfirmware crashes.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c5b6e63d-0a29-4539-a4db-a7f89b83b754",  "id": "CVE-2022-28388",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28388"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "44b2888e-51c7-494c-9ba1-ee2c4f9c363c",  "id": "GHSA-q445-7m23-qrmw",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "76436c7f-05a8-4e15-953a-b797bc35f27d",  "id": "AZL-39794",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "276d7f99-8565-4e9d-9a2d-badac2d32d0b",  "id": "CVE-2026-43223",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix URB leak in pvr2_send_request_ex\n\nWhen pvr2_send_request_ex() submits a write URB successfully but fails to\nsubmit the read URB (e.g. returns -ENOMEM), it returns immediately without\nwaiting for the write URB to complete. Since the driver reuses the same\nURB structure, a subsequent call to pvr2_send_request_ex() attempts to\nsubmit the still-active write URB, triggering a 'URB submitted while\nactive' warning in usb_submit_urb().\n\nFix this by ensuring the write URB is unlinked and waited upon if the read\nURB submission fails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "61e2d538-16c5-4299-81cc-0f679d9a5421",  "id": "AZL-6350",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.2,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "38487b55-ea36-4d14-a448-ed05732f56a7",  "id": "CVE-2019-11884",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11884"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\\0' character.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bd156171-c975-4389-bb79-183212285500",  "id": "OESA-2024-1720",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a58e0daf-7aad-410f-827e-2271415f6ea2",  "id": "CVE-2017-16533",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16533"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The usbhid_parse function in drivers/hid/usbhid/hid-core.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b62bdfea-0b75-40fb-9ae2-5152a4caf51d",  "id": "SUSE-SU-2015:0979-2",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "542a2528-9c46-489c-ba55-2cc0a7d5bda2",  "id": "SUSE-SU-2025:0130-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0714cd73-e086-47bb-a65e-13182bb3830a",  "id": "CVE-2024-35843",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Use device rbtree in iopf reporting path\n\nThe existing I/O page fault handler currently locates the PCI device by\ncalling pci_get_domain_bus_and_slot(). This function searches the list\nof all PCI devices until the desired device is found. To improve lookup\nefficiency, replace it with device_rbtree_find() to search the device\nwithin the probed device rbtree.\n\nThe I/O page fault is initiated by the device, which does not have any\nsynchronization mechanism with the software to ensure that the device\nstays in the probed device tree. Theoretically, a device could be released\nby the IOMMU subsystem after device_rbtree_find() and before\niopf_get_dev_fault_param(), which would cause a use-after-free problem.\n\nAdd a mutex to synchronize the I/O page fault reporting path and the IOMMU\nrelease device path. This lock doesn't introduce any performance overhead,\nas the conflict between I/O page fault reporting and device releasing is\nvery rare.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0989db80-8dd0-4091-b8e8-cf55199b829c",  "id": "SUSE-SU-2022:4371-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f65d2f77-8c2f-4977-98e2-638926e45671",  "id": "CVE-2022-48911",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: fix possible use-after-free\n\nEric Dumazet says:\n  The sock_hold() side seems suspect, because there is no guarantee\n  that sk_refcnt is not already 0.\n\nOn failure, we cannot queue the packet and need to indicate an\nerror.  The packet will be dropped by the caller.\n\nv2: split skb prefetch hunk into separate change",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cf2b0940-3dba-4775-8b45-a1ab492de48d",  "id": "CVE-2024-49938",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    824  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit\n\nSyzbot points out that skb_trim() has a sanity check on the existing length of\nthe skb, which can be uninitialised in some error paths. The intent here is\nclearly just to reset the length to zero before resubmitting, so switch to\ncalling __skb_set_length(skb, 0) directly. In addition, __skb_set_length()\nalready contains a call to skb_reset_tail_pointer(), so remove the redundant\ncall.\n\nThe syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar\nusage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "df020914-8970-4ae9-a3cc-afd89a400d78",  "id": "ALSA-2026:26275",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "83e6610c-49aa-4ca5-b520-6afdedfbd09a",  "id": "CVE-2023-53383",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4\n\nThe T241 platform suffers from the T241-FABRIC-4 erratum which causes\nunexpected behavior in the GIC when multiple transactions are received\nsimultaneously from different sources. This hardware issue impacts\nNVIDIA server platforms that use more than two T241 chips\ninterconnected. Each chip has support for 320 {E}SPIs.\n\nThis issue occurs when multiple packets from different GICs are\nincorrectly interleaved at the target chip. The erratum text below\nspecifies exactly what can cause multiple transfer packets susceptible\nto interleaving and GIC state corruption. GIC state corruption can\nlead to a range of problems, including kernel panics, and unexpected\nbehavior.\n\n>From the erratum text:\n  \"In some cases, inter-socket AXI4 Stream packets with multiple\n  transfers, may be interleaved by the fabric when presented to ARM\n  Generic Interrupt Controller. GIC expects all transfers of a packet\n  to be delivered without any interleaving.\n\n  The following GICv3 commands may result in multiple transfer packets\n  over inter-socket AXI4 Stream interface:\n   - Register reads from GICD_I* and GICD_N*\n   - Register writes to 64-bit GICD registers other than GICD_IROUTERn*\n   - ITS command MOVALL\n\n  Multiple commands in GICv4+ utilize multiple transfer packets,\n  including VMOVP, VMOVI, VMAPP, and 64-bit register accesses.\"\n\n  This issue impacts system configurations with more than 2 sockets,\n  that require multi-transfer packets to be sent over inter-socket\n  AXI4 Stream interface between GIC instances on different sockets.\n  GICv4 cannot be supported. GICv3 SW model can only be supported\n  with the workaround. Single and Dual socket configurations are not\n  impacted by this issue and support GICv3 and GICv4.\"\n\n\nWriting to the chip alias region of the GICD_In{E} registers except\nGICD_ICENABLERn has an equivalent effect as writing to the global\ndistributor. The SPI interrupt deactivate path is not impacted by\nthe erratum.\n\nTo fix this problem, implement a workaround that ensures read accesses\nto the GICD_In{E} registers are directed to the chip that owns the\nSPI, and disable GICv4.x features. To simplify code changes, the\ngic_configure_irq() function uses the same alias region for both read\nand write operations to GICD_ICFGR.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9121590b-49a3-409b-9124-47490ec83c58",  "id": "CVE-2024-40902",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120,    121  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: xattr: fix buffer overflow for invalid xattr\n\nWhen an xattr size is not what is expected, it is printed out to the\nkernel log in hex format as a form of debugging.  But when that xattr\nsize is bigger than the expected size, printing it out can cause an\naccess off the end of the buffer.\n\nFix this all up by properly restricting the size of the debug hex dump\nin the kernel log.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "29fd3f00-360f-4ef4-a867-64f13c15da4f",  "id": "openSUSE-SU-2021:1426-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "92bf6b38-a7d7-41d0-ae46-9b73ea3e88f3",  "id": "CVE-2011-3619",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3619"  },  "ratings": [    {      "score": 4.6,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 3.0 does not properly handle invalid parameters, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by writing to a /proc/#####/attr/current file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "79079d7d-044d-4cb2-943b-25c6432e91b3",  "id": "MGASA-2025-0025",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "488e2155-92e4-4a5a-bff1-299e6b8a1ca0",  "id": "SUSE-SU-2021:2825-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "821028f7-412b-4a96-9290-cbc4ee73fa2a",  "id": "CVE-2026-53369",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: reject descriptors with oversized CRC length\n\nudf_read_tagged() skips CRC verification when descCRCLength +\nsizeof(struct tag) exceeds the block size.  A crafted UDF image can\nset descCRCLength to an oversized value to bypass CRC validation\nentirely; the descriptor is then accepted based solely on the 8-bit\ntag checksum, which is trivially recomputable.\n\nReject such descriptors instead of silently accepting them.  A\nlegitimate single-block descriptor should never have a CRC length that\nexceeds the block.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3fa4ea0d-4362-44b2-843b-741ff81d39ac",  "id": "CVE-2021-47600",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47600"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm btree remove: fix use after free in rebalance_children()\n\nMove dm_tm_unlock() after dm_tm_dec().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fba01706-6386-445c-883e-b2d3fab33641",  "id": "CVE-2014-3508",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3508"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2656241-2244-467c-bbe6-bf9aabcbad7e",  "id": "CVE-2018-10087",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10087"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "58acafd2-efa6-4241-8464-fd9b1f71fd7e",  "id": "SUSE-SU-2016:3269-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a15ebedc-3712-4049-b9bc-c4978c275fa7",  "id": "CVE-2026-64273",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: iforce - bound the device-reported force-feedback effect index\n\niforce_process_packet() handles a status report (packet id 0x02) by\ntaking a force-feedback effect index straight from the device wire and\nusing it to address the per-effect state array:\n\n\ti = data[1] & 0x7f;\n\tif (data[1] & 0x80) {\n\t\tif (!test_and_set_bit(FF_CORE_IS_PLAYED,\n\t\t\t\t      iforce->core_effects[i].flags))\n\t\t\t...\n\t} else if (test_and_clear_bit(FF_CORE_IS_PLAYED,\n\t\t\t\t      iforce->core_effects[i].flags)) {\n\t\t...\n\t}\n\nThe index is masked only with 0x7f, so it ranges 0..127, but\ncore_effects[] holds only IFORCE_EFFECTS_MAX (32) entries.  For an index\nof 32..127 the test_and_set_bit()/test_and_clear_bit() is an\nout-of-bounds single-bit read-modify-write past the array.  core_effects[]\nis the second-to-last member of struct iforce, so the write lands in the\ntrailing members and beyond the embedding kzalloc()'d iforce_serio /\niforce_usb object.\n\ndata[1] is unvalidated device payload on both transports (the USB\ninterrupt endpoint and serio), and the status path is not gated on force\nfeedback being present, so a malicious or counterfeit device can set or\nclear a bit at an attacker-chosen offset past the object.\n\nReject an out-of-range index instead of indexing with it.  Bound against\nthe array dimension IFORCE_EFFECTS_MAX rather than dev->ff->max_effects so\nthe check guarantees memory safety regardless of how many effects the\ndevice registered.  A legitimate \"effect started/stopped\" status always\ncarries an index below IFORCE_EFFECTS_MAX, so well-formed devices are\nunaffected; the neighbouring mark_core_as_ready() loop is already bounded\nand is left untouched.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0019ea5d-7fcf-45e0-a9bf-99a9d42ce9b1",  "id": "CVE-2024-42288",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix for possible memory corruption\n\nInit Control Block is dereferenced incorrectly.  Correctly dereference ICB",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "881cf707-e24a-491b-993c-62663c69083b",  "id": "CVE-2018-7492",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7492"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service, related to RDS_GET_MR and RDS_GET_MR_FOR_DEST.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1127edd7-db98-4258-b03a-6cc93724f4d4",  "id": "CVE-2021-47280",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47280"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    367,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Fix use-after-free read in drm_getunique()\n\nThere is a time-of-check-to-time-of-use error in drm_getunique() due\nto retrieving file_priv->master prior to locking the device's master\nmutex.\n\nAn example can be seen in the crash report of the use-after-free error\nfound by Syzbot:\nhttps://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803\n\nIn the report, the master pointer was used after being freed. This is\nbecause another process had acquired the device's master mutex in\ndrm_setmaster_ioctl(), then overwrote fpriv->master in\ndrm_new_set_master(). The old value of fpriv->master was subsequently\nfreed before the mutex was unlocked.\n\nTo fix this, we lock the device's master mutex before retrieving the\npointer from from fpriv->master. This patch passes the Syzbot\nreproducer test.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8947a599-767f-4172-b3eb-f0e231d7d91e",  "id": "CVE-2024-46751",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()\n\nInstead of doing a BUG_ON() handle the error by returning -EUCLEAN,\naborting the transaction and logging an error message.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f3f4ae54-9489-4518-aa16-7c228d13bb1a",  "id": "CVE-2023-53277",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwl3945: Add missing check for create_singlethread_workqueue\n\nAdd the check for the return value of the create_singlethread_workqueue\nin order to avoid NULL pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "849768e3-cee3-4e0b-a050-14e1e2134cdf",  "id": "CVE-2022-49567",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempolicy: fix uninit-value in mpol_rebind_policy()\n\nmpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when\npol->mode is MPOL_LOCAL.  Check pol->mode before access\npol->w.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c).\n\nBUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline]\nBUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368\n mpol_rebind_policy mm/mempolicy.c:352 [inline]\n mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368\n cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline]\n cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278\n cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515\n cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline]\n cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804\n __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520\n cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539\n cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852\n kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296\n call_write_iter include/linux/fs.h:2162 [inline]\n new_sync_write fs/read_write.c:503 [inline]\n vfs_write+0x1318/0x2030 fs/read_write.c:590\n ksys_write+0x28b/0x510 fs/read_write.c:643\n __do_sys_write fs/read_write.c:655 [inline]\n __se_sys_write fs/read_write.c:652 [inline]\n __x64_sys_write+0xdb/0x120 fs/read_write.c:652\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nUninit was created at:\n slab_post_alloc_hook mm/slab.h:524 [inline]\n slab_alloc_node mm/slub.c:3251 [inline]\n slab_alloc mm/slub.c:3259 [inline]\n kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264\n mpol_new mm/mempolicy.c:293 [inline]\n do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853\n kernel_set_mempolicy mm/mempolicy.c:1504 [inline]\n __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline]\n __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507\n __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nKMSAN: uninit-value in mpol_rebind_task (2)\nhttps://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc\n\nThis patch seems to fix below bug too.\nKMSAN: uninit-value in mpol_rebind_mm (2)\nhttps://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b\n\nThe uninit-value is pol->w.cpuset_mems_allowed in mpol_rebind_policy().\nWhen syzkaller reproducer runs to the beginning of mpol_new(),\n\n\t    mpol_new() mm/mempolicy.c\n\t  do_mbind() mm/mempolicy.c\n\tkernel_mbind() mm/mempolicy.c\n\n`mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags`\nis 0. Then\n\n\tmode = MPOL_LOCAL;\n\t...\n\tpolicy->mode = mode;\n\tpolicy->flags = flags;\n\nwill be executed. So in mpol_set_nodemask(),\n\n\t    mpol_set_nodemask() mm/mempolicy.c\n\t  do_mbind()\n\tkernel_mbind()\n\npol->mode is 4 (MPOL_LOCAL), that `nodemask` in `pol` is not initialized,\nwhich will be accessed in mpol_rebind_policy().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6f9d20ab-c596-4e77-be6c-720316bd0dd0",  "id": "CLSA-2025-1745269163",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a4e71bbc-a683-475b-ada0-b87b3ed11791",  "id": "CLSA-2025-1744926159",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0d0ba40b-8f5c-4289-8a70-6c7f18bcf2a7",  "id": "MGASA-2020-0023",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf6ae847-a47c-4774-a8de-66a923b42b1e",  "id": "CVE-2019-19081",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19081"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "66e7c438-1499-4138-8438-fbe0e8863161",  "id": "CVE-2023-53407",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "db7cb69c-9280-4db3-a66c-d9194e6d625b",  "id": "CVE-2020-25211",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25211"  },  "ratings": [    {      "score": 6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c310b63-ef31-4aff-bc5f-5c64e183bde1",  "id": "CVE-2016-2383",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2383"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The adjust_branches function in kernel/bpf/verifier.c in the Linux kernel before 4.5 does not consider the delta in the backward-jump case, which allows local users to obtain sensitive information from kernel memory by creating a packet filter and then loading crafted BPF instructions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dce6ed1d-1864-4565-985b-64d2be36b344",  "id": "CVE-2022-49006",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Free buffers when a used dynamic event is removed\n\nAfter 65536 dynamic events have been added and removed, the \"type\" field\nof the event then uses the first type number that is available (not\ncurrently used by other events). A type number is the identifier of the\nbinary blobs in the tracing ring buffer (known as events) to map them to\nlogic that can parse the binary blob.\n\nThe issue is that if a dynamic event (like a kprobe event) is traced and\nis in the ring buffer, and then that event is removed (because it is\ndynamic, which means it can be created and destroyed), if another dynamic\nevent is created that has the same number that new event's logic on\nparsing the binary blob will be used.\n\nTo show how this can be an issue, the following can crash the kernel:\n\n # cd /sys/kernel/tracing\n # for i in `seq 65536`; do\n     echo 'p:kprobes/foo do_sys_openat2 $arg1:u32' > kprobe_events\n # done\n\nFor every iteration of the above, the writing to the kprobe_events will\nremove the old event and create a new one (with the same format) and\nincrease the type number to the next available on until the type number\nreaches over 65535 which is the max number for the 16 bit type. After it\nreaches that number, the logic to allocate a new number simply looks for\nthe next available number. When an dynamic event is removed, that number\nis then available to be reused by the next dynamic event created. That is,\nonce the above reaches the max number, the number assigned to the event in\nthat loop will remain the same.\n\nNow that means deleting one dynamic event and created another will reuse\nthe previous events type number. This is where bad things can happen.\nAfter the above loop finishes, the kprobes/foo event which reads the\ndo_sys_openat2 function call's first parameter as an integer.\n\n # echo 1 > kprobes/foo/enable\n # cat /etc/passwd > /dev/null\n # cat trace\n             cat-2211    [005] ....  2007.849603: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n             cat-2211    [005] ....  2007.849620: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n             cat-2211    [005] ....  2007.849838: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n             cat-2211    [005] ....  2007.849880: foo: (do_sys_openat2+0x0/0x130) arg1=4294967196\n # echo 0 > kprobes/foo/enable\n\nNow if we delete the kprobe and create a new one that reads a string:\n\n # echo 'p:kprobes/foo do_sys_openat2 +0($arg2):string' > kprobe_events\n\nAnd now we can the trace:\n\n # cat trace\n        sendmail-1942    [002] .....   530.136320: foo: (do_sys_openat2+0x0/0x240) arg1=             cat-2046    [004] .....   530.930817: foo: (do_sys_openat2+0x0/0x240) arg1=\"������������������������������������������������������������������������������������������������\"\n             cat-2046    [004] .....   530.930961: foo: (do_sys_openat2+0x0/0x240) arg1=\"������������������������������������������������������������������������������������������������\"\n             cat-2046    [004] .....   530.934278: foo: (do_sys_openat2+0x0/0x240) arg1=\"������������������������������������������������������������������������������������������������\"\n             cat-2046    [004] .....   530.934563: foo: (do_sys_openat2+0x0/0x240) arg1=\"���������������������������������������\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f8e0808e-803f-45b9-b052-dee4fcb5de1f",  "id": "CVE-2022-49123",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nath11k: Fix frames flush failure caused by deadlock\n\nWe are seeing below warnings:\n\nkernel: [25393.301506] ath11k_pci 0000:01:00.0: failed to flush mgmt transmit queue 0\nkernel: [25398.421509] ath11k_pci 0000:01:00.0: failed to flush mgmt transmit queue 0\nkernel: [25398.421831] ath11k_pci 0000:01:00.0: dropping mgmt frame for vdev 0, is_started 0\n\nthis means ath11k fails to flush mgmt. frames because wmi_mgmt_tx_work\nhas no chance to run in 5 seconds.\n\nBy setting /proc/sys/kernel/hung_task_timeout_secs to 20 and increasing\nATH11K_FLUSH_TIMEOUT to 50 we get below warnings:\n\nkernel: [  120.763160] INFO: task wpa_supplicant:924 blocked for more than 20 seconds.\nkernel: [  120.763169]       Not tainted 5.10.90 #12\nkernel: [  120.763177] \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\nkernel: [  120.763186] task:wpa_supplicant  state:D stack:    0 pid:  924 ppid:     1 flags:0x000043a0\nkernel: [  120.763201] Call Trace:\nkernel: [  120.763214]  __schedule+0x785/0x12fa\nkernel: [  120.763224]  ? lockdep_hardirqs_on_prepare+0xe2/0x1bb\nkernel: [  120.763242]  schedule+0x7e/0xa1\nkernel: [  120.763253]  schedule_timeout+0x98/0xfe\nkernel: [  120.763266]  ? run_local_timers+0x4a/0x4a\nkernel: [  120.763291]  ath11k_mac_flush_tx_complete+0x197/0x2b1 [ath11k 13c3a9bf37790f4ac8103b3decf7ab4008ac314a]\nkernel: [  120.763306]  ? init_wait_entry+0x2e/0x2e\nkernel: [  120.763343]  __ieee80211_flush_queues+0x167/0x21f [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763378]  __ieee80211_recalc_idle+0x105/0x125 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763411]  ieee80211_recalc_idle+0x14/0x27 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763441]  ieee80211_free_chanctx+0x77/0xa2 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763473]  __ieee80211_vif_release_channel+0x100/0x131 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763540]  ieee80211_vif_release_channel+0x66/0x81 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763572]  ieee80211_destroy_auth_data+0xa3/0xe6 [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763612]  ieee80211_mgd_deauth+0x178/0x29b [mac80211 335da900954f1c5ea7f1613d92088ce83342042c]\nkernel: [  120.763654]  cfg80211_mlme_deauth+0x1a8/0x22c [cfg80211 8945aa5bc2af5f6972336665d8ad6f9c191ad5be]\nkernel: [  120.763697]  nl80211_deauthenticate+0xfa/0x123 [cfg80211 8945aa5bc2af5f6972336665d8ad6f9c191ad5be]\nkernel: [  120.763715]  genl_rcv_msg+0x392/0x3c2\nkernel: [  120.763750]  ? nl80211_associate+0x432/0x432 [cfg80211 8945aa5bc2af5f6972336665d8ad6f9c191ad5be]\nkernel: [  120.763782]  ? nl80211_associate+0x432/0x432 [cfg80211 8945aa5bc2af5f6972336665d8ad6f9c191ad5be]\nkernel: [  120.763802]  ? genl_rcv+0x36/0x36\nkernel: [  120.763814]  netlink_rcv_skb+0x89/0xf7\nkernel: [  120.763829]  genl_rcv+0x28/0x36\nkernel: [  120.763840]  netlink_unicast+0x179/0x24b\nkernel: [  120.763854]  netlink_sendmsg+0x393/0x401\nkernel: [  120.763872]  sock_sendmsg+0x72/0x76\nkernel: [  120.763886]  ____sys_sendmsg+0x170/0x1e6\nkernel: [  120.763897]  ? copy_msghdr_from_user+0x7a/0xa2\nkernel: [  120.763914]  ___sys_sendmsg+0x95/0xd1\nkernel: [  120.763940]  __sys_sendmsg+0x85/0xbf\nkernel: [  120.763956]  do_syscall_64+0x43/0x55\nkernel: [  120.763966]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\nkernel: [  120.763977] RIP: 0033:0x79089f3fcc83\nkernel: [  120.763986] RSP: 002b:00007ffe604f0508 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nkernel: [  120.763997] RAX: ffffffffffffffda RBX: 000059b40e987690 RCX: 000079089f3fcc83\nkernel: [  120.764006] RDX: 0000000000000000 RSI: 00007ffe604f0558 RDI: 0000000000000009\nkernel: [  120.764014] RBP: 00007ffe604f0540 R08: 0000000000000004 R09: 0000000000400000\nkernel: [  120.764023] R10: 00007ffe604f0638 R11: 0000000000000246 R12: 000059b40ea04980\nkernel: [  120.764032] R13: 00007ffe604\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "03c46b7e-e4c5-4301-9c69-2fc1f1a3eb66",  "id": "CVE-2006-2940",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-2940"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) \"public exponent\" or (2) \"public modulus\" values in X.509 certificates that require extra time to process when using RSA signature verification.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c9374aa1-c1eb-494e-a7cb-86813785119e",  "id": "CVE-2023-2007",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2007"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    367,    667  ],  "analysis": {    "state": "in_triage"  },  "description": "The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "35d52264-56c7-4696-873a-bb8ca355a813",  "id": "CVE-2022-48695",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpt3sas: Fix use-after-free warning\n\nFix the following use-after-free warning which is observed during\ncontroller reset:\n\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7ec9c1c2-f352-4fc4-8ece-a96feac4ad50",  "id": "CVE-2024-24858",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24858"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0ad2d8a3-f9b3-4d27-b5ca-ed0fa4257b94",  "id": "CVE-2019-7308",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7308"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:151475/Linux-Insufficient-eBPF-Spectre-V1-Mitigation.html'"    }  ]},{  "bom-ref": "77d7c793-ef65-4e49-85d5-9f2af921d603",  "id": "CVE-2025-38230",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: validate AG parameters in dbMount() to prevent crashes\n\nValidate db_agheight, db_agwidth, and db_agstart in dbMount to catch\ncorrupted metadata early and avoid undefined behavior in dbAllocAG.\nLimits are derived from L2LPERCTL, LPERCTL/MAXAG, and CTLTREESIZE:\n\n- agheight: 0 to L2LPERCTL/2 (0 to 5) ensures shift\n  (L2LPERCTL - 2*agheight) >= 0.\n- agwidth: 1 to min(LPERCTL/MAXAG, 2^(L2LPERCTL - 2*agheight))\n  ensures agperlev >= 1.\n  - Ranges: 1-8 (agheight 0-3), 1-4 (agheight 4), 1 (agheight 5).\n  - LPERCTL/MAXAG = 1024/128 = 8 limits leaves per AG;\n    2^(10 - 2*agheight) prevents division to 0.\n- agstart: 0 to CTLTREESIZE-1 - agwidth*(MAXAG-1) keeps ti within\n  stree (size 1365).\n  - Ranges: 0-1237 (agwidth 1), 0-348 (agwidth 8).\n\nUBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:1400:9\nshift exponent -335544310 is negative\nCPU: 0 UID: 0 PID: 5822 Comm: syz-executor130 Not tainted 6.14.0-rc5-syzkaller #0\nHardware name: Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n ubsan_epilogue lib/ubsan.c:231 [inline]\n __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468\n dbAllocAG+0x1087/0x10b0 fs/jfs/jfs_dmap.c:1400\n dbDiscardAG+0x352/0xa20 fs/jfs/jfs_dmap.c:1613\n jfs_ioc_trim+0x45a/0x6b0 fs/jfs/jfs_discard.c:105\n jfs_ioctl+0x2cd/0x3e0 fs/jfs/ioctl.c:131\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "58be558e-d131-4437-8b44-b6687469ee2a",  "id": "CVE-2018-5333",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5333"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:47957'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'MSF:rds_atomic_free_op_null_pointer_deref_priv_esc'"    }  ]},{  "bom-ref": "be885e58-dd45-48aa-90b5-8b92d387c0ee",  "id": "CVE-2019-19543",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19543"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5b9930b0-5643-4b38-94a1-a120ef8e6e56",  "id": "CVE-2026-23253",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-core: fix wrong reinitialization of ringbuffer on reopen\n\ndvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the\nDVR device.  dvb_ringbuffer_init() calls init_waitqueue_head(), which\nreinitializes the waitqueue list head to empty.\n\nSince dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the\nsame DVR device share it), this orphans any existing waitqueue entries\nfrom io_uring poll or epoll, leaving them with stale prev/next pointers\nwhile the list head is reset to {self, self}.\n\nThe waitqueue and spinlock in dvr_buffer are already properly\ninitialized once in dvb_dmxdev_init().  The open path only needs to\nreset the buffer data pointer, size, and read/write positions.\n\nReplace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct\nassignment of data/size and a call to dvb_ringbuffer_reset(), which\nproperly resets pread, pwrite, and error with correct memory ordering\nwithout touching the waitqueue or spinlock.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9d24b4d6-db4f-4b22-be45-1029a332f7c7",  "id": "CVE-2023-53148",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Fix igb_down hung on surprise removal\n\nIn a setup where a Thunderbolt hub connects to Ethernet and a display\nthrough USB Type-C, users may experience a hung task timeout when they\nremove the cable between the PC and the Thunderbolt hub.\nThis is because the igb_down function is called multiple times when\nthe Thunderbolt hub is unplugged. For example, the igb_io_error_detected\ntriggers the first call, and the igb_remove triggers the second call.\nThe second call to igb_down will block at napi_synchronize.\nHere's the call trace:\n    __schedule+0x3b0/0xddb\n    ? __mod_timer+0x164/0x5d3\n    schedule+0x44/0xa8\n    schedule_timeout+0xb2/0x2a4\n    ? run_local_timers+0x4e/0x4e\n    msleep+0x31/0x38\n    igb_down+0x12c/0x22a [igb 6615058754948bfde0bf01429257eb59f13030d4]\n    __igb_close+0x6f/0x9c [igb 6615058754948bfde0bf01429257eb59f13030d4]\n    igb_close+0x23/0x2b [igb 6615058754948bfde0bf01429257eb59f13030d4]\n    __dev_close_many+0x95/0xec\n    dev_close_many+0x6e/0x103\n    unregister_netdevice_many+0x105/0x5b1\n    unregister_netdevice_queue+0xc2/0x10d\n    unregister_netdev+0x1c/0x23\n    igb_remove+0xa7/0x11c [igb 6615058754948bfde0bf01429257eb59f13030d4]\n    pci_device_remove+0x3f/0x9c\n    device_release_driver_internal+0xfe/0x1b4\n    pci_stop_bus_device+0x5b/0x7f\n    pci_stop_bus_device+0x30/0x7f\n    pci_stop_bus_device+0x30/0x7f\n    pci_stop_and_remove_bus_device+0x12/0x19\n    pciehp_unconfigure_device+0x76/0xe9\n    pciehp_disable_slot+0x6e/0x131\n    pciehp_handle_presence_or_link_change+0x7a/0x3f7\n    pciehp_ist+0xbe/0x194\n    irq_thread_fn+0x22/0x4d\n    ? irq_thread+0x1fd/0x1fd\n    irq_thread+0x17b/0x1fd\n    ? irq_forced_thread_fn+0x5f/0x5f\n    kthread+0x142/0x153\n    ? __irq_get_irqchip_state+0x46/0x46\n    ? kthread_associate_blkcg+0x71/0x71\n    ret_from_fork+0x1f/0x30\n\nIn this case, igb_io_error_detected detaches the network interface\nand requests a PCIE slot reset, however, the PCIE reset callback is\nnot being invoked and thus the Ethernet connection breaks down.\nAs the PCIE error in this case is a non-fatal one, requesting a\nslot reset can be avoided.\nThis patch fixes the task hung issue and preserves Ethernet\nconnection by ignoring non-fatal PCIE errors.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b64cbcc9-c2ea-44e6-976e-8bcd568be00a",  "id": "CVE-2016-2546",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2546"  },  "ratings": [    {      "score": 5.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "sound/core/timer.c in the Linux kernel before 4.4.1 uses an incorrect type of mutex, which allows local users to cause a denial of service (race condition, use-after-free, and system crash) via a crafted ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4ccce057-479e-493d-bb4c-2724f6c7d8cd",  "id": "CVE-2012-3364",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3364"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple stack-based buffer overflows in the Near Field Communication Controller Interface (NCI) in the Linux kernel before 3.4.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via incoming frames with crafted length fields.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3555529f-0c15-4893-843d-f7530949385b",  "id": "CVE-2024-26644",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't abort filesystem when attempting to snapshot deleted subvolume\n\nIf the source file descriptor to the snapshot ioctl refers to a deleted\nsubvolume, we get the following abort:\n\n  BTRFS: Transaction aborted (error -2)\n  WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875 create_pending_snapshot+0x1040/0x1190 [btrfs]\n  Modules linked in: pata_acpi btrfs ata_piix libata scsi_mod virtio_net blake2b_generic xor net_failover virtio_rng failover scsi_common rng_core raid6_pq libcrc32c\n  CPU: 0 PID: 833 Comm: t_snapshot_dele Not tainted 6.7.0-rc6 #2\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014\n  RIP: 0010:create_pending_snapshot+0x1040/0x1190 [btrfs]\n  RSP: 0018:ffffa09c01337af8 EFLAGS: 00010282\n  RAX: 0000000000000000 RBX: ffff9982053e7c78 RCX: 0000000000000027\n  RDX: ffff99827dc20848 RSI: 0000000000000001 RDI: ffff99827dc20840\n  RBP: ffffa09c01337c00 R08: 0000000000000000 R09: ffffa09c01337998\n  R10: 0000000000000003 R11: ffffffffb96da248 R12: fffffffffffffffe\n  R13: ffff99820535bb28 R14: ffff99820b7bd000 R15: ffff99820381ea80\n  FS:  00007fe20aadabc0(0000) GS:ffff99827dc00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000559a120b502f CR3: 00000000055b6000 CR4: 00000000000006f0\n  Call Trace:\n   <TASK>\n   ? create_pending_snapshot+0x1040/0x1190 [btrfs]\n   ? __warn+0x81/0x130\n   ? create_pending_snapshot+0x1040/0x1190 [btrfs]\n   ? report_bug+0x171/0x1a0\n   ? handle_bug+0x3a/0x70\n   ? exc_invalid_op+0x17/0x70\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? create_pending_snapshot+0x1040/0x1190 [btrfs]\n   ? create_pending_snapshot+0x1040/0x1190 [btrfs]\n   create_pending_snapshots+0x92/0xc0 [btrfs]\n   btrfs_commit_transaction+0x66b/0xf40 [btrfs]\n   btrfs_mksubvol+0x301/0x4d0 [btrfs]\n   btrfs_mksnapshot+0x80/0xb0 [btrfs]\n   __btrfs_ioctl_snap_create+0x1c2/0x1d0 [btrfs]\n   btrfs_ioctl_snap_create_v2+0xc4/0x150 [btrfs]\n   btrfs_ioctl+0x8a6/0x2650 [btrfs]\n   ? kmem_cache_free+0x22/0x340\n   ? do_sys_openat2+0x97/0xe0\n   __x64_sys_ioctl+0x97/0xd0\n   do_syscall_64+0x46/0xf0\n   entry_SYSCALL_64_after_hwframe+0x6e/0x76\n  RIP: 0033:0x7fe20abe83af\n  RSP: 002b:00007ffe6eff1360 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fe20abe83af\n  RDX: 00007ffe6eff23c0 RSI: 0000000050009417 RDI: 0000000000000003\n  RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fe20ad16cd0\n  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n  R13: 00007ffe6eff13c0 R14: 00007fe20ad45000 R15: 0000559a120b6d58\n   </TASK>\n  ---[ end trace 0000000000000000 ]---\n  BTRFS: error (device vdc: state A) in create_pending_snapshot:1875: errno=-2 No such entry\n  BTRFS info (device vdc: state EA): forced readonly\n  BTRFS warning (device vdc: state EA): Skipping commit of aborted transaction.\n  BTRFS: error (device vdc: state EA) in cleanup_transaction:2055: errno=-2 No such entry\n\nThis happens because create_pending_snapshot() initializes the new root\nitem as a copy of the source root item. This includes the refs field,\nwhich is 0 for a deleted subvolume. The call to btrfs_insert_root()\ntherefore inserts a root with refs == 0. btrfs_get_new_fs_root() then\nfinds the root and returns -ENOENT if refs == 0, which causes\ncreate_pending_snapshot() to abort.\n\nFix it by checking the source root's refs before attempting the\nsnapshot, but after locking subvol_sem to avoid racing with deletion.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2a97648-1732-400f-8bdd-14fafaf4a679",  "id": "CVE-2010-1437",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1437"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:33886'"    }  ]},{  "bom-ref": "608693bb-2398-4371-8896-52af4608e30a",  "id": "CVE-2013-4125",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4125"  },  "ratings": [    {      "score": 5.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The fib6_add_rt2node function in net/ipv6/ip6_fib.c in the IPv6 stack in the Linux kernel through 3.10.1 does not properly handle Router Advertisement (RA) messages in certain circumstances involving three routes that initially qualified for membership in an ECMP route set until a change occurred for one of the first two routes, which allows remote attackers to cause a denial of service (system crash) via a crafted sequence of messages.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "607a953e-bdd3-4815-804a-edb81f3d3964",  "id": "CVE-2016-4482",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4482"  },  "ratings": [    {      "score": 6.2,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4b7ee098-8553-4358-b4ba-74b380c74117",  "id": "CVE-2023-39189",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39189"  },  "ratings": [    {      "score": 6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d4cdaa97-b781-429f-947b-d7f34c1e2a88",  "id": "CVE-2022-3543",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3543"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401,    404  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function unix_sock_destructor/unix_release_sock of the file net/unix/af_unix.c of the component BPF. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211043.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "60cf196d-63f1-43ed-9954-b4986d627167",  "id": "AZL-89925",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a5ce1058-9189-4cc1-a439-0af10d136851",  "id": "CVE-2023-53334",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: chipidea: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1ab3f879-58d4-4c7d-80f3-567bb3bb8af5",  "id": "CVE-2013-2206",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2206"  },  "ratings": [    {      "score": 5.4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The sctp_sf_do_5_2_4_dupcook function in net/sctp/sm_statefuns.c in the SCTP implementation in the Linux kernel before 3.8.5 does not properly handle associations during the processing of a duplicate COOKIE ECHO chunk, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted SCTP traffic.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "835b87bf-4c41-4fd8-b02e-aded43ba90a4",  "id": "SUSE-SU-2022:3959-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "05fdcc72-29e7-498d-b2af-61fe1dd2a006",  "id": "CVE-2024-58017",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nprintk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX\n\nShifting 1 << 31 on a 32-bit int causes signed integer overflow, which\nleads to undefined behavior. To prevent this, cast 1 to u32 before\nperforming the shift, ensuring well-defined behavior.\n\nThis change explicitly avoids any potential overflow by ensuring that\nthe shift occurs on an unsigned 32-bit integer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "497e6128-9c1c-4d56-a055-f5f6140248c5",  "id": "OESA-2026-2436",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "332cfc8f-66b2-4a78-b90c-98949f8b5058",  "id": "CVE-2016-5829",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5829"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e44af894-a0f7-49a8-9584-3c200cd8495c",  "id": "CVE-2020-27820",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27820"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if \"unbind\" the driver).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04531876-2312-4efd-ad89-fe8d9136b498",  "id": "CVE-2021-47620",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47620"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: refactor malicious adv data check\n\nCheck for out-of-bound read was being performed at the end of while\nnum_reports loop, and would fill journal with false positives. Added\ncheck to beginning of loop processing so that it doesn't get checked\nafter ptr has been advanced.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c8dcf7bd-5f16-4f13-b422-92f4872114e3",  "id": "CVE-2021-47468",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47468"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nisdn: mISDN: Fix sleeping function called from invalid context\n\nThe driver can call card->isac.release() function from an atomic\ncontext.\n\nFix this by calling this function after releasing the lock.\n\nThe following log reveals it:\n\n[   44.168226 ] BUG: sleeping function called from invalid context at kernel/workqueue.c:3018\n[   44.168941 ] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 5475, name: modprobe\n[   44.169574 ] INFO: lockdep is turned off.\n[   44.169899 ] irq event stamp: 0\n[   44.170160 ] hardirqs last  enabled at (0): [<0000000000000000>] 0x0\n[   44.170627 ] hardirqs last disabled at (0): [<ffffffff814209ed>] copy_process+0x132d/0x3e00\n[   44.171240 ] softirqs last  enabled at (0): [<ffffffff81420a1a>] copy_process+0x135a/0x3e00\n[   44.171852 ] softirqs last disabled at (0): [<0000000000000000>] 0x0\n[   44.172318 ] Preemption disabled at:\n[   44.172320 ] [<ffffffffa009b0a9>] nj_release+0x69/0x500 [netjet]\n[   44.174441 ] Call Trace:\n[   44.174630 ]  dump_stack_lvl+0xa8/0xd1\n[   44.174912 ]  dump_stack+0x15/0x17\n[   44.175166 ]  ___might_sleep+0x3a2/0x510\n[   44.175459 ]  ? nj_release+0x69/0x500 [netjet]\n[   44.175791 ]  __might_sleep+0x82/0xe0\n[   44.176063 ]  ? start_flush_work+0x20/0x7b0\n[   44.176375 ]  start_flush_work+0x33/0x7b0\n[   44.176672 ]  ? trace_irq_enable_rcuidle+0x85/0x170\n[   44.177034 ]  ? kasan_quarantine_put+0xaa/0x1f0\n[   44.177372 ]  ? kasan_quarantine_put+0xaa/0x1f0\n[   44.177711 ]  __flush_work+0x11a/0x1a0\n[   44.177991 ]  ? flush_work+0x20/0x20\n[   44.178257 ]  ? lock_release+0x13c/0x8f0\n[   44.178550 ]  ? __kasan_check_write+0x14/0x20\n[   44.178872 ]  ? do_raw_spin_lock+0x148/0x360\n[   44.179187 ]  ? read_lock_is_recursive+0x20/0x20\n[   44.179530 ]  ? __kasan_check_read+0x11/0x20\n[   44.179846 ]  ? do_raw_spin_unlock+0x55/0x900\n[   44.180168 ]  ? ____kasan_slab_free+0x116/0x140\n[   44.180505 ]  ? _raw_spin_unlock_irqrestore+0x41/0x60\n[   44.180878 ]  ? skb_queue_purge+0x1a3/0x1c0\n[   44.181189 ]  ? kfree+0x13e/0x290\n[   44.181438 ]  flush_work+0x17/0x20\n[   44.181695 ]  mISDN_freedchannel+0xe8/0x100\n[   44.182006 ]  isac_release+0x210/0x260 [mISDNipac]\n[   44.182366 ]  nj_release+0xf6/0x500 [netjet]\n[   44.182685 ]  nj_remove+0x48/0x70 [netjet]\n[   44.182989 ]  pci_device_remove+0xa9/0x250",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b5777f3e-cbe8-49f8-9f18-de8d334d3e02",  "id": "CVE-2026-43187",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    191  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: delete attr leaf freemap entries when empty\n\nBack in commit 2a2b5932db6758 (\"xfs: fix attr leaf header freemap.size\nunderflow\"), Brian Foster observed that it's possible for a small\nfreemap at the end of the end of the xattr entries array to experience\na size underflow when subtracting the space consumed by an expansion of\nthe entries array.  There are only three freemap entries, which means\nthat it is not a complete index of all free space in the leaf block.\n\nThis code can leave behind a zero-length freemap entry with a nonzero\nbase.  Subsequent setxattr operations can increase the base up to the\npoint that it overlaps with another freemap entry.  This isn't in and of\nitself a problem because the code in _leaf_add that finds free space\nignores any freemap entry with zero size.\n\nHowever, there's another bug in the freemap update code in _leaf_add,\nwhich is that it fails to update a freemap entry that begins midway\nthrough the xattr entry that was just appended to the array.  That can\nresult in the freemap containing two entries with the same base but\ndifferent sizes (0 for the \"pushed-up\" entry, nonzero for the entry\nthat's actually tracking free space).  A subsequent _leaf_add can then\nallocate xattr namevalue entries on top of the entries array, leading to\ndata loss.  But fixing that is for later.\n\nFor now, eliminate the possibility of confusion by zeroing out the base\nof any freemap entry that has zero size.  Because the freemap is not\nintended to be a complete index of free space, a subsequent failure to\nfind any free space for a new xattr will trigger block compaction, which\nregenerates the freemap.\n\nIt looks like this bug has been in the codebase for quite a long time.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d477579b-6533-4491-bbc0-ce696dd4ae9b",  "id": "CVE-2025-37858",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    190  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/jfs: Prevent integer overflow in AG size calculation\n\nThe JFS filesystem calculates allocation group (AG) size using 1 <<\nl2agsize in dbExtendFS(). When l2agsize exceeds 31 (possible with >2TB\naggregates on 32-bit systems), this 32-bit shift operation causes undefined\nbehavior and improper AG sizing.\n\nOn 32-bit architectures:\n- Left-shifting 1 by 32+ bits results in 0 due to integer overflow\n- This creates invalid AG sizes (0 or garbage values) in\nsbi->bmap->db_agsize\n- Subsequent block allocations would reference invalid AG structures\n- Could lead to:\n  - Filesystem corruption during extend operations\n  - Kernel crashes due to invalid memory accesses\n  - Security vulnerabilities via malformed on-disk structures\n\nFix by casting to s64 before shifting:\nbmp->db_agsize = (s64)1 << l2agsize;\n\nThis ensures 64-bit arithmetic even on 32-bit architectures. The cast\nmatches the data type of db_agsize (s64) and follows similar patterns in\nJFS block calculation code.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ffa8b343-a5b8-4c8f-b8e8-a308851bf525",  "id": "CVE-2017-15537",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15537"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The x86/fpu (Floating Point Unit) subsystem in the Linux kernel before 4.13.5, when a processor supports the xsave feature but not the xsaves feature, does not correctly handle attempts to set reserved bits in the xstate header via the ptrace() or rt_sigreturn() system call, allowing local users to read the FPU registers of other processes on the system, related to arch/x86/kernel/fpu/regset.c and arch/x86/kernel/fpu/signal.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c836acd0-2a4d-4571-a6d9-05976da523f3",  "id": "CVE-2026-43089",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm_user: fix info leak in build_mapping()\n\nstruct xfrm_usersa_id has a one-byte padding hole after the proto\nfield, which ends up never getting set to zero before copying out to\nuserspace.  Fix that up by zeroing out the whole structure before\nsetting individual variables.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b3c80801-b364-4201-8b7c-18089542d02e",  "id": "CVE-2015-0293",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0293"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0b49c753-82e2-460d-ac21-d2246bb07dfe",  "id": "CVE-2024-47143",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-debug: fix a possible deadlock on radix_lock\n\nradix_lock() shouldn't be held while holding dma_hash_entry[idx].lock\notherwise, there's a possible deadlock scenario when\ndma debug API is called holding rq_lock():\n\nCPU0                   CPU1                       CPU2\ndma_free_attrs()\ncheck_unmap()          add_dma_entry()            __schedule() //out\n                                                  (A) rq_lock()\nget_hash_bucket()\n(A) dma_entry_hash\n                                                  check_sync()\n                       (A) radix_lock()           (W) dma_entry_hash\ndma_entry_free()\n(W) radix_lock()\n                       // CPU2's one\n                       (W) rq_lock()\n\nCPU1 situation can happen when it extending radix tree and\nit tries to wake up kswapd via wake_all_kswapd().\n\nCPU2 situation can happen while perf_event_task_sched_out()\n(i.e. dma sync operation is called while deleting perf_event using\n etm and etr tmc which are Arm Coresight hwtracing driver backends).\n\nTo remove this possible situation, call dma_entry_free() after\nput_hash_bucket() in check_unmap().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8658d88a-5d02-42ee-a74c-e04ac1f23fcc",  "id": "CVE-2015-8845",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8845"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    284  ],  "analysis": {    "state": "in_triage"  },  "description": "The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e3b24160-912e-4123-8312-9597cc3bc765",  "id": "CVE-2023-37454",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37454"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udf_put_super and udf_close_lvid functions in fs/udf/super.c. NOTE: the suse.com reference has a different perspective about this.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c88abd91-eacb-48ee-989c-2ef65ba086c8",  "id": "CVE-2024-42253",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: pca953x: fix pca953x_irq_bus_sync_unlock race\n\nEnsure that `i2c_lock' is held when setting interrupt latch and mask in\npca953x_irq_bus_sync_unlock() in order to avoid races.\n\nThe other (non-probe) call site pca953x_gpio_set_multiple() ensures the\nlock is held before calling pca953x_write_regs().\n\nThe problem occurred when a request raced against irq_bus_sync_unlock()\napproximately once per thousand reboots on an i.MX8MP based system.\n\n * Normal case\n\n   0-0022: write register AI|3a {03,02,00,00,01} Input latch P0\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\n\n * Race case\n\n   0-0022: write register AI|08 {ff,00,00,00,00} Output P3\n   0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register ***\n   0-0022: write register AI|12 {fc,00,00,00,00} Config P3\n   0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6528738c-ec84-41f0-b82e-352e87b29633",  "id": "SUSE-SU-2016:2394-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f70c341-8171-4b99-a3f5-dd637bc66084",  "id": "CVE-2013-4512",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4512"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "77ca24f3-fb24-4272-82d6-b5f37bef6ac5",  "id": "CVE-2011-4576",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4576"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7a031ffa-9398-4f0a-b3e8-15460ca65ba1",  "id": "CVE-2014-1737",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1737"  },  "ratings": [    {      "score": 7.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    754  ],  "analysis": {    "state": "in_triage"  },  "description": "The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e4e676d3-b1ba-4c38-bd57-12d9055f1db1",  "id": "CVE-2020-14351",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14351"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "37de31fd-5ed2-4a73-950d-bdb928594ae4",  "id": "CVE-2022-49124",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mce: Work around an erratum on fast string copy instructions\n\nA rare kernel panic scenario can happen when the following conditions\nare met due to an erratum on fast string copy instructions:\n\n1) An uncorrected error.\n2) That error must be in first cache line of a page.\n3) Kernel must execute page_copy from the page immediately before that\npage.\n\nThe fast string copy instructions (\"REP; MOVS*\") could consume an\nuncorrectable memory error in the cache line _right after_ the desired\nregion to copy and raise an MCE.\n\nBit 0 of MSR_IA32_MISC_ENABLE can be cleared to disable fast string\ncopy and will avoid such spurious machine checks. However, that is less\npreferable due to the permanent performance impact. Considering memory\npoison is rare, it's desirable to keep fast string copy enabled until an\nMCE is seen.\n\nIntel has confirmed the following:\n1. The CPU erratum of fast string copy only applies to Skylake,\nCascade Lake and Cooper Lake generations.\n\nDirectly return from the MCE handler:\n2. Will result in complete execution of the \"REP; MOVS*\" with no data\nloss or corruption.\n3. Will not result in another MCE firing on the next poisoned cache line\ndue to \"REP; MOVS*\".\n4. Will resume execution from a correct point in code.\n5. Will result in the same instruction that triggered the MCE firing a\nsecond MCE immediately for any other software recoverable data fetch\nerrors.\n6. Is not safe without disabling the fast string copy, as the next fast\nstring copy of the same buffer on the same CPU would result in a PANIC\nMCE.\n\nThis should mitigate the erratum completely with the only caveat that\nthe fast string copy is disabled on the affected hyper thread thus\nperformance degradation.\n\nThis is still better than the OS crashing on MCEs raised on an\nirrelevant process due to \"REP; MOVS*' accesses in a kernel context,\ne.g., copy_page.\n\n\nInjected errors on 1st cache line of 8 anonymous pages of process\n'proc1' and observed MCE consumption from 'proc2' with no panic\n(directly returned).\n\nWithout the fix, the host panicked within a few minutes on a\nrandom 'proc2' process due to kernel access from copy_page.\n\n  [ bp: Fix comment style + touch ups, zap an unlikely(), improve the\n    quirk function's readability. ]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e5b65d63-d86e-435a-8688-83bfe06f336f",  "id": "CVE-2021-47342",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47342"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix possible UAF when remounting r/o a mmp-protected file system\n\nAfter commit 618f003199c6 (\"ext4: fix memory leak in\next4_fill_super\"), after the file system is remounted read-only, there\nis a race where the kmmpd thread can exit, causing sbi->s_mmp_tsk to\npoint at freed memory, which the call to ext4_stop_mmpd() can trip\nover.\n\nFix this by only allowing kmmpd() to exit when it is stopped via\next4_stop_mmpd().\n\nBug-Report-Link: <20210629143603.2166962-1-yebin10@huawei.com>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e565758e-fc08-421f-aa7e-6fbbbaca8e46",  "id": "CVE-2019-15212",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15212"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500.c driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8f4761ae-7c23-402b-acea-e42dcf29c325",  "id": "CVE-2013-4483",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4483"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local users to cause a denial of service (memory consumption or system crash) via a crafted application.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "551510ae-8306-47b8-9693-e63639a92e5d",  "id": "CVE-2023-53117",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: prevent out-of-bounds array speculation when closing a file descriptor\n\nGoogle-Bug-Id: 114199369",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bdc8e5f7-9722-4422-8c21-b29c284c1c05",  "id": "CVE-2022-0264",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0264"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    755  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a67d5d60-7ade-458a-97f5-cd6c5d034140",  "id": "CVE-2021-47117",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47117"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed\n\nWe got follow bug_on when run fsstress with injecting IO fault:\n[130747.323114] kernel BUG at fs/ext4/extents_status.c:762!\n[130747.323117] Internal error: Oops - BUG: 0 [#1] SMP\n......\n[130747.334329] Call trace:\n[130747.334553]  ext4_es_cache_extent+0x150/0x168 [ext4]\n[130747.334975]  ext4_cache_extents+0x64/0xe8 [ext4]\n[130747.335368]  ext4_find_extent+0x300/0x330 [ext4]\n[130747.335759]  ext4_ext_map_blocks+0x74/0x1178 [ext4]\n[130747.336179]  ext4_map_blocks+0x2f4/0x5f0 [ext4]\n[130747.336567]  ext4_mpage_readpages+0x4a8/0x7a8 [ext4]\n[130747.336995]  ext4_readpage+0x54/0x100 [ext4]\n[130747.337359]  generic_file_buffered_read+0x410/0xae8\n[130747.337767]  generic_file_read_iter+0x114/0x190\n[130747.338152]  ext4_file_read_iter+0x5c/0x140 [ext4]\n[130747.338556]  __vfs_read+0x11c/0x188\n[130747.338851]  vfs_read+0x94/0x150\n[130747.339110]  ksys_read+0x74/0xf0\n\nThis patch's modification is according to Jan Kara's suggestion in:\nhttps://patchwork.ozlabs.org/project/linux-ext4/patch/20210428085158.3728201-1-yebin10@huawei.com/\n\"I see. Now I understand your patch. Honestly, seeing how fragile is trying\nto fix extent tree after split has failed in the middle, I would probably\ngo even further and make sure we fix the tree properly in case of ENOSPC\nand EDQUOT (those are easily user triggerable).  Anything else indicates a\nHW problem or fs corruption so I'd rather leave the extent tree as is and\ndon't try to fix it (which also means we will not create overlapping\nextents).\"",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c2eb5b4-3b7f-474a-ad9b-e8b1cd48b5a0",  "id": "CVE-2022-49121",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix tag leaks on error\n\nIn pm8001_chip_set_dev_state_req(), pm8001_chip_fw_flash_update_req(),\npm80xx_chip_phy_ctl_req() and pm8001_chip_reg_dev_req() add missing calls\nto pm8001_tag_free() to free the allocated tag when pm8001_mpi_build_cmd()\nfails.\n\nSimilarly, in pm8001_exec_internal_task_abort(), if the chip ->task_abort\nmethod fails, the tag allocated for the abort request task must be\nfreed. Add the missing call to pm8001_tag_free().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6d65b92f-6b6c-41de-9ac0-72e30207efff",  "id": "CVE-2021-4460",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4460"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix UBSAN shift-out-of-bounds warning\n\nIf get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up\ndoing a shift operation where the number of bits shifted equals\nnumber of bits in the operand. This behaviour is undefined.\n\nSet num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the\ncount is >= number of bits in the operand.\n\nBug: https://gitlab.freedesktop.org/drm/amd/-/issues/1472",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "241ff0cf-e854-4086-a64a-0a7f8600f8b7",  "id": "CVE-2022-49621",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: pmac32-cpufreq: Fix refcount leak bug\n\nIn pmac_cpufreq_init_MacRISC3(), we need to add corresponding\nof_node_put() for the three node pointers whose refcount have\nbeen incremented by of_find_node_by_name().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f15ad359-38b2-486a-afdf-98ed92ecaf89",  "id": "CVE-2010-3079",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3079"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel/trace/ftrace.c in the Linux kernel before 2.6.35.5, when debugfs is enabled, does not properly handle interaction between mutex possession and llseek operations, which allows local users to cause a denial of service (NULL pointer dereference and outage of all function tracing files) via an lseek call on a file descriptor associated with the set_ftrace_filter file.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "514f37c8-1f5e-4367-ae43-5a9ce4395c41",  "id": "CVE-2022-49277",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: fix memory leak in jffs2_do_mount_fs\n\nIf jffs2_build_filesystem() in jffs2_do_mount_fs() returns an error,\nwe can observe the following kmemleak report:\n\n--------------------------------------------\nunreferenced object 0xffff88811b25a640 (size 64):\n  comm \"mount\", pid 691, jiffies 4294957728 (age 71.952s)\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace:\n    [<ffffffffa493be24>] kmem_cache_alloc_trace+0x584/0x880\n    [<ffffffffa5423a06>] jffs2_sum_init+0x86/0x130\n    [<ffffffffa5400e58>] jffs2_do_mount_fs+0x798/0xac0\n    [<ffffffffa540acf3>] jffs2_do_fill_super+0x383/0xc30\n    [<ffffffffa540c00a>] jffs2_fill_super+0x2ea/0x4c0\n    [...]\nunreferenced object 0xffff88812c760000 (size 65536):\n  comm \"mount\", pid 691, jiffies 4294957728 (age 71.952s)\n  hex dump (first 32 bytes):\n    bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................\n    bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................\n  backtrace:\n    [<ffffffffa493a449>] __kmalloc+0x6b9/0x910\n    [<ffffffffa5423a57>] jffs2_sum_init+0xd7/0x130\n    [<ffffffffa5400e58>] jffs2_do_mount_fs+0x798/0xac0\n    [<ffffffffa540acf3>] jffs2_do_fill_super+0x383/0xc30\n    [<ffffffffa540c00a>] jffs2_fill_super+0x2ea/0x4c0\n    [...]\n--------------------------------------------\n\nThis is because the resources allocated in jffs2_sum_init() are not\nreleased. Call jffs2_sum_exit() to release these resources to solve\nthe problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a3cfcfc4-e4da-4911-a3b4-f40c6f0f0225",  "id": "RLSA-2026:1473",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a40f0151-c632-4bd0-9f79-175de5ad5630",  "id": "CVE-2014-5472",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5472"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    20  ],  "analysis": {    "state": "in_triage"  },  "description": "The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "58aa1b7a-fcc3-4dea-844e-8b98c471edb0",  "id": "CVE-2019-14897",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14897"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    121,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary code, when a STA works in IBSS mode (allows connecting stations together without the use of an AP) and connects to another STA.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "64385f74-43b9-4ef0-8618-0d1bdb595217",  "id": "CVE-2017-18193",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18193"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/f2fs/extent_cache.c in the Linux kernel before 4.13 mishandles extent trees, which allows local users to cause a denial of service (BUG) via an application with multiple threads.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bbe458c3-fb03-412b-988b-0acf4e24074c",  "id": "CVE-2020-27170",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27170"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    203  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5025cf3f-de87-4f98-852b-978d13027d6a",  "id": "CVE-2019-17053",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17053"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"    }  ],  "cwes": [    276  ],  "analysis": {    "state": "in_triage"  },  "description": "ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-e69dbd4619e7.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b02acd57-f13c-40ce-b9ce-1dcba29c20c7",  "id": "CVE-2024-53198",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen: Fix the issue of resource not being properly released in xenbus_dev_probe()\n\nThis patch fixes an issue in the function xenbus_dev_probe(). In the\nxenbus_dev_probe() function, within the if (err) branch at line 313, the\nprogram incorrectly returns err directly without releasing the resources\nallocated by err = drv->probe(dev, id). As the return value is non-zero,\nthe upper layers assume the processing logic has failed. However, the probe\noperation was performed earlier without a corresponding remove operation.\nSince the probe actually allocates resources, failing to perform the remove\noperation could lead to problems.\n\nTo fix this issue, we followed the resource release logic of the\nxenbus_dev_remove() function by adding a new block fail_remove before the\nfail_put block. After entering the branch if (err) at line 313, the\nfunction will use a goto statement to jump to the fail_remove block,\nensuring that the previously acquired resources are correctly released,\nthus preventing the reference count leak.\n\nThis bug was identified by an experimental static analysis tool developed\nby our team. The tool specializes in analyzing reference count operations\nand detecting potential issues where resources are not properly managed.\nIn this case, the tool flagged the missing release operation as a\npotential problem, which led to the development of this patch.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "087aec28-f363-4c38-8503-6a8ebc3352e0",  "id": "CVE-2024-49895",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    129  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation\n\nThis commit addresses a potential index out of bounds issue in the\n`cm3_helper_translate_curve_to_degamma_hw_format` function in the DCN30\ncolor  management module. The issue could occur when the index 'i'\nexceeds the  number of transfer function points (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure 'i' is within bounds before accessing the\ntransfer function points. If 'i' is out of bounds, the function returns\nfalse to indicate an error.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:338 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:339 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:340 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bfa328a1-728a-4527-8e70-b37896a7c090",  "id": "RHSA-2024:5136",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b8d6d6b5-0bd2-4593-b24c-0707a7f16bbb",  "id": "CVE-2013-1826",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1826"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b5e309fd-054a-4e46-8dec-ff49654088f2",  "id": "CVE-2017-18241",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18241"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service (NULL pointer dereference and panic) by using a noflush_merge option that triggers a NULL value for a flush_cmd_control data structure.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1c581679-cb6b-4fd5-b013-7fd723138fea",  "id": "CVE-2026-23238",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nromfs: check sb_set_blocksize() return value\n\nromfs_fill_super() ignores the return value of sb_set_blocksize(), which\ncan fail if the requested block size is incompatible with the block\ndevice's configuration.\n\nThis can be triggered by setting a loop device's block size larger than\nPAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs\nfilesystem on that device.\n\nWhen sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the\ndevice has logical_block_size=32768, bdev_validate_blocksize() fails\nbecause the requested size is smaller than the device's logical block\nsize. sb_set_blocksize() returns 0 (failure), but romfs ignores this and\ncontinues mounting.\n\nThe superblock's block size remains at the device's logical block size\n(32768). Later, when sb_bread() attempts I/O with this oversized block\nsize, it triggers a kernel BUG in folio_set_bh():\n\n    kernel BUG at fs/buffer.c:1582!\n    BUG_ON(size > PAGE_SIZE);\n\nFix by checking the return value of sb_set_blocksize() and failing the\nmount with -EINVAL if it returns 0.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5ce5535a-c339-407c-ba63-8a02112515ec",  "id": "CVE-2025-71292",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: nlink overflow in jfs_rename\n\nIf nlink is maximal for a directory (-1) and inside that directory you\nperform a rename for some child directory (not moving from the parent),\nthen the nlink of the first directory is first incremented and later\ndecremented. Normally this is fine, but when nlink = -1 this causes a\nwrap around to 0, and then drop_nlink issues a warning.\n\nAfter applying the patch syzbot no longer issues any warnings. I also\nran some basic fs tests to look for any regressions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8ef4a116-7b43-4049-9498-f56c92a39334",  "id": "CVE-2017-17558",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17558"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f31f6bdd-10c5-490d-8c1a-3a9d1f9a317b",  "id": "CVE-2022-43750",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43750"  },  "ratings": [    {      "score": 6.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b262afaf-e497-4ee3-80cd-5a64ebe4ca7a",  "id": "CVE-2023-35823",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35823"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f62e1e40-6f7f-408f-ba76-80e52d58bd52",  "id": "CVE-2024-56611",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM\n\nWe currently assume that there is at least one VMA in a MM, which isn't\ntrue.\n\nSo we might end up having find_vma() return NULL, to then de-reference\nNULL.  So properly handle find_vma() returning NULL.\n\nThis fixes the report:\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 1 UID: 0 PID: 6021 Comm: syz-executor284 Not tainted 6.12.0-rc7-syzkaller-00187-gf868cd251776 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024\nRIP: 0010:migrate_to_node mm/mempolicy.c:1090 [inline]\nRIP: 0010:do_migrate_pages+0x403/0x6f0 mm/mempolicy.c:1194\nCode: ...\nRSP: 0018:ffffc9000375fd08 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffffc9000375fd78 RCX: 0000000000000000\nRDX: ffff88807e171300 RSI: dffffc0000000000 RDI: ffff88803390c044\nRBP: ffff88807e171428 R08: 0000000000000014 R09: fffffbfff2039ef1\nR10: ffffffff901cf78f R11: 0000000000000000 R12: 0000000000000003\nR13: ffffc9000375fe90 R14: ffffc9000375fe98 R15: ffffc9000375fdf8\nFS:  00005555919e1380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005555919e1ca8 CR3: 000000007f12a000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n kernel_migrate_pages+0x5b2/0x750 mm/mempolicy.c:1709\n __do_sys_migrate_pages mm/mempolicy.c:1727 [inline]\n __se_sys_migrate_pages mm/mempolicy.c:1723 [inline]\n __x64_sys_migrate_pages+0x96/0x100 mm/mempolicy.c:1723\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[akpm@linux-foundation.org: add unlikely()]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fee179a2-a2a4-4fad-9710-d8b4a99c88ec",  "id": "CVE-2022-50084",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm raid: fix address sanitizer warning in raid_status\n\nThere is this warning when using a kernel with the address sanitizer\nand running this testsuite:\nhttps://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi_raid\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid]\nRead of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319\nCPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3.<snip> #1\nHardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\nCall Trace:\n <TASK>\n dump_stack_lvl+0x6a/0x9c\n print_address_description.constprop.0+0x1f/0x1e0\n print_report.cold+0x55/0x244\n kasan_report+0xc9/0x100\n raid_status+0x1747/0x2820 [dm_raid]\n dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod]\n table_load+0x35c/0x630 [dm_mod]\n ctl_ioctl+0x411/0x630 [dm_mod]\n dm_ctl_ioctl+0xa/0x10 [dm_mod]\n __x64_sys_ioctl+0x12a/0x1a0\n do_syscall_64+0x5b/0x80\n\nThe warning is caused by reading conf->max_nr_stripes in raid_status. The\ncode in raid_status reads mddev->private, casts it to struct r5conf and\nreads the entry max_nr_stripes.\n\nHowever, if we have different raid type than 4/5/6, mddev->private\ndoesn't point to struct r5conf; it may point to struct r0conf, struct\nr1conf, struct r10conf or struct mpconf. If we cast a pointer to one\nof these structs to struct r5conf, we will be reading invalid memory\nand KASAN warns about it.\n\nFix this bug by reading struct r5conf only if raid type is 4, 5 or 6.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9cfaf2d2-1637-49b4-8d18-5028a464cd4f",  "id": "ROOT-OS-ALPINE-317-CVE-2022-48174",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b4a8547c-b290-4004-b5ad-7f628caa5875",  "id": "CVE-2025-37841",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\npm: cpupower: bench: Prevent NULL dereference on malloc failure\n\nIf malloc returns NULL due to low memory, 'config' pointer can be NULL.\nAdd a check to prevent NULL dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8cb7b077-46a3-40e9-a1ba-5e0416ad5999",  "id": "CVE-2014-8134",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8134"  },  "ratings": [    {      "score": 3.3,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "84030d22-ba22-40cf-9edc-6b3f3a4342fe",  "id": "CVE-2022-49438",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: sparcspkr - fix refcount leak in bbc_beep_probe\n\nof_find_node_by_path() calls of_find_node_opts_by_path(),\nwhich returns a node pointer with refcount\nincremented, we should use of_node_put() on it when done.\nAdd missing of_node_put() to avoid refcount leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "353a6e0c-6a64-4503-9c75-ead618ce256e",  "id": "CVE-2016-5412",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5412"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS users to cause a denial of service (host OS infinite loop) by making a H_CEDE hypercall during the existence of a suspended transaction.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c6a1d18c-6d00-417c-a68b-fe12e495db62",  "id": "DSA-3197-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2fb65cb-2335-4d16-92cb-c542b88e12e6",  "id": "CVE-2024-39469",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors\n\nThe error handling in nilfs_empty_dir() when a directory folio/page read\nfails is incorrect, as in the old ext2 implementation, and if the\nfolio/page cannot be read or nilfs_check_folio() fails, it will falsely\ndetermine the directory as empty and corrupt the file system.\n\nIn addition, since nilfs_empty_dir() does not immediately return on a\nfailed folio/page read, but continues to loop, this can cause a long loop\nwith I/O if i_size of the directory's inode is also corrupted, causing the\nlog writer thread to wait and hang, as reported by syzbot.\n\nFix these issues by making nilfs_empty_dir() immediately return a false\nvalue (0) if it fails to get a directory folio/page.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "69272e01-2563-45bc-9bf1-e421fd90389b",  "id": "CVE-2024-40977",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921s: fix potential hung tasks during chip recovery\n\nDuring chip recovery (e.g. chip reset), there is a possible situation that\nkernel worker reset_work is holding the lock and waiting for kernel thread\nstat_worker to be parked, while stat_worker is waiting for the release of\nthe same lock.\nIt causes a deadlock resulting in the dumping of hung tasks messages and\npossible rebooting of the device.\n\nThis patch prevents the execution of stat_worker during the chip recovery.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d51ef102-0823-4f37-997b-ce11c563dc3b",  "id": "CVE-2010-3874",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3874"  },  "ratings": [    {      "score": 4,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "Heap-based buffer overflow in the bcm_connect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.36.2 on 64-bit platforms might allow local users to cause a denial of service (memory corruption) via a connect operation.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0f689f7b-92b4-4e61-abac-9150c82f755f",  "id": "CVE-2010-2538",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2538"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 might allow local users to obtain sensitive information via a BTRFS_IOC_CLONE_RANGE ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "60a7c59e-9f8d-4f91-b8c7-d5734b4c3cfa",  "id": "CVE-2025-39745",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcutorture: Fix rcutorture_one_extend_check() splat in RT kernels\n\nFor built with CONFIG_PREEMPT_RT=y kernels, running rcutorture\ntests resulted in the following splat:\n\n[   68.797425] rcutorture_one_extend_check during change: Current 0x1  To add 0x1  To remove 0x0  preempt_count() 0x0\n[   68.797533] WARNING: CPU: 2 PID: 512 at kernel/rcu/rcutorture.c:1993 rcutorture_one_extend_check+0x419/0x560 [rcutorture]\n[   68.797601] Call Trace:\n[   68.797602]  <TASK>\n[   68.797619]  ? lockdep_softirqs_off+0xa5/0x160\n[   68.797631]  rcutorture_one_extend+0x18e/0xcc0 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]\n[   68.797646]  ? local_clock+0x19/0x40\n[   68.797659]  rcu_torture_one_read+0xf0/0x280 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]\n[   68.797678]  ? __pfx_rcu_torture_one_read+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]\n[   68.797804]  ? __pfx_rcu_torture_timer+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]\n[   68.797815] rcu-torture: rcu_torture_reader task started\n[   68.797824] rcu-torture: Creating rcu_torture_reader task\n[   68.797824]  rcu_torture_reader+0x238/0x580 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c]\n[   68.797836]  ? kvm_sched_clock_read+0x15/0x30\n\nDisable BH does not change the SOFTIRQ corresponding bits in\npreempt_count() for RT kernels, this commit therefore use\nsoftirq_count() to check the if BH is disabled.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10232766-9f65-4a77-bdc9-55ab08b34687",  "id": "CVE-2021-47356",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47356"  },  "ratings": [    {      "score": 7.7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: fix possible use-after-free in HFC_cleanup()\n\nThis module's remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver's remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4d62cf10-378c-4564-9763-c1d99cef7c73",  "id": "CVE-2017-18224",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18224"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 4.15, fs/ocfs2/aops.c omits use of a semaphore and consequently has a race condition for access to the extent tree during read operations in DIRECT mode, which allows local users to cause a denial of service (BUG) by modifying a certain e_cpos field.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d4e11772-51c5-444a-9b2e-bfa9aa11e337",  "id": "CVE-2020-25681",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25681"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    122  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause a buffer overflow with arbitrary data in a heap memory segment, possibly executing code on the machine. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a1d42193-da5c-4d75-b8ff-5c2e5d8ba791",  "id": "OESA-2026-2043",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c3b5ca41-0005-49f4-bcc3-d5cd4b5bb8c4",  "id": "CVE-2013-6376",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6376"  },  "ratings": [    {      "score": 5.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:S/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (host OS crash) via a crafted ICR write operation in x2apic mode.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c43a892d-935e-46a7-bf4f-d1d383845f22",  "id": "OESA-2023-1092",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3a96b86a-6d65-41ab-bc6a-6517e9955b7f",  "id": "CVE-2024-42229",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: aead,cipher - zeroize key buffer after use\n\nI.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding\ncryptographic information should be zeroized once they are no longer\nneeded. Accomplish this by using kfree_sensitive for buffers that\npreviously held the private key.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b2d1df02-33fb-4ed6-92c3-038878af40e0",  "id": "CVE-2023-6932",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation.\n\nA race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread.\n\nWe recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2643d7a5-1680-4ff3-b612-4aa1cc0fb4b1",  "id": "CVE-2021-32399",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32399"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1eecb61a-d5e2-436b-b64c-d0742ee6fee2",  "id": "CVE-2026-53059",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    190,    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm log: fix out-of-bounds write due to region_count overflow\n\nThe local variable region_count in create_log_context() is declared as\nunsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit).\nWhen a device-mapper target has a sufficiently large ti->len with a small\nregion_size, the division result can exceed UINT_MAX. The truncated\nvalue is then used to calculate bitset_size, causing clean_bits,\nsync_bits, and recovering_bits to be allocated far smaller than needed\nfor the actual number of regions.\n\nSubsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use\nregion indices derived from the full untruncated region space, causing\nout-of-bounds writes to kernel heap memory allocated by vmalloc.\n\nThis can be reproduced by creating a mirror target whose region_count\noverflows 32 bits:\n\n  dmsetup create bigzero --table '0 8589934594 zero'\n  dmsetup create mymirror --table '0 8589934594 mirror \\\n    core 2 2 nosync 2 /dev/mapper/bigzero 0 \\\n    /dev/mapper/bigzero 0'\n\nThe status output confirms the truncation (sync_count=1 instead of\n4294967297, because 0x100000001 was truncated to 1):\n\n  $ dmsetup status mymirror\n  0 8589934594 mirror 2 254:1 254:1 1/4294967297 ...\n\nThis leads to a kernel crash in core_in_sync:\n\n  BUG: scheduling while atomic: (udev-worker)/9150/0x00000000\n  RIP: 0010:core_in_sync+0x14/0x30 [dm_log]\n  CR2: 0000000000000008\n  Fixing recursive fault but reboot is needed!\n\nFix by widening the local region_count to sector_t and adding an\nexplicit overflow check before the value is assigned to lc->region_count.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "04e791aa-9476-4bfb-98a7-12e8314f928b",  "id": "ALSA-2023:1405",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ef8745e2-8f32-402f-8349-465caf2f6602",  "id": "RHSA-2024:7848",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "89a68876-078d-4736-a5da-4b9c28f0d0d0",  "id": "CVE-2025-38061",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pktgen: fix access outside of user given buffer in pktgen_thread_write()\n\nHonour the user given buffer size for the strn_len() calls (otherwise\nstrn_len() will access memory outside of the user given buffer).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bae21088-3068-43dc-86d1-d0810e38ae64",  "id": "DLA-260-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "202cf7ee-b93a-4319-8fd2-8af7b59c0019",  "id": "RHSA-2024:0154",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2379da8a-567d-47eb-b3e3-0a1909762ba6",  "id": "CVE-2020-25668",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25668"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    662  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free in con_font_op.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "88fb76d6-ab5f-497c-a2bc-9ef224830aa2",  "id": "CVE-2012-2744",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2744"  },  "ratings": [    {      "score": 7.8,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6 module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "450cbc67-a119-458d-a069-ce9a3224de5b",  "id": "CVE-2022-48919",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix double free race when mount fails in cifs_get_root()\n\nWhen cifs_get_root() fails during cifs_smb3_do_mount() we call\ndeactivate_locked_super() which eventually will call delayed_free() which\nwill free the context.\nIn this situation we should not proceed to enter the out: section in\ncifs_smb3_do_mount() and free the same resources a second time.\n\n[Thu Feb 10 12:59:06 2022] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x32/0x60\n[Thu Feb 10 12:59:06 2022] Read of size 8 at addr ffff888364f4d110 by task swapper/1/0\n\n[Thu Feb 10 12:59:06 2022] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G           OE     5.17.0-rc3+ #4\n[Thu Feb 10 12:59:06 2022] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 12/17/2019\n[Thu Feb 10 12:59:06 2022] Call Trace:\n[Thu Feb 10 12:59:06 2022]  <IRQ>\n[Thu Feb 10 12:59:06 2022]  dump_stack_lvl+0x5d/0x78\n[Thu Feb 10 12:59:06 2022]  print_address_description.constprop.0+0x24/0x150\n[Thu Feb 10 12:59:06 2022]  ? rcu_cblist_dequeue+0x32/0x60\n[Thu Feb 10 12:59:06 2022]  kasan_report.cold+0x7d/0x117\n[Thu Feb 10 12:59:06 2022]  ? rcu_cblist_dequeue+0x32/0x60\n[Thu Feb 10 12:59:06 2022]  __asan_load8+0x86/0xa0\n[Thu Feb 10 12:59:06 2022]  rcu_cblist_dequeue+0x32/0x60\n[Thu Feb 10 12:59:06 2022]  rcu_core+0x547/0xca0\n[Thu Feb 10 12:59:06 2022]  ? call_rcu+0x3c0/0x3c0\n[Thu Feb 10 12:59:06 2022]  ? __this_cpu_preempt_check+0x13/0x20\n[Thu Feb 10 12:59:06 2022]  ? lock_is_held_type+0xea/0x140\n[Thu Feb 10 12:59:06 2022]  rcu_core_si+0xe/0x10\n[Thu Feb 10 12:59:06 2022]  __do_softirq+0x1d4/0x67b\n[Thu Feb 10 12:59:06 2022]  __irq_exit_rcu+0x100/0x150\n[Thu Feb 10 12:59:06 2022]  irq_exit_rcu+0xe/0x30\n[Thu Feb 10 12:59:06 2022]  sysvec_hyperv_stimer0+0x9d/0xc0\n...\n[Thu Feb 10 12:59:07 2022] Freed by task 58179:\n[Thu Feb 10 12:59:07 2022]  kasan_save_stack+0x26/0x50\n[Thu Feb 10 12:59:07 2022]  kasan_set_track+0x25/0x30\n[Thu Feb 10 12:59:07 2022]  kasan_set_free_info+0x24/0x40\n[Thu Feb 10 12:59:07 2022]  ____kasan_slab_free+0x137/0x170\n[Thu Feb 10 12:59:07 2022]  __kasan_slab_free+0x12/0x20\n[Thu Feb 10 12:59:07 2022]  slab_free_freelist_hook+0xb3/0x1d0\n[Thu Feb 10 12:59:07 2022]  kfree+0xcd/0x520\n[Thu Feb 10 12:59:07 2022]  cifs_smb3_do_mount+0x149/0xbe0 [cifs]\n[Thu Feb 10 12:59:07 2022]  smb3_get_tree+0x1a0/0x2e0 [cifs]\n[Thu Feb 10 12:59:07 2022]  vfs_get_tree+0x52/0x140\n[Thu Feb 10 12:59:07 2022]  path_mount+0x635/0x10c0\n[Thu Feb 10 12:59:07 2022]  __x64_sys_mount+0x1bf/0x210\n[Thu Feb 10 12:59:07 2022]  do_syscall_64+0x5c/0xc0\n[Thu Feb 10 12:59:07 2022]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n[Thu Feb 10 12:59:07 2022] Last potentially related work creation:\n[Thu Feb 10 12:59:07 2022]  kasan_save_stack+0x26/0x50\n[Thu Feb 10 12:59:07 2022]  __kasan_record_aux_stack+0xb6/0xc0\n[Thu Feb 10 12:59:07 2022]  kasan_record_aux_stack_noalloc+0xb/0x10\n[Thu Feb 10 12:59:07 2022]  call_rcu+0x76/0x3c0\n[Thu Feb 10 12:59:07 2022]  cifs_umount+0xce/0xe0 [cifs]\n[Thu Feb 10 12:59:07 2022]  cifs_kill_sb+0xc8/0xe0 [cifs]\n[Thu Feb 10 12:59:07 2022]  deactivate_locked_super+0x5d/0xd0\n[Thu Feb 10 12:59:07 2022]  cifs_smb3_do_mount+0xab9/0xbe0 [cifs]\n[Thu Feb 10 12:59:07 2022]  smb3_get_tree+0x1a0/0x2e0 [cifs]\n[Thu Feb 10 12:59:07 2022]  vfs_get_tree+0x52/0x140\n[Thu Feb 10 12:59:07 2022]  path_mount+0x635/0x10c0\n[Thu Feb 10 12:59:07 2022]  __x64_sys_mount+0x1bf/0x210\n[Thu Feb 10 12:59:07 2022]  do_syscall_64+0x5c/0xc0\n[Thu Feb 10 12:59:07 2022]  entry_SYSCALL_64_after_hwframe+0x44/0xae",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f54a5e83-bfcb-4b47-9c84-2f25fce9e3ee",  "id": "CVE-2025-37780",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: Prevent the use of too small fid\n\nsyzbot reported a slab-out-of-bounds Read in isofs_fh_to_parent. [1]\n\nThe handle_bytes value passed in by the reproducing program is equal to 12.\nIn handle_to_path(), only 12 bytes of memory are allocated for the structure\nfile_handle->f_handle member, which causes an out-of-bounds access when\naccessing the member parent_block of the structure isofs_fid in isofs,\nbecause accessing parent_block requires at least 16 bytes of f_handle.\nHere, fh_len is used to indirectly confirm that the value of handle_bytes\nis greater than 3 before accessing parent_block.\n\n[1]\nBUG: KASAN: slab-out-of-bounds in isofs_fh_to_parent+0x1b8/0x210 fs/isofs/export.c:183\nRead of size 4 at addr ffff0000cc030d94 by task syz-executor215/6466\nCPU: 1 UID: 0 PID: 6466 Comm: syz-executor215 Not tainted 6.14.0-rc7-syzkaller-ga2392f333575 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025\nCall trace:\n show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0x198/0x550 mm/kasan/report.c:521\n kasan_report+0xd8/0x138 mm/kasan/report.c:634\n __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380\n isofs_fh_to_parent+0x1b8/0x210 fs/isofs/export.c:183\n exportfs_decode_fh_raw+0x2dc/0x608 fs/exportfs/expfs.c:523\n do_handle_to_path+0xa0/0x198 fs/fhandle.c:257\n handle_to_path fs/fhandle.c:385 [inline]\n do_handle_open+0x8cc/0xb8c fs/fhandle.c:403\n __do_sys_open_by_handle_at fs/fhandle.c:443 [inline]\n __se_sys_open_by_handle_at fs/fhandle.c:434 [inline]\n __arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:434\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151\n el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744\n el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762\n el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600\n\nAllocated by task 6466:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x40/0x78 mm/kasan/common.c:68\n kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:562\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __do_kmalloc_node mm/slub.c:4294 [inline]\n __kmalloc_noprof+0x32c/0x54c mm/slub.c:4306\n kmalloc_noprof include/linux/slab.h:905 [inline]\n handle_to_path fs/fhandle.c:357 [inline]\n do_handle_open+0x5a4/0xb8c fs/fhandle.c:403\n __do_sys_open_by_handle_at fs/fhandle.c:443 [inline]\n __se_sys_open_by_handle_at fs/fhandle.c:434 [inline]\n __arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:434\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151\n el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744\n el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762\n el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4a8ba408-a53c-467c-b1a8-54dcbcad10a3",  "id": "CVE-2022-50349",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: tifm: fix possible memory leak in tifm_7xx1_switch_media()\n\nIf device_register() returns error in tifm_7xx1_switch_media(),\nname of kobject which is allocated in dev_set_name() called in device_add()\nis leaked.\n\nNever directly free @dev after calling device_register(), even\nif it returned an error! Always use put_device() to give up the\nreference initialized.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5e3f0483-44ec-471e-93d6-9e4e246e26d2",  "id": "CVE-2019-18786",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18786"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    908  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c, which could cause a memory disclosure problem.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d6a5f739-e630-4b2d-a1cb-fdbb49a8472c",  "id": "CVE-2022-49887",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: meson: vdec: fix possible refcount leak in vdec_probe()\n\nv4l2_device_unregister need to be called to put the refcount got by\nv4l2_device_register when vdec_probe fails or vdec_remove is called.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2eaf93c4-b7c2-4c4d-85f3-e9536ea8ba4b",  "id": "AZL-13352",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "535235f7-943e-4c5e-8c25-959041188709",  "id": "CVE-2023-53408",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntrace/blktrace: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic\nat once.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "98ba0e73-5985-43d2-9e8a-7630b52b1d2b",  "id": "CVE-2011-4077",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4077"  },  "ratings": [    {      "score": 6.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "Buffer overflow in the xfs_readlink function in fs/xfs/xfs_vnodeops.c in XFS in the Linux kernel 2.6, when CONFIG_XFS_DEBUG is disabled, allows local users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via an XFS image containing a symbolic link with a long pathname.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "eae873fe-46db-478d-8d6c-c0dc3c420e71",  "id": "CVE-2016-9755",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9755"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "The netfilter subsystem in the Linux kernel before 4.9 mishandles IPv6 reassembly, which allows local users to cause a denial of service (integer overflow, out-of-bounds write, and GPF) or possibly have unspecified other impact via a crafted application that makes socket, connect, and writev system calls, related to net/ipv6/netfilter/nf_conntrack_reasm.c and net/ipv6/netfilter/nf_defrag_ipv6_hooks.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d2263165-2851-4088-b4d2-1203b6893d95",  "id": "AZL-92840",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d9a6b254-c631-4a70-85e3-156bae220a6d",  "id": "CLSA-2025-1759865335",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4cc82ba1-57d7-4292-94d1-5fca247fb57c",  "id": "CVE-2025-39829",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntrace/fgraph: Fix the warning caused by missing unregister notifier\n\nThis warning was triggered during testing on v6.16:\n\nnotifier callback ftrace_suspend_notifier_call already registered\nWARNING: CPU: 2 PID: 86 at kernel/notifier.c:23 notifier_chain_register+0x44/0xb0\n...\nCall Trace:\n <TASK>\n blocking_notifier_chain_register+0x34/0x60\n register_ftrace_graph+0x330/0x410\n ftrace_profile_write+0x1e9/0x340\n vfs_write+0xf8/0x420\n ? filp_flush+0x8a/0xa0\n ? filp_close+0x1f/0x30\n ? do_dup2+0xaf/0x160\n ksys_write+0x65/0xe0\n do_syscall_64+0xa4/0x260\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nWhen writing to the function_profile_enabled interface, the notifier was\nnot unregistered after start_graph_tracing failed, causing a warning the\nnext time function_profile_enabled was written.\n\nFixed by adding unregister_pm_notifier in the exception path.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "212a3439-39cc-4217-bfb4-15e424ccab3f",  "id": "CVE-2026-45988",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix re-decryption of RESPONSE packets\n\nIf a RESPONSE packet gets a temporary failure during processing, it may end\nup in a partially decrypted state - and then get requeued for a retry.\n\nFix this by just discarding the packet; we will send another CHALLENGE\npacket and thereby elicit a further response.  Similarly, discard an\nincoming CHALLENGE packet if we get an error whilst generating a RESPONSE;\nthe server will send another CHALLENGE.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "32b80c13-ff9f-42bc-aee1-fbb69f3cf6c2",  "id": "RHSA-2020:1840",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "502bbbae-44e2-4e4e-b444-a2f3dcfa357e",  "id": "CVE-2022-50211",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd-raid10: fix KASAN warning\n\nThere's a KASAN warning in raid10_remove_disk when running the lvm\ntest lvconvert-raid-reshape.sh. We fix this warning by verifying that the\nvalue \"number\" is valid.\n\nBUG: KASAN: slab-out-of-bounds in raid10_remove_disk+0x61/0x2a0 [raid10]\nRead of size 8 at addr ffff889108f3d300 by task mdX_raid10/124682\n\nCPU: 3 PID: 124682 Comm: mdX_raid10 Not tainted 5.19.0-rc6 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\nCall Trace:\n <TASK>\n dump_stack_lvl+0x34/0x44\n print_report.cold+0x45/0x57a\n ? __lock_text_start+0x18/0x18\n ? raid10_remove_disk+0x61/0x2a0 [raid10]\n kasan_report+0xa8/0xe0\n ? raid10_remove_disk+0x61/0x2a0 [raid10]\n raid10_remove_disk+0x61/0x2a0 [raid10]\nBuffer I/O error on dev dm-76, logical block 15344, async page read\n ? __mutex_unlock_slowpath.constprop.0+0x1e0/0x1e0\n remove_and_add_spares+0x367/0x8a0 [md_mod]\n ? super_written+0x1c0/0x1c0 [md_mod]\n ? mutex_trylock+0xac/0x120\n ? _raw_spin_lock+0x72/0xc0\n ? _raw_spin_lock_bh+0xc0/0xc0\n md_check_recovery+0x848/0x960 [md_mod]\n raid10d+0xcf/0x3360 [raid10]\n ? sched_clock_cpu+0x185/0x1a0\n ? rb_erase+0x4d4/0x620\n ? var_wake_function+0xe0/0xe0\n ? psi_group_change+0x411/0x500\n ? preempt_count_sub+0xf/0xc0\n ? _raw_spin_lock_irqsave+0x78/0xc0\n ? __lock_text_start+0x18/0x18\n ? raid10_sync_request+0x36c0/0x36c0 [raid10]\n ? preempt_count_sub+0xf/0xc0\n ? _raw_spin_unlock_irqrestore+0x19/0x40\n ? del_timer_sync+0xa9/0x100\n ? try_to_del_timer_sync+0xc0/0xc0\n ? _raw_spin_lock_irqsave+0x78/0xc0\n ? __lock_text_start+0x18/0x18\n ? _raw_spin_unlock_irq+0x11/0x24\n ? __list_del_entry_valid+0x68/0xa0\n ? finish_wait+0xa3/0x100\n md_thread+0x161/0x260 [md_mod]\n ? unregister_md_personality+0xa0/0xa0 [md_mod]\n ? _raw_spin_lock_irqsave+0x78/0xc0\n ? prepare_to_wait_event+0x2c0/0x2c0\n ? unregister_md_personality+0xa0/0xa0 [md_mod]\n kthread+0x148/0x180\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x1f/0x30\n </TASK>\n\nAllocated by task 124495:\n kasan_save_stack+0x1e/0x40\n __kasan_kmalloc+0x80/0xa0\n setup_conf+0x140/0x5c0 [raid10]\n raid10_run+0x4cd/0x740 [raid10]\n md_run+0x6f9/0x1300 [md_mod]\n raid_ctr+0x2531/0x4ac0 [dm_raid]\n dm_table_add_target+0x2b0/0x620 [dm_mod]\n table_load+0x1c8/0x400 [dm_mod]\n ctl_ioctl+0x29e/0x560 [dm_mod]\n dm_compat_ctl_ioctl+0x7/0x20 [dm_mod]\n __do_compat_sys_ioctl+0xfa/0x160\n do_syscall_64+0x90/0xc0\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nLast potentially related work creation:\n kasan_save_stack+0x1e/0x40\n __kasan_record_aux_stack+0x9e/0xc0\n kvfree_call_rcu+0x84/0x480\n timerfd_release+0x82/0x140\nL __fput+0xfa/0x400\n task_work_run+0x80/0xc0\n exit_to_user_mode_prepare+0x155/0x160\n syscall_exit_to_user_mode+0x12/0x40\n do_syscall_64+0x42/0xc0\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nSecond to last potentially related work creation:\n kasan_save_stack+0x1e/0x40\n __kasan_record_aux_stack+0x9e/0xc0\n kvfree_call_rcu+0x84/0x480\n timerfd_release+0x82/0x140\n __fput+0xfa/0x400\n task_work_run+0x80/0xc0\n exit_to_user_mode_prepare+0x155/0x160\n syscall_exit_to_user_mode+0x12/0x40\n do_syscall_64+0x42/0xc0\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThe buggy address belongs to the object at ffff889108f3d200\n which belongs to the cache kmalloc-256 of size 256\nThe buggy address is located 0 bytes to the right of\n 256-byte region [ffff889108f3d200, ffff889108f3d300)\n\nThe buggy address belongs to the physical page:\npage:000000007ef2a34c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1108f3c\nhead:000000007ef2a34c order:2 compound_mapcount:0 compound_pincount:0\nflags: 0x4000000000010200(slab|head|zone=2)\nraw: 4000000000010200 0000000000000000 dead000000000001 ffff889100042b40\nraw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff889108f3d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff889108f3d280: 00 00\n---truncated---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cacbe6ff-e109-43d2-905a-e012df266a3f",  "id": "CVE-2023-1476",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1476"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "40a21095-9436-4eae-b6d2-aee580734b7e",  "id": "CVE-2023-52878",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds\n\nIf the \"struct can_priv::echoo_skb\" is accessed out of bounds, this\nwould cause a kernel crash. Instead, issue a meaningful warning\nmessage and return with an error.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "30709bca-107f-4976-864a-2f4d78dcc78a",  "id": "CVE-2022-45888",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45888"  },  "ratings": [    {      "score": 6.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of a USB device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "77186fc0-3a60-4da4-bb0d-aca51c79dbde",  "id": "DSA-4963-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b230ac70-c8f6-48ac-a2cf-cdd3a910f1b5",  "id": "CVE-2014-8709",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8709"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fd206994-e110-4e75-ab81-f5adf40f3049",  "id": "CVE-2019-14763",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14763"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/gadget.c may potentially cause a deadlock with f_hid.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2144f1b3-b12e-4f83-b54c-895d6cdc1c78",  "id": "CLSA-2026-1777567430",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c3024aa4-45d7-4db8-a4ab-5f1b9486a7a4",  "id": "CLSA-2026-1778071148",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3b5fbe6d-72af-46cc-8ccb-06ae3f1c06df",  "id": "DSA-4855-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "43cf1556-6d60-4b1f-9881-7db42e49fad4",  "id": "CVE-2025-38602",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    252  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\niwlwifi: Add missing check for alloc_ordered_workqueue\n\nAdd check for the return value of alloc_ordered_workqueue since it may\nreturn NULL pointer.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2add984-30ed-4a27-9a92-fca8d0e0026c",  "id": "CVE-2022-26966",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26966"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from heap memory via crafted frame lengths from a device.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fb135372-6314-425a-91b7-523515d62394",  "id": "DSA-3500-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4bc5f391-6761-48f6-8fa4-81b9e66fffc0",  "id": "CVE-2015-1788",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1788"  },  "ratings": [    {      "score": 4.3,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allows remote attackers to cause a denial of service (infinite loop) via a session that uses an Elliptic Curve algorithm, as demonstrated by an attack against a server that supports client authentication.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f0b1cddb-90cc-4f45-afb5-23d0d76a5e14",  "id": "CVE-2018-1108",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1108"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    330  ],  "analysis": {    "state": "in_triage"  },  "description": "kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'PSS:147423/Linux-RNG-Flaws.html'"    }  ]},{  "bom-ref": "91dd4e65-9409-450d-a262-654e6ee2b90c",  "id": "CVE-2024-53090",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    674  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix lock recursion\n\nafs_wake_up_async_call() can incur lock recursion.  The problem is that it\nis called from AF_RXRPC whilst holding the ->notify_lock, but it tries to\ntake a ref on the afs_call struct in order to pass it to a work queue - but\nif the afs_call is already queued, we then have an extraneous ref that must\nbe put... calling afs_put_call() may call back down into AF_RXRPC through\nrxrpc_kernel_shutdown_call(), however, which might try taking the\n->notify_lock again.\n\nThis case isn't very common, however, so defer it to a workqueue.  The oops\nlooks something like:\n\n  BUG: spinlock recursion on CPU#0, krxrpcio/7001/1646\n   lock: 0xffff888141399b30, .magic: dead4ead, .owner: krxrpcio/7001/1646, .owner_cpu: 0\n  CPU: 0 UID: 0 PID: 1646 Comm: krxrpcio/7001 Not tainted 6.12.0-rc2-build3+ #4351\n  Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x47/0x70\n   do_raw_spin_lock+0x3c/0x90\n   rxrpc_kernel_shutdown_call+0x83/0xb0\n   afs_put_call+0xd7/0x180\n   rxrpc_notify_socket+0xa0/0x190\n   rxrpc_input_split_jumbo+0x198/0x1d0\n   rxrpc_input_data+0x14b/0x1e0\n   ? rxrpc_input_call_packet+0xc2/0x1f0\n   rxrpc_input_call_event+0xad/0x6b0\n   rxrpc_input_packet_on_conn+0x1e1/0x210\n   rxrpc_input_packet+0x3f2/0x4d0\n   rxrpc_io_thread+0x243/0x410\n   ? __pfx_rxrpc_io_thread+0x10/0x10\n   kthread+0xcf/0xe0\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork+0x24/0x40\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork_asm+0x1a/0x30\n   </TASK>",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b32dc5a7-973e-4d20-9c00-4b7e69b7447c",  "id": "CVE-2026-64191",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: stub: Reject I2C block transfers with invalid length\n\nThe I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]\nas the transfer length. The existing check only clamps it to avoid\noverrunning the chip->words[256] register array, but does not validate\nit against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union\ni2c_smbus_data.block buffer (34 bytes total). The driver is a\ndevelopment/test tool (CONFIG_I2C_STUB=m, not built by default)\nthat must be loaded with a chip_addr= parameter.\n\nA local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl\nwith I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing\nstub_xfer() to read or write past the end of the union\ni2c_smbus_data.block buffer:\n\n BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)\n Read of size 1 at addr ffff88800abcfd92 by task exploit/81\n Call Trace:\n  <TASK>\n  stub_xfer (drivers/i2c/i2c-stub.c:223)\n  __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)\n  i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)\n  i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)\n  i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)\n  __x64_sys_ioctl (fs/ioctl.c:583)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  </TASK>\n\nThe bug exists because i2c-stub implements .smbus_xfer directly,\nbypassing the I2C_SMBUS_BLOCK_MAX validation in\ni2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same\nfunction correctly validates against I2C_SMBUS_BLOCK_MAX, but the\nI2C_SMBUS_I2C_BLOCK_DATA case does not.\n\nFix by rejecting transfers with data->block[0] == 0 or\ndata->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with\nboth the I2C_SMBUS_BLOCK_DATA case in the same function and the\nI2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "dd364f2c-4c3f-47d8-a46d-f44be765f844",  "id": "CVE-2017-12154",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12154"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the \"CR8-load exiting\" and \"CR8-store exiting\" L0 vmcs02 controls exist in cases where L1 omits the \"use TPR shadow\" vmcs12 control, which allows KVM L2 guest OS users to obtain read and write access to the hardware CR8 register.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "38301009-fd7d-4af1-9718-af3bba52683e",  "id": "CVE-2016-3070",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3070"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "The trace_writeback_dirty_page implementation in include/trace/events/writeback.h in the Linux kernel before 4.4 improperly interacts with mm/migrate.c, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "918666f6-b3df-4ae2-942c-2b1d908672ba",  "id": "CVE-2024-46802",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: added NULL check at start of dc_validate_stream\n\n[Why]\nprevent invalid memory access\n\n[How]\ncheck if dc and stream are NULL",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f124a3ff-54a0-4569-88c5-d8d6c89c7bc1",  "id": "CVE-2023-53151",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: prevent soft lockup while flush writes\n\nCurrently, there is no limit for raid1/raid10 plugged bio. While flushing\nwrites, raid1 has cond_resched() while raid10 doesn't, and too many\nwrites can cause soft lockup.\n\nFollow up soft lockup can be triggered easily with writeback test for\nraid10 with ramdisks:\n\nwatchdog: BUG: soft lockup - CPU#10 stuck for 27s! [md0_raid10:1293]\nCall Trace:\n <TASK>\n call_rcu+0x16/0x20\n put_object+0x41/0x80\n __delete_object+0x50/0x90\n delete_object_full+0x2b/0x40\n kmemleak_free+0x46/0xa0\n slab_free_freelist_hook.constprop.0+0xed/0x1a0\n kmem_cache_free+0xfd/0x300\n mempool_free_slab+0x1f/0x30\n mempool_free+0x3a/0x100\n bio_free+0x59/0x80\n bio_put+0xcf/0x2c0\n free_r10bio+0xbf/0xf0\n raid_end_bio_io+0x78/0xb0\n one_write_done+0x8a/0xa0\n raid10_end_write_request+0x1b4/0x430\n bio_endio+0x175/0x320\n brd_submit_bio+0x3b9/0x9b7 [brd]\n __submit_bio+0x69/0xe0\n submit_bio_noacct_nocheck+0x1e6/0x5a0\n submit_bio_noacct+0x38c/0x7e0\n flush_pending_writes+0xf0/0x240\n raid10d+0xac/0x1ed0\n\nFix the problem by adding cond_resched() to raid10 like what raid1 did.\n\nNote that unlimited plugged bio still need to be optimized, for example,\nin the case of lots of dirty pages writeback, this will take lots of\nmemory and io will spend a long time in plug, hence io latency is bad.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8c53752d-95b4-485e-95e5-8e8bde68fea1",  "id": "CVE-2016-0723",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0723"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    200,    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "9437b4bf-48c2-41f0-9aad-511c0ac9b794",  "id": "CVE-2022-49674",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm raid: fix accesses beyond end of raid member array\n\nOn dm-raid table load (using raid_ctr), dm-raid allocates an array\nrs->devs[rs->raid_disks] for the raid device members. rs->raid_disks\nis defined by the number of raid metadata and image tupples passed\ninto the target's constructor.\n\nIn the case of RAID layout changes being requested, that number can be\ndifferent from the current number of members for existing raid sets as\ndefined in their superblocks. Example RAID layout changes include:\n- raid1 legs being added/removed\n- raid4/5/6/10 number of stripes changed (stripe reshaping)\n- takeover to higher raid level (e.g. raid5 -> raid6)\n\nWhen accessing array members, rs->raid_disks must be used in control\nloops instead of the potentially larger value in rs->md.raid_disks.\nOtherwise it will cause memory access beyond the end of the rs->devs\narray.\n\nFix this by changing code that is prone to out-of-bounds access.\nAlso fix validate_raid_redundancy() to validate all devices that are\nadded. Also, use braces to help clean up raid_iterate_devices().\n\nThe out-of-bounds memory accesses was discovered using KASAN.\n\nThis commit was verified to pass all LVM2 RAID tests (with KASAN\nenabled).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "520088c2-bdc3-42b4-b508-29cb77e7c342",  "id": "CVE-2023-52511",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: sun6i: reduce DMA RX transfer width to single byte\n\nThrough empirical testing it has been determined that sometimes RX SPI\ntransfers with DMA enabled return corrupted data. This is down to single\nor even multiple bytes lost during DMA transfer from SPI peripheral to\nmemory. It seems the RX FIFO within the SPI peripheral can become\nconfused when performing bus read accesses wider than a single byte to it\nduring an active SPI transfer.\n\nThis patch reduces the width of individual DMA read accesses to the\nRX FIFO to a single byte to mitigate that issue.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ace92a9f-0a55-441d-b3b5-a620ed5d81b6",  "id": "openSUSE-SU-2026:20090-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6e9c5e05-f380-4064-b334-c33a6636c875",  "id": "CVE-2022-0812",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0812"  },  "ratings": [    {      "score": 4.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    200  ],  "analysis": {    "state": "in_triage"  },  "description": "An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux Kernel. This flaw allows an attacker with normal user privileges to leak kernel information.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fe25a5ad-58d4-4f36-8a14-00a900025bba",  "id": "CVE-2017-16530",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16530"  },  "ratings": [    {      "score": 6.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to drivers/usb/storage/uas-detect.h and drivers/usb/storage/uas.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f6719e86-b221-404f-a597-d4641859f95c",  "id": "SUSE-SU-2026:22020-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b5e2982d-f073-4bc4-b44b-71ac9f6824e7",  "id": "CVE-2022-28390",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28390"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "3170f1c4-3a50-4cf9-8c45-6979651cbd21",  "id": "CVE-2023-53540",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: reject auth/assoc to AP with our address\n\nIf the AP uses our own address as its MLD address or BSSID, then\nclearly something's wrong. Reject such connections so we don't\ntry and fail later.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4c7ccc33-cd64-4ac3-a03d-f0a5b89f406d",  "id": "CVE-2025-39847",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: fix memory leak in pad_compress_skb\n\nIf alloc_skb() fails in pad_compress_skb(), it returns NULL without\nreleasing the old skb. The caller does:\n\n    skb = pad_compress_skb(ppp, skb);\n    if (!skb)\n        goto drop;\n\ndrop:\n    kfree_skb(skb);\n\nWhen pad_compress_skb() returns NULL, the reference to the old skb is\nlost and kfree_skb(skb) ends up doing nothing, leading to a memory leak.\n\nAlign pad_compress_skb() semantics with realloc(): only free the old\nskb if allocation and compression succeed.  At the call site, use the\nnew_skb variable so the original skb is not lost when pad_compress_skb()\nfails.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d0603964-ea40-4e60-9008-846eeb0bdefe",  "id": "CVE-2026-23243",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umad: Reject negative data_len in ib_umad_write\n\nib_umad_write computes data_len from user-controlled count and the\nMAD header sizes. With a mismatched user MAD header size and RMPP\nheader length, data_len can become negative and reach ib_create_send_mad().\nThis can make the padding calculation exceed the segment size and trigger\nan out-of-bounds memset in alloc_send_rmpp_list().\n\nAdd an explicit check to reject negative data_len before creating the\nsend buffer.\n\nKASAN splat:\n[  211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0\n[  211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102\n[  211.365867] ib_create_send_mad+0xa01/0x11b0\n[  211.365887] ib_umad_write+0x853/0x1c80",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2c095bcf-720f-450b-b095-14092ebc432b",  "id": "CVE-2013-0217",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0217"  },  "ratings": [    {      "score": 5.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:M/Au:S/C:N/I:N/A:C"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "481e5a69-1207-4253-ba85-6ea68991e2c5",  "id": "CVE-2021-33656",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33656"  },  "ratings": [    {      "score": 6.8,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f53a21f5-0d98-44c0-8ebe-f8ee6aa7a7b2",  "id": "CVE-2024-41060",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: check bo_va->bo is non-NULL before using it\n\nThe call to radeon_vm_clear_freed might clear bo_va->bo, so\nwe have to check it before dereferencing it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "456f0164-f594-41f1-989d-dab1d53e7aa7",  "id": "CVE-2026-43190",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.199999999999999,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_tcpmss: check remaining length before reading optlen\n\nQuoting reporter:\n  In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads\n op[i+1] directly without validating the remaining option length.\n\n  If the last byte of the option field is not EOL/NOP (0/1), the code attempts\n  to index op[i+1]. In the case where i + 1 == optlen, this causes an\n  out-of-bounds read, accessing memory past the optlen boundary\n  (either reading beyond the stack buffer _opt or the\n  following payload).",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "43e5abed-cc16-47ae-9c6c-046f39a188d9",  "id": "RHSA-2026:1473",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f85b6700-eb68-4afc-a811-8c889f7619fe",  "id": "CVE-2025-37740",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    369  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: add sanity check for agwidth in dbMount\n\nThe width in dmapctl of the AG is zero, it trigger a divide error when\ncalculating the control page level in dbAllocAG.\n\nTo avoid this issue, add a check for agwidth in dbAllocAG.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1031ab2d-4979-4ff3-b8fc-7f1e02b46683",  "id": "CVE-2024-57809",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: imx6: Fix suspend/resume support on i.MX6QDL\n\nThe suspend/resume functionality is currently broken on the i.MX6QDL\nplatform, as documented in the NXP errata (ERR005723):\n\n  https://www.nxp.com/docs/en/errata/IMX6DQCE.pdf\n\nThis patch addresses the issue by sharing most of the suspend/resume\nsequences used by other i.MX devices, while avoiding modifications to\ncritical registers that disrupt the PCIe functionality. It targets the\nsame problem as the following downstream commit:\n\n  https://github.com/nxp-imx/linux-imx/commit/4e92355e1f79d225ea842511fcfd42b343b32995\n\nUnlike the downstream commit, this patch also resets the connected PCIe\ndevice if possible. Without this reset, certain drivers, such as ath10k\nor iwlwifi, will crash on resume. The device reset is also done by the\ndriver on other i.MX platforms, making this patch consistent with\nexisting practices.\n\nUpon resuming, the kernel will hang and display an error. Here's an\nexample of the error encountered with the ath10k driver:\n\n  ath10k_pci 0000:01:00.0: Unable to change power state from D3hot to D0, device inaccessible\n  Unhandled fault: imprecise external abort (0x1406) at 0x0106f944\n\nWithout this patch, suspend/resume will fail on i.MX6QDL devices if a\nPCIe device is connected.\n\n[kwilczynski: commit log, added tag for stable releases]",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "37741b68-1321-40c1-bdd0-be46e682fc9c",  "id": "CVE-2016-10743",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10743"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    332  ],  "analysis": {    "state": "in_triage"  },  "description": "hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.",  "affects": [    {      "ref": "4ad2d68d-e2cd-48fc-9790-822e0c9cca9b",      "versions": [        {          "component": "hostapd",          "version": "0.4.8"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ac66b177-b8a5-4e6d-a3d2-225e2b5d4872",  "id": "CVE-2013-0166",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0166"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b35d868b-2749-4ab5-8e9d-f248e9af721f",  "id": "CVE-2024-42147",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/debugfs - Fix debugfs uninit process issue\n\nDuring the zip probe process, the debugfs failure does not stop\nthe probe. When debugfs initialization fails, jumping to the\nerror branch will also release regs, in addition to its own\nrollback operation.\n\nAs a result, it may be released repeatedly during the regs\nuninit process. Therefore, the null check needs to be added to\nthe regs uninit process.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4f654587-06a2-4321-b662-4f168c705cf1",  "id": "CVE-2022-49542",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    667  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg()\n\nIn an attempt to log message 0126 with LOG_TRACE_EVENT, the following hard\nlockup call trace hangs the system.\n\nCall Trace:\n _raw_spin_lock_irqsave+0x32/0x40\n lpfc_dmp_dbg.part.32+0x28/0x220 [lpfc]\n lpfc_cmpl_els_fdisc+0x145/0x460 [lpfc]\n lpfc_sli_cancel_jobs+0x92/0xd0 [lpfc]\n lpfc_els_flush_cmd+0x43c/0x670 [lpfc]\n lpfc_els_flush_all_cmd+0x37/0x60 [lpfc]\n lpfc_sli4_async_event_proc+0x956/0x1720 [lpfc]\n lpfc_do_work+0x1485/0x1d70 [lpfc]\n kthread+0x112/0x130\n ret_from_fork+0x1f/0x40\nKernel panic - not syncing: Hard LOCKUP\n\nThe same CPU tries to claim the phba->port_list_lock twice.\n\nMove the cfg_log_verbose checks as part of the lpfc_printf_vlog() and\nlpfc_printf_log() macros before calling lpfc_dmp_dbg().  There is no need\nto take the phba->port_list_lock within lpfc_dmp_dbg().",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6f3c1657-1a19-4cf7-a8a4-e086b5a1c6c5",  "id": "CVE-2018-10880",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10880"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7a34a056-c1fa-4186-a27e-708e5506cc3c",  "id": "CVE-2025-39748",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Forget ranges when refining tnum after JSET\n\nSyzbot reported a kernel warning due to a range invariant violation on\nthe following BPF program.\n\n  0: call bpf_get_netns_cookie\n  1: if r0 == 0 goto <exit>\n  2: if r0 & Oxffffffff goto <exit>\n\nThe issue is on the path where we fall through both jumps.\n\nThat path is unreachable at runtime: after insn 1, we know r0 != 0, but\nwith the sign extension on the jset, we would only fallthrough insn 2\nif r0 == 0. Unfortunately, is_branch_taken() isn't currently able to\nfigure this out, so the verifier walks all branches. The verifier then\nrefines the register bounds using the second condition and we end\nup with inconsistent bounds on this unreachable path:\n\n  1: if r0 == 0 goto <exit>\n    r0: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0xffffffffffffffff)\n  2: if r0 & 0xffffffff goto <exit>\n    r0 before reg_bounds_sync: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0)\n    r0 after reg_bounds_sync:  u64=[0x1, 0] var_off=(0, 0)\n\nImproving the range refinement for JSET to cover all cases is tricky. We\nalso don't expect many users to rely on JSET given LLVM doesn't generate\nthose instructions. So instead of improving the range refinement for\nJSETs, Eduard suggested we forget the ranges whenever we're narrowing\ntnums after a JSET. This patch implements that approach.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2daaff17-e076-445b-92cd-2acdd4a5f53e",  "id": "RLSA-2026:0337",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cd60d1ab-67f4-49f0-ad7a-486ae022cc5a",  "id": "CVE-2022-50381",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix a crash in mempool_free\n\nThere's a crash in mempool_free when running the lvm test\nshell/lvchange-rebuild-raid.sh.\n\nThe reason for the crash is this:\n* super_written calls atomic_dec_and_test(&mddev->pending_writes) and\n  wake_up(&mddev->sb_wait). Then it calls rdev_dec_pending(rdev, mddev)\n  and bio_put(bio).\n* so, the process that waited on sb_wait and that is woken up is racing\n  with bio_put(bio).\n* if the process wins the race, it calls bioset_exit before bio_put(bio)\n  is executed.\n* bio_put(bio) attempts to free a bio into a destroyed bio set - causing\n  a crash in mempool_free.\n\nWe fix this bug by moving bio_put before atomic_dec_and_test.\n\nWe also move rdev_dec_pending before atomic_dec_and_test as suggested by\nNeil Brown.\n\nThe function md_end_flush has a similar bug - we must call bio_put before\nwe decrement the number of in-progress bios.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 11557f0067 P4D 11557f0067 PUD 0\n Oops: 0002 [#1] PREEMPT SMP\n CPU: 0 PID: 73 Comm: kworker/0:1 Not tainted 6.1.0-rc3 #5\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\n Workqueue: kdelayd flush_expired_bios [dm_delay]\n RIP: 0010:mempool_free+0x47/0x80\n Code: 48 89 ef 5b 5d ff e0 f3 c3 48 89 f7 e8 32 45 3f 00 48 63 53 08 48 89 c6 3b 53 04 7d 2d 48 8b 43 10 8d 4a 01 48 89 df 89 4b 08 <48> 89 2c d0 e8 b0 45 3f 00 48 8d 7b 30 5b 5d 31 c9 ba 01 00 00 00\n RSP: 0018:ffff88910036bda8 EFLAGS: 00010093\n RAX: 0000000000000000 RBX: ffff8891037b65d8 RCX: 0000000000000001\n RDX: 0000000000000000 RSI: 0000000000000202 RDI: ffff8891037b65d8\n RBP: ffff8891447ba240 R08: 0000000000012908 R09: 00000000003d0900\n R10: 0000000000000000 R11: 0000000000173544 R12: ffff889101a14000\n R13: ffff8891562ac300 R14: ffff889102b41440 R15: ffffe8ffffa00d05\n FS:  0000000000000000(0000) GS:ffff88942fa00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 0000001102e99000 CR4: 00000000000006b0\n Call Trace:\n  <TASK>\n  clone_endio+0xf4/0x1c0 [dm_mod]\n  clone_endio+0xf4/0x1c0 [dm_mod]\n  __submit_bio+0x76/0x120\n  submit_bio_noacct_nocheck+0xb6/0x2a0\n  flush_expired_bios+0x28/0x2f [dm_delay]\n  process_one_work+0x1b4/0x300\n  worker_thread+0x45/0x3e0\n  ? rescuer_thread+0x380/0x380\n  kthread+0xc2/0x100\n  ? kthread_complete_and_exit+0x20/0x20\n  ret_from_fork+0x1f/0x30\n  </TASK>\n Modules linked in: brd dm_delay dm_raid dm_mod af_packet uvesafb cfbfillrect cfbimgblt cn cfbcopyarea fb font fbdev tun autofs4 binfmt_misc configfs ipv6 virtio_rng virtio_balloon rng_core virtio_net pcspkr net_failover failover qemu_fw_cfg button mousedev raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq raid6_pq async_xor xor async_tx raid1 raid0 md_mod sd_mod t10_pi crc64_rocksoft crc64 virtio_scsi scsi_mod evdev psmouse bsg scsi_common [last unloaded: brd]\n CR2: 0000000000000000\n ---[ end trace 0000000000000000 ]---",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2e2fd062-2dcc-4f35-be16-e7691e906d70",  "id": "CVE-2021-47498",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47498"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm rq: don't queue request to blk-mq during DM suspend\n\nDM uses blk-mq's quiesce/unquiesce to stop/start device mapper queue.\n\nBut blk-mq's unquiesce may come from outside events, such as elevator\nswitch, updating nr_requests or others, and request may come during\nsuspend, so simply ask for blk-mq to requeue it.\n\nFixes one kernel panic issue when running updating nr_requests and\ndm-mpath suspend/resume stress test.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "192eec38-5346-466b-9266-21ce1c7837d2",  "id": "OESA-2026-1466",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 4.7,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52b8507b-1db7-40de-b7ce-3b1d3b415f20",  "id": "CVE-2024-26903",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security\n\nDuring our fuzz testing of the connection and disconnection process at the\nRFCOMM layer, we discovered this bug. By comparing the packets from a\nnormal connection and disconnection process with the testcase that\ntriggered a KASAN report. We analyzed the cause of this bug as follows:\n\n1. In the packets captured during a normal connection, the host sends a\n`Read Encryption Key Size` type of `HCI_CMD` packet\n(Command Opcode: 0x1408) to the controller to inquire the length of\nencryption key.After receiving this packet, the controller immediately\nreplies with a Command Completepacket (Event Code: 0x0e) to return the\nEncryption Key Size.\n\n2. In our fuzz test case, the timing of the controller's response to this\npacket was delayed to an unexpected point: after the RFCOMM and L2CAP\nlayers had disconnected but before the HCI layer had disconnected.\n\n3. After receiving the Encryption Key Size Response at the time described\nin point 2, the host still called the rfcomm_check_security function.\nHowever, by this time `struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;`\nhad already been released, and when the function executed\n`return hci_conn_security(conn->hcon, d->sec_level, auth_type, d->out);`,\nspecifically when accessing `conn->hcon`, a null-ptr-deref error occurred.\n\nTo fix this bug, check if `sk->sk_state` is BT_CLOSED before calling\nrfcomm_recv_frame in rfcomm_process_rx.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "691410c9-419b-4511-9631-358d0c1082d4",  "id": "CVE-2024-53051",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hdcp: Add encoder check in intel_hdcp_get_capability\n\nSometimes during hotplug scenario or suspend/resume scenario encoder is\nnot always initialized when intel_hdcp_get_capability add\na check to avoid kernel null pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed7787ff-7a00-48f0-9fc7-970ae5502e46",  "id": "CVE-2017-18552",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18552"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b025ed1a-f1c9-40ba-810b-75caf4a9a91c",  "id": "CVE-2024-38599",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: prevent xattr node from overflowing the eraseblock\n\nAdd a check to make sure that the requested xattr node size is no larger\nthan the eraseblock minus the cleanmarker.\n\nUnlike the usual inode nodes, the xattr nodes aren't split into parts\nand spread across multiple eraseblocks, which means that a xattr node\nmust not occupy more than one eraseblock. If the requested xattr value is\ntoo large, the xattr node can spill onto the next eraseblock, overwriting\nthe nodes and causing errors such as:\n\njffs2: argh. node added in wrong place at 0x0000b050(2)\njffs2: nextblock 0x0000a000, expected at 0000b00c\njffs2: error: (823) do_verify_xattr_datum: node CRC failed at 0x01e050,\nread=0xfc892c93, calc=0x000000\njffs2: notice: (823) jffs2_get_inode_nodes: Node header CRC failed\nat 0x01e00c. {848f,2fc4,0fef511f,59a3d171}\njffs2: Node at 0x0000000c with length 0x00001044 would run over the\nend of the erase block\njffs2: Perhaps the file system was created with the wrong erase size?\njffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found\nat 0x00000010: 0x1044 instead\n\nThis breaks the filesystem and can lead to KASAN crashes such as:\n\nBUG: KASAN: slab-out-of-bounds in jffs2_sum_add_kvec+0x125e/0x15d0\nRead of size 4 at addr ffff88802c31e914 by task repro/830\nCPU: 0 PID: 830 Comm: repro Not tainted 6.9.0-rc3+ #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS Arch Linux 1.16.3-1-1 04/01/2014\nCall Trace:\n <TASK>\n dump_stack_lvl+0xc6/0x120\n print_report+0xc4/0x620\n ? __virt_addr_valid+0x308/0x5b0\n kasan_report+0xc1/0xf0\n ? jffs2_sum_add_kvec+0x125e/0x15d0\n ? jffs2_sum_add_kvec+0x125e/0x15d0\n jffs2_sum_add_kvec+0x125e/0x15d0\n jffs2_flash_direct_writev+0xa8/0xd0\n jffs2_flash_writev+0x9c9/0xef0\n ? __x64_sys_setxattr+0xc4/0x160\n ? do_syscall_64+0x69/0x140\n ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n [...]\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ba9f16db-2ea7-488b-b6c5-f3447c1b2142",  "id": "CVE-2011-4098",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4098"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    119  ],  "analysis": {    "state": "in_triage"  },  "description": "The fallocate implementation in the GFS2 filesystem in the Linux kernel before 3.2 relies on the page cache, which might allow local users to cause a denial of service by preallocating blocks in certain situations involving insufficient memory.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "883f14ae-4fca-4eab-a916-f32870cc253b",  "id": "CVE-2022-49864",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram()\n\n./drivers/gpu/drm/amd/amdkfd/kfd_migrate.c:985:58-62: ERROR: p is NULL but dereferenced.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6abdb39e-e2bd-49cc-880c-fc30145b0ab1",  "id": "CVE-2024-56650",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: fix LED ID check in led_tg_check()\n\nSyzbot has reported the following BUG detected by KASAN:\n\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\n...\nCall Trace:\n <TASK>\n dump_stack_lvl+0x241/0x360\n ? __pfx_dump_stack_lvl+0x10/0x10\n ? __pfx__printk+0x10/0x10\n ? _printk+0xd5/0x120\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n print_report+0x169/0x550\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x45f/0x530\n ? __phys_addr+0xba/0x170\n ? strlen+0x58/0x70\n kasan_report+0x143/0x180\n ? strlen+0x58/0x70\n strlen+0x58/0x70\n kstrdup+0x20/0x80\n led_tg_check+0x18b/0x3c0\n xt_check_target+0x3bb/0xa40\n ? __pfx_xt_check_target+0x10/0x10\n ? stack_depot_save_flags+0x6e4/0x830\n ? nft_target_init+0x174/0xc30\n nft_target_init+0x82d/0xc30\n ? __pfx_nft_target_init+0x10/0x10\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? rcu_is_watching+0x15/0xb0\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? __kmalloc_noprof+0x21a/0x400\n nf_tables_newrule+0x1860/0x2980\n ? __pfx_nf_tables_newrule+0x10/0x10\n ? __nla_parse+0x40/0x60\n nfnetlink_rcv+0x14e5/0x2ab0\n ? __pfx_validate_chain+0x10/0x10\n ? __pfx_nfnetlink_rcv+0x10/0x10\n ? __lock_acquire+0x1384/0x2050\n ? netlink_deliver_tap+0x2e/0x1b0\n ? __pfx_lock_release+0x10/0x10\n ? netlink_deliver_tap+0x2e/0x1b0\n netlink_unicast+0x7f8/0x990\n ? __pfx_netlink_unicast+0x10/0x10\n ? __virt_addr_valid+0x183/0x530\n ? __check_object_size+0x48e/0x900\n netlink_sendmsg+0x8e4/0xcb0\n ? __pfx_netlink_sendmsg+0x10/0x10\n ? aa_sock_msg_perm+0x91/0x160\n ? __pfx_netlink_sendmsg+0x10/0x10\n __sock_sendmsg+0x223/0x270\n ____sys_sendmsg+0x52a/0x7e0\n ? __pfx_____sys_sendmsg+0x10/0x10\n __sys_sendmsg+0x292/0x380\n ? __pfx___sys_sendmsg+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\n ? exc_page_fault+0x590/0x8c0\n ? do_syscall_64+0xb6/0x230\n do_syscall_64+0xf3/0x230\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n </TASK>\n\nSince an invalid (without '\\0' byte at all) byte sequence may be passed\nfrom userspace, add an extra check to ensure that such a sequence is\nrejected as possible ID and so never passed to 'kstrdup()' and further.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0a1a5b30-1bed-46d3-a641-dcf8f269f05c",  "id": "CVE-2024-50111",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Enable IRQ if do_ale() triggered in irq-enabled context\n\nUnaligned access exception can be triggered in irq-enabled context such\nas user mode, in this case do_ale() may call get_user() which may cause\nsleep. Then we will get:\n\n BUG: sleeping function called from invalid context at arch/loongarch/kernel/access-helper.h:7\n in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 129, name: modprobe\n preempt_count: 0, expected: 0\n RCU nest depth: 0, expected: 0\n CPU: 0 UID: 0 PID: 129 Comm: modprobe Tainted: G        W          6.12.0-rc1+ #1723\n Tainted: [W]=WARN\n Stack : 9000000105e0bd48 0000000000000000 9000000003803944 9000000105e08000\n         9000000105e0bc70 9000000105e0bc78 0000000000000000 0000000000000000\n         9000000105e0bc78 0000000000000001 9000000185e0ba07 9000000105e0b890\n         ffffffffffffffff 9000000105e0bc78 73924b81763be05b 9000000100194500\n         000000000000020c 000000000000000a 0000000000000000 0000000000000003\n         00000000000023f0 00000000000e1401 00000000072f8000 0000007ffbb0e260\n         0000000000000000 0000000000000000 9000000005437650 90000000055d5000\n         0000000000000000 0000000000000003 0000007ffbb0e1f0 0000000000000000\n         0000005567b00490 0000000000000000 9000000003803964 0000007ffbb0dfec\n         00000000000000b0 0000000000000007 0000000000000003 0000000000071c1d\n         ...\n Call Trace:\n [<9000000003803964>] show_stack+0x64/0x1a0\n [<9000000004c57464>] dump_stack_lvl+0x74/0xb0\n [<9000000003861ab4>] __might_resched+0x154/0x1a0\n [<900000000380c96c>] emulate_load_store_insn+0x6c/0xf60\n [<9000000004c58118>] do_ale+0x78/0x180\n [<9000000003801bc8>] handle_ale+0x128/0x1e0\n\nSo enable IRQ if unaligned access exception is triggered in irq-enabled\ncontext to fix it.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c8cede9b-4379-48ea-ad42-f1d382a662cd",  "id": "CVE-2010-4243",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4243"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial of service (memory consumption) via a crafted exec system call, aka an \"OOM dodging issue,\" a related issue to CVE-2010-3858.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:15619'"    }  ]},{  "bom-ref": "3dff2858-28a3-429a-9dac-e424f7ab1a50",  "id": "RHSA-2016:0722",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "02698ee0-179e-43f6-b314-e9b4e523f633",  "id": "MGASA-2014-0165",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "949acd6f-5668-4968-8be6-fe218d8f4799",  "id": "CVE-2025-38323",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atm: add lec_mutex\n\nsyzbot found its way in net/atm/lec.c, and found an error path\nin lecd_attach() could leave a dangling pointer in dev_lec[].\n\nAdd a mutex to protect dev_lecp[] uses from lecd_attach(),\nlec_vcc_attach() and lec_mcast_attach().\n\nFollowing patch will use this mutex for /proc/net/atm/lec.\n\nBUG: KASAN: slab-use-after-free in lecd_attach net/atm/lec.c:751 [inline]\nBUG: KASAN: slab-use-after-free in lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008\nRead of size 8 at addr ffff88807c7b8e68 by task syz.1.17/6142\n\nCPU: 1 UID: 0 PID: 6142 Comm: syz.1.17 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025\nCall Trace:\n <TASK>\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n  print_address_description mm/kasan/report.c:408 [inline]\n  print_report+0xcd/0x680 mm/kasan/report.c:521\n  kasan_report+0xe0/0x110 mm/kasan/report.c:634\n  lecd_attach net/atm/lec.c:751 [inline]\n  lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008\n  do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159\n  sock_do_ioctl+0x118/0x280 net/socket.c:1190\n  sock_ioctl+0x227/0x6b0 net/socket.c:1311\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\n  __se_sys_ioctl fs/ioctl.c:893 [inline]\n  __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nAllocated by task 6132:\n  kasan_save_stack+0x33/0x60 mm/kasan/common.c:47\n  kasan_save_track+0x14/0x30 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n  __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394\n  kasan_kmalloc include/linux/kasan.h:260 [inline]\n  __do_kmalloc_node mm/slub.c:4328 [inline]\n  __kvmalloc_node_noprof+0x27b/0x620 mm/slub.c:5015\n  alloc_netdev_mqs+0xd2/0x1570 net/core/dev.c:11711\n  lecd_attach net/atm/lec.c:737 [inline]\n  lane_ioctl+0x17db/0x23e0 net/atm/lec.c:1008\n  do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159\n  sock_do_ioctl+0x118/0x280 net/socket.c:1190\n  sock_ioctl+0x227/0x6b0 net/socket.c:1311\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\n  __se_sys_ioctl fs/ioctl.c:893 [inline]\n  __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 6132:\n  kasan_save_stack+0x33/0x60 mm/kasan/common.c:47\n  kasan_save_track+0x14/0x30 mm/kasan/common.c:68\n  kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576\n  poison_slab_object mm/kasan/common.c:247 [inline]\n  __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264\n  kasan_slab_free include/linux/kasan.h:233 [inline]\n  slab_free_hook mm/slub.c:2381 [inline]\n  slab_free mm/slub.c:4643 [inline]\n  kfree+0x2b4/0x4d0 mm/slub.c:4842\n  free_netdev+0x6c5/0x910 net/core/dev.c:11892\n  lecd_attach net/atm/lec.c:744 [inline]\n  lane_ioctl+0x1ce8/0x23e0 net/atm/lec.c:1008\n  do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159\n  sock_do_ioctl+0x118/0x280 net/socket.c:1190\n  sock_ioctl+0x227/0x6b0 net/socket.c:1311\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\n  __se_sys_ioctl fs/ioctl.c:893 [inline]\n  __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "cf3b04b8-b214-4c18-a4af-f18c92da75d6",  "id": "CVE-2023-52920",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: support non-r10 register spill/fill to/from stack in precision tracking\n\nUse instruction (jump) history to record instructions that performed\nregister spill/fill to/from stack, regardless if this was done through\nread-only r10 register, or any other register after copying r10 into it\n*and* potentially adjusting offset.\n\nTo make this work reliably, we push extra per-instruction flags into\ninstruction history, encoding stack slot index (spi) and stack frame\nnumber in extra 10 bit flags we take away from prev_idx in instruction\nhistory. We don't touch idx field for maximum performance, as it's\nchecked most frequently during backtracking.\n\nThis change removes basically the last remaining practical limitation of\nprecision backtracking logic in BPF verifier. It fixes known\ndeficiencies, but also opens up new opportunities to reduce number of\nverified states, explored in the subsequent patches.\n\nThere are only three differences in selftests' BPF object files\naccording to veristat, all in the positive direction (less states).\n\nFile                                    Program        Insns (A)  Insns (B)  Insns  (DIFF)  States (A)  States (B)  States (DIFF)\n--------------------------------------  -------------  ---------  ---------  -------------  ----------  ----------  -------------\ntest_cls_redirect_dynptr.bpf.linked3.o  cls_redirect        2987       2864  -123 (-4.12%)         240         231    -9 (-3.75%)\nxdp_synproxy_kern.bpf.linked3.o         syncookie_tc       82848      82661  -187 (-0.23%)        5107        5073   -34 (-0.67%)\nxdp_synproxy_kern.bpf.linked3.o         syncookie_xdp      85116      84964  -152 (-0.18%)        5162        5130   -32 (-0.62%)\n\nNote, I avoided renaming jmp_history to more generic insn_hist to\nminimize number of lines changed and potential merge conflicts between\nbpf and bpf-next trees.\n\nNotice also cur_hist_entry pointer reset to NULL at the beginning of\ninstruction verification loop. This pointer avoids the problem of\nrelying on last jump history entry's insn_idx to determine whether we\nalready have entry for current instruction or not. It can happen that we\nadded jump history entry because current instruction is_jmp_point(), but\nalso we need to add instruction flags for stack access. In this case, we\ndon't want to entries, so we need to reuse last added entry, if it is\npresent.\n\nRelying on insn_idx comparison has the same ambiguity problem as the one\nthat was fixed recently in [0], so we avoid that.\n\n  [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5c0ec0d5-b7b0-4947-8f3c-e8a5b7a65a05",  "id": "CVE-2024-53241",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/xen: don't do PV iret hypercall through hypercall page\n\nInstead of jumping to the Xen hypercall page for doing the iret\nhypercall, directly code the required sequence in xen-asm.S.\n\nThis is done in preparation of no longer using hypercall page at all,\nas it has shown to cause problems with speculation mitigations.\n\nThis is part of XSA-466 / CVE-2024-53241.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5b5824f6-0437-4c0e-82d1-fc9e2e22d9c7",  "id": "openSUSE-SU-2024:10721-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a3c8e533-f8bc-4804-8e24-17437bff7eb0",  "id": "CVE-2018-20679",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20679"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6831280d-d016-465f-a9dd-93e920331cd3",  "id": "RHSA-2026:1594",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6edb4f2f-654d-4c7c-9511-fd30e253dfc8",  "id": "CVE-2022-49115",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: Fix misused goto label\n\nFix a misused goto label jump since that can result in a memory leak.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c2f619a4-3383-4d71-84be-88cb0457c58a",  "id": "CVE-2024-41067",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: scrub: handle RST lookup error correctly\n\n[BUG]\nWhen running btrfs/060 with forced RST feature, it would crash the\nfollowing ASSERT() inside scrub_read_endio():\n\n\tASSERT(sector_nr < stripe->nr_sectors);\n\nBefore that, we would have tree dump from\nbtrfs_get_raid_extent_offset(), as we failed to find the RST entry for\nthe range.\n\n[CAUSE]\nInside scrub_submit_extent_sector_read() every time we allocated a new\nbbio we immediately called btrfs_map_block() to make sure there was some\nRST range covering the scrub target.\n\nBut if btrfs_map_block() fails, we immediately call endio for the bbio,\nwhile the bbio is newly allocated, it's completely empty.\n\nThen inside scrub_read_endio(), we go through the bvecs to find\nthe sector number (as bi_sector is no longer reliable if the bio is\nsubmitted to lower layers).\n\nAnd since the bio is empty, such bvecs iteration would not find any\nsector matching the sector, and return sector_nr == stripe->nr_sectors,\ntriggering the ASSERT().\n\n[FIX]\nInstead of calling btrfs_map_block() after allocating a new bbio, call\nbtrfs_map_block() first.\n\nSince our only objective of calling btrfs_map_block() is only to update\nstripe_len, there is really no need to do that after btrfs_alloc_bio().\n\nThis new timing would avoid the problem of handling empty bbio\ncompletely, and in fact fixes a possible race window for the old code,\nwhere if the submission thread is the only owner of the pending_io, the\nscrub would never finish (since we didn't decrease the pending_io\ncounter).\n\nAlthough the root cause of RST lookup failure still needs to be\naddressed.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e2d8cf6a-9113-4c96-9ce2-8daada51fdd4",  "id": "CVE-2019-19072",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19072"  },  "ratings": [    {      "score": 4.4,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    401  ],  "analysis": {    "state": "in_triage"  },  "description": "A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e1832fc0-d7ed-4307-82d8-a07bfda2a7be",  "id": "CVE-2018-14612",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14612"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in btrfs_root_node() when mounting a crafted btrfs image, because of a lack of chunk block group mapping validation in btrfs_read_block_groups in fs/btrfs/extent-tree.c, and a lack of empty-tree checks in check_leaf in fs/btrfs/tree-checker.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7ed1ac9d-ec1b-453e-a901-378f15f344e3",  "id": "CVE-2022-50086",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don't allow the same type rq_qos add more than once\n\nIn our test of iocost, we encountered some list add/del corruptions of\ninner_walk list in ioc_timer_fn.\n\nThe reason can be described as follows:\n\ncpu 0\t\t\t\t\tcpu 1\nioc_qos_write\t\t\t\tioc_qos_write\n\nioc = q_to_ioc(queue);\nif (!ioc) {\n        ioc = kzalloc();\n\t\t\t\t\tioc = q_to_ioc(queue);\n\t\t\t\t\tif (!ioc) {\n\t\t\t\t\t\tioc = kzalloc();\n\t\t\t\t\t\t...\n\t\t\t\t\t\trq_qos_add(q, rqos);\n\t\t\t\t\t}\n        ...\n        rq_qos_add(q, rqos);\n        ...\n}\n\nWhen the io.cost.qos file is written by two cpus concurrently, rq_qos may\nbe added to one disk twice. In that case, there will be two iocs enabled\nand running on one disk. They own different iocgs on their active list. In\nthe ioc_timer_fn function, because of the iocgs from two iocs have the\nsame root iocg, the root iocg's walk_list may be overwritten by each other\nand this leads to list add/del corruptions in building or destroying the\ninner_walk list.\n\nAnd so far, the blk-rq-qos framework works in case that one instance for\none type rq_qos per queue by default. This patch make this explicit and\nalso fix the crash above.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1260cd5e-bd5e-47e5-9ba3-792641eb8636",  "id": "CVE-2017-9075",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9075"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "The sctp_v6_create_accept_sk function in net/sctp/ipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "52924b6a-005c-4000-a5af-9f9300e31aa2",  "id": "CVE-2015-3339",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3339"  },  "ratings": [    {      "score": 6.2,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4bdbd30f-f841-4a50-88b3-c5e0cd8e3317",  "id": "CLSA-2023-1687282015",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "a7e978a8-bb45-4e7d-bbdb-cd07ef7fc804",  "id": "RHSA-2018:0998",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.9,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2bebc0ac-b847-4b56-999f-b33dba6285b6",  "id": "CVE-2019-19447",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19447"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "1d8d7f84-f571-4ac7-89e6-8cbe8a8d17c6",  "id": "CVE-2022-50033",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: host: ohci-ppc-of: Fix refcount leak bug\n\nIn ohci_hcd_ppc_of_probe(), of_find_compatible_node() will return\na node pointer with refcount incremented. We should use of_node_put()\nwhen it is not used anymore.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "408dbd64-1d6c-46ff-b0a7-cf3db78beba7",  "id": "CVE-2010-3705",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3705"  },  "ratings": [    {      "score": 8.300000000000001,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:A/AC:L/Au:N/C:C/I:C/A:C"    }  ],  "cwes": [    400  ],  "analysis": {    "state": "in_triage"  },  "description": "The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmac_ids array of an SCTP peer, which allows remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c7c21386-d0ad-49e4-a1f6-f57fe1774883",  "id": "CVE-2017-7518",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7518"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:30/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    250,    755  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate their privileges inside the guest. Linux guests are not affected by this.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "17910c33-d0e6-41f3-b4c0-4103e6a303d7",  "id": "CVE-2023-34256",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34256"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated \"When modifying the block device while it is mounted by the filesystem\" access.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "e3772e2c-9a47-428a-8357-c5d0123822c8",  "id": "CVE-2023-52918",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pci: cx23885: check cx23885_vdev_init() return\n\ncx23885_vdev_init() can return a NULL pointer, but that pointer\nis used in the next line without a check.\n\nAdd a NULL pointer check and go to the error unwind if it is NULL.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f81ca21d-1ba2-4057-89ba-92b9e839e5fe",  "id": "RHSA-2023:3408",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "fa60064d-6794-4fd2-876d-fae97bc83cdf",  "id": "CVE-2024-35945",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: phy_device: Prevent nullptr exceptions on ISR\n\nIf phydev->irq is set unconditionally, check\nfor valid interrupt handler or fall back to polling mode to prevent\nnullptr exceptions in interrupt service routine.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "67b7e970-bcc9-45b3-a054-462b0f0a5288",  "id": "CVE-2021-47646",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47646"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"Revert \"block, bfq: honor already-setup queue merges\"\"\n\nA crash [1] happened to be triggered in conjunction with commit\n2d52c58b9c9b (\"block, bfq: honor already-setup queue merges\"). The\nlatter was then reverted by commit ebc69e897e17 (\"Revert \"block, bfq:\nhonor already-setup queue merges\"\"). Yet, the reverted commit was not\nthe one introducing the bug. In fact, it actually triggered a UAF\nintroduced by a different commit, and now fixed by commit d29bd41428cf\n(\"block, bfq: reset last_bfqq_created on group change\").\n\nSo, there is no point in keeping commit 2d52c58b9c9b (\"block, bfq:\nhonor already-setup queue merges\") out. This commit restores it.\n\n[1] https://bugzilla.kernel.org/show_bug.cgi?id=214503",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f91c14df-eb8b-42d8-b2e5-cd1a63091346",  "id": "CVE-2021-45486",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45486"  },  "ratings": [    {      "score": 3.5,      "severity": "low",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"    }  ],  "cwes": [    327  ],  "analysis": {    "state": "in_triage"  },  "description": "In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash table is very small.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "acc5fd77-33c4-4d67-9b43-2e202b184a3e",  "id": "CVE-2016-6301",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6301"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    399,    835  ],  "analysis": {    "state": "in_triage"  },  "description": "The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.",  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0360f0d6-f19f-4d5b-baee-53d10c4e7b5d",  "id": "CVE-2026-31609",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 9.800000000000001,      "severity": "critical",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    415  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()\n\nsmbd_send_batch_flush() already calls smbd_free_send_io(),\nso we should not call it again after smbd_post_send()\nmoved it to the batch list.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "5b700c1a-6c30-4e6c-b5ad-a2df9e9134ac",  "id": "CVE-2019-11486",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11486"  },  "ratings": [    {      "score": 7,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    362  ],  "analysis": {    "state": "in_triage"  },  "description": "The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c571666d-da4e-4bed-9e17-54b7d1493ee2",  "id": "MGASA-2021-0310",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2200c4fe-aa75-42d6-859d-c51b7ae55fd8",  "id": "CVE-2023-0394",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0394"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ec259059-2ba9-4a8b-ad02-69e1d778a9ca",  "id": "CVE-2020-10720",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10720"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with local access to crash the system.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6740ee01-b9fd-4e24-b3b2-8af1ccf1e139",  "id": "MGASA-2014-0008",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d31609d4-3b54-40c1-8c5a-4fe85113d12e",  "id": "CVE-2024-49889",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid use-after-free in ext4_ext_show_leaf()\n\nIn ext4_find_extent(), path may be freed by error or be reallocated, so\nusing a previously saved *ppath may have been freed and thus may trigger\nuse-after-free, as follows:\n\next4_split_extent\n  path = *ppath;\n  ext4_split_extent_at(ppath)\n  path = ext4_find_extent(ppath)\n  ext4_split_extent_at(ppath)\n    // ext4_find_extent fails to free path\n    // but zeroout succeeds\n  ext4_ext_show_leaf(inode, path)\n    eh = path[depth].p_hdr\n    // path use-after-free !!!\n\nSimilar to ext4_split_extent_at(), we use *ppath directly as an input to\next4_ext_show_leaf(). Fix a spelling error by the way.\n\nSame problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only\nused in ext4_ext_show_leaf(), remove 'path' and use *ppath directly.\n\nThis issue is triggered only when EXT_DEBUG is defined and therefore does\nnot affect functionality.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'SNYK:SNYK-UNMANAGED-TORVALDSLINUX-20697192'"    }  ]},{  "bom-ref": "e7b51d41-8b91-4301-b320-8641e9d82f07",  "id": "SUSE-SU-2026:2974-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "67679f21-8273-4a68-9487-3af8be5b70c1",  "id": "CVE-2012-2383",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2383"  },  "ratings": [    {      "score": 4.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C"    }  ],  "cwes": [    189  ],  "analysis": {    "state": "in_triage"  },  "description": "Integer overflow in the i915_gem_execbuffer2 function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "bf68dfad-4b5e-43cc-aab9-74880b358875",  "id": "CVE-2019-19241",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19241"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is related to fs/io-wq.c, fs/io_uring.c, and net/socket.c. For example, an attacker can bypass intended restrictions on adding an IPv4 address to the loopback interface. This occurs because IORING_OP_SENDMSG operations, although requested in the context of an unprivileged user, are sometimes performed by a kernel worker thread without considering that context.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    {      "name": "EMBA:sbom:1:exploit",      "value": "'EDB:47779'"    },    {      "name": "EMBA:sbom:2:exploit",      "value": "'PSS:155669/Linux-sendmsg-Privilege-Escalation.html'"    }  ]},{  "bom-ref": "4d6c2335-93a9-4158-b502-f52e43d3bfff",  "id": "MGASA-2023-0253",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "efb306f4-7952-43d9-8d40-1de2deacb34f",  "id": "CVE-2019-20811",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20811"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "50edc484-555c-40b5-9642-421fe280aab0",  "id": "CVE-2025-38328",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\njffs2: check jffs2_prealloc_raw_node_refs() result in few other places\n\nFuzzing hit another invalid pointer dereference due to the lack of\nchecking whether jffs2_prealloc_raw_node_refs() completed successfully.\nSubsequent logic implies that the node refs have been allocated.\n\nHandle that. The code is ready for propagating the error upwards.\n\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 1 PID: 5835 Comm: syz-executor145 Not tainted 5.10.234-syzkaller #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:jffs2_link_node_ref+0xac/0x690 fs/jffs2/nodelist.c:600\nCall Trace:\n jffs2_mark_erased_block fs/jffs2/erase.c:460 [inline]\n jffs2_erase_pending_blocks+0x688/0x1860 fs/jffs2/erase.c:118\n jffs2_garbage_collect_pass+0x638/0x1a00 fs/jffs2/gc.c:253\n jffs2_reserve_space+0x3f4/0xad0 fs/jffs2/nodemgmt.c:167\n jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362\n jffs2_write_end+0x712/0x1110 fs/jffs2/file.c:302\n generic_perform_write+0x2c2/0x500 mm/filemap.c:3347\n __generic_file_write_iter+0x252/0x610 mm/filemap.c:3465\n generic_file_write_iter+0xdb/0x230 mm/filemap.c:3497\n call_write_iter include/linux/fs.h:2039 [inline]\n do_iter_readv_writev+0x46d/0x750 fs/read_write.c:740\n do_iter_write+0x18c/0x710 fs/read_write.c:866\n vfs_writev+0x1db/0x6a0 fs/read_write.c:939\n do_pwritev fs/read_write.c:1036 [inline]\n __do_sys_pwritev fs/read_write.c:1083 [inline]\n __se_sys_pwritev fs/read_write.c:1078 [inline]\n __x64_sys_pwritev+0x235/0x310 fs/read_write.c:1078\n do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "10b922a8-8037-49df-a742-eba4d02041ec",  "id": "CVE-2022-49879",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix BUG_ON() when directory entry has invalid rec_len\n\nThe rec_len field in the directory entry has to be a multiple of 4.  A\ncorrupted filesystem image can be used to hit a BUG() in\next4_rec_len_to_disk(), called from make_indexed_dir().\n\n ------------[ cut here ]------------\n kernel BUG at fs/ext4/ext4.h:2413!\n ...\n RIP: 0010:make_indexed_dir+0x53f/0x5f0\n ...\n Call Trace:\n  <TASK>\n  ? add_dirent_to_buf+0x1b2/0x200\n  ext4_add_entry+0x36e/0x480\n  ext4_add_nondir+0x2b/0xc0\n  ext4_create+0x163/0x200\n  path_openat+0x635/0xe90\n  do_filp_open+0xb4/0x160\n  ? __create_object.isra.0+0x1de/0x3b0\n  ? _raw_spin_unlock+0x12/0x30\n  do_sys_openat2+0x91/0x150\n  __x64_sys_open+0x6c/0xa0\n  do_syscall_64+0x3c/0x80\n  entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThe fix simply adds a call to ext4_check_dir_entry() to validate the\ndirectory entry, returning -EFSCORRUPTED if the entry is invalid.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "8bc15a3f-19db-47b4-904b-0dcafc6ed3db",  "id": "CVE-2019-3459",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3459"  },  "ratings": [    {      "score": 6.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before 5.1-rc1.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4fcb3bd3-425a-4595-a668-639a909a4f49",  "id": "SUSE-SU-2022:4260-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "294c1f81-dc8d-42d5-ab6a-c5a79037c10e",  "id": "CVE-2021-47480",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47480"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Put LLD module refcnt after SCSI device is released\n\nSCSI host release is triggered when SCSI device is freed. We have to make\nsure that the low-level device driver module won't be unloaded before SCSI\nhost instance is released because shost->hostt is required in the release\nhandler.\n\nMake sure to put LLD module refcnt after SCSI device is released.\n\nFixes a kernel panic of 'BUG: unable to handle page fault for address'\nreported by Changhui and Yi.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f93fbda7-57f1-4946-bc57-fcdd305748f9",  "id": "CVE-2024-45025",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    787  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nfix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE\n\ncopy_fd_bitmaps(new, old, count) is expected to copy the first\ncount/BITS_PER_LONG bits from old->full_fds_bits[] and fill\nthe rest with zeroes.  What it does is copying enough words\n(BITS_TO_LONGS(count/BITS_PER_LONG)), then memsets the rest.\nThat works fine, *if* all bits past the cutoff point are\nclear.  Otherwise we are risking garbage from the last word\nwe'd copied.\n\nFor most of the callers that is true - expand_fdtable() has\ncount equal to old->max_fds, so there's no open descriptors\npast count, let alone fully occupied words in ->open_fds[],\nwhich is what bits in ->full_fds_bits[] correspond to.\n\nThe other caller (dup_fd()) passes sane_fdtable_size(old_fdt, max_fds),\nwhich is the smallest multiple of BITS_PER_LONG that covers all\nopened descriptors below max_fds.  In the common case (copying on\nfork()) max_fds is ~0U, so all opened descriptors will be below\nit and we are fine, by the same reasons why the call in expand_fdtable()\nis safe.\n\nUnfortunately, there is a case where max_fds is less than that\nand where we might, indeed, end up with junk in ->full_fds_bits[] -\nclose_range(from, to, CLOSE_RANGE_UNSHARE) with\n\t* descriptor table being currently shared\n\t* 'to' being above the current capacity of descriptor table\n\t* 'from' being just under some chunk of opened descriptors.\nIn that case we end up with observably wrong behaviour - e.g. spawn\na child with CLONE_FILES, get all descriptors in range 0..127 open,\nthen close_range(64, ~0U, CLOSE_RANGE_UNSHARE) and watch dup(0) ending\nup with descriptor #128, despite #64 being observably not open.\n\nThe minimally invasive fix would be to deal with that in dup_fd().\nIf this proves to add measurable overhead, we can go that way, but\nlet's try to fix copy_fd_bitmaps() first.\n\n* new helper: bitmap_copy_and_expand(to, from, bits_to_copy, size).\n* make copy_fd_bitmaps() take the bitmap size in words, rather than\nbits; it's 'count' argument is always a multiple of BITS_PER_LONG,\nso we are not losing any information, and that way we can use the\nsame helper for all three bitmaps - compiler will see that count\nis a multiple of BITS_PER_LONG for the large ones, so it'll generate\nplain memcpy()+memset().\n\nReproducer added to tools/testing/selftests/core/close_range_test.c",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "2b7a43f3-99af-4913-9678-7939cea9bc7e",  "id": "CVE-2021-47579",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47579"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix warning in ovl_create_real()\n\nSyzbot triggered the following warning in ovl_workdir_create() ->\novl_create_real():\n\n\tif (!err && WARN_ON(!newdentry->d_inode)) {\n\nThe reason is that the cgroup2 filesystem returns from mkdir without\ninstantiating the new dentry.\n\nWeird filesystems such as this will be rejected by overlayfs at a later\nstage during setup, but to prevent such a warning, call ovl_mkdir_real()\ndirectly from ovl_workdir_create() and reject this case early.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "710a97b6-9dea-463b-b50f-a73f224109a3",  "id": "CVE-2026-43427",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    125  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: class: cdc-wdm: fix reordering issue in read code path\n\nQuoting the bug report:\n\nDue to compiler optimization or CPU out-of-order execution, the\ndesc->length update can be reordered before the memmove. If this\nhappens, wdm_read() can see the new length and call copy_to_user() on\nuninitialized memory. This also violates LKMM data race rules [1].\n\nFix it by using WRITE_ONCE and memory barriers.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c6932354-737b-4e80-b1c3-8d68c49a9b51",  "id": "OESA-2025-1882",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 6.3,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "6a02d1f5-f0b0-4db2-9e0e-b88c09dd60d0",      "versions": [        {          "component": "busybox",          "version": "1.14.1"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ceaed90d-1e65-4e98-85d8-dc5326a05e68",  "id": "CVE-2022-3544",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3544"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    404  ],  "analysis": {    "state": "in_triage"  },  "description": "A vulnerability, which was classified as problematic, was found in Linux Kernel. Affected is the function damon_sysfs_add_target of the file mm/damon/sysfs.c of the component Netfilter. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211044.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f5bfaa40-74e9-496b-a9b3-34f5d6708f97",  "id": "CVE-2026-31408",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold\n\nsco_recv_frame() reads conn->sk under sco_conn_lock() but immediately\nreleases the lock without holding a reference to the socket. A concurrent\nclose() can free the socket between the lock release and the subsequent\nsk->sk_state access, resulting in a use-after-free.\n\nOther functions in the same file (sco_sock_timeout(), sco_conn_del())\ncorrectly use sco_sock_hold() to safely hold a reference under the lock.\n\nFix by using sco_sock_hold() to take a reference before releasing the\nlock, and adding sock_put() on all exit paths.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "7bb6d98b-c883-444b-bdcc-1945e08d92fe",  "id": "CVE-2025-38377",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.800000000000001,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nrose: fix dangling neighbour pointers in rose_rt_device_down()\n\nThere are two bugs in rose_rt_device_down() that can cause\nuse-after-free:\n\n1. The loop bound `t->count` is modified within the loop, which can\n   cause the loop to terminate early and miss some entries.\n\n2. When removing an entry from the neighbour array, the subsequent entries\n   are moved up to fill the gap, but the loop index `i` is still\n   incremented, causing the next entry to be skipped.\n\nFor example, if a node has three neighbours (A, A, B) with count=3 and A\nis being removed, the second A is not checked.\n\n    i=0: (A, A, B) -> (A, B) with count=2\n          ^ checked\n    i=1: (A, B)    -> (A, B) with count=2\n             ^ checked (B, not A!)\n    i=2: (doesn't occur because i < count is false)\n\nThis leaves the second A in the array with count=2, but the rose_neigh\nstructure has been freed. Code that accesses these entries assumes that\nthe first `count` entries are valid pointers, causing a use-after-free\nwhen it accesses the dangling pointer.\n\nFix both issues by iterating over the array in reverse order with a fixed\nloop bound. This ensures that all entries are examined and that the removal\nof an entry doesn't affect subsequent iterations.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "b54dd186-1ab7-4f96-a2af-fe7a55ec1b16",  "id": "CVE-2020-36557",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36557"  },  "ratings": [    {      "score": 5.1,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    362,    416  ],  "analysis": {    "state": "in_triage"  },  "description": "A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6d4d6354-8a9b-44ae-8df0-0eaca3334f17",  "id": "CVE-2011-3210",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3210"  },  "ratings": [    {      "score": 5,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"    }  ],  "cwes": [    399  ],  "analysis": {    "state": "in_triage"  },  "description": "The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "95b60869-5112-4206-b2cd-360d36846e79",  "id": "CVE-2026-43268",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: pretend special inodes as regular files\n\nSince commit af153bb63a33 (\"vfs: catch invalid modes in may_open()\")\nrequires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/\nS_IFIFO/S_IFSOCK type, use S_IFREG for special inodes.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "0eaac8d0-507b-4c1d-a69f-025f110f82b7",  "id": "CVE-2024-46826",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nELF: fix kernel.randomize_va_space double read\n\nELF loader uses \"randomize_va_space\" twice. It is sysctl and can change\nat any moment, so 2 loads could see 2 different values in theory with\nunpredictable consequences.\n\nIssue exactly one load for consistent value across one exec.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c3895775-2319-401f-bb9e-40851edf086f",  "id": "CVE-2023-53247",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    617  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand\n\nWhile trying to get the subpage blocksize tests running, I hit the\nfollowing panic on generic/476\n\n  assertion failed: PagePrivate(page) && page->private, in fs/btrfs/subpage.c:229\n  kernel BUG at fs/btrfs/subpage.c:229!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n  CPU: 1 PID: 1453 Comm: fsstress Not tainted 6.4.0-rc7+ #12\n  Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20230301gitf80f052277c8-26.fc38 03/01/2023\n  pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n  pc : btrfs_subpage_assert+0xbc/0xf0\n  lr : btrfs_subpage_assert+0xbc/0xf0\n  Call trace:\n   btrfs_subpage_assert+0xbc/0xf0\n   btrfs_subpage_clear_checked+0x38/0xc0\n   btrfs_page_clear_checked+0x48/0x98\n   btrfs_truncate_block+0x5d0/0x6a8\n   btrfs_cont_expand+0x5c/0x528\n   btrfs_write_check.isra.0+0xf8/0x150\n   btrfs_buffered_write+0xb4/0x760\n   btrfs_do_write_iter+0x2f8/0x4b0\n   btrfs_file_write_iter+0x1c/0x30\n   do_iter_readv_writev+0xc8/0x158\n   do_iter_write+0x9c/0x210\n   vfs_iter_write+0x24/0x40\n   iter_file_splice_write+0x224/0x390\n   direct_splice_actor+0x38/0x68\n   splice_direct_to_actor+0x12c/0x260\n   do_splice_direct+0x90/0xe8\n   generic_copy_file_range+0x50/0x90\n   vfs_copy_file_range+0x29c/0x470\n   __arm64_sys_copy_file_range+0xcc/0x498\n   invoke_syscall.constprop.0+0x80/0xd8\n   do_el0_svc+0x6c/0x168\n   el0_svc+0x50/0x1b0\n   el0t_64_sync_handler+0x114/0x120\n   el0t_64_sync+0x194/0x198\n\nThis happens because during btrfs_cont_expand we'll get a page, set it\nas mapped, and if it's not Uptodate we'll read it.  However between the\nread and re-locking the page we could have called release_folio() on the\npage, but left the page in the file mapping.  release_folio() can clear\nthe page private, and thus further down we blow up when we go to modify\nthe subpage bits.\n\nFix this by putting the set_page_extent_mapped() after the read.  This\nis safe because read_folio() will call set_page_extent_mapped() before\nit does the read, and then if we clear page private but leave it on the\nmapping we're completely safe re-setting set_page_extent_mapped().  With\nthis patch I can now run generic/476 without panicing.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "03ecab0a-c36e-46e6-a4f5-96d1bdf73b2a",  "id": "CVE-2014-0076",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0076"  },  "ratings": [    {      "score": 1.9,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    310  ],  "analysis": {    "state": "in_triage"  },  "description": "The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack.",  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d36ad51c-38ab-4a88-93bd-955eb0d31aeb",  "id": "AZL-13564",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.4,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "6dfea213-d29c-4883-ba16-50195394c3b0",  "id": "CVE-2025-37803",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.8,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    120  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nudmabuf: fix a buf size overflow issue during udmabuf creation\n\nby casting size_limit_mb to u64  when calculate pglimit.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4643cc88-ea1b-4f5b-af48-eec2d42d14bf",  "id": "CVE-2023-52833",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: Add date->evt_skb is NULL check\n\nfix crash because of null pointers\n\n[ 6104.969662] BUG: kernel NULL pointer dereference, address: 00000000000000c8\n[ 6104.969667] #PF: supervisor read access in kernel mode\n[ 6104.969668] #PF: error_code(0x0000) - not-present page\n[ 6104.969670] PGD 0 P4D 0\n[ 6104.969673] Oops: 0000 [#1] SMP NOPTI\n[ 6104.969684] RIP: 0010:btusb_mtk_hci_wmt_sync+0x144/0x220 [btusb]\n[ 6104.969688] RSP: 0018:ffffb8d681533d48 EFLAGS: 00010246\n[ 6104.969689] RAX: 0000000000000000 RBX: ffff8ad560bb2000 RCX: 0000000000000006\n[ 6104.969691] RDX: 0000000000000000 RSI: ffffb8d681533d08 RDI: 0000000000000000\n[ 6104.969692] RBP: ffffb8d681533d70 R08: 0000000000000001 R09: 0000000000000001\n[ 6104.969694] R10: 0000000000000001 R11: 00000000fa83b2da R12: ffff8ad461d1d7c0\n[ 6104.969695] R13: 0000000000000000 R14: ffff8ad459618c18 R15: ffffb8d681533d90\n[ 6104.969697] FS:  00007f5a1cab9d40(0000) GS:ffff8ad578200000(0000) knlGS:00000\n[ 6104.969699] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 6104.969700] CR2: 00000000000000c8 CR3: 000000018620c001 CR4: 0000000000760ef0\n[ 6104.969701] PKRU: 55555554\n[ 6104.969702] Call Trace:\n[ 6104.969708]  btusb_mtk_shutdown+0x44/0x80 [btusb]\n[ 6104.969732]  hci_dev_do_close+0x470/0x5c0 [bluetooth]\n[ 6104.969748]  hci_rfkill_set_block+0x56/0xa0 [bluetooth]\n[ 6104.969753]  rfkill_set_block+0x92/0x160\n[ 6104.969755]  rfkill_fop_write+0x136/0x1e0\n[ 6104.969759]  __vfs_write+0x18/0x40\n[ 6104.969761]  vfs_write+0xdf/0x1c0\n[ 6104.969763]  ksys_write+0xb1/0xe0\n[ 6104.969765]  __x64_sys_write+0x1a/0x20\n[ 6104.969769]  do_syscall_64+0x51/0x180\n[ 6104.969771]  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n[ 6104.969773] RIP: 0033:0x7f5a21f18fef\n[ 6104.9] RSP: 002b:00007ffeefe39010 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\n[ 6104.969780] RAX: ffffffffffffffda RBX: 000055c10a7560a0 RCX: 00007f5a21f18fef\n[ 6104.969781] RDX: 0000000000000008 RSI: 00007ffeefe39060 RDI: 0000000000000012\n[ 6104.969782] RBP: 00007ffeefe39060 R08: 0000000000000000 R09: 0000000000000017\n[ 6104.969784] R10: 00007ffeefe38d97 R11: 0000000000000293 R12: 0000000000000002\n[ 6104.969785] R13: 00007ffeefe39220 R14: 00007ffeefe391a0 R15: 000055c10a72acf0",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "027c635f-141e-4a1f-874f-901e92102555",  "id": "CVE-2022-48994",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event\n\nWith clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),\nindirect call targets are validated against the expected function\npointer prototype to make sure the call target is valid to help mitigate\nROP attacks. If they are not identical, there is a failure at run time,\nwhich manifests as either a kernel panic or thread getting killed.\n\nseq_copy_in_user() and seq_copy_in_kernel() did not have prototypes\nmatching snd_seq_dump_func_t. Adjust this and remove the casts. There\nare not resulting binary output differences.\n\nThis was found as a result of Clang's new -Wcast-function-type-strict\nflag, which is more sensitive than the simpler -Wcast-function-type,\nwhich only checks for type width mismatches.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "c70b4311-8b88-4c2c-843e-a4a9f214980b",  "id": "CVE-2019-15215",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15215"  },  "ratings": [    {      "score": 4.6,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    416  ],  "analysis": {    "state": "in_triage"  },  "description": "An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/cpia2/cpia2_usb.c driver.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4417880a-268b-47fb-b008-facee2f0d2c4",  "id": "CVE-2011-2210",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2210"  },  "ratings": [    {      "score": 2.1,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The osf_getsysinfo function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform does not properly restrict the data size for GSI_GET_HWRPB operations, which allows local users to obtain sensitive information from kernel memory via a crafted call.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "496ef250-93b2-4f84-a499-fc0524a5210c",  "id": "CVE-2013-1957",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1957"  },  "ratings": [    {      "score": 4.7,      "severity": "unknown",      "method": "CVSSv2",      "vector": "AV:L/AC:M/Au:N/C:C/I:N/A:N"    }  ],  "cwes": [    264  ],  "analysis": {    "state": "in_triage"  },  "description": "The clone_mnt function in fs/namespace.c in the Linux kernel before 3.8.6 does not properly restrict changes to the MNT_READONLY flag, which allows local users to bypass an intended read-only property of a filesystem by leveraging a separate mount namespace.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "ed130122-28aa-4bb8-a638-4b9050b65d7d",  "id": "DSA-2931-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "778920fb-0c78-4884-97fc-7fac6b9f5282",  "id": "RHSA-2026:26275",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 8.1,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "d0369aee-fe57-4044-945b-fed1c3796dc4",  "id": "RHSA-2021:4424",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 7.5,      "severity": "high",      "method": "CVSSv3",      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "4b5426dc-8733-463f-ad7f-688fcd5e43fa",  "id": "DSA-3251-1",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "3256f8a8-5c16-4e78-a0b7-edd06568bc34",      "versions": [        {          "component": "dnsmasq",          "version": "2.45"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "f7f14f5f-64bf-4c92-a788-dfad8b73bcff",  "id": "CVE-2021-47343",  "source": {    "name": "NVD",    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47343"  },  "ratings": [    {      "score": 5.5,      "severity": "medium",      "method": "CVSSv3",      "vector": "CVSS:31/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"    }  ],  "cwes": [    1188  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm btree remove: assign new_root only when removal succeeds\n\nremove_raw() in dm_btree_remove() may fail due to IO read error\n(e.g. read the content of origin block fails during shadowing),\nand the value of shadow_spine::root is uninitialized, but\nthe uninitialized value is still assign to new_root in the\nend of dm_btree_remove().\n\nFor dm-thin, the value of pmd->details_root or pmd->root will become\nan uninitialized value, so if trying to read details_info tree again\nout-of-bound memory may occur as showed below:\n\n  general protection fault, probably for non-canonical address 0x3fdcb14c8d7520\n  CPU: 4 PID: 515 Comm: dmsetup Not tainted 5.13.0-rc6\n  Hardware name: QEMU Standard PC\n  RIP: 0010:metadata_ll_load_ie+0x14/0x30\n  Call Trace:\n   sm_metadata_count_is_more_than_one+0xb9/0xe0\n   dm_tm_shadow_block+0x52/0x1c0\n   shadow_step+0x59/0xf0\n   remove_raw+0xb2/0x170\n   dm_btree_remove+0xf4/0x1c0\n   dm_pool_delete_thin_device+0xc3/0x140\n   pool_message+0x218/0x2b0\n   target_message+0x251/0x290\n   ctl_ioctl+0x1c4/0x4d0\n   dm_ctl_ioctl+0xe/0x20\n   __x64_sys_ioctl+0x7b/0xb0\n   do_syscall_64+0x40/0xb0\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nFixing it by only assign new_root when removal succeeds",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "149b164c-47b1-403a-b140-fd6aa1f2a0b3",  "id": "CLSA-2026-1777393624",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    null  ],  "analysis": {    "state": "in_triage"  },  "affects": [    {      "ref": "af079853-d91d-432d-bec1-07cff283479d",      "versions": [        {          "component": "openssl",          "version": "0.9.8a"        }      ]    }  ],  "properties": [    null  ]},{  "bom-ref": "18456ea2-d00f-4adc-be19-dd8ab7c2073d",  "id": "CVE-2023-52789",  "source": {    "name": "OSV",    "url": "UNKNOWN"  },  "ratings": [    {      "score": 0,      "severity": "unknown",      "method": "CVSSvunknown",      "vector": "unknown"    }  ],  "cwes": [    476  ],  "analysis": {    "state": "in_triage"  },  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: vcc: Add check for kstrdup() in vcc_probe()\n\nAdd check for the return value of kstrdup() and return the error, if it\nfails in order to avoid NULL pointer dereference.",  "affects": [    {      "ref": "ff92e1af-8d15-4177-8068-54cb99ba59d6",      "versions": [        {          "component": "linux_kernel",          "version": "2.6.33.2"        }      ]    }  ],  "properties": [    null  ]}]}