{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-53362", "aliases": [], "title": "Linux：脆弱性情報", "summary": "Linux カーネルの IPv6 実装において、__ip6_append_data() のページ割り当てパスで fraggap（フラグメント間の隙間）を考慮していなかったため、コピー先が skb の末端を越えて skb_shared_info に書き込まれ、メモリ破壊が起こる欠陥が修正されました。", "risk": "この欠陥によりカーネルメモリが破壊され、システムがクラッシュする可能性があります。", "product": "Linux", "category": "linux", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "Linux", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Linux", "range": ">= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 / < 14200d435af9a9eeb444f529fc2f689a236b7962" }, { "product": "Linux", "range": ">= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 / < 65fb14cbebb0cd0eff903a22d33537ddc8b95769" }, { "product": "Linux", "range": ">= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 / < 46f201f8b4c39633a1fa3dc12459f506d470993d" }, { "product": "Linux", "range": ">= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 / < 6374fb9edf72c67a118a2c214a0dddd04c921e0a" }, { "product": "Linux", "range": ">= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 / < e9eacf19281ea2498b36291b56c9606118c2d74e" }, { "product": "Linux", "range": ">= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 / < 736b380e28d0480c7bc3e022f1950f31fe53a7c5" }, { "product": "Linux", "range": "6.0" }, { "product": "Linux", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "カーネルのソースコードで __ip6_append_data() の paged アロケーションパスに fraggap を加算し、pagedlen から fraggap を減算するように修正します。", "「CVE-2026-53362」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "利用しているLinuxの配布元が示す、このCVEへの修正パッケージを管理者に適用してもらいます。Ubuntu Desktopでは「ソフトウェアの更新」から提供された更新を適用できます。サーバーや他の配布元では、それぞれの正規の更新手順に従います。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53362", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-53362", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5", "label": "CVE掲載の参考情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-07-04T11:56:35.864Z", "modifiedAt": "2026-10-15T01:23:25.441Z", "fetchedAt": "2026-10-23T02:43:49.437Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap bytes carried over from the previous skb are copied just past\nthe fragment headers in the new skb's linear area. The linear area is\ntherefore undersized by fraggap bytes while pagedlen is overstated by the\nsame amount, and the copy writes past skb->end into the trailing\nskb_shared_info.\n\nAn unprivileged user can trigger this via a UDPv6 socket using\nMSG_MORE together with MSG_SPLICE_PAGES.\n\nThe bad accounting was introduced by commit 773ba4fe9104 (\"ipv6:\navoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix\n__ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative\ncopy value caused -EINVAL to be returned. That later commit allowed\nMSG_SPLICE_PAGES to proceed in this case, making the corruption\ntriggerable.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.\nSince a negative copy is no longer expected for a valid MSG_SPLICE_PAGES\ncase, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "sourceTitle": "ipv6: account for fraggap on the paged allocation path", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv6/ip6_output.c" ], "versions": [ { "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "14200d435af9a9eeb444f529fc2f689a236b7962", "status": "affected", "versionType": "git" }, { "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "65fb14cbebb0cd0eff903a22d33537ddc8b95769", "status": "affected", "versionType": "git" }, { "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "46f201f8b4c39633a1fa3dc12459f506d470993d", "status": "affected", "versionType": "git" }, { "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "6374fb9edf72c67a118a2c214a0dddd04c921e0a", "status": "affected", "versionType": "git" }, { "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "e9eacf19281ea2498b36291b56c9606118c2d74e", "status": "affected", "versionType": "git" }, { "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "736b380e28d0480c7bc3e022f1950f31fe53a7c5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv6/ip6_output.c" ], "versions": [ { "version": "6.0", "status": "affected" }, { "version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.177", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.144", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.38", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-53362", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "fetchedAt": "2026-10-23T02:43:49.437Z", "publishedAt": "2026-07-04T11:56:35.864Z", "modifiedAt": "2026-10-15T01:23:25.441Z", "state": "published", "provider": "Linux", "title": "ipv6: account for fraggap on the paged allocation path", "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap bytes carried over from the previous skb are copied just past\nthe fragment headers in the new skb's linear area. The linear area is\ntherefore undersized by fraggap bytes while pagedlen is overstated by the\nsame amount, and the copy writes past skb->end into the trailing\nskb_shared_info.\n\nAn unprivileged user can trigger this via a UDPv6 socket using\nMSG_MORE together with MSG_SPLICE_PAGES.\n\nThe bad accounting was introduced by commit 773ba4fe9104 (\"ipv6:\navoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix\n__ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative\ncopy value caused -EINVAL to be returned. That later commit allowed\nMSG_SPLICE_PAGES to proceed in this case, making the corruption\ntriggerable.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.\nSince a negative copy is no longer expected for a valid MSG_SPLICE_PAGES\ncase, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/0", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [ "net/ipv6/ip6_output.c" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "14200d435af9a9eeb444f529fc2f689a236b7962", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "65fb14cbebb0cd0eff903a22d33537ddc8b95769", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "46f201f8b4c39633a1fa3dc12459f506d470993d", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "6374fb9edf72c67a118a2c214a0dddd04c921e0a", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "e9eacf19281ea2498b36291b56c9606118c2d74e", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "736b380e28d0480c7bc3e022f1950f31fe53a7c5", "versionType": "git", "status": "affected" } ] }, { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/1", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [ "net/ipv6/ip6_output.c" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "6.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "0", "lessThan": "6.0", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "6.1.177", "lessThanOrEqual": "6.1.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "6.6.144", "lessThanOrEqual": "6.6.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "6.12.95", "lessThanOrEqual": "6.12.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": "6.18.38", "lessThanOrEqual": "6.18.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": "7.1.3", "lessThanOrEqual": "7.1.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/7", "version": "7.2", "lessThanOrEqual": "*", "versionType": "original_commit_for_fix", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "Linux", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/0" }, { "url": "https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/1" }, { "url": "https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/2" }, { "url": "https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/3" }, { "url": "https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/4" }, { "url": "https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/5" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "label": "siemens-SADP", "tags": [], "provider": "siemens-SADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/ipv6/ip6_output.c\"],\"versions\":[{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"14200d435af9a9eeb444f529fc2f689a236b7962\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"65fb14cbebb0cd0eff903a22d33537ddc8b95769\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"46f201f8b4c39633a1fa3dc12459f506d470993d\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"6374fb9edf72c67a118a2c214a0dddd04c921e0a\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"e9eacf19281ea2498b36291b56c9606118c2d74e\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"736b380e28d0480c7bc3e022f1950f31fe53a7c5\",\"status\":\"affected\",\"versionType\":\"git\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/ipv6/ip6_output.c\"],\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.177\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.144\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.95\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.18.38\",\"lessThanOrEqual\":\"6.18.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"7.1.3\",\"lessThanOrEqual\":\"7.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap bytes carried over from the previous skb are copied just past\nthe fragment headers in the new skb's linear area. The linear area is\ntherefore undersized by fraggap bytes while pagedlen is overstated by the\nsame amount, and the copy writes past skb->end into the trailing\nskb_shared_info.\n\nAn unprivileged user can trigger this via a UDPv6 socket using\nMSG_MORE together with MSG_SPLICE_PAGES.\n\nThe bad accounting was introduced by commit 773ba4fe9104 (\"ipv6:\navoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix\n__ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative\ncopy value caused -EINVAL to be returned. That later commit allowed\nMSG_SPLICE_PAGES to proceed in this case, making the corruption\ntriggerable.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.\nSince a negative copy is no longer expected for a valid MSG_SPLICE_PAGES\ncase, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "sourcePath": "body:advisory", "text": "SSA-784472\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-784472: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1.\n\nSiemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2024-58005\n\nCVE-2023-52927\n\nCVE-2024-53166\n\nCVE-2024-58002\n\nCVE-2025-21844\n\nCVE-2024-26982\n\nCVE-2024-58079\n\nCVE-2025-21858\n\nCVE-2025-21865\n\nCVE-2025-21859\n\nCVE-2025-21862\n\nCVE-2025-21846\n\nCVE-2025-21864\n\nCVE-2025-21838\n\nCVE-2025-21756\n\nCVE-2025-21702\n\nCVE-2024-57977\n\nCVE-2025-21725\n\nCVE-2025-21806\n\nCVE-2024-58009\n\nCVE-2025-21767\n\nCVE-2025-21763\n\nCVE-2024-58077\n\nCVE-2024-58063\n\nCVE-2024-58013\n\nCVE-2025-21835\n\nCVE-2024-57979\n\nCVE-2025-21703\n\nCVE-2025-21735\n\nCVE-2025-21761\n\nCVE-2024-58071\n\nCVE-2025-21728\n\nCVE-2025-21738\n\nCVE-2025-21766\n\nCVE-2025-21795\n\nCVE-2025-21787\n\nCVE-2025-21779\n\nCVE-2024-58061\n\nCVE-2025-21724\n\nCVE-2025-21719\n\nCVE-2025-21790\n\nCVE-2025-21764\n\nCVE-2025-21705\n\nCVE-2025-21814\n\nCVE-2025-21765\n\nCVE-2025-21791\n\nCVE-2024-57986\n\nCVE-2024-40945\n\nCVE-2025-21744\n\nCVE-2024-57993\n\nCVE-2025-21700\n\nCVE-2024-57981\n\nCVE-2025-21832\n\nCVE-2024-58083\n\nCVE-2024-58020\n\nCVE-2025-21706\n\nCVE-2024-57996\n\nCVE-2025-21796\n\nCVE-2025-21758\n\nCVE-2025-21727\n\nCVE-2025-21745\n\nCVE-2024-58058\n\nCVE-2024-58017\n\nCVE-2024-58068\n\nCVE-2025-21716\n\nCVE-2025-21708\n\nCVE-2024-58014\n\nCVE-2025-21704\n\nCVE-2024-57980\n\nCVE-2025-21731\n\nCVE-2025-21726\n\nCVE-2025-21707\n\nCVE-2025-21776\n\nCVE-2025-21830\n\nCVE-2025-21760\n\nCVE-2025-21753\n\nCVE-2025-21762\n\nCVE-2024-58072\n\nCVE-2026-23253\n\nCVE-2026-23277\n\nCVE-2026-23279\n\nCVE-2026-23303\n\nCVE-2026-23356\n\nCVE-2025-21682\n\nCVE-2025-38250\n\nCVE-2026-23204\n\nCVE-2026-23365\n\nCVE-2026-23290\n\nCVE-2026-23339\n\nCVE-2026-23281\n\nCVE-2026-23372\n\nCVE-2026-23312\n\nCVE-2026-23367\n\nCVE-2026-23388\n\nCVE-2026-23398\n\nCVE-2026-23396\n\nCVE-2026-23274\n\nCVE-2026-23336\n\nCVE-2026-23395\n\nCVE-2026-23382\n\nCVE-2026-23368\n\nCVE-2026-23351\n\nCVE-2026-23357\n\nCVE-2026-23245\n\nCVE-2026-23352\n\nCVE-2026-23300\n\nCVE-2026-23100\n\nCVE-2025-68206\n\nCVE-2026-23379\n\nCVE-2025-39748\n\nCVE-2026-23381\n\nCVE-2026-23291\n\nCVE-2026-23304\n\nCVE-2026-23397\n\nCVE-2026-23318\n\nCVE-2026-23391\n\nCVE-2026-23113\n\nCVE-2024-56719\n\nCVE-2026-23154\n\nCVE-2025-68265\n\nCVE-2026-23296\n\nCVE-2026-23231\n\nCVE-2026-23292\n\nCVE-2026-23317\n\nCVE-2026-23319\n\nCVE-2026-23271\n\nCVE-2026-23141\n\nCVE-2026-23157\n\nCVE-2026-23270\n\nCVE-2025-40135\n\nCVE-2025-38162\n\nCVE-2026-23315\n\nCVE-2024-47809\n\nCVE-2025-39863\n\nCVE-2025-68239\n\nCVE-2026-23321\n\nCVE-2025-38192\n\nCVE-2025-38105\n\nCVE-2026-23343\n\nCVE-2026-23340\n\nCVE-2026-23364\n\nCVE-2026-23392\n\nCVE-2024-49998\n\nCVE-2026-23370\n\nCVE-2025-38704\n\nCVE-2026-23359\n\nCVE-2026-23378\n\nCVE-2026-23273\n\nCVE-2026-31708\n\nCVE-2026-43052\n\nCVE-2026-43350\n\nCVE-2026-46056\n\nCVE-2026-31705\n\nCVE-2026-46107\n\nCVE-2026-31449\n\nCVE-2025-21863\n\nCVE-2026-46307\n\nCVE-2026-46047\n\nCVE-2026-31586\n\nCVE-2026-31580\n\nCVE-2026-23444\n\nCVE-2026-23442\n\nCVE-2026-31583\n\nCVE-2026-31532\n\nCVE-2026-31624\n\nCVE-2026-31625\n\nCVE-2026-31630\n\nCVE-2026-31622\n\nCVE-2026-31637\n\nCVE-2026-31629\n\nCVE-2026-31617\n\nCVE-2026-31642\n\nCVE-2026-23066\n\nCVE-2026-23389\n\nCVE-2026-31488\n\nCVE-2026-43110\n\nCVE-2026-31711\n\nCVE-2026-46015\n\nCVE-2026-23399\n\nCVE-2026-43080\n\nCVE-2026-31500\n\nCVE-2026-43111\n\nCVE-2026-31673\n\nCVE-2026-43099\n\nCVE-2026-46037\n\nCVE-2023-53292\n\nCVE-2026-46101\n\nCVE-2026-46161\n\nCVE-2026-31681\n\nCVE-2026-31685\n\nCVE-2026-31696\n\nCVE-2026-43085\n\nCVE-2026-31699\n\nCVE-2026-43089\n\nCVE-2026-31698\n\nCVE-2026-43093\n\nCVE-2026-43493\n\nCVE-2026-43496\n\nCVE-2026-43502\n\nCVE-2026-45834\n\nCVE-2026-45835\n\nCVE-2026-45844\n\nCVE-2026-45843\n\nCVE-2026-45836\n\nCVE-2026-45840\n\nCVE-2026-45842\n\nCVE-2026-46023\n\nCVE-2026-46040\n\nCVE-2026-46051\n\nCVE-2026-46046\n\nCVE-2026-45838\n\nCVE-2026-46033\n\nCVE-2026-46022\n\nCVE-2026-46064\n\nCVE-2026-46070\n\nCVE-2026-46018\n\nCVE-2026-45841\n\nCVE-2026-46088\n\nCVE-2026-46128\n\nCVE-2026-46120\n\nCVE-2026-46124\n\nCVE-2026-46102\n\nCVE-2026-46122\n\nCVE-2026-46146\n\nCVE-2026-46149\n\nCVE-2026-46163\n\nCVE-2026-46177\n\nCVE-2026-46187\n\nCVE-2026-46227\n\nCVE-2026-46243\n\nCVE-2026-43117\n\nCVE-2026-46275\n\nCVE-2026-46303\n\nCVE-2026-43503\n\nCVE-2026-46294\n\nCVE-2026-46167\n\nCVE-2026-46151\n\nCVE-2025-22105\n\nCVE-2024-36922\n\nCVE-2024-56647\n\nCVE-2024-56657\n\nCVE-2026-23255\n\nCVE-2026-43499\n\nCVE-2026-31704\n\nCVE-2026-46113\n\nCVE-2026-46304\n\nCVE-2026-31697\n\nCVE-2026-43114\n\nCVE-2025-38584\n\nCVE-2026-31407\n\nCVE-2026-46150\n\nCVE-2026-31676\n\nCVE-2026-46234\n\nCVE-2026-46214\n\nCVE-2026-46172\n\nCVE-2026-46209\n\nCVE-2026-45997\n\nCVE-2026-31613\n\nCVE-2026-45839\n\nCVE-2026-31612\n\nCVE-2026-43074\n\nCVE-2026-31611\n\nCVE-2026-46050\n\nCVE-2026-43112\n\nCVE-2026-46092\n\nCVE-2025-39997\n\nCVE-2026-46099\n\nCVE-2026-46165\n\nCVE-2026-31694\n\nCVE-2026-46168\n\nCVE-2026-46173\n\nCVE-2026-46136\n\nCVE-2026-46185\n\nCVE-2026-43071\n\nCVE-2026-43094\n\nCVE-2026-46306\n\nCVE-2026-46195\n\nCVE-2026-46193\n\nCVE-2026-46116\n\nCVE-2026-46044\n\nCVE-2026-43116\n\nCVE-2026-53184\n\nCVE-2026-31712\n\nCVE-2026-43421\n\nCVE-2026-53131\n\nCVE-2026-23310\n\nCVE-2026-53198\n\nCVE-2026-46065\n\nCVE-2026-53183\n\nCVE-2026-53147\n\nCVE-2026-46190\n\nCVE-2026-46110\n\nCVE-2026-46323\n\nCVE-2023-54271\n\nCVE-2026-43492\n\nCVE-2026-52918\n\nCVE-2026-45991\n\nCVE-2026-46026\n\nCVE-2026-46038\n\nCVE-2026-46191\n\nCVE-2026-46003\n\nCVE-2026-31700\n\nCVE-2026-46069\n\nCVE-2026-53177\n\nCVE-2026-46021\n\nCVE-2026-52929\n\nCVE-2026-46159\n\nCVE-2026-52923\n\nCVE-2026-52930\n\nCVE-2026-52943\n\nCVE-2026-46083\n\nCVE-2026-46125\n\nCVE-2026-52946\n\nCVE-2026-46180\n\nCVE-2026-53168\n\nCVE-2026-53150\n\nCVE-2026-53080\n\nCVE-2026-53148\n\nCVE-2026-43303\n\nCVE-2026-53149\n\nCVE-2026-46321\n\nCVE-2026-53146\n\nCVE-2026-52947\n\nCVE-2026-52942\n\nCVE-2026-52910\n\nCVE-2026-46322\n\nCVE-2026-46086\n\nCVE-2026-45850\n\nCVE-2026-31709\n\nCVE-2026-46137\n\nCVE-2026-52948\n\nCVE-2026-46320\n\nCVE-2026-53181\n\nCVE-2026-52917\n\nCVE-2026-46196\n\nCVE-2026-53208\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53225\n\nCVE-2026-53228\n\nCVE-2026-53236\n\nCVE-2026-53212\n\nCVE-2026-53221\n\nCVE-2026-53227\n\nCVE-2026-53245\n\nCVE-2026-53249\n\nCVE-2026-53253\n\nCVE-2026-53239\n\nCVE-2026-53254\n\nCVE-2026-53242\n\nCVE-2026-53256\n\nCVE-2026-53263\n\nCVE-2026-53265\n\nCVE-2026-53264\n\nCVE-2026-53255\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53337\n\nCVE-2026-53349\n\nCVE-2026-53350\n\nCVE-2026-53352\n\nCVE-2026-53358\n\nCVE-2025-23131\n\nCVE-2026-23278\n\nCVE-2026-53356\n\nCVE-2026-31451\n\nCVE-2026-23302\n\nCVE-2026-23272\n\nCVE-2026-46331\n\nCVE-2026-52928\n\nCVE-2026-52909\n\nCVE-2026-53325\n\nCVE-2026-53167\n\nCVE-2026-53362\n\nCVE-2026-53192\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nOnly build and run applications from trusted sources.\n\nLimit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-1500 TM MFP is a Technology module Multi functional platform for SIMATIC S7-1500 PLCs based on SIMATIC Industrial OS\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2023-52927\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: allow exp not to be removed in nf_ct_find_expectation\n\nCurrently nf_conntrack_in() calling nf_ct_find_expectation() will\nremove the exp from the hash table. However, in some scenario, we\nexpect the exp not to be removed when the created ct will not be\nconfirmed, like in OVS and TC conntrack in the following patches.\n\nThis patch allows exp not to be removed by setting IPS_CONFIRMED\nin the status of the tmpl.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2023-53292\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none\n\nAfter grabbing q->sysfs_lock, q->elevator may become NULL because of\nelevator switch.\n\nFix the NULL dereference on q->elevator by checking it with lock.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2023-54271\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init\n\nblk-iocost sometimes causes the following crash:\n\nBUG: kernel NULL pointer dereference, address: 00000000000000e0\n...\nRIP: 0010:_raw_spin_lock+0x17/0x30\nCode: be 01 02 00 00 e8 79 38 39 ff 31 d2 89 d0 5d c3 0f 1f 00 0f 1f 44 00 00 55 48 89 e5 65 ff 05 48 d0 34 7e b9 01 00 00 00 31 c0 0f b1 0f 75 02 5d c3 89 c6 e8 ea 04 00 00 5d c3 0f 1f 84 00 00\nRSP: 0018:ffffc900023b3d40 EFLAGS: 00010046\nRAX: 0000000000000000 RBX: 00000000000000e0 RCX: 0000000000000001\nRDX: ffffc900023b3d20 RSI: ffffc900023b3cf0 RDI: 00000000000000e0\nRBP: ffffc900023b3d40 R08: ffffc900023b3c10 R09: 0000000000000003\nR10: 0000000000000064 R11: 000000000000000a R12: ffff888102337000\nR13: fffffffffffffff2 R14: ffff88810af408c8 R15: ffff8881070c3600\nFS: 00007faaaf364fc0(0000) GS:ffff88842fdc0000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000000000e0 CR3: 00000001097b1000 CR4: 0000000000350ea0\nCall Trace:\n\nioc_weight_write+0x13d/0x410\ncgroup_file_write+0x7a/0x130\nkernfs_fop_write_iter+0xf5/0x170\nvfs_write+0x298/0x370\nksys_write+0x5f/0xb0\n__x64_sys_write+0x1b/0x20\ndo_syscall_64+0x3d/0x80\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThis happens because iocg->ioc is NULL. The field is initialized by\nioc_pd_init() and never cleared. The NULL deref is caused by\nblkcg_activate_policy() installing blkg_policy_data before initializing it.\n\nblkcg_activate_policy() was doing the following:\n\nAllocate pd's for all existing blkg's and install them in blkg->pd[].\n\nInitialize all pd's.\n\nOnline all pd's.\n\nblkcg_activate_policy() only grabs the queue_lock and may release and\nre-acquire the lock as allocation may need to sleep. ioc_weight_write()\ngrabs blkcg->lock and iterates all its blkg's. The two can race and if\nioc_weight_write() runs during #1 or between #1 and #2, it can encounter a\npd which is not initialized yet, leading to crash.\n\nThe crash can be reproduced with the following script:\n\n#!/bin/bash\n\necho +io > /sys/fs/cgroup/cgroup.subtree_control\nsystemd-run --unit touch-sda --scope dd if=/dev/sda of=/dev/null bs=1M count=1 iflag=direct\necho 100 > /sys/fs/cgroup/system.slice/io.weight\nbash -c \"echo '8:0 enable=1' > /sys/fs/cgroup/io.cost.qos\" &\nsleep .2\necho 100 > /sys/fs/cgroup/system.slice/io.weight\n\nwith the following patch applied:\n\ndiff --git a/block/blk-cgroup.c b/block/blk-cgroup.c\nindex fc49be622e05..38d671d5e10c 100644\n--- a/block/blk-cgroup.c\n+++ b/block/blk-cgroup.c\n@@ -1553,6 +1553,12 @@ int blkcg_activate_policy(struct gendisk disk, const struct blkcg_policy pol)\npd->online = false;\n}\n\nif (system_state == SYSTEM_RUNNING) {\n\nspin_unlock_irq(&q->queue_lock);\n\nssleep(1);\n\nspin_lock_irq(&q->queue_lock);\n\n}\n+\n/ all allocated, init in the same order /\nif (pol->pd_init_fn)\nlist_for_each_entry_reverse(blkg, &q->blkg_list, q_node)\n\nI don't see a reason why all pd's should be allocated, initialized and\nonlined together. The only ordering requirement is that parent blkgs to be\ninitialized and onlined before children, which is guaranteed from the\nwalking order. Let's fix the bug by allocating, initializing and onlining pd\nfor each blkg and holding blkcg->lock over initialization and onlining. This\nensures that an installed blkg is always fully initialized and onlined\nremoving the the race window.\n\nCVSS v3.1 Base Score\n0.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2024-26982\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check the inode number is not the invalid value of zero\n\nSyskiller has produced an out of bounds access in fill_meta_index().\n\nThat out of bounds access is ultimately caused because the inode\nhas an inode number with the invalid value of zero, which was not checked.\n\nThe reason this causes the out of bounds access is due to following\nsequence of events:\n\nFill_meta_index() is called to allocate (via empty_meta_index())\nand fill a metadata index. It however suffers a data read error\nand aborts, invalidating the newly returned empty metadata index.\nIt does this by setting the inode number of the index to zero,\nwhich means unused (zero is not a valid inode number).\n\nWhen fill_meta_index() is subsequently called again on another\nread operation, locate_meta_index() returns the previous index\nbecause it matches the inode number of 0. Because this index\nhas been returned it is expected to have been filled, and because\nit hasn't been, an out of bounds access is performed.\n\nThis patch adds a sanity check which checks that the inode number\nis not zero when the inode is created and returns -EINVAL if it is.\n\n[phillip@squashfs.org.uk: whitespace fix]\n\nCVSS v3.1 Base Score\n7.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\nCWE\nCWE-125: Out-of-bounds Read\n\nVulnerability CVE-2024-36922\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: read txq->read_ptr under lock\n\nIf we read txq->read_ptr without lock, we can read the same\nvalue twice, then obtain the lock, and reclaim from there\nto two different places, but crucially reclaim the same\nentry twice, resulting in the WARN_ONCE() a little later.\nFix that by reading txq->read_ptr under lock.\n\nCVSS v3.1 Base Score\n8.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2024-40945\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu: Return right value in iommu_sva_bind_device()\n\niommu_sva_bind_device() should return either a sva bond handle or an\nERR_PTR value in error cases. Existing drivers (idxd and uacce) only\ncheck the return value with IS_ERR(). This could potentially lead to\na kernel NULL pointer dereference issue if the function returns NULL\ninstead of an error pointer.\n\nIn reality, this doesn't cause any problems because iommu_sva_bind_device()\nonly returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA.\nIn this case, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) will\nreturn an error, and the device drivers won't call iommu_sva_bind_device()\nat all.\n\nCVSS v3.1 Base Score\n6.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\n\nCWE\nCWE-393: Return of Wrong Status Code\n\nVulnerability CVE-2024-47809\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix possible lkb_resource null dereference\n\nThis patch fixes a possible null pointer dereference when this function is\ncalled from request_lock() as lkb->lkb_resource is not assigned yet,\nonly after validate_lock_args() by calling attach_lkb(). Another issue\nis that a resource name could be a non printable bytearray and we cannot\nassume to be ASCII coded.\n\nThe log functionality is probably never being hit when DLM is used in\nnormal way and no debug logging is enabled. The null pointer dereference\ncan only occur on a new created lkb that does not have the resource\nassigned yet, it probably never hits the null pointer dereference but we\nshould be sure that other changes might not change this behaviour and we\nactually can hit the mentioned null pointer dereference.\n\nIn this patch we just drop the printout of the resource name, the lkb id\nis enough to make a possible connection to a resource name if this\nexists.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2024-49998\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: improve shutdown sequence\n\nAlexander Sverdlin presents 2 problems during shutdown with the\nlan9303 driver. One is specific to lan9303 and the other just happens\nto reproduce there.\n\nThe first problem is that lan9303 is unique among DSA drivers in that it\ncalls dev_get_drvdata() at \"arbitrary runtime\" (not probe, not shutdown,\nnot remove):\n\nphy_state_machine()\n-> ...\n-> dsa_user_phy_read()\n-> ds->ops->phy_read()\n-> lan9303_phy_read()\n-> chip->ops->phy_read()\n-> lan9303_mdio_phy_read()\n-> dev_get_drvdata()\n\nBut we never stop the phy_state_machine(), so it may continue to run\nafter dsa_switch_shutdown(). Our common pattern in all DSA drivers is\nto set drvdata to NULL to suppress the remove() method that may come\nafterwards. But in this case it will result in an NPD.\n\nThe second problem is that the way in which we set\ndp->conduit->dsa_ptr = NULL; is concurrent with receive packet\nprocessing. dsa_switch_rcv() checks once whether dev->dsa_ptr is NULL,\nbut afterwards, rather than continuing to use that non-NULL value,\ndev->dsa_ptr is dereferenced again and again without NULL checks:\ndsa_conduit_find_user() and many other places. In between dereferences,\nthere is no locking to ensure that what was valid once continues to be\nvalid.\n\nBoth problems have the common aspect that closing the conduit interface\nsolves them.\n\nIn the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN\nevent in dsa_user_netdevice_event() which closes user ports as well.\ndsa_port_disable_rt() calls phylink_stop(), which synchronously stops\nthe phylink state machine, and ds->ops->phy_read() will thus no longer\ncall into the driver after this point.\n\nIn the second case, dev_close(conduit) should do this, as per\nDocumentation/networking/driver.rst:\n\n| Quiescence\n| ----------\n|\n| After the ndo_stop routine has been called, the hardware must\n| not receive or transmit any data. All in flight packets must\n| be aborted. If necessary, poll or wait for completion of\n| any reset commands.\n\nSo it should be sufficient to ensure that later, when we zeroize\nconduit->dsa_ptr, there will be no concurrent dsa_switch_rcv() call\non this conduit.\n\nThe addition of the netif_device_detach() function is to ensure that\nioctls, rtnetlinks and ethtool requests on the user ports no longer\npropagate down to the driver - we're no longer prepared to handle them.\n\nThe race condition actually did not exist when commit 0650bf52b31f\n(\"net: dsa: be compatible with masters which unregister on shutdown\")\nfirst introduced dsa_switch_shutdown(). It was created later, when we\nstopped unregistering the user interfaces from a bad spot, and we just\nreplaced that sequence with a racy zeroization of conduit->dsa_ptr\n(one which doesn't ensure that the interfaces aren't up).\n\nCVSS v3.1 Base Score\n4.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2024-53166\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix bfqq uaf in bfq_limit_depth()\n\nSet new allocated bfqq to bic or remove freed bfqq from bic are both\nprotected by bfqd->lock, however bfq_limit_depth() is deferencing bfqq\nfrom bic without the lock, this can lead to UAF if the io_context is\nshared by multiple tasks.\n\nFor example, test bfq with io_uring can trigger following UAF in v6.6:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in bfqq_group+0x15/0x50\n\nCall Trace:\n\ndump_stack_lvl+0x47/0x80\nprint_address_description.constprop.0+0x66/0x300\nprint_report+0x3e/0x70\nkasan_report+0xb4/0xf0\nbfqq_group+0x15/0x50\nbfqq_request_over_limit+0x130/0x9a0\nbfq_limit_depth+0x1b5/0x480\n__blk_mq_alloc_requests+0x2b5/0xa00\nblk_mq_get_new_requests+0x11d/0x1d0\nblk_mq_submit_bio+0x286/0xb00\nsubmit_bio_noacct_nocheck+0x331/0x400\n__block_write_full_folio+0x3d0/0x640\nwritepage_cb+0x3b/0xc0\nwrite_cache_pages+0x254/0x6c0\nwrite_cache_pages+0x254/0x6c0\ndo_writepages+0x192/0x310\nfilemap_fdatawrite_wbc+0x95/0xc0\n__filemap_fdatawrite_range+0x99/0xd0\nfilemap_write_and_wait_range.part.0+0x4d/0xa0\nblkdev_read_iter+0xef/0x1e0\nio_read+0x1b6/0x8a0\nio_issue_sqe+0x87/0x300\nio_wq_submit_work+0xeb/0x390\nio_worker_handle_work+0x24d/0x550\nio_wq_worker+0x27f/0x6c0\nret_from_fork_asm+0x1b/0x30\n\nAllocated by task 808602:\nkasan_save_stack+0x1e/0x40\nkasan_set_track+0x21/0x30\n__kasan_slab_alloc+0x83/0x90\nkmem_cache_alloc_node+0x1b1/0x6d0\nbfq_get_queue+0x138/0xfa0\nbfq_get_bfqq_handle_split+0xe3/0x2c0\nbfq_init_rq+0x196/0xbb0\nbfq_insert_request.isra.0+0xb5/0x480\nbfq_insert_requests+0x156/0x180\nblk_mq_insert_request+0x15d/0x440\nblk_mq_submit_bio+0x8a4/0xb00\nsubmit_bio_noacct_nocheck+0x331/0x400\n__blkdev_direct_IO_async+0x2dd/0x330\nblkdev_write_iter+0x39a/0x450\nio_write+0x22a/0x840\nio_issue_sqe+0x87/0x300\nio_wq_submit_work+0xeb/0x390\nio_worker_handle_work+0x24d/0x550\nio_wq_worker+0x27f/0x6c0\nret_from_fork+0x2d/0x50\nret_from_fork_asm+0x1b/0x30\n\nFreed by task 808589:\nkasan_save_stack+0x1e/0x40\nkasan_set_track+0x21/0x30\nkasan_save_free_info+0x27/0x40\n__kasan_slab_free+0x126/0x1b0\nkmem_cache_free+0x10c/0x750\nbfq_put_queue+0x2dd/0x770\n__bfq_insert_request.isra.0+0x155/0x7a0\nbfq_insert_request.isra.0+0x122/0x480\nbfq_insert_requests+0x156/0x180\nblk_mq_dispatch_plug_list+0x528/0x7e0\nblk_mq_flush_plug_list.part.0+0xe5/0x590\n__blk_flush_plug+0x3b/0x90\nblk_finish_plug+0x40/0x60\ndo_writepages+0x19d/0x310\nfilemap_fdatawrite_wbc+0x95/0xc0\n__filemap_fdatawrite_range+0x99/0xd0\nfilemap_write_and_wait_range.part.0+0x4d/0xa0\nblkdev_read_iter+0xef/0x1e0\nio_read+0x1b6/0x8a0\nio_issue_sqe+0x87/0x300\nio_wq_submit_work+0xeb/0x390\nio_worker_handle_work+0x24d/0x550\nio_wq_worker+0x27f/0x6c0\nret_from_fork+0x2d/0x50\nret_from_fork_asm+0x1b/0x30\n\nFix the problem by protecting bic_to_bfqq() with bfqd->lock.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n7.1\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2024-56647\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix icmp host relookup triggering ip_rt_bug\n\narp link failure may trigger ip_rt_bug while xfrm enabled, call trace is:\n\nWARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 ip_rt_bug+0x14/0x20\nModules linked in:\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:ip_rt_bug+0x14/0x20\nCall Trace:\n\nip_send_skb+0x14/0x40\n__icmp_send+0x42d/0x6a0\nipv4_link_failure+0xe2/0x1d0\narp_error_report+0x3c/0x50\nneigh_invalidate+0x8d/0x100\nneigh_timer_handler+0x2e1/0x330\ncall_timer_fn+0x21/0x120\n__run_timer_base.part.0+0x1c9/0x270\nrun_timer_softirq+0x4c/0x80\nhandle_softirqs+0xac/0x280\nirq_exit_rcu+0x62/0x80\nsysvec_apic_timer_interrupt+0x77/0x90\n\nThe script below reproduces this scenario:\nip xfrm policy add src 0.0.0.0/0 dst 0.0.0.0/0 \\\ndir out priority 0 ptype main flag localok icmp\nip l a veth1 type veth\nip a a 192.168.141.111/24 dev veth0\nip l s ", "truncated": true, "representation": "html_text_excerpt", "relatedCve": "CVE-2026-53362", "relatedCves": [ "CVE-2024-58005", "CVE-2023-52927", "CVE-2024-53166", "CVE-2024-58002", "CVE-2025-21844", "CVE-2024-26982", "CVE-2024-58079", "CVE-2025-21858", "CVE-2025-21865", "CVE-2025-21859", "CVE-2025-21862", "CVE-2025-21846", "CVE-2025-21864", "CVE-2025-21838", "CVE-2025-21756", "CVE-2025-21702", "CVE-2024-57977", "CVE-2025-21725", "CVE-2025-21806", "CVE-2024-58009", "CVE-2025-21767", "CVE-2025-21763", "CVE-2024-58077", "CVE-2024-58063", "CVE-2024-58013", "CVE-2025-21835", "CVE-2024-57979", "CVE-2025-21703", "CVE-2025-21735", "CVE-2025-21761", "CVE-2024-58071", "CVE-2025-21728", "CVE-2025-21738", "CVE-2025-21766", "CVE-2025-21795", "CVE-2025-21787", "CVE-2025-21779", "CVE-2024-58061", "CVE-2025-21724", "CVE-2025-21719", "CVE-2025-21790", "CVE-2025-21764", "CVE-2025-21705", "CVE-2025-21814", "CVE-2025-21765", "CVE-2025-21791", "CVE-2024-57986", "CVE-2024-40945", "CVE-2025-21744", "CVE-2024-57993", "CVE-2025-21700", "CVE-2024-57981", "CVE-2025-21832", "CVE-2024-58083", "CVE-2024-58020", "CVE-2025-21706", "CVE-2024-57996", "CVE-2025-21796", "CVE-2025-21758", "CVE-2025-21727", "CVE-2025-21745", "CVE-2024-58058", "CVE-2024-58017", "CVE-2024-58068", "CVE-2025-21716", "CVE-2025-21708", "CVE-2024-58014", "CVE-2025-21704", "CVE-2024-57980", "CVE-2025-21731", "CVE-2025-21726", "CVE-2025-21707", "CVE-2025-21776", "CVE-2025-21830", "CVE-2025-21760", "CVE-2025-21753", "CVE-2025-21762", "CVE-2024-58072", "CVE-2026-23253", "CVE-2026-23277", "CVE-2026-23279", "CVE-2026-23303", "CVE-2026-23356", "CVE-2025-21682", "CVE-2025-38250", "CVE-2026-23204", "CVE-2026-23365", "CVE-2026-23290", "CVE-2026-23339", "CVE-2026-23281", "CVE-2026-23372", "CVE-2026-23312", "CVE-2026-23367", "CVE-2026-23388", "CVE-2026-23398", "CVE-2026-23396", "CVE-2026-23274", "CVE-2026-23336", "CVE-2026-23395", "CVE-2026-23382", "CVE-2026-23368", "CVE-2026-23351", "CVE-2026-23357", "CVE-2026-23245", "CVE-2026-23352", "CVE-2026-23300", "CVE-2026-23100", "CVE-2025-68206", "CVE-2026-23379", "CVE-2025-39748", "CVE-2026-23381", "CVE-2026-23291", "CVE-2026-23304", "CVE-2026-23397", "CVE-2026-23318", "CVE-2026-23391", "CVE-2026-23113", "CVE-2024-56719", "CVE-2026-23154", "CVE-2025-68265", "CVE-2026-23296", "CVE-2026-23231", "CVE-2026-23292", "CVE-2026-23317", "CVE-2026-23319", "CVE-2026-23271", "CVE-2026-23141", "CVE-2026-23157", "CVE-2026-23270", "CVE-2025-40135", "CVE-2025-38162", "CVE-2026-23315", "CVE-2024-47809", "CVE-2025-39863", "CVE-2025-68239", "CVE-2026-23321", "CVE-2025-38192", "CVE-2025-38105", "CVE-2026-23343", "CVE-2026-23340", "CVE-2026-23364", "CVE-2026-23392", "CVE-2024-49998", "CVE-2026-23370", "CVE-2025-38704", "CVE-2026-23359", "CVE-2026-23378", "CVE-2026-23273", "CVE-2026-31708", "CVE-2026-43052", "CVE-2026-43350", "CVE-2026-46056", "CVE-2026-31705", "CVE-2026-46107", "CVE-2026-31449", "CVE-2025-21863", "CVE-2026-46307", "CVE-2026-46047", "CVE-2026-31586", "CVE-2026-31580", "CVE-2026-23444", "CVE-2026-23442", "CVE-2026-31583", "CVE-2026-31532", "CVE-2026-31624", "CVE-2026-31625", "CVE-2026-31630", "CVE-2026-31622", "CVE-2026-31637", "CVE-2026-31629", "CVE-2026-31617", "CVE-2026-31642", "CVE-2026-23066", "CVE-2026-23389", "CVE-2026-31488", "CVE-2026-43110", "CVE-2026-31711", "CVE-2026-46015", "CVE-2026-23399", "CVE-2026-43080", "CVE-2026-31500", "CVE-2026-43111", "CVE-2026-31673", "CVE-2026-43099", "CVE-2026-46037", "CVE-2023-53292", "CVE-2026-46101", "CVE-2026-46161", "CVE-2026-31681", "CVE-2026-31685", "CVE-2026-31696", "CVE-2026-43085", "CVE-2026-31699", "CVE-2026-43089", "CVE-2026-31698", "CVE-2026-43093", "CVE-2026-43493", "CVE-2026-43496", "CVE-2026-43502", "CVE-2026-45834", "CVE-2026-45835", "CVE-2026-45844", "CVE-2026-45843", "CVE-2026-45836", "CVE-2026-45840", "CVE-2026-45842", "CVE-2026-46023", "CVE-2026-46040", "CVE-2026-46051", "CVE-2026-46046", "CVE-2026-45838", "CVE-2026-46033", "CVE-2026-46022", "CVE-2026-46064", "CVE-2026-46070", "CVE-2026-46018", "CVE-2026-45841", "CVE-2026-46088", "CVE-2026-46128", "CVE-2026-46120", "CVE-2026-46124", "CVE-2026-46102", "CVE-2026-46122", "CVE-2026-46146", "CVE-2026-46149", "CVE-2026-46163", "CVE-2026-46177", "CVE-2026-46187", "CVE-2026-46227", "CVE-2026-46243", "CVE-2026-43117", "CVE-2026-46275", "CVE-2026-46303", "CVE-2026-43503", "CVE-2026-46294", "CVE-2026-46167", "CVE-2026-46151", "CVE-2025-22105", "CVE-2024-36922", "CVE-2024-56647", "CVE-2024-56657", "CVE-2026-23255", "CVE-2026-43499", "CVE-2026-31704", "CVE-2026-46113", "CVE-2026-46304", "CVE-2026-31697", "CVE-2026-43114", "CVE-2025-38584", "CVE-2026-31407", "CVE-2026-46150", "CVE-2026-31676", "CVE-2026-46234", "CVE-2026-46214", "CVE-2026-46172", "CVE-2026-46209", "CVE-2026-45997", "CVE-2026-31613", "CVE-2026-45839", "CVE-2026-31612", "CVE-2026-43074", "CVE-2026-31611", "CVE-2026-46050", "CVE-2026-43112", "CVE-2026-46092", "CVE-2025-39997", "CVE-2026-46099", "CVE-2026-46165", "CVE-2026-31694", "CVE-2026-46168", "CVE-2026-46173", "CVE-2026-46136", "CVE-2026-46185", "CVE-2026-43071", "CVE-2026-43094", "CVE-2026-46306", "CVE-2026-46195", "CVE-2026-46193", "CVE-2026-46116", "CVE-2026-46044", "CVE-2026-43116", "CVE-2026-53184", "CVE-2026-31712", "CVE-2026-43421", "CVE-2026-53131", "CVE-2026-23310", "CVE-2026-53198", "CVE-2026-46065", "CVE-2026-53183", "CVE-2026-53147", "CVE-2026-46190", "CVE-2026-46110", "CVE-2026-46323", "CVE-2023-54271", "CVE-2026-43492", "CVE-2026-52918", "CVE-2026-45991", "CVE-2026-46026", "CVE-2026-46038", "CVE-2026-46191", "CVE-2026-46003", "CVE-2026-31700", "CVE-2026-46069", "CVE-2026-53177", "CVE-2026-46021", "CVE-2026-52929", "CVE-2026-46159", "CVE-2026-52923", "CVE-2026-52930", "CVE-2026-52943", "CVE-2026-46083", "CVE-2026-46125", "CVE-2026-52946", "CVE-2026-46180", "CVE-2026-53168", "CVE-2026-53150", "CVE-2026-53080", "CVE-2026-53148", "CVE-2026-43303", "CVE-2026-53149", "CVE-2026-46321", "CVE-2026-53146", "CVE-2026-52947", "CVE-2026-52942", "CVE-2026-52910", "CVE-2026-46322", "CVE-2026-46086", "CVE-2026-45850", "CVE-2026-31709", "CVE-2026-46137", "CVE-2026-52948", "CVE-2026-46320", "CVE-2026-53181", "CVE-2026-52917", "CVE-2026-46196", "CVE-2026-53208", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53225", "CVE-2026-53228", "CVE-2026-53236", "CVE-2026-53212", "CVE-2026-53221", "CVE-2026-53227", "CVE-2026-53245", "CVE-2026-53249", "CVE-2026-53253", "CVE-2026-53239", "CVE-2026-53254", "CVE-2026-53242", "CVE-2026-53256", "CVE-2026-53263", "CVE-2026-53265", "CVE-2026-53264", "CVE-2026-53255", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53337", "CVE-2026-53349", "CVE-2026-53350", "CVE-2026-53352", "CVE-2026-53358", "CVE-2025-23131", "CVE-2026-23278", "CVE-2026-53356", "CVE-2026-31451", "CVE-2026-23302", "CVE-2026-23272", "CVE-2026-46331", "CVE-2026-52928", "CVE-2026-52909", "CVE-2026-53325", "CVE-2026-53167", "CVE-2026-53362", "CVE-2026-53192", "CVE-2026-64560", "CVE-2025-37780" ] } ], "limits": { "completeness": "bounded", "truncatedFields": [ "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" ], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 当該CVEを本文中に明記した、直接参照された公的機関・開発元の告知を追加しています。複数製品・CVEを含む告知の対策は、その製品・CVEとの対応関係を維持してください。", "excludedLinkedSources": [] }, "supplementarySources": [ { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "title": "SSA-784472", "relatedCves": [ "CVE-2024-58005", "CVE-2023-52927", "CVE-2024-53166", "CVE-2024-58002", "CVE-2025-21844", "CVE-2024-26982", "CVE-2024-58079", "CVE-2025-21858", "CVE-2025-21865", "CVE-2025-21859", "CVE-2025-21862", "CVE-2025-21846", "CVE-2025-21864", "CVE-2025-21838", "CVE-2025-21756", "CVE-2025-21702", "CVE-2024-57977", "CVE-2025-21725", "CVE-2025-21806", "CVE-2024-58009", "CVE-2025-21767", "CVE-2025-21763", "CVE-2024-58077", "CVE-2024-58063", "CVE-2024-58013", "CVE-2025-21835", "CVE-2024-57979", "CVE-2025-21703", "CVE-2025-21735", "CVE-2025-21761", "CVE-2024-58071", "CVE-2025-21728", "CVE-2025-21738", "CVE-2025-21766", "CVE-2025-21795", "CVE-2025-21787", "CVE-2025-21779", "CVE-2024-58061", "CVE-2025-21724", "CVE-2025-21719", "CVE-2025-21790", "CVE-2025-21764", "CVE-2025-21705", "CVE-2025-21814", "CVE-2025-21765", "CVE-2025-21791", "CVE-2024-57986", "CVE-2024-40945", "CVE-2025-21744", "CVE-2024-57993", "CVE-2025-21700", "CVE-2024-57981", "CVE-2025-21832", "CVE-2024-58083", "CVE-2024-58020", "CVE-2025-21706", "CVE-2024-57996", "CVE-2025-21796", "CVE-2025-21758", "CVE-2025-21727", "CVE-2025-21745", "CVE-2024-58058", "CVE-2024-58017", "CVE-2024-58068", "CVE-2025-21716", "CVE-2025-21708", "CVE-2024-58014", "CVE-2025-21704", "CVE-2024-57980", "CVE-2025-21731", "CVE-2025-21726", "CVE-2025-21707", "CVE-2025-21776", "CVE-2025-21830", "CVE-2025-21760", "CVE-2025-21753", "CVE-2025-21762", "CVE-2024-58072", "CVE-2026-23253", "CVE-2026-23277", "CVE-2026-23279", "CVE-2026-23303", "CVE-2026-23356", "CVE-2025-21682", "CVE-2025-38250", "CVE-2026-23204", "CVE-2026-23365", "CVE-2026-23290", "CVE-2026-23339", "CVE-2026-23281", "CVE-2026-23372", "CVE-2026-23312", "CVE-2026-23367", "CVE-2026-23388", "CVE-2026-23398", "CVE-2026-23396", "CVE-2026-23274", "CVE-2026-23336", "CVE-2026-23395", "CVE-2026-23382", "CVE-2026-23368", "CVE-2026-23351", "CVE-2026-23357", "CVE-2026-23245", "CVE-2026-23352", "CVE-2026-23300", "CVE-2026-23100", "CVE-2025-68206", "CVE-2026-23379", "CVE-2025-39748", "CVE-2026-23381", "CVE-2026-23291", "CVE-2026-23304", "CVE-2026-23397", "CVE-2026-23318", "CVE-2026-23391", "CVE-2026-23113", "CVE-2024-56719", "CVE-2026-23154", "CVE-2025-68265", "CVE-2026-23296", "CVE-2026-23231", "CVE-2026-23292", "CVE-2026-23317", "CVE-2026-23319", "CVE-2026-23271", "CVE-2026-23141", "CVE-2026-23157", "CVE-2026-23270", "CVE-2025-40135", "CVE-2025-38162", "CVE-2026-23315", "CVE-2024-47809", "CVE-2025-39863", "CVE-2025-68239", "CVE-2026-23321", "CVE-2025-38192", "CVE-2025-38105", "CVE-2026-23343", "CVE-2026-23340", "CVE-2026-23364", "CVE-2026-23392", "CVE-2024-49998", "CVE-2026-23370", "CVE-2025-38704", "CVE-2026-23359", "CVE-2026-23378", "CVE-2026-23273", "CVE-2026-31708", "CVE-2026-43052", "CVE-2026-43350", "CVE-2026-46056", "CVE-2026-31705", "CVE-2026-46107", "CVE-2026-31449", "CVE-2025-21863", "CVE-2026-46307", "CVE-2026-46047", "CVE-2026-31586", "CVE-2026-31580", "CVE-2026-23444", "CVE-2026-23442", "CVE-2026-31583", "CVE-2026-31532", "CVE-2026-31624", "CVE-2026-31625", "CVE-2026-31630", "CVE-2026-31622", "CVE-2026-31637", "CVE-2026-31629", "CVE-2026-31617", "CVE-2026-31642", "CVE-2026-23066", "CVE-2026-23389", "CVE-2026-31488", "CVE-2026-43110", "CVE-2026-31711", "CVE-2026-46015", "CVE-2026-23399", "CVE-2026-43080", "CVE-2026-31500", "CVE-2026-43111", "CVE-2026-31673", "CVE-2026-43099", "CVE-2026-46037", "CVE-2023-53292", "CVE-2026-46101", "CVE-2026-46161", "CVE-2026-31681", "CVE-2026-31685", "CVE-2026-31696", "CVE-2026-43085", "CVE-2026-31699", "CVE-2026-43089", "CVE-2026-31698", "CVE-2026-43093", "CVE-2026-43493", "CVE-2026-43496", "CVE-2026-43502", "CVE-2026-45834", "CVE-2026-45835", "CVE-2026-45844", "CVE-2026-45843", "CVE-2026-45836", "CVE-2026-45840", "CVE-2026-45842", "CVE-2026-46023", "CVE-2026-46040", "CVE-2026-46051", "CVE-2026-46046", "CVE-2026-45838", "CVE-2026-46033", "CVE-2026-46022", "CVE-2026-46064", "CVE-2026-46070", "CVE-2026-46018", "CVE-2026-45841", "CVE-2026-46088", "CVE-2026-46128", "CVE-2026-46120", "CVE-2026-46124", "CVE-2026-46102", "CVE-2026-46122", "CVE-2026-46146", "CVE-2026-46149", "CVE-2026-46163", "CVE-2026-46177", "CVE-2026-46187", "CVE-2026-46227", "CVE-2026-46243", "CVE-2026-43117", "CVE-2026-46275", "CVE-2026-46303", "CVE-2026-43503", "CVE-2026-46294", "CVE-2026-46167", "CVE-2026-46151", "CVE-2025-22105", "CVE-2024-36922", "CVE-2024-56647", "CVE-2024-56657", "CVE-2026-23255", "CVE-2026-43499", "CVE-2026-31704", "CVE-2026-46113", "CVE-2026-46304", "CVE-2026-31697", "CVE-2026-43114", "CVE-2025-38584", "CVE-2026-31407", "CVE-2026-46150", "CVE-2026-31676", "CVE-2026-46234", "CVE-2026-46214", "CVE-2026-46172", "CVE-2026-46209", "CVE-2026-45997", "CVE-2026-31613", "CVE-2026-45839", "CVE-2026-31612", "CVE-2026-43074", "CVE-2026-31611", "CVE-2026-46050", "CVE-2026-43112", "CVE-2026-46092", "CVE-2025-39997", "CVE-2026-46099", "CVE-2026-46165", "CVE-2026-31694", "CVE-2026-46168", "CVE-2026-46173", "CVE-2026-46136", "CVE-2026-46185", "CVE-2026-43071", "CVE-2026-43094", "CVE-2026-46306", "CVE-2026-46195", "CVE-2026-46193", "CVE-2026-46116", "CVE-2026-46044", "CVE-2026-43116", "CVE-2026-53184", "CVE-2026-31712", "CVE-2026-43421", "CVE-2026-53131", "CVE-2026-23310", "CVE-2026-53198", "CVE-2026-46065", "CVE-2026-53183", "CVE-2026-53147", "CVE-2026-46190", "CVE-2026-46110", "CVE-2026-46323", "CVE-2023-54271", "CVE-2026-43492", "CVE-2026-52918", "CVE-2026-45991", "CVE-2026-46026", "CVE-2026-46038", "CVE-2026-46191", "CVE-2026-46003", "CVE-2026-31700", "CVE-2026-46069", "CVE-2026-53177", "CVE-2026-46021", "CVE-2026-52929", "CVE-2026-46159", "CVE-2026-52923", "CVE-2026-52930", "CVE-2026-52943", "CVE-2026-46083", "CVE-2026-46125", "CVE-2026-52946", "CVE-2026-46180", "CVE-2026-53168", "CVE-2026-53150", "CVE-2026-53080", "CVE-2026-53148", "CVE-2026-43303", "CVE-2026-53149", "CVE-2026-46321", "CVE-2026-53146", "CVE-2026-52947", "CVE-2026-52942", "CVE-2026-52910", "CVE-2026-46322", "CVE-2026-46086", "CVE-2026-45850", "CVE-2026-31709", "CVE-2026-46137", "CVE-2026-52948", "CVE-2026-46320", "CVE-2026-53181", "CVE-2026-52917", "CVE-2026-46196", "CVE-2026-53208", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53225", "CVE-2026-53228", "CVE-2026-53236", "CVE-2026-53212", "CVE-2026-53221", "CVE-2026-53227", "CVE-2026-53245", "CVE-2026-53249", "CVE-2026-53253", "CVE-2026-53239", "CVE-2026-53254", "CVE-2026-53242", "CVE-2026-53256", "CVE-2026-53263", "CVE-2026-53265", "CVE-2026-53264", "CVE-2026-53255", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53337", "CVE-2026-53349", "CVE-2026-53350", "CVE-2026-53352", "CVE-2026-53358", "CVE-2025-23131", "CVE-2026-23278", "CVE-2026-53356", "CVE-2026-31451", "CVE-2026-23302", "CVE-2026-23272", "CVE-2026-46331", "CVE-2026-52928", "CVE-2026-52909", "CVE-2026-53325", "CVE-2026-53167", "CVE-2026-53362", "CVE-2026-53192", "CVE-2026-64560", "CVE-2025-37780" ] } ], "relatedDocuments": [ { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "title": "SSA-784472", "relatedCves": [ "CVE-2024-58005", "CVE-2023-52927", "CVE-2024-53166", "CVE-2024-58002", "CVE-2025-21844", "CVE-2024-26982", "CVE-2024-58079", "CVE-2025-21858", "CVE-2025-21865", "CVE-2025-21859", "CVE-2025-21862", "CVE-2025-21846", "CVE-2025-21864", "CVE-2025-21838", "CVE-2025-21756", "CVE-2025-21702", "CVE-2024-57977", "CVE-2025-21725", "CVE-2025-21806", "CVE-2024-58009", "CVE-2025-21767", "CVE-2025-21763", "CVE-2024-58077", "CVE-2024-58063", "CVE-2024-58013", "CVE-2025-21835", "CVE-2024-57979", "CVE-2025-21703", "CVE-2025-21735", "CVE-2025-21761", "CVE-2024-58071", "CVE-2025-21728", "CVE-2025-21738", "CVE-2025-21766", "CVE-2025-21795", "CVE-2025-21787", "CVE-2025-21779", "CVE-2024-58061", "CVE-2025-21724", "CVE-2025-21719", "CVE-2025-21790", "CVE-2025-21764", "CVE-2025-21705", "CVE-2025-21814", "CVE-2025-21765", "CVE-2025-21791", "CVE-2024-57986", "CVE-2024-40945", "CVE-2025-21744", "CVE-2024-57993", "CVE-2025-21700", "CVE-2024-57981", "CVE-2025-21832", "CVE-2024-58083", "CVE-2024-58020", "CVE-2025-21706", "CVE-2024-57996", "CVE-2025-21796", "CVE-2025-21758", "CVE-2025-21727", "CVE-2025-21745", "CVE-2024-58058", "CVE-2024-58017", "CVE-2024-58068", "CVE-2025-21716", "CVE-2025-21708", "CVE-2024-58014", "CVE-2025-21704", "CVE-2024-57980", "CVE-2025-21731", "CVE-2025-21726", "CVE-2025-21707", "CVE-2025-21776", "CVE-2025-21830", "CVE-2025-21760", "CVE-2025-21753", "CVE-2025-21762", "CVE-2024-58072", "CVE-2026-23253", "CVE-2026-23277", "CVE-2026-23279", "CVE-2026-23303", "CVE-2026-23356", "CVE-2025-21682", "CVE-2025-38250", "CVE-2026-23204", "CVE-2026-23365", "CVE-2026-23290", "CVE-2026-23339", "CVE-2026-23281", "CVE-2026-23372", "CVE-2026-23312", "CVE-2026-23367", "CVE-2026-23388", "CVE-2026-23398", "CVE-2026-23396", "CVE-2026-23274", "CVE-2026-23336", "CVE-2026-23395", "CVE-2026-23382", "CVE-2026-23368", "CVE-2026-23351", "CVE-2026-23357", "CVE-2026-23245", "CVE-2026-23352", "CVE-2026-23300", "CVE-2026-23100", "CVE-2025-68206", "CVE-2026-23379", "CVE-2025-39748", "CVE-2026-23381", "CVE-2026-23291", "CVE-2026-23304", "CVE-2026-23397", "CVE-2026-23318", "CVE-2026-23391", "CVE-2026-23113", "CVE-2024-56719", "CVE-2026-23154", "CVE-2025-68265", "CVE-2026-23296", "CVE-2026-23231", "CVE-2026-23292", "CVE-2026-23317", "CVE-2026-23319", "CVE-2026-23271", "CVE-2026-23141", "CVE-2026-23157", "CVE-2026-23270", "CVE-2025-40135", "CVE-2025-38162", "CVE-2026-23315", "CVE-2024-47809", "CVE-2025-39863", "CVE-2025-68239", "CVE-2026-23321", "CVE-2025-38192", "CVE-2025-38105", "CVE-2026-23343", "CVE-2026-23340", "CVE-2026-23364", "CVE-2026-23392", "CVE-2024-49998", "CVE-2026-23370", "CVE-2025-38704", "CVE-2026-23359", "CVE-2026-23378", "CVE-2026-23273", "CVE-2026-31708", "CVE-2026-43052", "CVE-2026-43350", "CVE-2026-46056", "CVE-2026-31705", "CVE-2026-46107", "CVE-2026-31449", "CVE-2025-21863", "CVE-2026-46307", "CVE-2026-46047", "CVE-2026-31586", "CVE-2026-31580", "CVE-2026-23444", "CVE-2026-23442", "CVE-2026-31583", "CVE-2026-31532", "CVE-2026-31624", "CVE-2026-31625", "CVE-2026-31630", "CVE-2026-31622", "CVE-2026-31637", "CVE-2026-31629", "CVE-2026-31617", "CVE-2026-31642", "CVE-2026-23066", "CVE-2026-23389", "CVE-2026-31488", "CVE-2026-43110", "CVE-2026-31711", "CVE-2026-46015", "CVE-2026-23399", "CVE-2026-43080", "CVE-2026-31500", "CVE-2026-43111", "CVE-2026-31673", "CVE-2026-43099", "CVE-2026-46037", "CVE-2023-53292", "CVE-2026-46101", "CVE-2026-46161", "CVE-2026-31681", "CVE-2026-31685", "CVE-2026-31696", "CVE-2026-43085", "CVE-2026-31699", "CVE-2026-43089", "CVE-2026-31698", "CVE-2026-43093", "CVE-2026-43493", "CVE-2026-43496", "CVE-2026-43502", "CVE-2026-45834", "CVE-2026-45835", "CVE-2026-45844", "CVE-2026-45843", "CVE-2026-45836", "CVE-2026-45840", "CVE-2026-45842", "CVE-2026-46023", "CVE-2026-46040", "CVE-2026-46051", "CVE-2026-46046", "CVE-2026-45838", "CVE-2026-46033", "CVE-2026-46022", "CVE-2026-46064", "CVE-2026-46070", "CVE-2026-46018", "CVE-2026-45841", "CVE-2026-46088", "CVE-2026-46128", "CVE-2026-46120", "CVE-2026-46124", "CVE-2026-46102", "CVE-2026-46122", "CVE-2026-46146", "CVE-2026-46149", "CVE-2026-46163", "CVE-2026-46177", "CVE-2026-46187", "CVE-2026-46227", "CVE-2026-46243", "CVE-2026-43117", "CVE-2026-46275", "CVE-2026-46303", "CVE-2026-43503", "CVE-2026-46294", "CVE-2026-46167", "CVE-2026-46151", "CVE-2025-22105", "CVE-2024-36922", "CVE-2024-56647", "CVE-2024-56657", "CVE-2026-23255", "CVE-2026-43499", "CVE-2026-31704", "CVE-2026-46113", "CVE-2026-46304", "CVE-2026-31697", "CVE-2026-43114", "CVE-2025-38584", "CVE-2026-31407", "CVE-2026-46150", "CVE-2026-31676", "CVE-2026-46234", "CVE-2026-46214", "CVE-2026-46172", "CVE-2026-46209", "CVE-2026-45997", "CVE-2026-31613", "CVE-2026-45839", "CVE-2026-31612", "CVE-2026-43074", "CVE-2026-31611", "CVE-2026-46050", "CVE-2026-43112", "CVE-2026-46092", "CVE-2025-39997", "CVE-2026-46099", "CVE-2026-46165", "CVE-2026-31694", "CVE-2026-46168", "CVE-2026-46173", "CVE-2026-46136", "CVE-2026-46185", "CVE-2026-43071", "CVE-2026-43094", "CVE-2026-46306", "CVE-2026-46195", "CVE-2026-46193", "CVE-2026-46116", "CVE-2026-46044", "CVE-2026-43116", "CVE-2026-53184", "CVE-2026-31712", "CVE-2026-43421", "CVE-2026-53131", "CVE-2026-23310", "CVE-2026-53198", "CVE-2026-46065", "CVE-2026-53183", "CVE-2026-53147", "CVE-2026-46190", "CVE-2026-46110", "CVE-2026-46323", "CVE-2023-54271", "CVE-2026-43492", "CVE-2026-52918", "CVE-2026-45991", "CVE-2026-46026", "CVE-2026-46038", "CVE-2026-46191", "CVE-2026-46003", "CVE-2026-31700", "CVE-2026-46069", "CVE-2026-53177", "CVE-2026-46021", "CVE-2026-52929", "CVE-2026-46159", "CVE-2026-52923", "CVE-2026-52930", "CVE-2026-52943", "CVE-2026-46083", "CVE-2026-46125", "CVE-2026-52946", "CVE-2026-46180", "CVE-2026-53168", "CVE-2026-53150", "CVE-2026-53080", "CVE-2026-53148", "CVE-2026-43303", "CVE-2026-53149", "CVE-2026-46321", "CVE-2026-53146", "CVE-2026-52947", "CVE-2026-52942", "CVE-2026-52910", "CVE-2026-46322", "CVE-2026-46086", "CVE-2026-45850", "CVE-2026-31709", "CVE-2026-46137", "CVE-2026-52948", "CVE-2026-46320", "CVE-2026-53181", "CVE-2026-52917", "CVE-2026-46196", "CVE-2026-53208", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53225", "CVE-2026-53228", "CVE-2026-53236", "CVE-2026-53212", "CVE-2026-53221", "CVE-2026-53227", "CVE-2026-53245", "CVE-2026-53249", "CVE-2026-53253", "CVE-2026-53239", "CVE-2026-53254", "CVE-2026-53242", "CVE-2026-53256", "CVE-2026-53263", "CVE-2026-53265", "CVE-2026-53264", "CVE-2026-53255", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53337", "CVE-2026-53349", "CVE-2026-53350", "CVE-2026-53352", "CVE-2026-53358", "CVE-2025-23131", "CVE-2026-23278", "CVE-2026-53356", "CVE-2026-31451", "CVE-2026-23302", "CVE-2026-23272", "CVE-2026-46331", "CVE-2026-52928", "CVE-2026-52909", "CVE-2026-53325", "CVE-2026-53167", "CVE-2026-53362", "CVE-2026-53192", "CVE-2026-64560", "CVE-2025-37780" ], "truncated": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-15T01:23:25.441Z", "fetchedAt": "2026-10-23T02:43:49.437Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-08-27T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Linuxに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:37:42.020Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8075a6c8701b77ff3ce09331b1485a2c06a5660bbb7480139bdb5ef040acb32d", "sourceModifiedAt": "2026-10-15T01:23:25.441Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Linux カーネルの IPv6 実装において、__ip6_append_data() のページ割り当てパスで fraggap（フラグメント間の隙間）を考慮していなかったため、コピー先が skb の末端を越えて skb_shared_info に書き込まれ、メモリ破壊が起こる欠陥が修正されました。", "risk": "この欠陥によりカーネルメモリが破壊され、システムがクラッシュする可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "特権のないユーザーが UDPv6 ソケットで MSG_MORE と MSG_SPLICE_PAGES を組み合わせて使用した場合に、この欠陥をトリガーできます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "paged‑allocation ブランチが MSG_MORE、NETIF_F_SG、または大きな fraglen の条件で選択されたときに影響します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Linux / Linux。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、14200d435af9a9eeb444f529fc2f689a236b7962未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、65fb14cbebb0cd0eff903a22d33537ddc8b95769未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、46f201f8b4c39633a1fa3dc12459f506d470993d未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、6374fb9edf72c67a118a2c214a0dddd04c921e0a未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、e9eacf19281ea2498b36291b56c9606118c2d74e未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、736b380e28d0480c7bc3e022f1950f31fe53a7c5未満。対象のファイル：net/ipv6/ip6_output.c", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Linux / Linux。影響ありとして記載：6.0。影響なしとして記載：6.0未満の版。影響なしとして記載：6.1.177以上、6.1.*以下。影響なしとして記載：6.6.144以上、6.6.*以下。影響なしとして記載：6.12.95以上、6.12.*以下。影響なしとして記載：6.18.38以上、6.18.*以下。影響なしとして記載：7.1.3以上、7.1.*以下。影響なしとして記載：7.2以上（原資料の上限表記は「*」）。対象のファイル：net/ipv6/ip6_output.c。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53362" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E3" ] }, { "text": "管理担当者に、Linuxの種類（Ubuntu、Red Hatなど）と版、対象パッケージ名、配布元を含む完全なパッケージ番号を確認してもらいます。OSの種類や製品の上流の番号だけで、影響の有無を決めないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "actions": [ { "text": "カーネルのソースコードで __ip6_append_data() の paged アロケーションパスに fraggap を加算し、pagedlen から fraggap を減算するように修正します。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E1" ] }, { "text": "「CVE-2026-53362」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-53362", "https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962", "https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769", "https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d", "https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a", "https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e", "https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53362" ] }, { "text": "利用しているLinuxの配布元が示す、このCVEへの修正パッケージを管理者に適用してもらいます。Ubuntu Desktopでは「ソフトウェアの更新」から提供された更新を適用できます。サーバーや他の配布元では、それぞれの正規の更新手順に従います。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "temporaryMitigations": [ { "text": "更新が用意されていない場合は、配布元や保守会社へCVE番号とパッケージ番号を送り、影響の有無・回避策・提供予定を確認します。他のLinux向けの修正をそのまま入れないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E3" ] }, { "text": "修正後の完全なパッケージ番号と、その配布元のCVE対応表を照合します。古い番号のまま修正を取り込む場合があるため、数字が小さいという理由だけで未修正とは扱いません。管理者に必要な再起動の完了も確認してもらってください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。", "長い公式資料の一部を使って解説しています。対象製品・版・構成の全一覧は、併記した構造化データも管理担当者と照合してください。", "公式資料が長いため、取得できた一部の内容に基づく説明です。対象の版・例外・構成条件が省略されている可能性があるため、取得範囲だけで対象外とは判断しないでください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53362", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-53362", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5", "label": "CVE掲載の参考情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap bytes carried over from the previous skb are copied just past\nthe fragment headers in the new skb's linear area. The linear area is\ntherefore undersized by fraggap bytes while pagedlen is overstated by the\nsame amount, and the copy writes past skb->end into the trailing\nskb_shared_info.\n\nAn unprivileged user can trigger this via a UDPv6 socket using\nMSG_MORE together with MSG_SPLICE_PAGES.\n\nThe bad accounting was introduced by commit 773ba4fe9104 (\"ipv6:\navoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix\n__ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative\ncopy value caused -EINVAL to be returned. That later commit allowed\nMSG_SPLICE_PAGES to proceed in this case, making the corruption\ntriggerable.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.\nSince a negative copy is no longer expected for a valid MSG_SPLICE_PAGES\ncase, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourceField": "/containers/cna/title", "excerpt": "ipv6: account for fraggap on the paged allocation path", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/ipv6/ip6_output.c\"],\"versions\":[{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"14200d435af9a9eeb444f529fc2f689a236b7962\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"65fb14cbebb0cd0eff903a22d33537ddc8b95769\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"46f201f8b4c39633a1fa3dc12459f506d470993d\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"6374fb9edf72c67a118a2c214a0dddd04c921e0a\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"e9eacf19281ea2498b36291b56c9606118c2d74e\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"736b380e28d0480c7bc3e022f1950f31fe53a7c5\",\"status\":\"affected\",\"versionType\":\"git\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/ipv6/ip6_output.c\"],\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.177\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.144\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.95\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.18.38\",\"lessThanOrEqual\":\"6.18.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"7.1.3\",\"lessThanOrEqual\":\"7.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53362", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-53362\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-53362（Linux）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・特権のないユーザーが UDPv6 ソケットで MSG_MORE と MSG_SPLICE_PAGES を組み合わせて使用した場合に、この欠陥をトリガーできます。\n・paged‑allocation ブランチが MSG_MORE、NETIF_F_SG、または大きな fraglen の条件で選択されたときに影響します。\n・公式の対象表：Linux / Linux。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、14200d435af9a9eeb444f529fc2f689a236b7962未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、65fb14cbebb0cd0eff903a22d33537ddc8b95769未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、46f201f8b4c39633a1fa3dc12459f506d470993d未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、6374fb9edf72c67a118a2c214a0dddd04c921e0a未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、e9eacf19281ea2498b36291b56c9606118c2d74e未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、736b380e28d0480c7bc3e022f1950f31fe53a7c5未満。対象のファイル：net/ipv6/ip6_output.c\n・公式の対象表：Linux / Linux。影響ありとして記載：6.0。影響なしとして記載：6.0未満の版。影響なしとして記載：6.1.177以上、6.1.*以下。影響なしとして記載：6.6.144以上、6.6.*以下。影響なしとして記載：6.12.95以上、6.12.*以下。影響なしとして記載：6.18.38以上、6.18.*以下。影響なしとして記載：7.1.3以上、7.1.*以下。影響なしとして記載：7.2以上（原資料の上限表記は「*」）。対象のファイル：net/ipv6/ip6_output.c。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-53362", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:37:42.020Z", "lastSuccess": "2026-10-23T03:37:42.020Z", "sourceCheckedAt": "2026-10-23T02:43:49.437Z", "errorCode": null }, "glossary": [] } } ], "total": 1, "limit": 20, "offset": 0, "filters": { "product": "linux", "type": "all", "q": "CVE-2026-53362", "page": 1 }, "pagination": { "page": 1, "pageSize": 20, "totalPages": 1 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-23T06:17:49.165Z", "lastAttempt": "2026-10-23T06:17:49.165Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-23T06:17:49.165Z", "lastAttempt": "2026-10-23T06:17:49.165Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-23T06:17:49.165Z", "lastAttempt": "2026-10-23T06:17:49.165Z", "error": null, "recordCount": 1754, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-23T06:17:49.165Z", "lastAttempt": "2026-10-23T06:17:49.165Z", "error": null, "recordCount": 22, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T05:02:49.729Z 〜 2026-10-23T06:17:49.165Z、全製品の変更 39/39件まで確認、対象22件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-23T06:17:49.165Z", "lastAttempt": "2026-10-23T06:17:49.165Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }