{"advisories":[{"id":"USN-8593-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8593-1"},{"id":"USN-8603-1","source":"usn","title":"Linux kernel (Azure) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8603-1"},{"id":"USN-8618-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8618-1"},{"id":"USN-8663-1","source":"usn","title":"Linux kernel (NVIDIA) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8663-1"},{"id":"USN-8664-1","source":"usn","title":"Linux kernel (NVIDIA BaseOS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8664-1"},{"id":"USN-8728-1","source":"usn","title":"Linux kernel (GCP) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8728-1"},{"id":"USN-8729-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-1"},{"id":"USN-8761-1","source":"usn","title":"Linux kernel (Azure) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8761-1"},{"id":"USN-8729-2","source":"usn","title":"Linux kernel (Raspberry Pi Real-time) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-2"},{"id":"USN-8761-2","source":"usn","title":"Linux kernel (Azure FIPS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8761-2"},{"id":"USN-8781-1","source":"usn","title":"Linux kernel (NVIDIA Tegra) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8781-1"},{"id":"USN-8729-3","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-3"},{"id":"USN-8802-1","source":"usn","title":"Linux kernel (Oracle) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8802-1"},{"id":"USN-8728-2","source":"usn","title":"Linux kernel (Azure) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8728-2"},{"id":"USN-8729-4","source":"usn","title":"Linux kernel (Low Latency) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-4"},{"id":"USN-8729-5","source":"usn","title":"Linux kernel (AWS FIPS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-5"}],"cve":"CVE-2026-64025","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[ef5659280eb13e8ac31c296f58cfdfa1684ac06b,c9ea01768903ae47f210cd457af1dead6de7a9c3)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[ef5659280eb13e8ac31c296f58cfdfa1684ac06b,7c8cf21bc4efb4af18d6096db3f8bd06d622251c)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[ef5659280eb13e8ac31c296f58cfdfa1684ac06b,1861d369efd62d67796563bf3e01fc22e5626f8b)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[ef5659280eb13e8ac31c296f58cfdfa1684ac06b,8a52139560f833c3975032e1f5762611e3a36d71)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[ef5659280eb13e8ac31c296f58cfdfa1684ac06b,ddf8029623a1af20e984c040e89ff918158397ab)"}}],"enrichment":{"confidence":99.0,"confidence_source":"inferred","scores":[{"score":99.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"Linux","source":"cna","vendor":"Linux"},"product":"linux_kernel","vendor":"linux"},{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"generic","value":"5.10"}},{"platform":null,"status":"unaffected","versions":{"scheme":"generic","value":"[0,5.10)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.6.142,6.7.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.12.92,6.13.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.18.34,6.19.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[7.0.11,7.1.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"generic","value":"[7.1,*]"}}],"enrichment":{"confidence":99.0,"confidence_source":"inferred","scores":[{"score":99.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"Linux","source":"cna","vendor":"Linux"},"product":"linux_kernel","vendor":"linux"}],"created":"2026-07-21T07:30:03.260154+00:00","title":"Linux Kernel Use‑After‑Free via BPF Socket Map TLS Race","updated":"2026-08-04T18:15:03.347341+00:00","vendors":["linux","linux$PRODUCT$linux_kernel"]},"epss":{"score":0.00652},"mitre":{"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"created":"2026-07-19T15:39:17.178000+00:00","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, skmsg: fix verdict sk_data_ready racing with ktls rx\n\nsk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and\ndefers to psock->saved_data_ready when a TLS RX context is present,\navoiding a conflict with the TLS strparser's ownership of the receive\nqueue (commit e91de6afa81c, \"bpf: Fix running sk_skb program types\nwith ktls\").\n\nsk_psock_verdict_data_ready() has no equivalent guard.  When a socket\nis inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is\nconfigured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready\nas rx_ctx->saved_data_ready.  On data arrival:\n\n  tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready\n    -> saved_data_ready() = sk_psock_verdict_data_ready()\n      -> tcp_read_skb() drains sk_receive_queue via __skb_unlink()\n         without calling tcp_eat_skb(), so copied_seq is not advanced.\n\ntls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls\ntcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and\nreturns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned\n(potentially freed) skb.  tls_decrypt_sg() subsequently walks that\nfrag_list: use-after-free.\n\nApply the same fix as sk_psock_strp_data_ready(): if a TLS RX context\nis present, call psock->saved_data_ready (sock_def_readable) to wake\nrecv() waiters and return immediately, leaving the receive queue\nuntouched.  TLS retains sole ownership of the queue and decrypts the\nrecord normally through tls_sw_recvmsg().","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/64xxx/CVE-2026-64025.json","references":["https://git.kernel.org/stable/c/1861d369efd62d67796563bf3e01fc22e5626f8b","https://git.kernel.org/stable/c/7c8cf21bc4efb4af18d6096db3f8bd06d622251c","https://git.kernel.org/stable/c/8a52139560f833c3975032e1f5762611e3a36d71","https://git.kernel.org/stable/c/c9ea01768903ae47f210cd457af1dead6de7a9c3","https://git.kernel.org/stable/c/ddf8029623a1af20e984c040e89ff918158397ab"],"title":"bpf, skmsg: fix verdict sk_data_ready racing with ktls rx","updated":"2026-08-05T12:38:19.891000+00:00","vendors":["linux","linux$PRODUCT$linux_kernel"],"weaknesses":[]},"nvd":{"cpes":[],"created":"2026-07-19T16:17:42.527000+00:00","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, skmsg: fix verdict sk_data_ready racing with ktls rx\n\nsk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and\ndefers to psock->saved_data_ready when a TLS RX context is present,\navoiding a conflict with the TLS strparser's ownership of the receive\nqueue (commit e91de6afa81c, \"bpf: Fix running sk_skb program types\nwith ktls\").\n\nsk_psock_verdict_data_ready() has no equivalent guard.  When a socket\nis inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is\nconfigured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready\nas rx_ctx->saved_data_ready.  On data arrival:\n\n  tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready\n    -> saved_data_ready() = sk_psock_verdict_data_ready()\n      -> tcp_read_skb() drains sk_receive_queue via __skb_unlink()\n         without calling tcp_eat_skb(), so copied_seq is not advanced.\n\ntls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls\ntcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and\nreturns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned\n(potentially freed) skb.  tls_decrypt_sg() subsequently walks that\nfrag_list: use-after-free.\n\nApply the same fix as sk_psock_strp_data_ready(): if a TLS RX context\nis present, call psock->saved_data_ready (sock_def_readable) to wake\nrecv() waiters and return immediately, leaving the receive queue\nuntouched.  TLS retains sole ownership of the queue and decrypts the\nrecord normally through tls_sw_recvmsg().","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-64025.json","references":["https://git.kernel.org/stable/c/1861d369efd62d67796563bf3e01fc22e5626f8b","https://git.kernel.org/stable/c/7c8cf21bc4efb4af18d6096db3f8bd06d622251c","https://git.kernel.org/stable/c/8a52139560f833c3975032e1f5762611e3a36d71","https://git.kernel.org/stable/c/c9ea01768903ae47f210cd457af1dead6de7a9c3","https://git.kernel.org/stable/c/ddf8029623a1af20e984c040e89ff918158397ab"],"title":null,"updated":"2026-07-30T14:59:47.950000+00:00","vendors":[],"weaknesses":[]},"opencve":{"changes":[{"created":"2026-07-19T15:45:00+00:00","data":[{"details":{"new":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, skmsg: fix verdict sk_data_ready racing with ktls rx\n\nsk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and\ndefers to psock->saved_data_ready when a TLS RX context is present,\navoiding a conflict with the TLS strparser's ownership of the receive\nqueue (commit e91de6afa81c, \"bpf: Fix running sk_skb program types\nwith ktls\").\n\nsk_psock_verdict_data_ready() has no equivalent guard.  When a socket\nis inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is\nconfigured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready\nas rx_ctx->saved_data_ready.  On data arrival:\n\n  tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready\n    -> saved_data_ready() = sk_psock_verdict_data_ready()\n      -> tcp_read_skb() drains sk_receive_queue via __skb_unlink()\n         without calling tcp_eat_skb(), so copied_seq is not advanced.\n\ntls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls\ntcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and\nreturns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned\n(potentially freed) skb.  tls_decrypt_sg() subsequently walks that\nfrag_list: use-after-free.\n\nApply the same fix as sk_psock_strp_data_ready(): if a TLS RX context\nis present, call psock->saved_data_ready (sock_def_readable) to wake\nrecv() waiters and return immediately, leaving the receive queue\nuntouched.  TLS retains sole ownership of the queue and decrypts the\nrecord normally through tls_sw_recvmsg().","old":null},"type":"description"},{"details":{"new":"bpf, skmsg: fix verdict sk_data_ready racing with ktls rx","old":null},"type":"title"},{"details":["linux","linux$PRODUCT$linux_kernel"],"type":"first_time"},{"details":{"added":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["linux","linux$PRODUCT$linux_kernel"],"removed":[]},"type":"vendors"},{"details":{"added":["https://git.kernel.org/stable/c/1861d369efd62d67796563bf3e01fc22e5626f8b","https://git.kernel.org/stable/c/7c8cf21bc4efb4af18d6096db3f8bd06d622251c","https://git.kernel.org/stable/c/8a52139560f833c3975032e1f5762611e3a36d71","https://git.kernel.org/stable/c/c9ea01768903ae47f210cd457af1dead6de7a9c3","https://git.kernel.org/stable/c/ddf8029623a1af20e984c040e89ff918158397ab"],"removed":[]},"type":"references"}],"id":"dfb4bf0c-55dc-4790-860e-d23e046f64ec"},{"created":"2026-07-20T14:45:00+00:00","data":[{"details":{"added":{"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"be5273a0-8a00-4731-8598-988291787417"},{"created":"2026-07-21T22:45:00+00:00","data":[{"details":{"added":["CWE-416"],"removed":[]},"type":"weaknesses"}],"id":"766c9832-c899-4671-af6c-407279bc8fee"},{"created":"2026-07-22T12:15:00+00:00","data":[{"details":{"added":["CWE-364"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-64025-88f2@gregkh/T","https://nvd.nist.gov/vuln/detail/CVE-2026-64025","https://www.cve.org/CVERecord?id=CVE-2026-64025"],"removed":[]},"type":"references"},{"details":{"added":{},"removed":{},"updated":{"threat_severity":{"new":"Moderate","old":null}}},"type":"metrics"}],"id":"80157cd5-9120-4529-b646-c3b2ee0aeb40"},{"created":"2026-07-30T21:30:00+00:00","data":[{"details":{"added":[],"removed":["CWE-416"]},"type":"weaknesses"}],"id":"8d82c61c-220e-4eab-a241-67ea1ee4b371"}],"cpes":{"data":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"providers":["mitre"]},"created":{"data":"2026-07-19T00:00:00+00:00","provider":"redhat"},"description":{"data":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, skmsg: fix verdict sk_data_ready racing with ktls rx\n\nsk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and\ndefers to psock->saved_data_ready when a TLS RX context is present,\navoiding a conflict with the TLS strparser's ownership of the receive\nqueue (commit e91de6afa81c, \"bpf: Fix running sk_skb program types\nwith ktls\").\n\nsk_psock_verdict_data_ready() has no equivalent guard.  When a socket\nis inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is\nconfigured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready\nas rx_ctx->saved_data_ready.  On data arrival:\n\n  tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready\n    -> saved_data_ready() = sk_psock_verdict_data_ready()\n      -> tcp_read_skb() drains sk_receive_queue via __skb_unlink()\n         without calling tcp_eat_skb(), so copied_seq is not advanced.\n\ntls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls\ntcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and\nreturns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned\n(potentially freed) skb.  tls_decrypt_sg() subsequently walks that\nfrag_list: use-after-free.\n\nApply the same fix as sk_psock_strp_data_ready(): if a TLS RX context\nis present, call psock->saved_data_ready (sock_def_readable) to wake\nrecv() waiters and return immediately, leaving the receive queue\nuntouched.  TLS retains sole ownership of the queue and decrypts the\nrecord normally through tls_sw_recvmsg().","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00652},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":"Moderate","provider":"redhat"}},"references":{"data":["https://git.kernel.org/stable/c/1861d369efd62d67796563bf3e01fc22e5626f8b","https://git.kernel.org/stable/c/7c8cf21bc4efb4af18d6096db3f8bd06d622251c","https://git.kernel.org/stable/c/8a52139560f833c3975032e1f5762611e3a36d71","https://git.kernel.org/stable/c/c9ea01768903ae47f210cd457af1dead6de7a9c3","https://git.kernel.org/stable/c/ddf8029623a1af20e984c040e89ff918158397ab","https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-64025-88f2@gregkh/T","https://nvd.nist.gov/vuln/detail/CVE-2026-64025","https://www.cve.org/CVERecord?id=CVE-2026-64025"],"providers":["mitre","nvd","redhat"]},"title":{"data":"bpf, skmsg: fix verdict sk_data_ready racing with ktls rx","provider":"mitre"},"updated":{"data":"2026-07-30T21:15:06.240242+00:00","provider":"enrichment"},"vendors":{"data":["linux","linux$PRODUCT$linux_kernel"],"providers":["mitre","enrichment"]},"weaknesses":{"data":["CWE-364"],"providers":["redhat"]}},"redhat":{"cpes":[],"created":"2026-07-19T00:00:00+00:00","description":"In the Linux kernel, the following vulnerability has been resolved:\nbpf, skmsg: fix verdict sk_data_ready racing with ktls rx\nsk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and\ndefers to psock->saved_data_ready when a TLS RX context is present,\navoiding a conflict with the TLS strparser's ownership of the receive\nqueue (commit e91de6afa81c, \"bpf: Fix running sk_skb program types\nwith ktls\").\nsk_psock_verdict_data_ready() has no equivalent guard.  When a socket\nis inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is\nconfigured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready\nas rx_ctx->saved_data_ready.  On data arrival:\ntls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready\n-> saved_data_ready() = sk_psock_verdict_data_ready()\n-> tcp_read_skb() drains sk_receive_queue via __skb_unlink()\nwithout calling tcp_eat_skb(), so copied_seq is not advanced.\ntls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls\ntcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and\nreturns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned\n(potentially freed) skb.  tls_decrypt_sg() subsequently walks that\nfrag_list: use-after-free.\nApply the same fix as sk_psock_strp_data_ready(): if a TLS RX context\nis present, call psock->saved_data_ready (sock_def_readable) to wake\nrecv() waiters and return immediately, leaving the receive queue\nuntouched.  TLS retains sole ownership of the queue and decrypts the\nrecord normally through tls_sw_recvmsg().","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.0,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},"threat_severity":"Moderate"},"redhat_repo_path":"2026/CVE-2026-64025.json","references":["https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-64025-88f2@gregkh/T","https://nvd.nist.gov/vuln/detail/CVE-2026-64025","https://www.cve.org/CVERecord?id=CVE-2026-64025"],"title":"kernel: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx","updated":"2026-07-19T00:00:00+00:00","vendors":[],"weaknesses":["CWE-364"]}}