[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-46116":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-30T21:17:53.703Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":19,"aliases":20,"duplicate_of":9,"upstream":21,"downstream":22,"duplicates":73,"related":74,"reserved_at":9,"published_at":87,"modified_at":88,"state":89,"summary":90,"references_raw":99,"kevs":178,"epss":179,"epss_history":182,"metrics":299,"affected":307},"CVE-2026-46116","In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: defensively unhash xfrm_state lists in __xfrm_state_delete\n\nKASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s\nhlist_del_rcu calls under syzkaller load on linux-6.12.y stable\n(reproduced on 6.12.47, also reachable via the same code path on\ntorvalds/master and on the ipsec tree). Nine unique signatures cluster\nin the xfrm_state lifecycle, the load-bearing one being:\n\n  BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]\n  BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline]\n  BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c\n  Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435\n\n  Workqueue: netns cleanup_net\n  Call Trace:\n   __hlist_del / hlist_del_rcu\n   __xfrm_state_delete\n   xfrm_state_delete\n   xfrm_state_flush\n   xfrm_state_fini\n   ops_exit_list\n   cleanup_net\n\nThe other observed signatures hit the same slab object from\n__xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB\nwrite variant of __xfrm_state_delete, all on the byseq/byspi\nhash chains.\n\n__xfrm_state_delete() guards its byseq and byspi unhashes with\nvalue-based predicates:\n\n\tif (x->km.seq)\n\t\thlist_del_rcu(&x->byseq);\n\tif (x->id.spi)\n\t\thlist_del_rcu(&x->byspi);\n\nwhile everywhere else in the file (e.g. state_cache, state_cache_input)\nthe safer hlist_unhashed() check is used. xfrm_alloc_spi() sets\nx->id.spi = newspi inside xfrm_state_lock and then immediately inserts\ninto byspi, but a path that observes x->id.spi != 0 outside of\nxfrm_state_lock can still skip-or-hit the byspi unhash inconsistently\nwith whether x is actually on the list. The same holds for x->km.seq\nversus byseq, and the bydst/bysrc unhashes have no predicate at all,\nso a second __xfrm_state_delete() on the same object writes through\nLIST_POISON pprev.\n\nThe defensive change here:\n\n  - Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst,\n    bysrc, byseq and byspi so a second deletion is a no-op rather\n    than a write through LIST_POISON pprev. The byseq/byspi nodes\n    are already initialised in xfrm_state_alloc().\n  - Test hlist_unhashed() rather than the value predicate for\n    byseq/byspi, so the unhash decision tracks list state rather than\n    mutable scalar fields.\n\nEmpirical verification: applied this patch on top of v6.12.47, rebuilt,\nand re-ran the same syzkaller harness for 1h16m on a previously-crashy\nconfiguration that produced ~100 hits each of slab-use-after-free\nRead in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in\n__xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at\n~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo\nconfirms the xfrm_state slab is actively allocated and freed during\nthe run (~143 KiB resident), so the fuzzer is still exercising those\ncode paths -- they just no longer crash.\n\nReproduction:\n\n  - Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV\n  - syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db\n  - 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal\n  - 9 unique signatures collected in ~9h, all within xfrm_state\n    lifecycle",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-763","Release of Invalid Pointer or Reference","The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.","weakness","Incomplete","Base",[],[],[],[],[23,25,27,29,31,33,35,37,39,41,43,45,47,49,51,53,55,57,59,61,63,65,67,69,71],{"_key":24},"OPENSUSE-SU-2026:10954-1",{"_key":26},"SUSE-SU-2026:2450-1",{"_key":28},"SUSE-SU-2026:2631-1",{"_key":30},"SUSE-SU-2026:2630-1",{"_key":32},"SUSE-SU-2026:2638-1",{"_key":34},"SUSE-SU-2026:2658-1",{"_key":36},"SUSE-SU-2026:22521-1",{"_key":38},"SUSE-SU-2026:22522-1",{"_key":40},"SUSE-SU-2026:2799-1",{"_key":42},"SUSE-SU-2026:2800-1",{"_key":44},"DEBIAN-CVE-2026-46116",{"_key":46},"SUSE-SU-2026:22665-1",{"_key":48},"SUSE-SU-2026:22666-1",{"_key":50},"RHSA-2026:36018",{"_key":52},"RHSA-2026:39179",{"_key":54},"RHSA-2026:39180",{"_key":56},"RHSA-2026:39371",{"_key":58},"RHSA-2026:41234",{"_key":60},"RHSA-2026:41235",{"_key":62},"UBUNTU-CVE-2026-46116",{"_key":64},"USN-8566-1",{"_key":66},"USN-8567-1",{"_key":68},"USN-8568-1",{"_key":70},"USN-8569-1",{"_key":72},"USN-8574-1",[],[75,76,77,78,79,80,81,82,83,84,85,86],{"_key":24},{"_key":26},{"_key":28},{"_key":30},{"_key":32},{"_key":34},{"_key":36},{"_key":38},{"_key":40},{"_key":42},{"_key":46},{"_key":48},"2026-05-28T09:35:30.689Z","2026-07-22T12:08:37.153Z","Awaiting Analysis",{"cisa_kev":91,"cisa_ransomware":91,"cisa_vendor":9,"epss_severity":92,"epss_score":93,"severity":94,"severity_score":95,"severity_version":96,"severity_source":97,"severity_vector":98,"severity_status":89},false,"low",0.00125,"high",7.8,"v3.1","cve.org","CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",[100,105,109,113,117,121,125,129,135,140,145,150,154,158,162,166,170,174],{"url":101,"sources":102,"tags":104},"https://git.kernel.org/stable/c/b4a53add2fa8f1b5aa17d4c5686c320785fab182",[97,103],"nvd",[],{"url":106,"sources":107,"tags":108},"https://git.kernel.org/stable/c/26edb0a3c99f9d958c212be68b21f1221614dcf0",[97,103],[],{"url":110,"sources":111,"tags":112},"https://git.kernel.org/stable/c/4980162de555cb838f1a189ce7d2cbf5d2e7b050",[97,103],[],{"url":114,"sources":115,"tags":116},"https://git.kernel.org/stable/c/a2e2d08fb070fab4947447171f1c4e3ca5a188e5",[97,103],[],{"url":118,"sources":119,"tags":120},"https://git.kernel.org/stable/c/14acf9652e5690de3c7486c6db5fb8dafd0a32a3",[97,103],[],{"url":122,"sources":123,"tags":124},"https://git.kernel.org/stable/c/3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8",[97],[],{"url":126,"sources":127,"tags":128},"https://git.kernel.org/stable/c/2c617848ae6e4f07a3e397f604208c293bbecacc",[97],[],{"url":130,"sources":131,"tags":132},"https://access.redhat.com/security/cve/CVE-2026-46116",[97],[133,134],"VDB Entry","X Refsource REDHAT",{"url":136,"sources":137,"tags":138},"https://bugzilla.redhat.com/show_bug.cgi?id=2482523",[97],[139,134],"Issue Tracking",{"url":141,"sources":142,"tags":143},"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46116.json",[97],[144],"X Sadp Csaf Vex",{"url":146,"sources":147,"tags":148},"https://access.redhat.com/errata/RHSA-2026:36018",[97],[149,134],"Vendor Advisory",{"url":151,"sources":152,"tags":153},"https://access.redhat.com/errata/RHSA-2026:39371",[97],[149,134],{"url":155,"sources":156,"tags":157},"https://access.redhat.com/errata/RHSA-2026:39179",[97],[149,134],{"url":159,"sources":160,"tags":161},"https://access.redhat.com/errata/RHSA-2026:39180",[97],[149,134],{"url":163,"sources":164,"tags":165},"https://access.redhat.com/errata/RHSA-2026:41235",[97],[149,134],{"url":167,"sources":168,"tags":169},"https://access.redhat.com/errata/RHSA-2026:41234",[97],[149,134],{"url":171,"sources":172,"tags":173},"https://access.redhat.com/errata/RHSA-2026:42919",[97],[149,134],{"url":175,"sources":176,"tags":177},"https://access.redhat.com/errata/RHSA-2026:43231",[97],[149,134],[],{"date":180,"score":93,"percentile":181},"2026-07-05",0.02572,[183,187,190,194,197,200,203,207,210,213,216,219,222,225,228,231,234,237,240,243,246,249,251,254,257,260,263,267,270,273,276,279,282,285,287,290,293,295,298],{"date":184,"score":185,"percentile":186},"2026-05-28",0.00018,0.05152,{"date":188,"score":185,"percentile":189},"2026-05-29",0.05164,{"date":191,"score":192,"percentile":193},"2026-05-30",0.00012,0.01829,{"date":195,"score":192,"percentile":196},"2026-05-31",0.01821,{"date":198,"score":192,"percentile":199},"2026-06-01",0.01807,{"date":201,"score":192,"percentile":202},"2026-06-02",0.0179,{"date":204,"score":205,"percentile":206},"2026-06-03",0.00013,0.02437,{"date":208,"score":205,"percentile":209},"2026-06-04",0.0244,{"date":211,"score":205,"percentile":212},"2026-06-05",0.02452,{"date":214,"score":205,"percentile":215},"2026-06-06",0.02447,{"date":217,"score":205,"percentile":218},"2026-06-07",0.02394,{"date":220,"score":205,"percentile":221},"2026-06-08",0.0238,{"date":223,"score":205,"percentile":224},"2026-06-09",0.02336,{"date":226,"score":205,"percentile":227},"2026-06-10",0.02344,{"date":229,"score":205,"percentile":230},"2026-06-11",0.02359,{"date":232,"score":205,"percentile":233},"2026-06-12",0.02356,{"date":235,"score":205,"percentile":236},"2026-06-13",0.0235,{"date":238,"score":205,"percentile":239},"2026-06-14",0.02358,{"date":241,"score":93,"percentile":242},"2026-06-15",0.02521,{"date":244,"score":93,"percentile":245},"2026-06-16",0.02527,{"date":247,"score":93,"percentile":248},"2026-06-17",0.02535,{"date":250,"score":93,"percentile":248},"2026-06-18",{"date":252,"score":93,"percentile":253},"2026-06-19",0.02531,{"date":255,"score":93,"percentile":256},"2026-06-20",0.02557,{"date":258,"score":93,"percentile":259},"2026-06-21",0.02552,{"date":261,"score":93,"percentile":262},"2026-06-22",0.02549,{"date":264,"score":265,"percentile":266},"2026-06-23",0.00126,0.02569,{"date":268,"score":265,"percentile":269},"2026-06-24",0.02563,{"date":271,"score":265,"percentile":272},"2026-06-25",0.02579,{"date":274,"score":265,"percentile":275},"2026-06-26",0.02588,{"date":277,"score":265,"percentile":278},"2026-06-27",0.02596,{"date":280,"score":265,"percentile":281},"2026-06-28",0.02598,{"date":283,"score":265,"percentile":284},"2026-06-29",0.02601,{"date":286,"score":93,"percentile":181},"2026-06-30",{"date":288,"score":93,"percentile":289},"2026-07-01",0.02573,{"date":291,"score":93,"percentile":292},"2026-07-02",0.0257,{"date":294,"score":93,"percentile":292},"2026-07-03",{"date":296,"score":93,"percentile":297},"2026-07-04",0.02571,{"date":180,"score":93,"percentile":181},[300,305],{"source":97,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":301,"cvss_v4_0":9},{"baseScore":95,"baseSeverity":302,"vectorString":98,"impactScore":303,"exploitabilityScore":304},"HIGH",9.8,4.6,{"source":103,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":306,"cvss_v4_0":9},{"baseScore":95,"baseSeverity":302,"vectorString":98,"impactScore":303,"exploitabilityScore":304},[308],{"ecosystem":9,"name":309,"vendor":310,"product":310,"cpe_part":311,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":312},"Linux","linux","a",[313,320,323,326,329,332,335,338],{"version":314,"is_range":315,"range_type":97,"version_start":316,"version_start_type":317,"version_end":318,"version_end_type":319,"fixed_in":9},">= 7b4dc3600e4877178ba94c7fbf7e520421378aa6, \u003C 3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8",true,"7b4dc3600e4877178ba94c7fbf7e520421378aa6","including","3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8","excluding",{"version":321,"is_range":315,"range_type":97,"version_start":316,"version_start_type":317,"version_end":322,"version_end_type":319,"fixed_in":9},">= 7b4dc3600e4877178ba94c7fbf7e520421378aa6, \u003C 2c617848ae6e4f07a3e397f604208c293bbecacc","2c617848ae6e4f07a3e397f604208c293bbecacc",{"version":324,"is_range":315,"range_type":97,"version_start":316,"version_start_type":317,"version_end":325,"version_end_type":319,"fixed_in":9},">= 7b4dc3600e4877178ba94c7fbf7e520421378aa6, \u003C b4a53add2fa8f1b5aa17d4c5686c320785fab182","b4a53add2fa8f1b5aa17d4c5686c320785fab182",{"version":327,"is_range":315,"range_type":97,"version_start":316,"version_start_type":317,"version_end":328,"version_end_type":319,"fixed_in":9},">= 7b4dc3600e4877178ba94c7fbf7e520421378aa6, \u003C 26edb0a3c99f9d958c212be68b21f1221614dcf0","26edb0a3c99f9d958c212be68b21f1221614dcf0",{"version":330,"is_range":315,"range_type":97,"version_start":316,"version_start_type":317,"version_end":331,"version_end_type":319,"fixed_in":9},">= 7b4dc3600e4877178ba94c7fbf7e520421378aa6, \u003C 4980162de555cb838f1a189ce7d2cbf5d2e7b050","4980162de555cb838f1a189ce7d2cbf5d2e7b050",{"version":333,"is_range":315,"range_type":97,"version_start":316,"version_start_type":317,"version_end":334,"version_end_type":319,"fixed_in":9},">= 7b4dc3600e4877178ba94c7fbf7e520421378aa6, \u003C a2e2d08fb070fab4947447171f1c4e3ca5a188e5","a2e2d08fb070fab4947447171f1c4e3ca5a188e5",{"version":336,"is_range":315,"range_type":97,"version_start":316,"version_start_type":317,"version_end":337,"version_end_type":319,"fixed_in":9},">= 7b4dc3600e4877178ba94c7fbf7e520421378aa6, \u003C 14acf9652e5690de3c7486c6db5fb8dafd0a32a3","14acf9652e5690de3c7486c6db5fb8dafd0a32a3",{"version":339,"is_range":91,"range_type":97,"version_start":339,"version_start_type":317,"version_end":339,"version_end_type":317,"fixed_in":9},"2.6.19"]