{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74621", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.921Z", "datePublished": "2026-08-22T15:32:04.990Z", "dateUpdated": "2026-08-25T05:40:45.894Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:45.894Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix sk_buff leak when the header checks reject a packet\n\ntcf_ct_handle_fragments() runs its header sanity checks before handing\nanything to the defragmentation engine:\n\n\tif (family == NFPROTO_IPV4)\n\t\terr = tcf_ct_ipv4_is_fragment(skb, &frag);\n\telse\n\t\terr = tcf_ct_ipv6_is_fragment(skb, &frag);\n\tif (err || !frag)\n\t\treturn err;\n\ntcf_ct_ipv4_is_fragment() returns -EINVAL or -ENOMEM;\ntcf_ct_ipv6_is_fragment() adds -EPROTO when ipv6_find_hdr() fails. None of\nthem frees or queues the skb, so on that path the caller still owns it.\n\ntcf_ct_act() however funnels every non-zero return into the\nownership-transfer exit:\n\n\terr = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag);\n\tif (err)\n\t\tgoto out_frag;\n\t...\nout_frag:\n\tif (err != -EINPROGRESS)\n\t\ttcf_action_inc_drop_qstats(&c->common);\n\treturn TC_ACT_CONSUMED;\n\nTC_ACT_CONSUMED means the action took ownership of the skb, so no caller\nfrees it - sch_handle_ingress(), sch_handle_egress() and\ntcf_qevent_handle() all deliberately skip the free for that verdict. The\nskb is therefore orphaned: one sk_buff plus its data buffer is leaked per\nmalformed packet, unbounded. Note the drop counter is already incremented\nfor these errors, so the statistics claim a drop that never happens.\n\nThree different ownership states reach out_frag: today - the skb may be\nqueued by the defrag engine (-EINPROGRESS), already freed by\nnf_ct_handle_fragments(), or still owned by us. Tell the caller which of\nthose it is, and free the packet ourselves in the last case, which\nrestores the TC_ACT_SHOT behaviour that predated the Fixes: commit.\n\nReproduced on v7.2-rc6 with a 54-byte frame carrying a 40-byte IPv6\nheader with nexthdr = 0 (hop-by-hop) and nothing after it, on a\nclsact ingress chain with \"action ct\". kmemleak reports one leaked\n232-byte skbuff_head_cache object plus its 704-byte data buffer per\npacket; with this patch it reports none."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The leak is triggered in tcf_ct_act() on the packet datapath (netif_receive_skb \u2192 sch_handle_ingress/egress \u2192 tc_run \u2192 tcf_classify); on OVN/Kubernetes/SDN gateways and mlx5-offload nodes with act_ct on clsact, a remote peer sends malformed IP packets with no local access required.\nAC:L - The attacker fully controls packet contents; a 54-byte IPv6 frame with nexthdr=0 (hop-by-hop) and no trailing data deterministically makes ipv6_find_hdr() return -EPROTO, leaking one skb per packet without races or uncontrollable layout dependencies.\nPR:N - Installing act_ct requires CAP_NET_ADMIN, but triggering the leak on an already-configured internet-facing or tenant-facing gateway needs no target credentials; a remote attacker only sends crafted malformed IP packets, matching CNA precedent for packet-driven act_ct issues (e.g., CVE-2026-72057).\nUI:N - Exploitation requires only attacker-generated malformed packets reaching a host with act_ct on clsact/ingress or egress; no victim login, mount, or other interactive action is needed beyond normal network traffic processing.\nS:U - The leaked sk_buff objects remain within the host kernel memory domain; this is not a VM escape, sandbox breakout, or IOMMU boundary bypass, only unbounded kernel heap consumption on the affected node.\nC:N - This is a pure sk_buff ownership leak on an error path; skb memory is orphaned, not exposed to the attacker, with no out-of-bounds read, use-after-free, or other disclosure primitive.\nI:N - The flaw only fails to kfree_skb() when header validation rejects a packet; it does not corrupt, overwrite, or modify any memory contents and provides no write or code-execution primitive.\nA:H - Each malformed packet leaks one sk_buff plus its data buffer (~936 bytes); sustained remote flooding causes unbounded kernel memory exhaustion and OOM denial of service, matching CNA precedent for repeatable network-triggered skb leaks (e.g., CVE-2026-52974)."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/act_ct.c"], "versions": [{"version": "172ba7d46c202e679f3ccb10264c67416aaeb1c4", "lessThan": "b5dbecc2016e1692fd1c2532af9c41ba729cb747", "status": "affected", "versionType": "git"}, {"version": "0b5b831122fc3789fff75be433ba3e4dd7b779d4", "lessThan": "23e97d594ddd0153020c506d5041048fbde1beb4", "status": "affected", "versionType": "git"}, {"version": "73f7da5fd124f2cda9161e2e46114915e6e82e97", "lessThan": "737873a59905a54ca0d2d127ef882f3f88bf4379", "status": "affected", "versionType": "git"}, {"version": "3f14b377d01d8357eba032b4cabc8c1149b458b6", "lessThan": "47d99828591d0fe8be4b9c8992ff3b8e47968db9", "status": "affected", "versionType": "git"}, {"version": "3f14b377d01d8357eba032b4cabc8c1149b458b6", "lessThan": "b47bb899e04b5407c5a63fe88d4b6676586a6e84", "status": "affected", "versionType": "git"}, {"version": "3f14b377d01d8357eba032b4cabc8c1149b458b6", "lessThan": "439d3e404f9d5e515911cc8132cde198b337c19e", "status": "affected", "versionType": "git"}, {"version": "3f14b377d01d8357eba032b4cabc8c1149b458b6", "lessThan": "8a7ed561671aa6a911a2de99e59ef670a4d0b1df", "status": "affected", "versionType": "git"}, {"version": "f5346df0591d10bc948761ca854b1fae6d2ef441", "status": "affected", "versionType": "git"}, {"version": "5.15.148", "lessThan": "5.15.217", "status": "affected", "versionType": "semver"}, {"version": "6.1.75", "lessThan": "6.1.184", "status": "affected", "versionType": "semver"}, {"version": "6.6.14", "lessThan": "6.6.152", "status": "affected", "versionType": "semver"}, {"version": "6.7.2", "lessThan": "6.8", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/act_ct.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.148", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.75", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.14", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b5dbecc2016e1692fd1c2532af9c41ba729cb747"}, {"url": "https://git.kernel.org/stable/c/23e97d594ddd0153020c506d5041048fbde1beb4"}, {"url": "https://git.kernel.org/stable/c/737873a59905a54ca0d2d127ef882f3f88bf4379"}, {"url": "https://git.kernel.org/stable/c/47d99828591d0fe8be4b9c8992ff3b8e47968db9"}, {"url": "https://git.kernel.org/stable/c/b47bb899e04b5407c5a63fe88d4b6676586a6e84"}, {"url": "https://git.kernel.org/stable/c/439d3e404f9d5e515911cc8132cde198b337c19e"}, {"url": "https://git.kernel.org/stable/c/8a7ed561671aa6a911a2de99e59ef670a4d0b1df"}], "title": "net/sched: act_ct: fix sk_buff leak when the header checks reject a packet", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sched/act_ct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b5dbecc2016e1692fd1c2532af9c41ba729cb747", "status": "affected", "version": "172ba7d46c202e679f3ccb10264c67416aaeb1c4", "versionType": "git"}, {"lessThan": "23e97d594ddd0153020c506d5041048fbde1beb4", "status": "affected", "version": "0b5b831122fc3789fff75be433ba3e4dd7b779d4", "versionType": "git"}, {"lessThan": "737873a59905a54ca0d2d127ef882f3f88bf4379", "status": "affected", "version": "73f7da5fd124f2cda9161e2e46114915e6e82e97", "versionType": "git"}, {"lessThan": "47d99828591d0fe8be4b9c8992ff3b8e47968db9", "status": "affected", "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6", "versionType": "git"}, {"lessThan": "b47bb899e04b5407c5a63fe88d4b6676586a6e84", "status": "affected", "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6", "versionType": "git"}, {"lessThan": "439d3e404f9d5e515911cc8132cde198b337c19e", "status": "affected", "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6", "versionType": "git"}, {"lessThan": "8a7ed561671aa6a911a2de99e59ef670a4d0b1df", "status": "affected", "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6", "versionType": "git"}, {"status": "affected", "version": "f5346df0591d10bc948761ca854b1fae6d2ef441", "versionType": "git"}, {"lessThan": "5.15.217", "status": "affected", "version": "5.15.148", "versionType": "semver"}, {"lessThan": "6.1.184", "status": "affected", "version": "6.1.75", "versionType": "semver"}, {"lessThan": "6.6.152", "status": "affected", "version": "6.6.14", "versionType": "semver"}, {"lessThan": "6.8", "status": "affected", "version": "6.7.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sched/act_ct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix sk_buff leak when the header checks reject a packet\n\ntcf_ct_handle_fragments() runs its header sanity checks before handing\nanything to the defragmentation engine:\n\n\tif (family == NFPROTO_IPV4)\n\t\terr = tcf_ct_ipv4_is_fragment(skb, &frag);\n\telse\n\t\terr = tcf_ct_ipv6_is_fragment(skb, &frag);\n\tif (err || !frag)\n\t\treturn err;\n\ntcf_ct_ipv4_is_fragment() returns -EINVAL or -ENOMEM;\ntcf_ct_ipv6_is_fragment() adds -EPROTO when ipv6_find_hdr() fails. None of\nthem frees or queues the skb, so on that path the caller still owns it.\n\ntcf_ct_act() however funnels every non-zero return into the\nownership-transfer exit:\n\n\terr = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag);\n\tif (err)\n\t\tgoto out_frag;\n\t...\nout_frag:\n\tif (err != -EINPROGRESS)\n\t\ttcf_action_inc_drop_qstats(&c->common);\n\treturn TC_ACT_CONSUMED;\n\nTC_ACT_CONSUMED means the action took ownership of the skb, so no caller\nfrees it - sch_handle_ingress(), sch_handle_egress() and\ntcf_qevent_handle() all deliberately skip the free for that verdict. The\nskb is therefore orphaned: one sk_buff plus its data buffer is leaked per\nmalformed packet, unbounded. Note the drop counter is already incremented\nfor these errors, so the statistics claim a drop that never happens.\n\nThree different ownership states reach out_frag: today - the skb may be\nqueued by the defrag engine (-EINPROGRESS), already freed by\nnf_ct_handle_fragments(), or still owned by us. Tell the caller which of\nthose it is, and free the packet ourselves in the last case, which\nrestores the TC_ACT_SHOT behaviour that predated the Fixes: commit.\n\nReproduced on v7.2-rc6 with a 54-byte frame carrying a 40-byte IPv6\nheader with nexthdr = 0 (hop-by-hop) and nothing after it, on a\nclsact ingress chain with \"action ct\". kmemleak reports one leaked\n232-byte skbuff_head_cache object plus its 704-byte data buffer per\npacket; with this patch it reports none."}], "id": "CVE-2026-74621", "lastModified": "2026-08-25T06:18:40.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-22T16:16:34.897", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/23e97d594ddd0153020c506d5041048fbde1beb4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/439d3e404f9d5e515911cc8132cde198b337c19e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47d99828591d0fe8be4b9c8992ff3b8e47968db9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/737873a59905a54ca0d2d127ef882f3f88bf4379"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8a7ed561671aa6a911a2de99e59ef670a4d0b1df"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b47bb899e04b5407c5a63fe88d4b6676586a6e84"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b5dbecc2016e1692fd1c2532af9c41ba729cb747"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/sched: act_ct: fix sk_buff leak when the header checks reject a packet", "id": "2521373", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521373"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's `net/sched: act_ct` component. A remote attacker could exploit this vulnerability by sending specially crafted malformed packets. When these packets are rejected by header checks, the system fails to properly free the associated memory, leading to an unbounded memory leak. This continuous memory consumption can result in a Denial of Service (DoS), making the system unresponsive or unstable."], "name": "CVE-2026-74621", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74621\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74621\nhttps://lore.kernel.org/linux-cve-announce/2026082219-CVE-2026-74621-81bd@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[73f7da5fd124f2cda9161e2e46114915e6e82e97,737873a59905a54ca0d2d127ef882f3f88bf4379)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f14b377d01d8357eba032b4cabc8c1149b458b6,47d99828591d0fe8be4b9c8992ff3b8e47968db9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f14b377d01d8357eba032b4cabc8c1149b458b6,b47bb899e04b5407c5a63fe88d4b6676586a6e84)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f14b377d01d8357eba032b4cabc8c1149b458b6,439d3e404f9d5e515911cc8132cde198b337c19e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3f14b377d01d8357eba032b4cabc8c1149b458b6,8a7ed561671aa6a911a2de99e59ef670a4d0b1df)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "172ba7d46c202e679f3ccb10264c67416aaeb1c4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "0b5b831122fc3789fff75be433ba3e4dd7b779d4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "f5346df0591d10bc948761ca854b1fae6d2ef441"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.14,6.6.152)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.148,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.75,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.7.2,6.8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:45:04.676353+00:00", "updated": "2026-08-25T08:30:04.574918+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}