{"id":"CVE-2026-72354","aliases":["BELL-CVE-2026-72354","DEBIAN-CVE-2026-72354","EUVD-2026-59253","GHSA-2cmf-w788-qhmg","UBUNTU-CVE-2026-72354"],"status":"published","title":"ntfs: avoid stale runlist element dereference in MFT writeback","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid stale runlist element dereference in MFT writeback\n\nntfs_write_mft_block() maps each $MFT record through the $MFT data\nrunlist. For sub-folio clusters it looks up a struct runlist_element under\nni-\u003erunlist.lock, drops the lock, and later uses rl-\u003elength and rl-\u003evcn\nwhen choosing folio_sz.\n\nThat pointer is only borrowed from ni-\u003erunlist.rl. Concurrent $MFT\nallocation extension can merge a replacement runlist under the same lock,\nand ntfs_rl_realloc() can free the old backing array. If that happens\nbetween the lookup and the later folio_sz decision, writeback can\ndereference freed runlist storage.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nMFT writeback path:               $MFT allocation extension:\n1. Look up rl under               1. Extend the $MFT data allocation.\n   ni-\u003erunlist.lock.              2. Publish a replacement runlist.\n2. Drop ni-\u003erunlist.lock.         3. Free the old runlist array.\n3. Read rl-\u003elength and rl-\u003evcn\n   to choose folio_sz.\n\nCompute the remaining run length while ni-\u003erunlist.lock is still held, and\nuse that scalar after unlock. This preserves the existing folio sizing\ndecision without carrying a borrowed runlist_element across the lock\nboundary.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in ntfs_mft_writepages+0x1c8d/0x1fb0\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x20d/0x410\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n kasan_report+0xe0/0x110\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ntfs_mft_writepages+0x1c8d/0x1fb0\n ? __pfx_ntfs_mft_writepages+0x10/0x10\n ? __pfx___mutex_unlock_slowpath+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? iput+0x92/0xa80\n do_writepages+0x219/0x530\n ? __pfx_do_writepages+0x10/0x10\n __writeback_single_inode+0x117/0xf50\n ? do_raw_spin_lock+0x130/0x270\n ? __pfx_do_raw_spin_lock+0x10/0x10\n ? __pfx___writeback_single_inode+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n writeback_sb_inodes+0x65b/0x1810\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_acquire+0x2b8/0x2f0\n ? __pfx_writeback_sb_inodes+0x10/0x10\n ? lock_release+0x1e0/0x280\n ? _raw_spin_unlock+0x23/0x40\n ? move_expired_inodes+0x2b8/0x850\n __writeback_inodes_wb+0xf4/0x270\n ? __pfx___writeback_inodes_wb+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? queue_io+0x2e4/0x410\n wb_writeback+0x666/0x880\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __pfx_wb_writeback+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? get_nr_dirty_inodes+0x1c/0x170\n wb_workfn+0x75e/0xbb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x27/0x60\n ? __pfx_wb_workfn+0x10/0x10\n ? __pfx_debug_object_deactivate+0x10/0x10\n ? lock_acquire+0x2b8/0x2f0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_release+0x1e0/0x280\n process_one_work+0x8d0/0x1870\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x575/0xf80\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2e7/0x3c0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x576/0x810\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x57e/0xe10\n ? __switch_to_asm+0x33/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 970:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n __kvmalloc_node_noprof+0x353/0x920\n ntfs_rl_realloc+0x3c/0x80\n ntfs_runlists_merge+0x1212/0x3010\n ntfs_mft_data_extend_allocation_nolock+0x3e0/0x1f40\n ntfs_mft_record_alloc+0x1ab4/0x4f10\n __ntfs_create+0x680/0x2e50\n ntfs_create+0x1e6/0x3a0\n path_openat+0x2b55/0x3c10\n do_file_open+0x1f4/0x460\n do_sys_openat2+0xde/0x170\n __x64_sys_openat+0x122/0x1e0\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 1294:\n kasan_save_\n---truncated---","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00508,"percentile":0.43723,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-15T05:55:56Z","modified":"2026-11-11T09:40:43Z","fixes":[{"ecosystem":"Linux","package":"Kernel","fixed_in":["7.1.5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["7.1.5-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.1.5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.111-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.10-1","6.17.11-1","6.17.12-1","6.17.13-1","6.17.13-1~bpo13+1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1","6.17.9-1","6.18.1-1~exp1","6.18.10-1","6.18.12-1","6.18.12-1~bpo13+1","6.18.13-1","6.18.14-1","6.18.15-1","6.18.15-1~bpo13+1","6.18.2-1~exp1","6.18.3-1","6.18.5-1","6.18.5-1~bpo13+1","6.18.8-1","6.18.9-1","6.18.9-1~bpo13+1","6.18~rc4-1~exp1","6.18~rc4-1~exp2","6.18~rc5-1~exp1","6.18~rc6-1~exp1","6.18~rc7-1~exp1","6.19-1~exp1","6.19.10-1","6.19.10-1~bpo13+1","6.19.11-1","6.19.11-1~bpo13+1","6.19.12-1","6.19.13-1","6.19.13-1~bpo13+1","6.19.14-1","6.19.14-1~bpo13+1","6.19.2-1~exp1","6.19.3-1~exp1","6.19.4-1~exp1","6.19.5-1~exp1","6.19.6-1","6.19.6-2","6.19.6-2~bpo13+1","6.19.8-1","6.19.8-1~bpo13+1","6.19~rc4-1~exp1","6.19~rc5-1~exp1","6.19~rc6-1~exp1","6.19~rc7-1~exp1","6.19~rc8-1~exp1","7.0-1~exp1","7.0.1-1~exp1","7.0.10-1","7.0.10-1~bpo13+1","7.0.12-1","7.0.12-2","7.0.12-2~bpo13+1","7.0.13-1","7.0.13-1~bpo13+1","7.0.14-1","7.0.3-1","7.0.4-1","7.0.4-1~bpo13+1","7.0.7-1","7.0.7-1~bpo13+1","7.0.9-1","7.0.9-1~bpo13+1","7.1.1-1~exp1","7.1.2-1~exp1","7.1.3-1","7.1.3-1+sunvdc","7.1.3-1~bpo13+1","7.1.4-1","7.1~rc2-1~exp1","7.1~rc3-1~exp1","7.1~rc4-1~exp1","7.1~rc4-1~exp2","7.1~rc5-1~exp1","7.1~rc7-1~exp1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5~24.04.2","6.17.0-1007.7~24.04.1","6.17.0-1009.9~24.04.2","6.17.0-1010.10~24.04.1","6.17.0-1012.12~24.04.1","6.17.0-1013.13~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1019.19~24.04.1","6.17.0-1020.20~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1008.8~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1011.11~24.04.2","6.17.0-1013.13~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1018.18~24.04.1","6.17.0-1020.20~24.04.1","6.17.0-1021.21~24.04.1","6.17.0-1022.22"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6","6.14.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1","6.14.0-1018.19~24.04.1","6.14.0-1019.20~24.04.1","6.14.0-1020.21~24.04.1","6.14.0-1021.22~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-24.24~24.04.3","6.14.0-27.27~24.04.1","6.14.0-28.28~24.04.1","6.14.0-29.29~24.04.1","6.14.0-32.32~24.04.1","6.14.0-33.33~24.04.1","6.14.0-34.34~24.04.1","6.14.0-35.35~24.04.1","6.14.0-36.36~24.04.1","6.14.0-37.37~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1016.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21","6.11.0-1022.22","6.11.0-1023.23","6.11.0-1024.24","6.11.0-1025.25","6.11.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13","6.14.0-1014.14","6.14.0-1015.15","6.14.0-1016.16","6.14.0-1017.17","6.14.0-1018.18","6.14.0-1019.19","6.14.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1031.31","6.8.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1","6.14.0-34.34.1~24.04.1","6.14.0-35.35.1~24.04.1","6.14.0-36.36.1~24.04.1","6.14.0-37.37.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-14.14.1~24.04.1","6.17.0-19.19.1~24.04.1","6.17.0-20.20.1~24.04.1","6.17.0-22.22.1~24.04.1","6.17.0-23.23.1~24.04.1","6.17.0-29.29.1~24.04.1","6.17.0-35.35.1~24.04.1","6.17.0-38.38.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.5~24.04.2","6.17.0-1006.7~24.04.1","6.17.0-1008.9~24.04.1","6.17.0-1009.10~24.04.1","6.17.0-1010.11~24.04.1","6.17.0-1011.12~24.04.1","6.17.0-1013.15~24.04.1","6.17.0-1014.16~24.04.1","6.17.0-1017.19~24.04.1","6.17.0-1018.20~24.04.1","6.17.0-1019.22"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1006.6"]}],"products":[{"vendor":"linux","product":"linux"}],"references":[{"url":"https://git.kernel.org/stable/c/9a2e36963a3fc52401586657d34e3f1c5a01ea56","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/81fe702ff1760da32bcd3ef4494b2a33dbeced72","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72354","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2cmf-w788-qhmg"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-72354","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72354.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-72354","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-72354","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72354","tags":["report"]},{"url":"https://git.kernel.org/linus/81fe702ff1760da32bcd3ef4494b2a33dbeced72","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-72354","title":"ntfs: avoid stale runlist element dereference in MFT writeback","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid stale runlist element dereference in MFT writeback\n\nntfs_write_mft_block() maps each $MFT record through the $MFT data\nrunlist. For sub-folio clusters it looks up a struct runlist_element under\nni-\u003erunlist.lock, drops the lock, and later uses rl-\u003elength and rl-\u003evcn\nwhen choosing folio_sz.\n\nThat pointer is only borrowed from ni-\u003erunlist.rl. Concurrent $MFT\nallocation extension can merge a replacement runlist under the same lock,\nand ntfs_rl_realloc() can free the old backing array. If that happens\nbetween the lookup and the later folio_sz decision, writeback can\ndereference freed runlist storage.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nMFT writeback path:               $MFT allocation extension:\n1. Look up rl under               1. Extend the $MFT data allocation.\n   ni-\u003erunlist.lock.              2. Publish a replacement runlist.\n2. Drop ni-\u003erunlist.lock.         3. Free the old runlist array.\n3. Read rl-\u003elength and rl-\u003evcn\n   to choose folio_sz.\n\nCompute the remaining run length while ni-\u003erunlist.lock is still held, and\nuse that scalar after unlock. This preserves the existing folio sizing\ndecision without carrying a borrowed runlist_element across the lock\nboundary.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in ntfs_mft_writepages+0x1c8d/0x1fb0\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x20d/0x410\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n kasan_report+0xe0/0x110\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ntfs_mft_writepages+0x1c8d/0x1fb0\n ? __pfx_ntfs_mft_writepages+0x10/0x10\n ? __pfx___mutex_unlock_slowpath+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? iput+0x92/0xa80\n do_writepages+0x219/0x530\n ? __pfx_do_writepages+0x10/0x10\n __writeback_single_inode+0x117/0xf50\n ? do_raw_spin_lock+0x130/0x270\n ? __pfx_do_raw_spin_lock+0x10/0x10\n ? __pfx___writeback_single_inode+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n writeback_sb_inodes+0x65b/0x1810\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_acquire+0x2b8/0x2f0\n ? __pfx_writeback_sb_inodes+0x10/0x10\n ? lock_release+0x1e0/0x280\n ? _raw_spin_unlock+0x23/0x40\n ? move_expired_inodes+0x2b8/0x850\n __writeback_inodes_wb+0xf4/0x270\n ? __pfx___writeback_inodes_wb+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? queue_io+0x2e4/0x410\n wb_writeback+0x666/0x880\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __pfx_wb_writeback+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? get_nr_dirty_inodes+0x1c/0x170\n wb_workfn+0x75e/0xbb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x27/0x60\n ? __pfx_wb_workfn+0x10/0x10\n ? __pfx_debug_object_deactivate+0x10/0x10\n ? lock_acquire+0x2b8/0x2f0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_release+0x1e0/0x280\n process_one_work+0x8d0/0x1870\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x575/0xf80\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2e7/0x3c0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x576/0x810\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x57e/0xe10\n ? __switch_to_asm+0x33/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 970:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n __kvmalloc_node_noprof+0x353/0x920\n ntfs_rl_realloc+0x3c/0x80\n ntfs_runlists_merge+0x1212/0x3010\n ntfs_mft_data_extend_allocation_nolock+0x3e0/0x1f40\n ntfs_mft_record_alloc+0x1ab4/0x4f10\n __ntfs_create+0x680/0x2e50\n ntfs_create+0x1e6/0x3a0\n path_openat+0x2b55/0x3c10\n do_file_open+0x1f4/0x460\n do_sys_openat2+0xde/0x170\n __x64_sys_openat+0x122/0x1e0\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 1294:\n kasan_save_\n---truncated---","status":"published","published":"2026-08-15T05:55:56.163Z","modified":"2026-08-17T05:43:12.145Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:19:51.663093Z"}],"euvd":[{"id":"EUVD-2026-59253","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid stale runlist element dereference in MFT writeback\n\nntfs_write_mft_block() maps each $MFT record through the $MFT data\nrunlist. For sub-folio clusters it looks up a struct runlist_element under\nni-\u003erunlist.lock, drops the lock, and later uses rl-\u003elength and rl-\u003evcn\nwhen choosing folio_sz.\n\nThat pointer is only borrowed from ni-\u003erunlist.rl. Concurrent $MFT\nallocation extension can merge a replacement runlist under the same lock,\nand ntfs_rl_realloc() can free the old backing array. If that happens\nbetween the lookup and the later folio_sz decision, writeback can\ndereference freed runlist storage.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nMFT writeback path:               $MFT allocation extension:\n1. Look up rl under               1. Extend the $MFT data allocation.\n   ni-\u003erunlist.lock.              2. Publish a replacement runlist.\n2. Drop ni-\u003erunlist.lock.         3. Free the old runlist array.\n3. Read rl-\u003elength and rl-\u003evcn\n   to choose folio_sz.\n\nCompute the remaining run length while ni-\u003erunlist.lock is still held, and\nuse that scalar after unlock. This preserves the existing folio sizing\ndecision without carrying a borrowed runlist_element across the lock\nboundary.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in ntfs_mft_writepages+0x1c8d/0x1fb0\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x20d/0x410\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n kasan_report+0xe0/0x110\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ntfs_mft_writepages+0x1c8d/0x1fb0\n ? __pfx_ntfs_mft_writepages+0x10/0x10\n ? __pfx___mutex_unlock_slowpath+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? iput+0x92/0xa80\n do_writepages+0x219/0x530\n ? __pfx_do_writepages+0x10/0x10\n __writeback_single_inode+0x117/0xf50\n ? do_raw_spin_lock+0x130/0x270\n ? __pfx_do_raw_spin_lock+0x10/0x10\n ? __pfx___writeback_single_inode+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n writeback_sb_inodes+0x65b/0x1810\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_acquire+0x2b8/0x2f0\n ? __pfx_writeback_sb_inodes+0x10/0x10\n ? lock_release+0x1e0/0x280\n ? _raw_spin_unlock+0x23/0x40\n ? move_expired_inodes+0x2b8/0x850\n __writeback_inodes_wb+0xf4/0x270\n ? __pfx___writeback_inodes_wb+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? queue_io+0x2e4/0x410\n wb_writeback+0x666/0x880\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __pfx_wb_writeback+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? get_nr_dirty_inodes+0x1c/0x170\n wb_workfn+0x75e/0xbb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x27/0x60\n ? __pfx_wb_workfn+0x10/0x10\n ? __pfx_debug_object_deactivate+0x10/0x10\n ? lock_acquire+0x2b8/0x2f0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_release+0x1e0/0x280\n process_one_work+0x8d0/0x1870\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x575/0xf80\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2e7/0x3c0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x576/0x810\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x57e/0xe10\n ? __switch_to_asm+0x33/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 970:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n __kvmalloc_node_noprof+0x353/0x920\n ntfs_rl_realloc+0x3c/0x80\n ntfs_runlists_merge+0x1212/0x3010\n ntfs_mft_data_extend_allocation_nolock+0x3e0/0x1f40\n ntfs_mft_record_alloc+0x1ab4/0x4f10\n __ntfs_create+0x680/0x2e50\n ntfs_create+0x1e6/0x3a0\n path_openat+0x2b55/0x3c10\n do_file_open+0x1f4/0x460\n do_sys_openat2+0xde/0x170\n __x64_sys_openat+0x122/0x1e0\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 1294:\n kasan_save_\n---truncated---","status":"published","published":"2026-08-15T05:55:56Z","modified":"2026-08-17T05:43:12Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:49.818495Z"}],"ghsa":[{"id":"GHSA-2cmf-w788-qhmg","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid stale runlist...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid stale runlist element dereference in MFT writeback\n\nntfs_write_mft_block() maps each $MFT record through the $MFT data\nrunlist. For sub-folio clusters it looks up a struct runlist_element under\nni-\u003erunlist.lock, drops the lock, and later uses rl-\u003elength and rl-\u003evcn\nwhen choosing folio_sz.\n\nThat pointer is only borrowed from ni-\u003erunlist.rl. Concurrent $MFT\nallocation extension can merge a replacement runlist under the same lock,\nand ntfs_rl_realloc() can free the old backing array. If that happens\nbetween the lookup and the later folio_sz decision, writeback can\ndereference freed runlist storage.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nMFT writeback path:               $MFT allocation extension:\n1. Look up rl under               1. Extend the $MFT data allocation.\n   ni-\u003erunlist.lock.              2. Publish a replacement runlist.\n2. Drop ni-\u003erunlist.lock.         3. Free the old runlist array.\n3. Read rl-\u003elength and rl-\u003evcn\n   to choose folio_sz.\n\nCompute the remaining run length while ni-\u003erunlist.lock is still held, and\nuse that scalar after unlock. This preserves the existing folio sizing\ndecision without carrying a borrowed runlist_element across the lock\nboundary.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in ntfs_mft_writepages+0x1c8d/0x1fb0\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x20d/0x410\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n kasan_report+0xe0/0x110\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ntfs_mft_writepages+0x1c8d/0x1fb0\n ? __pfx_ntfs_mft_writepages+0x10/0x10\n ? __pfx___mutex_unlock_slowpath+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? iput+0x92/0xa80\n do_writepages+0x219/0x530\n ? __pfx_do_writepages+0x10/0x10\n __writeback_single_inode+0x117/0xf50\n ? do_raw_spin_lock+0x130/0x270\n ? __pfx_do_raw_spin_lock+0x10/0x10\n ? __pfx___writeback_single_inode+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n writeback_sb_inodes+0x65b/0x1810\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_acquire+0x2b8/0x2f0\n ? __pfx_writeback_sb_inodes+0x10/0x10\n ? lock_release+0x1e0/0x280\n ? _raw_spin_unlock+0x23/0x40\n ? move_expired_inodes+0x2b8/0x850\n __writeback_inodes_wb+0xf4/0x270\n ? __pfx___writeback_inodes_wb+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? queue_io+0x2e4/0x410\n wb_writeback+0x666/0x880\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __pfx_wb_writeback+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? get_nr_dirty_inodes+0x1c/0x170\n wb_workfn+0x75e/0xbb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x27/0x60\n ? __pfx_wb_workfn+0x10/0x10\n ? __pfx_debug_object_deactivate+0x10/0x10\n ? lock_acquire+0x2b8/0x2f0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_release+0x1e0/0x280\n process_one_work+0x8d0/0x1870\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x575/0xf80\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2e7/0x3c0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x576/0x810\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x57e/0xe10\n ? __switch_to_asm+0x33/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 970:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n __kvmalloc_node_noprof+0x353/0x920\n ntfs_rl_realloc+0x3c/0x80\n ntfs_runlists_merge+0x1212/0x3010\n ntfs_mft_data_extend_allocation_nolock+0x3e0/0x1f40\n ntfs_mft_record_alloc+0x1ab4/0x4f10\n __ntfs_create+0x680/0x2e50\n ntfs_create+0x1e6/0x3a0\n path_openat+0x2b55/0x3c10\n do_file_open+0x1f4/0x460\n do_sys_openat2+0xde/0x170\n __x64_sys_openat+0x122/0x1e0\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 1294:\n kasan_save_\n---truncated---","status":"published","published":"2026-08-15T06:32:21Z","modified":"2026-08-17T06:34:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:10:33.443075Z"}],"nvd":[{"id":"CVE-2026-72354","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid stale runlist element dereference in MFT writeback\n\nntfs_write_mft_block() maps each $MFT record through the $MFT data\nrunlist. For sub-folio clusters it looks up a struct runlist_element under\nni-\u003erunlist.lock, drops the lock, and later uses rl-\u003elength and rl-\u003evcn\nwhen choosing folio_sz.\n\nThat pointer is only borrowed from ni-\u003erunlist.rl. Concurrent $MFT\nallocation extension can merge a replacement runlist under the same lock,\nand ntfs_rl_realloc() can free the old backing array. If that happens\nbetween the lookup and the later folio_sz decision, writeback can\ndereference freed runlist storage.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nMFT writeback path:               $MFT allocation extension:\n1. Look up rl under               1. Extend the $MFT data allocation.\n   ni-\u003erunlist.lock.              2. Publish a replacement runlist.\n2. Drop ni-\u003erunlist.lock.         3. Free the old runlist array.\n3. Read rl-\u003elength and rl-\u003evcn\n   to choose folio_sz.\n\nCompute the remaining run length while ni-\u003erunlist.lock is still held, and\nuse that scalar after unlock. This preserves the existing folio sizing\ndecision without carrying a borrowed runlist_element across the lock\nboundary.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in ntfs_mft_writepages+0x1c8d/0x1fb0\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x20d/0x410\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n kasan_report+0xe0/0x110\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ntfs_mft_writepages+0x1c8d/0x1fb0\n ? __pfx_ntfs_mft_writepages+0x10/0x10\n ? __pfx___mutex_unlock_slowpath+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? iput+0x92/0xa80\n do_writepages+0x219/0x530\n ? __pfx_do_writepages+0x10/0x10\n __writeback_single_inode+0x117/0xf50\n ? do_raw_spin_lock+0x130/0x270\n ? __pfx_do_raw_spin_lock+0x10/0x10\n ? __pfx___writeback_single_inode+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n writeback_sb_inodes+0x65b/0x1810\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_acquire+0x2b8/0x2f0\n ? __pfx_writeback_sb_inodes+0x10/0x10\n ? lock_release+0x1e0/0x280\n ? _raw_spin_unlock+0x23/0x40\n ? move_expired_inodes+0x2b8/0x850\n __writeback_inodes_wb+0xf4/0x270\n ? __pfx___writeback_inodes_wb+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? queue_io+0x2e4/0x410\n wb_writeback+0x666/0x880\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __pfx_wb_writeback+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? get_nr_dirty_inodes+0x1c/0x170\n wb_workfn+0x75e/0xbb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x27/0x60\n ? __pfx_wb_workfn+0x10/0x10\n ? __pfx_debug_object_deactivate+0x10/0x10\n ? lock_acquire+0x2b8/0x2f0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_release+0x1e0/0x280\n process_one_work+0x8d0/0x1870\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x575/0xf80\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2e7/0x3c0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x576/0x810\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x57e/0xe10\n ? __switch_to_asm+0x33/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 970:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n __kvmalloc_node_noprof+0x353/0x920\n ntfs_rl_realloc+0x3c/0x80\n ntfs_runlists_merge+0x1212/0x3010\n ntfs_mft_data_extend_allocation_nolock+0x3e0/0x1f40\n ntfs_mft_record_alloc+0x1ab4/0x4f10\n __ntfs_create+0x680/0x2e50\n ntfs_create+0x1e6/0x3a0\n path_openat+0x2b55/0x3c10\n do_file_open+0x1f4/0x460\n do_sys_openat2+0xde/0x170\n __x64_sys_openat+0x122/0x1e0\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 1294:\n kasan_save_\n---truncated---","status":"published","published":"2026-08-15T06:22:08.84Z","modified":"2026-08-17T06:18:39.54Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:37.926464Z"}],"osv":[{"id":"BELL-CVE-2026-72354","title":"CVE-2026-72354 does not affect BellSoft software","status":"withdrawn","published":"2026-08-18T06:06:32.684413Z","modified":"2026-08-18T07:15:53.590273149Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:25.777499Z"},{"id":"CVE-2026-72354","title":"ntfs: avoid stale runlist element dereference in MFT writeback","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: avoid stale runlist element dereference in MFT writeback\n\nntfs_write_mft_block() maps each $MFT record through the $MFT data\nrunlist. For sub-folio clusters it looks up a struct runlist_element under\nni-\u003erunlist.lock, drops the lock, and later uses rl-\u003elength and rl-\u003evcn\nwhen choosing folio_sz.\n\nThat pointer is only borrowed from ni-\u003erunlist.rl. Concurrent $MFT\nallocation extension can merge a replacement runlist under the same lock,\nand ntfs_rl_realloc() can free the old backing array. If that happens\nbetween the lookup and the later folio_sz decision, writeback can\ndereference freed runlist storage.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nMFT writeback path:               $MFT allocation extension:\n1. Look up rl under               1. Extend the $MFT data allocation.\n   ni-\u003erunlist.lock.              2. Publish a replacement runlist.\n2. Drop ni-\u003erunlist.lock.         3. Free the old runlist array.\n3. Read rl-\u003elength and rl-\u003evcn\n   to choose folio_sz.\n\nCompute the remaining run length while ni-\u003erunlist.lock is still held, and\nuse that scalar after unlock. This preserves the existing folio sizing\ndecision without carrying a borrowed runlist_element across the lock\nboundary.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in ntfs_mft_writepages+0x1c8d/0x1fb0\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x20d/0x410\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n kasan_report+0xe0/0x110\n ? ntfs_mft_writepages+0x1c8d/0x1fb0\n ntfs_mft_writepages+0x1c8d/0x1fb0\n ? __pfx_ntfs_mft_writepages+0x10/0x10\n ? __pfx___mutex_unlock_slowpath+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? iput+0x92/0xa80\n do_writepages+0x219/0x530\n ? __pfx_do_writepages+0x10/0x10\n __writeback_single_inode+0x117/0xf50\n ? do_raw_spin_lock+0x130/0x270\n ? __pfx_do_raw_spin_lock+0x10/0x10\n ? __pfx___writeback_single_inode+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n writeback_sb_inodes+0x65b/0x1810\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_acquire+0x2b8/0x2f0\n ? __pfx_writeback_sb_inodes+0x10/0x10\n ? lock_release+0x1e0/0x280\n ? _raw_spin_unlock+0x23/0x40\n ? move_expired_inodes+0x2b8/0x850\n __writeback_inodes_wb+0xf4/0x270\n ? __pfx___writeback_inodes_wb+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? queue_io+0x2e4/0x410\n wb_writeback+0x666/0x880\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __pfx_wb_writeback+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? get_nr_dirty_inodes+0x1c/0x170\n wb_workfn+0x75e/0xbb0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x27/0x60\n ? __pfx_wb_workfn+0x10/0x10\n ? __pfx_debug_object_deactivate+0x10/0x10\n ? lock_acquire+0x2b8/0x2f0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? lock_release+0x1e0/0x280\n process_one_work+0x8d0/0x1870\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x575/0xf80\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2e7/0x3c0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x576/0x810\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x57e/0xe10\n ? __switch_to_asm+0x33/0x70\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 970:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n __kvmalloc_node_noprof+0x353/0x920\n ntfs_rl_realloc+0x3c/0x80\n ntfs_runlists_merge+0x1212/0x3010\n ntfs_mft_data_extend_allocation_nolock+0x3e0/0x1f40\n ntfs_mft_record_alloc+0x1ab4/0x4f10\n __ntfs_create+0x680/0x2e50\n ntfs_create+0x1e6/0x3a0\n path_openat+0x2b55/0x3c10\n do_file_open+0x1f4/0x460\n do_sys_openat2+0xde/0x170\n __x64_sys_openat+0x122/0x1e0\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 1294:\n kasan_save_\n---truncated---","status":"published","published":"2026-08-15T05:55:56.163Z","modified":"2026-10-28T02:30:41.75657412Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:15.511448Z"},{"id":"DEBIAN-CVE-2026-72354","description":"In the Linux kernel, the following vulnerability has been resolved:  ntfs: avoid stale runlist element dereference in MFT writeback  ntfs_write_mft_block() maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlist_element under ni-\u003erunlist.lock, drops the lock, and later uses rl-\u003elength and rl-\u003evcn when choosing folio_sz.  That pointer is only borrowed from ni-\u003erunlist.rl. Concurrent $MFT allocation extension can merge a replacement runlist under the same lock, and ntfs_rl_realloc() can free the old backing array. If that happens between the lookup and the later folio_sz decision, writeback can dereference freed runlist storage.  The buggy scenario involves two paths, with each column showing the order within that path:  MFT writeback path:               $MFT allocation extension: 1. Look up rl under               1. Extend the $MFT data allocation.    ni-\u003erunlist.lock.              2. Publish a replacement runlist. 2. Drop ni-\u003erunlist.lock.         3. Free the old runlist array. 3. Read rl-\u003elength and rl-\u003evcn    to choose folio_sz.  Compute the remaining run length while ni-\u003erunlist.lock is still held, and use that scalar after unlock. This preserves the existing folio sizing decision without carrying a borrowed runlist_element across the lock boundary.  Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in ntfs_mft_writepages+0x1c8d/0x1fb0  Call Trace:  \u003cTASK\u003e  dump_stack_lvl+0x66/0xa0  print_report+0xce/0x630  ? ntfs_mft_writepages+0x1c8d/0x1fb0  ? srso_alias_return_thunk+0x5/0xfbef5  ? __virt_addr_valid+0x20d/0x410  ? ntfs_mft_writepages+0x1c8d/0x1fb0  kasan_report+0xe0/0x110  ? ntfs_mft_writepages+0x1c8d/0x1fb0  ntfs_mft_writepages+0x1c8d/0x1fb0  ? __pfx_ntfs_mft_writepages+0x10/0x10  ? __pfx___mutex_unlock_slowpath+0x10/0x10  ? srso_alias_return_thunk+0x5/0xfbef5  ? iput+0x92/0xa80  do_writepages+0x219/0x530  ? __pfx_do_writepages+0x10/0x10  __writeback_single_inode+0x117/0xf50  ? do_raw_spin_lock+0x130/0x270  ? __pfx_do_raw_spin_lock+0x10/0x10  ? __pfx___writeback_single_inode+0x10/0x10  ? srso_alias_return_thunk+0x5/0xfbef5  writeback_sb_inodes+0x65b/0x1810  ? srso_alias_return_thunk+0x5/0xfbef5  ? lock_acquire+0x2b8/0x2f0  ? __pfx_writeback_sb_inodes+0x10/0x10  ? lock_release+0x1e0/0x280  ? _raw_spin_unlock+0x23/0x40  ? move_expired_inodes+0x2b8/0x850  __writeback_inodes_wb+0xf4/0x270  ? __pfx___writeback_inodes_wb+0x10/0x10  ? srso_alias_return_thunk+0x5/0xfbef5  ? queue_io+0x2e4/0x410  wb_writeback+0x666/0x880  ? srso_alias_return_thunk+0x5/0xfbef5  ? __pfx_wb_writeback+0x10/0x10  ? srso_alias_return_thunk+0x5/0xfbef5  ? srso_alias_return_thunk+0x5/0xfbef5  ? get_nr_dirty_inodes+0x1c/0x170  wb_workfn+0x75e/0xbb0  ? srso_alias_return_thunk+0x5/0xfbef5  ? _raw_spin_unlock_irqrestore+0x27/0x60  ? __pfx_wb_workfn+0x10/0x10  ? __pfx_debug_object_deactivate+0x10/0x10  ? lock_acquire+0x2b8/0x2f0  ? srso_alias_return_thunk+0x5/0xfbef5  ? lock_release+0x1e0/0x280  process_one_work+0x8d0/0x1870  ? __pfx_process_one_work+0x10/0x10  ? srso_alias_return_thunk+0x5/0xfbef5  worker_thread+0x575/0xf80  ? __pfx_worker_thread+0x10/0x10  kthread+0x2e7/0x3c0  ? __pfx_kthread+0x10/0x10  ret_from_fork+0x576/0x810  ? __pfx_ret_from_fork+0x10/0x10  ? srso_alias_return_thunk+0x5/0xfbef5  ? __switch_to+0x57e/0xe10  ? __switch_to_asm+0x33/0x70  ? __pfx_kthread+0x10/0x10  ret_from_fork_asm+0x1a/0x30  \u003c/TASK\u003e  Allocated by task 970:  kasan_save_stack+0x33/0x60  kasan_save_track+0x14/0x30  __kasan_kmalloc+0xaa/0xb0  __kvmalloc_node_noprof+0x353/0x920  ntfs_rl_realloc+0x3c/0x80  ntfs_runlists_merge+0x1212/0x3010  ntfs_mft_data_extend_allocation_nolock+0x3e0/0x1f40  ntfs_mft_record_alloc+0x1ab4/0x4f10  __ntfs_create+0x680/0x2e50  ntfs_create+0x1e6/0x3a0  path_openat+0x2b55/0x3c10  do_file_open+0x1f4/0x460  do_sys_openat2+0xde/0x170  __x64_sys_openat+0x122/0x1e0  do_syscall_64+0x115/0x6a0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Freed by task 1294:  kasan_save_ ---truncated---","status":"published","published":"2026-08-15T06:22:08.84Z","modified":"2026-10-01T03:03:33.153262945Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"UBUNTU-CVE-2026-72354","description":"In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid stale runlist element dereference in MFT writeback ntfs_write_mft_block() maps each $MFT record through the $MFT data runlist. For sub-folio clusters it looks up a struct runlist_element under ni-\u003erunlist.lock, drops the lock, and later uses rl-\u003elength and rl-\u003evcn when choosing folio_sz. That pointer is only borrowed from ni-\u003erunlist.rl. Concurrent $MFT allocation extension can merge a replacement runlist under the same lock, and ntfs_rl_realloc() can free the old backing array. If that happens between the lookup and the later folio_sz decision, writeback can dereference freed runlist storage. The buggy scenario involves two paths, with each column showing the order within that path: MFT writeback path:               $MFT allocation extension: 1. Look up rl under               1. Extend the $MFT data allocation.    ni-\u003erunlist.lock.              2. Publish a replacement runlist. 2. Drop ni-\u003erunlist.lock.         3. Free the old runlist array. 3. Read rl-\u003elength and rl-\u003evcn    to choose folio_sz. Compute the remaining run length while ni-\u003erunlist.lock is still held, and use that scalar after unlock. This preserves the existing folio sizing decision without carrying a borrowed runlist_element across the lock boundary. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in ntfs_mft_writepages+0x1c8d/0x1fb0 Call Trace:  \u003cTASK\u003e  dump_stack_lvl+0x66/0xa0  print_report+0xce/0x630  ? ntfs_mft_writepages+0x1c8d/0x1fb0  ? srso_alias_return_thunk+0x5/0xfbef5  ? __virt_addr_valid+0x20d/0x410  ? ntfs_mft_writepages+0x1c8d/0x1fb0  kasan_report+0xe0/0x110  ? ntfs_mft_writepages+0x1c8d/0x1fb0  ntfs_mft_writepages+0x1c8d/0x1fb0  ? __pfx_ntfs_mft_writepages+0x10/0x10  ? __pfx___mutex_unlock_slowpath+0x10/0x10  ? srso_alias_return_thunk+0x5/0xfbef5  ? iput+0x92/0xa80  do_writepages+0x219/0x530  ? __pfx_do_writepages+0x10/0x10  __writeback_single_inode+0x117/0xf50  ? do_raw_spin_lock+0x130/0x270  ? __pfx_do_raw_spin_lock+0x10/0x10  ? __pfx___writeback_single_inode+0x10/0x10  ? srso_alias_return_thunk+0x5/0xfbef5  writeback_sb_inodes+0x65b/0x1810  ? srso_alias_return_thunk+0x5/0xfbef5  ? lock_acquire+0x2b8/0x2f0  ? __pfx_writeback_sb_inodes+0x10/0x10  ? lock_release+0x1e0/0x280  ? _raw_spin_unlock+0x23/0x40  ? move_expired_inodes+0x2b8/0x850  __writeback_inodes_wb+0xf4/0x270  ? __pfx___writeback_inodes_wb+0x10/0x10  ? srso_alias_return_thunk+0x5/0xfbef5  ? queue_io+0x2e4/0x410  wb_writeback+0x666/0x880  ? srso_alias_return_thunk+0x5/0xfbef5  ? __pfx_wb_writeback+0x10/0x10  ? srso_alias_return_thunk+0x5/0xfbef5  ? srso_alias_return_thunk+0x5/0xfbef5  ? get_nr_dirty_inodes+0x1c/0x170  wb_workfn+0x75e/0xbb0  ? srso_alias_return_thunk+0x5/0xfbef5  ? _raw_spin_unlock_irqrestore+0x27/0x60  ? __pfx_wb_workfn+0x10/0x10  ? __pfx_debug_object_deactivate+0x10/0x10  ? lock_acquire+0x2b8/0x2f0  ? srso_alias_return_thunk+0x5/0xfbef5  ? lock_release+0x1e0/0x280  process_one_work+0x8d0/0x1870  ? __pfx_process_one_work+0x10/0x10  ? srso_alias_return_thunk+0x5/0xfbef5  worker_thread+0x575/0xf80  ? __pfx_worker_thread+0x10/0x10  kthread+0x2e7/0x3c0  ? __pfx_kthread+0x10/0x10  ret_from_fork+0x576/0x810  ? __pfx_ret_from_fork+0x10/0x10  ? srso_alias_return_thunk+0x5/0xfbef5  ? __switch_to+0x57e/0xe10  ? __switch_to_asm+0x33/0x70  ? __pfx_kthread+0x10/0x10  ret_from_fork_asm+0x1a/0x30  \u003c/TASK\u003e Allocated by task 970:  kasan_save_stack+0x33/0x60  kasan_save_track+0x14/0x30  __kasan_kmalloc+0xaa/0xb0  __kvmalloc_node_noprof+0x353/0x920  ntfs_rl_realloc+0x3c/0x80  ntfs_runlists_merge+0x1212/0x3010  ntfs_mft_data_extend_allocation_nolock+0x3e0/0x1f40  ntfs_mft_record_alloc+0x1ab4/0x4f10  __ntfs_create+0x680/0x2e50  ntfs_create+0x1e6/0x3a0  path_openat+0x2b55/0x3c10  do_file_open+0x1f4/0x460  do_sys_openat2+0xde/0x170  __x64_sys_openat+0x122/0x1e0  do_syscall_64+0x115/0x6a0  entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 1294:  kasan_save_ ---truncated---","status":"published","published":"2026-08-15T06:22:00Z","modified":"2026-11-11T09:40:43.446486681Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T10:02:46.366373Z"}]}}