{
"document":{
"aggregate_severity":{
"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
"text":"MEDIUM"
},
"category":"csaf_vex",
"csaf_version":"2.0",
"distribution":{
"tlp":{
"label":"WHITE",
"url":"https:/www.first.org/tlp/"
}
},
"lang":"en",
"notes":[
{
"text":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Don't clobber irqfd routing type when deassigning irqfd\n\nWhen deassigning a KVM_IRQFD, don't clobber the irqfd's copy of the IRQ's\nrouting entry as doing so breaks kvm_arch_irq_bypass_del_producer() on x86\nand arm64, which explicitly look for KVM_IRQ_ROUTING_MSI. Instead, to\nhandle a concurrent routing update, verify that the irqfd is still active\nbefore consuming the routing information. As evidenced by the x86 and\narm64 bugs, and another bug in kvm_arch_update_irqfd_routing() (see below),\nclobbering the entry type without notifying arch code is surprising and\nerror prone.\n\nAs a bonus, checking that the irqfd is active provides a convenient\nlocation for documenting _why_ KVM must not consume the routing entry for\nan irqfd that is in the process of being deassigned: once the irqfd is\ndeleted from the list (which happens *before* the eventfd is detached), it\nwill no longer receive updates via kvm_irq_routing_update(), and so KVM\ncould deliver an event using stale routing information (relative to\nKVM_SET_GSI_ROUTING returning to userspace).\n\nAs an even better bonus, explicitly checking for the irqfd being active\nfixes a similar bug to the one the clobbering is trying to prevent: if an\nirqfd is deactivated, and then its routing is changed,\nkvm_irq_routing_update() won't invoke kvm_arch_update_irqfd_routing()\n(because the irqfd isn't in the list). And so if the irqfd is in bypass\nmode, IRQs will continue to be posted using the old routing information.\n\nAs for kvm_arch_irq_bypass_del_producer(), clobbering the routing type\nresults in KVM incorrectly keeping the IRQ in bypass mode, which is\nespecially problematic on AMD as KVM tracks IRQs that are being posted to\na vCPU in a list whose lifetime is tied to the irqfd.\n\nWithout the help of KASAN to detect use-after-free, the most common\nsympton on AMD is a NULL pointer deref in amd_iommu_update_ga() due to\nthe memory for irqfd structure being re-allocated and zeroed, resulting\nin irqfd->irq_bypass_data being NULL when read by\navic_update_iommu_vcpu_affinity():\n\n BUG: kernel NULL pointer dereference, address: 0000000000000018\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 40cf2b9067 P4D 40cf2b9067 PUD 408362a067 PMD 0\n Oops: Oops: 0000 [#1] SMP\n CPU: 6 UID: 0 PID: 40383 Comm: vfio_irq_test\n Tainted: G U W O 6.19.0-smp--5dddc257e6b2-irqfd #31 NONE\n Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025\n RIP: 0010:amd_iommu_update_ga+0x19/0xe0\n Call Trace:\n \n avic_update_iommu_vcpu_affinity+0x3d/0x90 [kvm_amd]\n __avic_vcpu_load+0xf4/0x130 [kvm_amd]\n kvm_arch_vcpu_load+0x89/0x210 [kvm]\n vcpu_load+0x30/0x40 [kvm]\n kvm_arch_vcpu_ioctl_run+0x45/0x620 [kvm]\n kvm_vcpu_ioctl+0x571/0x6a0 [kvm]\n __se_sys_ioctl+0x6d/0xb0\n do_syscall_64+0x6f/0x9d0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x46893b\n \n ---[ end trace 0000000000000000 ]---\n\nIf AVIC is inhibited when the irfd is deassigned, the bug will manifest as\nlist corruption, e.g. on the next irqfd assignment.\n\n list_add corruption. next->prev should be prev (ffff8d474d5cd588),\n but was 0000000000000000. (next=ffff8d8658f86530).\n ------------[ cut here ]------------\n kernel BUG at lib/list_debug.c:31!\n Oops: invalid opcode: 0000 [#1] SMP\n CPU: 128 UID: 0 PID: 80818 Comm: vfio_irq_test\n Tainted: G U W O 6.19.0-smp--f19dc4d680ba-irqfd #28 NONE\n Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025\n RIP: 0010:__list_add_valid_or_report+0x97/0xc0\n Call Trace:\n \n avic_pi_update_irte+0x28e/0x2b0 [kvm_amd]\n kvm_pi_update_irte+0xbf/0x190 [kvm]\n kvm_arch_irq_bypass_add_producer+0x72/0x90 [kvm]\n irq_bypass_register_consumer+0xcd/0x170 [irqbypa\n---truncated---",
"category":"general",
"title":"Synopsis"
}
],
"publisher":null,
"references":[
{
"summary":"nvd cve",
"category":"external",
"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23198"
},
{
"summary":"CVE-2026-23198 vex file",
"category":"self",
"url":"https://repo.openeuler.org/security/data/csaf/cve/2026/csaf-openeuler-cve-2026-23198.json"
},
{
"summary":"openEuler-SA-2026-1760",
"category":"self",
"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1760"
},
{
"summary":"CVE-2026-23198",
"category":"self",
"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-23198&packageName=kernel"
}
],
"title":"openEuler cve CVE-2026-23198",
"tracking":{
"initial_release_date":"2026-03-30T15:49:29+08:00",
"revision_history":[
{
"date":"2026-03-30T15:49:29+08:00",
"summary":"Initial",
"number":"1.0.0"
}
],
"generator":{
"date":"2026-03-30T15:49:29+08:00",
"engine":{
"name":"openEuler CSAF Tool V1.0"
}
},
"current_release_date":"2026-03-30T15:49:29+08:00",
"id":"CVE-2026-23198",
"version":"1.0.0",
"status":"interim"
}
},
"product_tree":{
"branches":[
{
"name":"openEuler",
"category":"vendor",
"branches":[
{
"name":"openEuler",
"branches":[
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"openEuler-24.03-LTS-SP1",
"name":"openEuler-24.03-LTS-SP1"
},
"name":"openEuler-24.03-LTS-SP1",
"category":"product_version"
}
],
"category":"product_name"
},
{
"name":"aarch64",
"branches":[
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"bpftool-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"bpftool-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"bpftool-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"bpftool-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"bpftool-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"bpftool-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"kernel-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"kernel-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"kernel-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"kernel-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-debugsource-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"kernel-debugsource-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"kernel-debugsource-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-devel-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"kernel-devel-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"kernel-devel-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-headers-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"kernel-headers-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"kernel-headers-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-source-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"kernel-source-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"kernel-source-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-tools-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"kernel-tools-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"kernel-tools-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-tools-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"kernel-tools-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"kernel-tools-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-tools-devel-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"kernel-tools-devel-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"kernel-tools-devel-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"perf-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"perf-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"perf-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"python3-perf-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"python3-perf-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"python3-perf-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"python3-perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"name":"python3-perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm"
},
"name":"python3-perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"category":"product_version"
}
],
"category":"architecture"
},
{
"name":"x86_64",
"branches":[
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"bpftool-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"bpftool-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"bpftool-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"bpftool-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"bpftool-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"bpftool-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"kernel-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"kernel-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"kernel-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"kernel-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-debugsource-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"kernel-debugsource-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"kernel-debugsource-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-devel-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"kernel-devel-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"kernel-devel-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-headers-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"kernel-headers-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"kernel-headers-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-source-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"kernel-source-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"kernel-source-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-tools-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"kernel-tools-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"kernel-tools-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-tools-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"kernel-tools-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"kernel-tools-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-tools-devel-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"kernel-tools-devel-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"kernel-tools-devel-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"perf-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"perf-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"perf-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"python3-perf-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"python3-perf-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"python3-perf-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
},
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"python3-perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"name":"python3-perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm"
},
"name":"python3-perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"category":"product_version"
}
],
"category":"architecture"
},
{
"name":"src",
"branches":[
{
"product":{
"product_identification_helper":{
"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
},
"product_id":"kernel-6.6.0-144.0.0.139.oe2403sp1.src.rpm",
"name":"kernel-6.6.0-144.0.0.139.oe2403sp1.src.rpm"
},
"name":"kernel-6.6.0-144.0.0.139.oe2403sp1.src.rpm",
"category":"product_version"
}
],
"category":"architecture"
}
]
}
],
"relationships":[
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"bpftool-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:bpftool-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"bpftool-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"bpftool-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:bpftool-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"bpftool-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"kernel-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"kernel-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-debugsource-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-debugsource-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"kernel-debugsource-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-devel-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-devel-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"kernel-devel-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-headers-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-headers-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"kernel-headers-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-source-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-source-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"kernel-source-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-tools-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-tools-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"kernel-tools-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-tools-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-tools-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"kernel-tools-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-tools-devel-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-tools-devel-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"kernel-tools-devel-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"perf-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:perf-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"perf-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"python3-perf-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:python3-perf-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"python3-perf-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"python3-perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:python3-perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64",
"name":"python3-perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"bpftool-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:bpftool-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"bpftool-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"bpftool-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:bpftool-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"bpftool-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"kernel-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"kernel-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-debugsource-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-debugsource-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"kernel-debugsource-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-devel-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-devel-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"kernel-devel-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-headers-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-headers-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"kernel-headers-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-source-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-source-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"kernel-source-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-tools-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-tools-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"kernel-tools-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-tools-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-tools-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"kernel-tools-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-tools-devel-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-tools-devel-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"kernel-tools-devel-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"perf-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:perf-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"perf-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"python3-perf-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:python3-perf-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"python3-perf-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"python3-perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:python3-perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64",
"name":"python3-perf-debuginfo-6.6.0-144.0.0.139.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
},
{
"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
"product_reference":"kernel-6.6.0-144.0.0.139.oe2403sp1.src.rpm",
"full_product_name":{
"product_id":"openEuler-24.03-LTS-SP1:kernel-6.6.0-144.0.0.139.oe2403sp1.src",
"name":"kernel-6.6.0-144.0.0.139.oe2403sp1.src as a component of openEuler-24.03-LTS-SP1"
},
"category":"default_component_of"
}
]
},
"vulnerabilities":[
{
"cve":"CVE-2026-23198",
"notes":[
{
"text":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Don't clobber irqfd routing type when deassigning irqfd\n\nWhen deassigning a KVM_IRQFD, don't clobber the irqfd's copy of the IRQ's\nrouting entry as doing so breaks kvm_arch_irq_bypass_del_producer() on x86\nand arm64, which explicitly look for KVM_IRQ_ROUTING_MSI. Instead, to\nhandle a concurrent routing update, verify that the irqfd is still active\nbefore consuming the routing information. As evidenced by the x86 and\narm64 bugs, and another bug in kvm_arch_update_irqfd_routing() (see below),\nclobbering the entry type without notifying arch code is surprising and\nerror prone.\n\nAs a bonus, checking that the irqfd is active provides a convenient\nlocation for documenting _why_ KVM must not consume the routing entry for\nan irqfd that is in the process of being deassigned: once the irqfd is\ndeleted from the list (which happens *before* the eventfd is detached), it\nwill no longer receive updates via kvm_irq_routing_update(), and so KVM\ncould deliver an event using stale routing information (relative to\nKVM_SET_GSI_ROUTING returning to userspace).\n\nAs an even better bonus, explicitly checking for the irqfd being active\nfixes a similar bug to the one the clobbering is trying to prevent: if an\nirqfd is deactivated, and then its routing is changed,\nkvm_irq_routing_update() won't invoke kvm_arch_update_irqfd_routing()\n(because the irqfd isn't in the list). And so if the irqfd is in bypass\nmode, IRQs will continue to be posted using the old routing information.\n\nAs for kvm_arch_irq_bypass_del_producer(), clobbering the routing type\nresults in KVM incorrectly keeping the IRQ in bypass mode, which is\nespecially problematic on AMD as KVM tracks IRQs that are being posted to\na vCPU in a list whose lifetime is tied to the irqfd.\n\nWithout the help of KASAN to detect use-after-free, the most common\nsympton on AMD is a NULL pointer deref in amd_iommu_update_ga() due to\nthe memory for irqfd structure being re-allocated and zeroed, resulting\nin irqfd->irq_bypass_data being NULL when read by\navic_update_iommu_vcpu_affinity():\n\n BUG: kernel NULL pointer dereference, address: 0000000000000018\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 40cf2b9067 P4D 40cf2b9067 PUD 408362a067 PMD 0\n Oops: Oops: 0000 [#1] SMP\n CPU: 6 UID: 0 PID: 40383 Comm: vfio_irq_test\n Tainted: G U W O 6.19.0-smp--5dddc257e6b2-irqfd #31 NONE\n Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025\n RIP: 0010:amd_iommu_update_ga+0x19/0xe0\n Call Trace:\n \n avic_update_iommu_vcpu_affinity+0x3d/0x90 [kvm_amd]\n __avic_vcpu_load+0xf4/0x130 [kvm_amd]\n kvm_arch_vcpu_load+0x89/0x210 [kvm]\n vcpu_load+0x30/0x40 [kvm]\n kvm_arch_vcpu_ioctl_run+0x45/0x620 [kvm]\n kvm_vcpu_ioctl+0x571/0x6a0 [kvm]\n __se_sys_ioctl+0x6d/0xb0\n do_syscall_64+0x6f/0x9d0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x46893b\n \n ---[ end trace 0000000000000000 ]---\n\nIf AVIC is inhibited when the irfd is deassigned, the bug will manifest as\nlist corruption, e.g. on the next irqfd assignment.\n\n list_add corruption. next->prev should be prev (ffff8d474d5cd588),\n but was 0000000000000000. (next=ffff8d8658f86530).\n ------------[ cut here ]------------\n kernel BUG at lib/list_debug.c:31!\n Oops: invalid opcode: 0000 [#1] SMP\n CPU: 128 UID: 0 PID: 80818 Comm: vfio_irq_test\n Tainted: G U W O 6.19.0-smp--f19dc4d680ba-irqfd #28 NONE\n Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025\n RIP: 0010:__list_add_valid_or_report+0x97/0xc0\n Call Trace:\n \n avic_pi_update_irte+0x28e/0x2b0 [kvm_amd]\n kvm_pi_update_irte+0xbf/0x190 [kvm]\n kvm_arch_irq_bypass_add_producer+0x72/0x90 [kvm]\n irq_bypass_register_consumer+0xcd/0x170 [irqbypa\n---truncated---",
"category":"description",
"title":"Vulnerability Description"
}
],
"product_status":{
"fixed":{
"$ref":"$.vulnerabilities[0].product_status.fixed"
}
},
"remediations":[
{
"product_ids":{
"$ref":"$.vulnerabilities[0].product_status.fixed"
},
"details":"kernel security update",
"category":"vendor_fix",
"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1760"
}
],
"scores":[
{
"cvss_v3":{
"baseSeverity":"MEDIUM",
"baseScore":5.5,
"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version":"3.1"
},
"products":{
"$ref":"$.vulnerabilities[0].product_status.fixed"
}
}
],
"threats":[
{
"details":"Medium",
"category":"impact"
}
],
"title":"CVE-2026-23198"
}
]
}