Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-46047

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Fix use-after-free in driver remove() In the remove callback, if a packet arrives after destroy_workqueue() is called, but before sock_release(), the qrtr_ns_data_ready() callback will try to queue the work, causing use-after-free issue. Fix this issue by saving the default 'sk_data_ready' callback during qrtr_ns_init() and use it to replace the qrtr_ns_data_ready() callback at the start of remove(). This ensur
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:32032aa154d893de01e26e6c88430a03be23d27ed1465a7046167ecdc24b709e
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/qrtr/ns.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"65168712c216584ff482a7d1a67589f2079b2634","status":"affected","version":"0c2204a4ad710d95d348ea006f14ba926e842ffd","versionType":"git"},{"lessThan":"dff081c3602f2fd810f69ef47945a226980dd05d","status":"affected","version":"0c2204a4ad710d95d348ea006f14ba926e842ffd","versionType":"git"},{"lessThan":"4ae0bd51bf7079e9c2a06b5de0ae04ba70d10167","status":"affected","version":"0c2204a4ad710d95d348ea006f14ba92…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5780d2ff13802b1571b9611d0cd78b37137488137f93b94f2159914fee308cbb · sha256:3f08cd751e49fd2a… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["net/qrtr/ns.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5780d2ff13802b1571b9611d0cd78b37137488137f93b94f2159914fee308cbb · sha256:3f08cd751e49fd2a… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/qrtr/ns.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"65168712c216584ff482a7d1a67589f2079b2634","status":"affected","version":"0c2204a4ad710d95d348ea006f14ba926e842ffd","versionType":"git"},{"lessThan":"dff081c3602f2fd810f69ef47945a226980dd05d","status":"affected","version":"0c2204a4ad710d95d348ea006f14ba926e842ffd","versionType":"git"},{"lessThan":"4ae0bd51bf7079e9c2a06b5de0ae04ba70d10167","status":"affected","version":"0c2204a4ad710d95d348ea006f14ba92…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5780d2ff13802b1571b9611d0cd78b37137488137f93b94f2159914fee308cbb · sha256:3f08cd751e49fd2a… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["net/qrtr/ns.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5780d2ff13802b1571b9611d0cd78b37137488137f93b94f2159914fee308cbb · sha256:3f08cd751e49fd2a… · /containers/cna/affected/1

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/0f313eb6a8f6dffa491373cf3afab979fa1c02f4"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5780d2ff13802b1571b9611d0cd78b37137488137f93b94f2159914fee308cbb · sha256:3f08cd751e49fd2a… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/2e127ceb1c415e246076d8e09e23e443a7a2038f"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5780d2ff13802b1571b9611d0cd78b37137488137f93b94f2159914fee308cbb · sha256:3f08cd751e49fd2a… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/4ae0bd51bf7079e9c2a06b5de0ae04ba70d10167"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5780d2ff13802b1571b9611d0cd78b37137488137f93b94f2159914fee308cbb · sha256:3f08cd751e49fd2a… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/65168712c216584ff482a7d1a67589f2079b2634"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5780d2ff13802b1571b9611d0cd78b37137488137f93b94f2159914fee308cbb · sha256:3f08cd751e49fd2a… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/7809fea20c9404bfcfa6112ec08d1fe1d3520beb"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5780d2ff13802b1571b9611d0cd78b37137488137f93b94f2159914fee308cbb · sha256:3f08cd751e49fd2a… · /containers/cna/references/7
{"url":"https://git.kernel.org/stable/c/db3c60ec772de30acae92d560dfcc5258e58dbe8"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5780d2ff13802b1571b9611d0cd78b37137488137f93b94f2159914fee308cbb · sha256:3f08cd751e49fd2a… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/dff081c3602f2fd810f69ef47945a226980dd05d"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5780d2ff13802b1571b9611d0cd78b37137488137f93b94f2159914fee308cbb · sha256:3f08cd751e49fd2a… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/f96779e916576e81430ebb326baff6e433fef8ae"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5780d2ff13802b1571b9611d0cd78b37137488137f93b94f2159914fee308cbb · sha256:3f08cd751e49fd2a… · /containers/cna/references/6

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer