Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-43068: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() CVE-2026-43067: In the Linux kernel, the following vulnerability has been resolved: ext4: handle wraparound when searching for blocks for indirect mapped blocks CVE-2026-43066: In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths CVE-2026-43065: In the Linux kernel, the following vulnerability has been resolved: ext4: always drain queued discard work in ext4_mb_release() CVE-2026-43063: In the Linux kernel, the following vulnerability has been resolved: xfs: don't irele after failing to iget in xfs_attri_recover_work CVE-2026-31679: In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/set_masked payload length CVE-2026-31678: In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release CVE-2026-31674: In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() CVE-2026-31570: In the Linux kernel, the following vulnerability has been resolved: can: gw: fix OOB heap access in cgw_csum_crc8_rel() CVE-2026-31561: In the Linux kernel, the following vulnerability has been resolved: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask CVE-2026-31555: In the Linux kernel, the following vulnerability has been resolved: futex: Clear stale exiting pointer in futex_lock_pi() retry path CVE-2026-31554: In the Linux kernel, the following vulnerability has been resolved: futex: Require sys_futex_requeue() to have identical flags CVE-2026-31528: In the Linux kernel, the following vulnerability has been resolved: perf: Make sure to use pmu_ctx->pmu for groups CVE-2026-31527: In the Linux kernel, the following vulnerability has been resolved: driver core: platform: use generic driver_override infrastructure CVE-2026-31525: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN CVE-2026-31524: In the Linux kernel, the following vulnerability has been resolved: HID: asus: avoid memory leak in asus_report_fixup() CVE-2026-31523: In the Linux kernel, the following vulnerability has been resolved: nvme-pci: ensure we're polling a polled queue CVE-2026-31521: In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol st_shndx is out of bounds CVE-2026-31519: In the Linux kernel, the following vulnerability has been resolved: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create CVE-2026-31518: In the Linux kernel, the following vulnerability has been resolved: esp: fix skb leak with espintcp and async crypto CVE-2026-31516: In the Linux kernel, the following vulnerability has been resolved: xfrm: prevent policy_hthresh.work from racing with netns teardown CVE-2026-31515: In the Linux kernel, the following vulnerability has been resolved: af_key: validate families in pfkey_send_migrate() CVE-2026-31514: In the Linux kernel, the following vulnerability has been resolved: erofs: set fileio bio failed in short read case CVE-2026-31508: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes CVE-2026-31504: In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race CVE-2026-31503: In the Linux kernel, the following vulnerability has been resolved: udp: Fix wildcard bind conflict check when using hash2 CVE-2026-31502: In the Linux kernel, the following vulnerability has been resolved: team: fix header_ops type confusion with non-Ethernet ports CVE-2026-31496: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: skip expectations in other netns via proc CVE-2026-31495: In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use netlink policy range checks CVE-2026-31492: In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Initialize free_qp completion before using it CVE-2026-31487: In the Linux kernel, the following vulnerability has been resolved: spi: use generic driver_override infrastructure CVE-2026-31480: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential deadlock in cpu hotplug with osnoise CVE-2026-31473: In the Linux kernel, the following vulnerability has been resolved: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex CVE-2026-31470: In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length CVE-2026-31469: In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false CVE-2026-31467: In the Linux kernel, the following vulnerability has been resolved: erofs: add GFP_NOIO in the bio completion if needed CVE-2026-31458: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] CVE-2026-31455: In the Linux kernel, the following vulnerability has been resolved: xfs: stop reclaim before pushing AIL during unmount CVE-2026-31454: In the Linux kernel, the following vulnerability has been resolved: xfs: save ailp before dropping the AIL lock in push callbacks CVE-2026-31453: In the Linux kernel, the following vulnerability has been resolved: xfs: avoid dereferencing log items after push callbacks CVE-2026-31452: In the Linux kernel, the following vulnerability has been resolved: ext4: convert inline data to extents when truncate exceed
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.12 | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | bpftool6.12-debuginfo | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.12.80-105.147 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.12 | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-aarch64 | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-debuginfo-common-x86_64 | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-devel | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-headers | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-debuginfo | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-devel | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-libbpf-static | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-modules-extra-common | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-debuginfo | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | kernel6.12-tools-devel | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | perf6.12 | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | perf6.12-debuginfo | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12 | 1:6.12.80-105.147.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.12-debuginfo | 1:6.12.80-105.147.amzn2023 |
Vulnerabilities 60
-
Critical 9.8
ext4: handle wraparound when searching for blocks for indirect mapped blocks
In the Linux kernel, the following vulnerability has been resolved: ext4: handle wraparound when searching for blocks for indirect mapped blocks Commit 4865c768b563 ("ext4: always allocate blocks only from groups inode can use") restricts what blocks will be …
-
Critical 9.4
ext4: avoid infinite loops caused by residual data
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this examp…
-
High 8.8
landlock: Fix handling of disconnected directories
In the Linux kernel, the following vulnerability has been resolved: landlock: Fix handling of disconnected directories Disconnected files or directories can appear when they are visible and opened from a bind mount, but have been renamed or moved from the sou…
-
High 8.8
can: gw: fix OOB heap access in cgw_csum_crc8_rel()
In the Linux kernel, the following vulnerability has been resolved: can: gw: fix OOB heap access in cgw_csum_crc8_rel() cgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx(): int from = calc_idx(crc8->from_idx, cf->len); int to = calc_idx(…
-
High 8.1
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). …
-
High 7.8
xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini()
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() After cancel_delayed_work_sync() is called from xfrm_nat_keepalive_net_fini(), xfrm_state_fini() flushes remaining sta…
-
High 7.8CVE-2026-31413 Public exploit
bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR maybe_fork_scalars() is called for both BPF_AND and BPF_OR when the source operand is a constant. When dst has signed range …
-
High 7.8
ext4: fix use-after-free in update_super_work when racing with umount
In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in update_super_work when racing with umount Commit b98535d09179 ("ext4: fix bug_on in start_this_handle during umount filesystem") moved ext4_unregister_sysfs() befo…
-
High 7.8
ext4: reject mount if bigalloc with s_first_data_block != 0
In the Linux kernel, the following vulnerability has been resolved: ext4: reject mount if bigalloc with s_first_data_block != 0 bigalloc with s_first_data_block != 0 is not supported, reject mounting it.
-
High 7.8
ext4: validate p_idx bounds in ext4_ext_correct_indexes
In the Linux kernel, the following vulnerability has been resolved: ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4_ext_correct_indexes() walks up the extent tree correcting index entries when the first extent in a leaf is modified. Before access…
-
High 7.8
xfs: avoid dereferencing log items after push callbacks
In the Linux kernel, the following vulnerability has been resolved: xfs: avoid dereferencing log items after push callbacks After xfsaild_push_item() calls iop_push(), the log item may have been freed if the AIL lock was dropped during the push. Background in…
-
High 7.8
xfs: save ailp before dropping the AIL lock in push callbacks
In the Linux kernel, the following vulnerability has been resolved: xfs: save ailp before dropping the AIL lock in push callbacks In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is dropped to perform buffer IO. Once the cluster buffer n…
-
High 7.8
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false A UAF issue occurs when the virtio_net driver is configured with napi_tx=N and the device's IFF_XMIT_D…
-
High 7.8
media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
In the Linux kernel, the following vulnerability has been resolved: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object clea…
-
High 7.8
team: fix header_ops type confusion with non-Ethernet ports
In the Linux kernel, the following vulnerability has been resolved: team: fix header_ops type confusion with non-Ethernet ports Similar to commit 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()") team has the same class of header_ops type …
-
High 7.8
net: fix fanout UAF in packet_release() via NETDEV_UP race
In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registra…
-
High 7.8
net: openvswitch: Avoid releasing netdev before teardown completes
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. A…
-
High 7.8
xfrm: prevent policy_hthresh.work from racing with netns teardown
In the Linux kernel, the following vulnerability has been resolved: xfrm: prevent policy_hthresh.work from racing with netns teardown A XFRM_MSG_NEWSPDINFO request can queue the per-net work item policy_hthresh.work onto the system workqueue. The queued callb…
-
High 7.8CVE-2026-31525 Public exploit
bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN The BPF interpreter's signed 32-bit division and modulo handlers use the kernel abs() macro on s32 operands. The abs() macro d…
-
High 7.8
perf: Make sure to use pmu_ctx->pmu for groups
In the Linux kernel, the following vulnerability has been resolved: perf: Make sure to use pmu_ctx->pmu for groups Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access when group_sched_in() fails and needs to roll back. This *should…
-
High 7.8
futex: Require sys_futex_requeue() to have identical flags
In the Linux kernel, the following vulnerability has been resolved: futex: Require sys_futex_requeue() to have identical flags Nicholas reported that his LLM found it was possible to create a UaF when sys_futex_requeue() is used with different flags. The init…
-
High 7.8
openvswitch: defer tunnel netdev_put to RCU release
In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race …
-
High 7.8
xfs: don't irele after failing to iget in xfs_attri_recover_work
In the Linux kernel, the following vulnerability has been resolved: xfs: don't irele after failing to iget in xfs_attri_recover_work xlog_recovery_iget* never set @ip to a valid pointer if they return an error, so this irele will walk off a dangling pointer. …
-
High 7.5
tls: Purge async_hold in tls_decrypt_async_wait()
In the Linux kernel, the following vulnerability has been resolved: tls: Purge async_hold in tls_decrypt_async_wait() The async_hold queue pins encrypted input skbs while the AEAD engine references their scatterlist data. Once tls_decrypt_async_wait() returns…
-
High 7.5
erofs: add GFP_NOIO in the bio completion if needed
In the Linux kernel, the following vulnerability has been resolved: erofs: add GFP_NOIO in the bio completion if needed The bio completion path in the process context (e.g. dm-verity) will directly call into decompression rather than trigger another workqueue…
-
High 7.1
virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length Validate host controlled value `quote_buf->out_len` that determines how many bytes of the quote are copied out to guest …
-
High 7.1
netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS. rt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[]. Va…
-
High 7.1
openvswitch: validate MPLS set/set_masked payload length
In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/set_masked payload length validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for SET/SET_MASKED actions. In action handling, OVS expects fixed-…
-
High 7.0
ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() When ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware platforms, it has already started the EC and installed the…
-
Unscored —
arm64/fpsimd: signal: Fix restoration of SVE context
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Fix restoration of SVE context When SME is supported, Restoring SVE signal context can go wrong in a few ways, including placing the task into an invalid state where the…
-
Unscored —
spi: tegra210-quad: Protect curr_xfer check in IRQ handler
In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect curr_xfer check in IRQ handler Now that all other accesses to curr_xfer are done under the lock, protect the curr_xfer NULL check in tegra_qspi_isr_thread() with t…
-
Unscored —
net: add proper RCU protection to /proc/net/ptype
In the Linux kernel, the following vulnerability has been resolved: net: add proper RCU protection to /proc/net/ptype Yin Fengwei reported an RCU stall in ptype_seq_show() and provided a patch. Real issue is that ptype_seq_next() and ptype_seq_show() violate …
-
Unscored —
bpf: Fix constant blinding for PROBE_MEM32 stores
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix constant blinding for PROBE_MEM32 stores BPF_ST | BPF_PROBE_MEM32 immediate stores are not handled by bpf_jit_blind_insn(), allowing user-controlled 32-bit immediates to survive unbl…
-
Unscored —
netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp process_sdp() declares union nf_inet_addr rtp_addr on the stack and passes it to the nf_nat_sip sdp_session hook …
-
Unscored —
netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD __build_packet_message() manually constructs the NFULA_PAYLOAD netlink attribute using skb_put() and skb_copy_bits(),…
-
Unscored —
btrfs: fix leak of kobject name for sub-group space_info
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix leak of kobject name for sub-group space_info When create_space_info_sub_group() allocates elements of space_info->sub_group[], kobject_init_and_add() is called for each element vi…
-
Unscored —
netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators When a process crashes and the kernel writes a core dump to a 9P filesystem, __kernel_write() creates an ITER_KVEC iterator…
-
Unscored —
ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
In the Linux kernel, the following vulnerability has been resolved: ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio Replace BUG_ON() with proper error handling when inline data size exceeds PAGE_SIZE. This prevents kernel panic and a…
-
Unscored —
ext4: convert inline data to extents when truncate exceeds inline size
In the Linux kernel, the following vulnerability has been resolved: ext4: convert inline data to extents when truncate exceeds inline size Add a check in ext4_setattr() to convert files from inline data storage to extent-based storage when truncate() grows th…
-
Unscored —
xfs: stop reclaim before pushing AIL during unmount
In the Linux kernel, the following vulnerability has been resolved: xfs: stop reclaim before pushing AIL during unmount The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken in…
-
Unscored —
mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] Multiple sysfs command paths dereference contexts_arr[0] without first verifying that kdamond->contexts->nr == 1. A user ca…
-
Unscored —
tracing: Fix potential deadlock in cpu hotplug with osnoise
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential deadlock in cpu hotplug with osnoise The following sequence may leads deadlock in cpu hotplug: task1 task2 task3 ----- ----- ----- mutex_lock(&interface_lock) [CPU GOIN…
-
Unscored —
spi: use generic driver_override infrastructure
In the Linux kernel, the following vulnerability has been resolved: spi: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_…
-
Unscored —
RDMA/irdma: Initialize free_qp completion before using it
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Initialize free_qp completion before using it In irdma_create_qp, if ib_copy_to_udata fails, it will call irdma_destroy_qp to clean up which will attempt to wait on the free_qp co…
-
Unscored —
netfilter: ctnetlink: use netlink policy range checks
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use netlink policy range checks Replace manual range and mask validations with netlink policy annotations in ctnetlink code paths, so that the netlink core rejects inval…
-
Unscored —
netfilter: nf_conntrack_expect: skip expectations in other netns via proc
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: skip expectations in other netns via proc Skip expectations that do not reside in this netns. Similar to e77e6ff502ea ("netfilter: conntrack: do not dump other…
-
Unscored —
udp: Fix wildcard bind conflict check when using hash2
In the Linux kernel, the following vulnerability has been resolved: udp: Fix wildcard bind conflict check when using hash2 When binding a udp_sock to a local address and port, UDP uses two hashes (udptable->hash and udptable->hash2) for collision detection. T…
-
Unscored —
erofs: set fileio bio failed in short read case
In the Linux kernel, the following vulnerability has been resolved: erofs: set fileio bio failed in short read case For file-backed mount, IO requests are handled by vfs_iocb_iter_read(). However, it can be interrupted by SIGKILL, returning the number of byte…
-
Unscored —
af_key: validate families in pfkey_send_migrate()
In the Linux kernel, the following vulnerability has been resolved: af_key: validate families in pfkey_send_migrate() syzbot was able to trigger a crash in skb_put() [1] Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecreq…
-
Unscored —
esp: fix skb leak with espintcp and async crypto
In the Linux kernel, the following vulnerability has been resolved: esp: fix skb leak with espintcp and async crypto When the TX queue for espintcp is full, esp_output_tail_tcp will return an error and not free the skb, because with synchronous crypto, the co…
-
Unscored —
btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
In the Linux kernel, the following vulnerability has been resolved: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create We have recently observed a number of subvolumes with broken dentries. ls-ing the parent dir looks like: drwxrwxrwt 1 root root 16 Ja…
-
Unscored —
module: Fix kernel panic when a symbol st_shndx is out of bounds
In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol st_shndx is out of bounds The module loader doesn't check for bounds of the ELF section index in simplify_symbols(): for (i = 1; i < symsec->sh_size / s…
-
Unscored —
nvme-pci: ensure we're polling a polled queue
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: ensure we're polling a polled queue A user can change the polled queue count at run time. There's a brief window during a reset where a hipri task may try to poll that queue before …
-
Unscored —
HID: asus: avoid memory leak in asus_report_fixup()
In the Linux kernel, the following vulnerability has been resolved: HID: asus: avoid memory leak in asus_report_fixup() The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc()…
-
Unscored —
driver core: platform: use generic driver_override infrastructure
In the Linux kernel, the following vulnerability has been resolved: driver core: platform: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus acc…
-
Unscored —
futex: Clear stale exiting pointer in futex_lock_pi() retry path
In the Linux kernel, the following vulnerability has been resolved: futex: Clear stale exiting pointer in futex_lock_pi() retry path Fuzzying/stressing futexes triggered: WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock…
-
Unscored —
x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask
In the Linux kernel, the following vulnerability has been resolved: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask Commit in Fixes added the FRED CR4 bit to the CR4 pinned bits mask so that whenever something else modifies CR4, that bit remains se…
-
Unscored —
ext4: always drain queued discard work in ext4_mb_release()
In the Linux kernel, the following vulnerability has been resolved: ext4: always drain queued discard work in ext4_mb_release() While reviewing recent ext4 patch[1], Sashiko raised the following concern[2]: > If the filesystem is initially mounted with the di…
-
Unscored —
ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths During code review, Joseph found that ext4_fc_replay_inode() calls ext4_get_fc_inode_loc() to get the inode location, which holds …
-
Unscored —
ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() There's issue as follows: ... EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68736.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23102.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23207.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23255.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23401.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23414.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23417.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31406.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31413.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31426.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31427.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31428.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31434.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31438.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31446.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31447.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31448.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31449.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31451.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31452.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31453.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31454.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31455.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31458.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31467.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31469.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31470.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31473.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31480.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31487.html