Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-45920: In the Linux kernel, the following vulnerability has been resolved: ext4: fix dirtyclusters double decrement on fs shutdown CVE-2026-45899: In the Linux kernel, the following vulnerability has been resolved: ext4: drop extent cache when splitting extent fails CVE-2026-45892: In the Linux kernel, the following vulnerability has been resolved: ext4: drop extent cache after doing PARTIAL_VALID1 zeroout CVE-2026-45858: In the Linux kernel, the following vulnerability has been resolved: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 CVE-2026-43483: In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated CVE-2026-43475: In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT CVE-2026-43472: In the Linux kernel, the following vulnerability has been resolved: unshare: fix unshare_fs() handling CVE-2026-43468: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix deadlock between devlink lock and esw->wq CVE-2026-43466: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery CVE-2026-43453: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() CVE-2026-43452: In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: guard option walkers against 1-byte tail reads CVE-2026-43451: In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path CVE-2026-43450: In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() CVE-2026-43449: In the Linux kernel, the following vulnerability has been resolved: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set CVE-2026-43448: In the Linux kernel, the following vulnerability has been resolved: nvme-pci: Fix race bug in nvme_poll_irqdisable() CVE-2026-43445: In the Linux kernel, the following vulnerability has been resolved: e1000/e1000e: Fix leak in DMA error cleanup CVE-2026-43441: In the Linux kernel, the following vulnerability has been resolved: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled CVE-2026-43439: In the Linux kernel, the following vulnerability has been resolved: cgroup: fix race between task migration and iteration CVE-2026-43432: In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix memory leak in xhci_disable_slot() CVE-2026-43428: In the Linux kernel, the following vulnerability has been resolved: USB: core: Limit the length of unkillable synchronous timeouts CVE-2026-43427: In the Linux kernel, the following vulnerability has been resolved: usb: class: cdc-wdm: fix reordering issue in read code path CVE-2026-43420: In the Linux kernel, the following vulnerability has been resolved: ceph: fix i_nlink underrun during async unlink CVE-2026-43411: In the Linux kernel, the following vulnerability has been resolved: tipc: fix divide-by-zero in tipc_sk_filter_connect() CVE-2026-43407: In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() CVE-2026-43406: In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in process_message_header() CVE-2026-43405: In the Linux kernel, the following vulnerability has been resolved: libceph: Use u32 for non-negative values in ceph_monmap_decode() CVE-2026-43383: In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time CVE-2026-43366: In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: check if target buffer list is still legacy on recycle CVE-2026-43365: In the Linux kernel, the following vulnerability has been resolved: xfs: fix undersized l_iclog_roundoff values CVE-2026-43363: In the Linux kernel, the following vulnerability has been resolved: x86/apic: Disable x2apic on resume if the kernel expects so CVE-2026-43361: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort when snapshotting received subvolumes CVE-2026-43360: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on file creation due to name hash collision CVE-2026-43359: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on set received ioctl due to item overflow CVE-2026-43341: In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill CVE-2026-43339: In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_addr() CVE-2026-43333: In the Linux kernel, the following vulnerability has been resolved: bpf: reject direct access to nullable PTR_TO_BUF pointers CVE-2026-43329: In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions CVE-2026-43328: In the Linux kernel, the following vulnerability has been resolved: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path CVE-2026-43281: In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() CVE-2026-43265: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() CVE-2026-43252: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | bpftool-debuginfo | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-aarch64 | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-debuginfo-common-x86_64 | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-devel | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-headers | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-debuginfo | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-devel | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-libbpf-static | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.1.168-202.320 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-modules-extra-common | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-tools | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-debuginfo | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | kernel-tools-devel | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | perf | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | perf-debuginfo | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | python3-perf | 1:6.1.168-202.320.amzn2023 |
| Amazon Linux · 2023 | python3-perf-debuginfo | 1:6.1.168-202.320.amzn2023 |
Vulnerabilities 174
-
Critical 9.8CVE-2026-31402 Public exploit
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size…
-
Critical 9.8
netfilter: nf_conntrack_expect: use expect->helper
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is …
-
Critical 9.8
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struc…
-
Critical 9.8
ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an I…
-
Critical 9.8
net/ipv6: ioam6: prevent schema length wraparound in trace fill
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill ioam6_fill_trace_data() stores the schema contribution to the trace length in a u8. With bit 22 enabled and the largest schema …
-
Critical 9.4
ext4: avoid infinite loops caused by residual data
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this examp…
-
Critical 9.4
net/tcp-md5: Fix MAC comparison to be constant-time
In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
-
Critical 9.1
netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…
-
Critical 9.1
bridge: br_nd_send: linearize skb before parsing ND options
In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these options are in the linear part of request. It…
-
Critical 9.1
libceph: prevent potential out-of-bounds reads in process_message_header()
In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in process_message_header() If the message frame is (maliciously) corrupted in a way that the length of the control segment ends up being less t…
-
Critical 9.1
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() This patch fixes an out-of-bounds access in ceph_handle_auth_reply() that can be triggered by a message of type CEPH_MS…
-
High 8.8
ext4: publish jinode after initialization
In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after initialization ext4_inode_attach_jinode() publishes ei->jinode to concurrent users. It used to set ei->jinode before jbd2_journal_init_jbd_inode(), allowing a reade…
-
High 8.8
can: gw: fix OOB heap access in cgw_csum_crc8_rel()
In the Linux kernel, the following vulnerability has been resolved: can: gw: fix OOB heap access in cgw_csum_crc8_rel() cgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx(): int from = calc_idx(crc8->from_idx, cf->len); int to = calc_idx(…
-
High 8.6
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() sip_help_tcp() parses the SIP Content-Length header with simple_strtoul(), which returns unsigned long, but st…
-
High 8.2
netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case In decode_int(), the CONS case calls get_bits(bs, 2) to read a length value, then calls get_uint(bs, len) without checking…
-
High 8.2
xen/privcmd: restrict usage in unprivileged domU
In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: restrict usage in unprivileged domU The Xen privcmd driver allows to issue arbitrary hypercalls from user space processes. This is normally no problem, as access is usually limit…
-
High 8.2
xfs: fix undersized l_iclog_roundoff values
In the Linux kernel, the following vulnerability has been resolved: xfs: fix undersized l_iclog_roundoff values If the superblock doesn't list a log stripe unit, we set the incore log roundoff value to 512. This leads to corrupt logs and unmountable filesyste…
-
High 8.2
netfilter: x_tables: guard option walkers against 1-byte tail reads
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: guard option walkers against 1-byte tail reads When the last byte of options is a non-single-byte option kind, walkers that advance with i += op[i + 1] ? : 1 can read op[…
-
High 8.2
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery In case of a TX error CQE, a recovery flow is triggered, mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc, desynci…
-
High 8.1
ipv6: use RCU in ip6_xmit()
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.
-
High 8.1
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). …
-
High 8.1
smb: client: fix krb5 mount with username option
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix krb5 mount with username option Customer reported that some of their krb5 mounts were failing against a single server as the client was trying to mount the shares with wrong …
-
High 7.8
net: clear the dst when changing skb protocol
In the Linux kernel, the following vulnerability has been resolved: net: clear the dst when changing skb protocol A not-so-careful NAT46 BPF program can crash the kernel if it indiscriminately flips ingress packets from v4 to v6: BUG: kernel NULL pointer dere…
-
High 7.8
nvme: fix admin request_queue lifetime
In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin request_queue lifetime The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensu…
-
High 7.8
net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks
In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the curren…
-
High 7.8
perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
In the Linux kernel, the following vulnerability has been resolved: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race Make sure that __perf_event_overflow() runs with IRQs disabled for all possible callchains. Specifically the software even…
-
High 7.8
netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels IDLETIMER revision 0 rules reuse existing timers by label and always call mod_timer() on timer->timer. If the label was create…
-
High 7.8
drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another loo…
-
High 7.8
net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
In the Linux kernel, the following vulnerability has been resolved: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs When shrinking the number of real tx queues, netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flus…
-
High 7.8
netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Yiming Qian reports Use-after-free in the pipapo set type: Under a large number of expired elements, commit-time GC can run f…
-
High 7.8
netfilter: xt_CT: drop pending enqueued packets on template removal
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_CT: drop pending enqueued packets on template removal Templates refer to objects that can go away while packets are sitting in nfqueue refer to: - helper, this can be an issue o…
-
High 7.8
netfilter: nf_tables: release flowtable after rcu grace period on error
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtabl…
-
High 7.8
net/sched: teql: Fix double-free in teql_master_xmit
In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free in teql_master_xmit Whenever a TEQL devices has a lockless Qdisc as root, qdisc_reset should be called using the seq_lock to avoid racing with the datapath. F…
-
High 7.8
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the netlink dump callback ctnetlink_exp_ct_dump_table(),…
-
High 7.8
NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd The /proc/fs/nfs/exports proc entry is created at module init and persists for the module's lifetime. exports_proc_open() …
-
High 7.8
ext4: fix use-after-free in update_super_work when racing with umount
In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in update_super_work when racing with umount Commit b98535d09179 ("ext4: fix bug_on in start_this_handle during umount filesystem") moved ext4_unregister_sysfs() befo…
-
High 7.8
ext4: reject mount if bigalloc with s_first_data_block != 0
In the Linux kernel, the following vulnerability has been resolved: ext4: reject mount if bigalloc with s_first_data_block != 0 bigalloc with s_first_data_block != 0 is not supported, reject mounting it.
-
High 7.8
xfs: avoid dereferencing log items after push callbacks
In the Linux kernel, the following vulnerability has been resolved: xfs: avoid dereferencing log items after push callbacks After xfsaild_push_item() calls iop_push(), the log item may have been freed if the AIL lock was dropped during the push. Background in…
-
High 7.8
xfs: save ailp before dropping the AIL lock in push callbacks
In the Linux kernel, the following vulnerability has been resolved: xfs: save ailp before dropping the AIL lock in push callbacks In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is dropped to perform buffer IO. Once the cluster buffer n…
-
High 7.8
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false A UAF issue occurs when the virtio_net driver is configured with napi_tx=N and the device's IFF_XMIT_D…
-
High 7.8
media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
In the Linux kernel, the following vulnerability has been resolved: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object clea…
-
High 7.8
net: fix fanout UAF in packet_release() via NETDEV_UP race
In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registra…
-
High 7.8
net: openvswitch: Avoid releasing netdev before teardown completes
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. A…
-
High 7.8
openvswitch: defer tunnel netdev_put to RCU release
In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race …
-
High 7.8
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: flowlabel: defer exclusive option free until RCU teardown `ip6fl_seq_show()` walks the global flowlabel hash under the seq-file RCU read-side lock and prints `fl->opt->opt_nflen` w…
-
High 7.8
wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free Currently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for the virt_wifi net devices. However, unregistering a virt_wi…
-
High 7.8
bpf: Fix regsafe() for pointers to packet
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix regsafe() for pointers to packet In case rold->reg->range == BEYOND_PKT_END && rcur->reg->range == N regsafe() may return true which may lead to current state with valid packet range…
-
High 7.8
HID: multitouch: Check to ensure report responses match the request
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Check to ensure report responses match the request It is possible for a malicious (or clumsy) device to respond to a specific report's feature request using a completely diff…
-
High 7.8
netfilter: nft_ct: drop pending enqueued packets on removal
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: drop pending enqueued packets on removal Packets sitting in nfqueue might hold a reference to: - templates that specify the conntrack zone, because a percpu area is used an…
-
High 7.8
netfilter: flowtable: strictly check for maximum number of actions
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethe…
-
High 7.8
ipv6: prevent possible UaF in addrconf_permanent_addr()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_addr() The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 aft…
-
High 7.8
io_uring/kbuf: check if target buffer list is still legacy on recycle
In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: check if target buffer list is still legacy on recycle There's a gap between when the buffer was grabbed and when it potentially gets recycled, where if the list is empty, some…
-
High 7.5
netfilter: nft_ct: add seqadj extension for natted connections
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: add seqadj extension for natted connections Sequence adjustment may be required for FTP traffic with PASV/EPSV modes. due to need to re-write packet payload (IP, port) on t…
-
High 7.5
dm-verity: disable recursive forward error correction
In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two problems with the recursive correction: 1. It may cause denial-of-service. In fec_read_bufs, there is a loop that has 253 i…
-
High 7.5
btrfs: do not free data reservation in fallback from inline due to -ENOSPC
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not free data reservation in fallback from inline due to -ENOSPC If we fail to create an inline extent due to -ENOSPC, we will attempt to go through the normal COW path, reserve an …
-
High 7.5
tls: Purge async_hold in tls_decrypt_async_wait()
In the Linux kernel, the following vulnerability has been resolved: tls: Purge async_hold in tls_decrypt_async_wait() The async_hold queue pins encrypted input skbs while the AEAD engine references their scatterlist data. Once tls_decrypt_async_wait() returns…
-
High 7.5
erofs: add GFP_NOIO in the bio completion if needed
In the Linux kernel, the following vulnerability has been resolved: erofs: add GFP_NOIO in the bio completion if needed The bio completion path in the process context (e.g. dm-verity) will directly call into decompression rather than trigger another workqueue…
-
High 7.5
net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
In the Linux kernel, the following vulnerability has been resolved: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback NETIF_F_IPV6_CSUM only advertises support for checksum offload of packets without IPv6 extension headers. Packets with extensi…
-
High 7.5
libceph: Use u32 for non-negative values in ceph_monmap_decode()
In the Linux kernel, the following vulnerability has been resolved: libceph: Use u32 for non-negative values in ceph_monmap_decode() This patch fixes unnecessary implicit conversions that change signedness of blob_len and num_mon in ceph_monmap_decode(). Curr…
-
High 7.5
net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled
In the Linux kernel, the following vulnerability has been resolved: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init(…
-
High 7.3
netfilter: ctnetlink: ignore explicit helper on new expectations
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helper on new expectations Use the existing master conntrack helper, anything else is not really supported and it just makes validation more complicated,…
-
High 7.1
net/sched: cls_u32: use skb_header_pointer_careful()
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a rep…
-
High 7.1
netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS. rt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[]. Va…
-
High 7.1
openvswitch: validate MPLS set/set_masked payload length
In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/set_masked payload length validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for SET/SET_MASKED actions. In action handling, OVS expects fixed-…
-
High 7.1
netfilter: x_tables: ensure names are nul-terminated
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: ensure names are nul-terminated Reject names that lack a \0 character before feeding them to functions that expect c-strings. Fixes tag is the most recent commit that nee…
-
High 7.0
ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() When ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware platforms, it has already started the EC and installed the…
-
Unscored —
rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access
In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access In the preparation stage of CPU online, if the corresponding the rdp's->nocb_cb_kthread does not exist, will be created, t…
-
Unscored —
bpf: Forget ranges when refining tnum after JSET
In the Linux kernel, the following vulnerability has been resolved: bpf: Forget ranges when refining tnum after JSET Syzbot reported a kernel warning due to a range invariant violation on the following BPF program. 0: call bpf_get_netns_cookie 1: if r0 == 0 g…
-
Unscored —
netfilter: ctnetlink: remove refcounting in expectation dumpers
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: remove refcounting in expectation dumpers Same pattern as previous patch: do not keep the expectation object alive via refcount, only store a cookie value and then use t…
-
Unscored —
binfmt_misc: restore write access before closing files opened by open_exec()
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: restore write access before closing files opened by open_exec() bm_register_write() opens an executable file using open_exec(), which internally calls do_open_execat() and denies…
-
Unscored —
ntfs: set dummy blocksize to read boot_block when mounting
In the Linux kernel, the following vulnerability has been resolved: ntfs: set dummy blocksize to read boot_block when mounting When mounting, sb->s_blocksize is used to read the boot_block without being defined or validated. Set a dummy blocksize before attem…
-
Unscored —
mm/hugetlb: fix hugetlb_pmd_shared()
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb_pmd_shared() Patch series "mm/hugetlb: fixes for PMD table sharing (incl. using mmu_gather)", v3. One functional fix, one performance regression fix, and two related c…
-
Unscored —
io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop Currently this is checked before running the pending work. Normally this is quite fine, as work items either end up blocking (which w…
-
Unscored —
btrfs: send: check for inline extents in range_is_hole_in_parent()
In the Linux kernel, the following vulnerability has been resolved: btrfs: send: check for inline extents in range_is_hole_in_parent() Before accessing the disk_bytenr field of a file extent item we need to check if we are dealing with an inline extent. This …
-
Unscored —
net: fix segmentation of forwarding fraglist GRO
In the Linux kernel, the following vulnerability has been resolved: net: fix segmentation of forwarding fraglist GRO This patch enhances GSO segment handling by properly checking the SKB_GSO_DODGY flag for frag_list GSO packets, addressing low throughput issu…
-
Unscored —
btrfs: do not strictly require dirty metadata threshold for metadata writepages
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not strictly require dirty metadata threshold for metadata writepages [BUG] There is an internal report that over 1000 processes are waiting at the io_schedule_timeout() of balance_…
-
Unscored —
net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit teql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit through slave devices, but does not update…
-
Unscored —
scsi: target: Fix recursive locking in __configfs_open_file()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix recursive locking in __configfs_open_file() In flush_write_buffer, &p->frag_sem is acquired and then the loaded store function is called, which, here, is target_core_item_db…
-
Unscored —
net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
In the Linux kernel, the following vulnerability has been resolved: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() …
-
Unscored —
scsi: core: Fix refcount leak for tagset_refcnt
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix refcount leak for tagset_refcnt This leak will cause a hang when tearing down the SCSI host. For example, iscsid hangs with the following call trace: [130120.652718] scsi_allo…
-
Unscored —
net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop When a standalone IPv6 nexthop object is created with a loopback device (e.g., "ip -6 nexthop add id 100 dev lo"), fib6_n…
-
Unscored —
smb: client: Don't log plaintext credentials in cifs_set_cifscreds
In the Linux kernel, the following vulnerability has been resolved: smb: client: Don't log plaintext credentials in cifs_set_cifscreds When debug logging is enabled, cifs_set_cifscreds() logs the key payload and exposes the plaintext username and password. Re…
-
Unscored —
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() l3mdev_master_dev_rcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost…
-
Unscored —
bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim The root cause of this bug is that when 'bpf_link_put' reduces the refcount of 'shim_link->link.link' to zero, the resource is consider…
-
Unscored —
mptcp: pm: in-kernel: always mark signal+subflow endp as used
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always mark signal+subflow endp as used Syzkaller managed to find a combination of actions that was generating this warning: msk->pm.local_addr_used == 0 WARNING: net/mp…
-
Unscored —
xdp: produce a warning when calculated tailroom is negative
In the Linux kernel, the following vulnerability has been resolved: xdp: produce a warning when calculated tailroom is negative Many ethernet drivers report xdp Rx queue frag size as being the same as DMA write size. However, the only user of this field, name…
-
Unscored —
x86/efi: defer freeing of boot services memory
In the Linux kernel, the following vulnerability has been resolved: x86/efi: defer freeing of boot services memory efi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE and EFI_BOOT_SERVICES_DATA using memblock_free_late(). There are two is…
-
Unscored —
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
In the Linux kernel, the following vulnerability has been resolved: drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Even though we check that we "should" be able to do lc_get_cumulative() while holding the device->al_lock spinlock, it may still fail, if …
-
Unscored —
bpf: Fix stack-out-of-bounds write in devmap
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack-out-of-bounds write in devmap get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds. Also the callers assume that…
-
Unscored —
can: bcm: fix locking for bcm_op runtime updates
In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix locking for bcm_op runtime updates Commit c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates") added a locking for some variables that can be modified at runtime wh…
-
Unscored —
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled: [ 1362.049207] [<8054e4b8>] …
-
Unscored —
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init()…
-
Unscored —
Squashfs: check metadata block offset is within range
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check metadata block offset is within range Syzkaller reports a "general protection fault in squashfs_copy_data" This is ultimately caused by a corrupted index look-up table, which …
-
Unscored —
nfnetlink_osf: validate individual option lengths in fingerprints
In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints nfnl_osf_add_callback() validates opt_num bounds and string NUL-termination but does not check individual option length field…
-
Unscored —CVE-2026-23398 Public exploit
icmp: fix NULL pointer dereference in icmp_tag_validation()
In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The…
-
Unscored —
udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
In the Linux kernel, the following vulnerability has been resolved: udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n When CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0 (success) without actually creating a socket. …
-
Unscored —
ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix previous acpi_processor_errata_piix4() fix After commi f132e089fe89 ("ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()"), device pointers ma…
-
Unscored —
PM: runtime: Fix a race condition related to device removal
In the Linux kernel, the following vulnerability has been resolved: PM: runtime: Fix a race condition related to device removal The following code in pm_runtime_work() may dereference the dev->parent pointer after the parent device has been freed: /* Maybe th…
-
Unscored —
nvdimm/bus: Fix potential use after free in asynchronous initialization
In the Linux kernel, the following vulnerability has been resolved: nvdimm/bus: Fix potential use after free in asynchronous initialization Dingisoul with KASAN reports a use after free if device_add() fails in nd_async_device_register(). Commit b6eae0f61db2 …
-
Unscored —
sunrpc: fix cache_request leak in cache_release
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix cache_request leak in cache_release When a reader's file descriptor is closed while in the middle of reading a cache_request (rp->offset != 0), cache_release() decrements the requ…
-
Unscored —
ipv6: avoid overflows in ip6_datagram_send_ctl()
In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian reported : <quote> I believe I found a locally triggerable kernel bug in the IPv6 sendmsg ancillary-data path that can panic the k…
-
Unscored —
netfilter: nfnetlink_log: account for netlink header size
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: account for netlink header size This is a followup to an old bug fix: NLMSG_DONE needs to account for the netlink header size, not just the attribute size. This can …
-
Unscored —
netfilter: ipset: drop logically empty buckets in mtype_del
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: drop logically empty buckets in mtype_del mtype_del() counts empty slots below n->pos in k, but it only drops the bucket when both n->pos and k are zero. This misses buckets…
-
Unscored —
net/sched: cls_fw: fix NULL pointer dereference on shared blocks
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_fw: fix NULL pointer dereference on shared blocks The old-method path in fw_classify() calls tcf_block_q() and dereferences q->handle. Shared blocks leave block->q NULL, causin…
-
Unscored —
net/sched: cls_flow: fix NULL pointer dereference on shared blocks
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flow: fix NULL pointer dereference on shared blocks flow_change() calls tcf_block_q() and dereferences q->handle to derive a default baseclass. Shared blocks leave block->q NUL…
-
Unscored —
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() m2sm() converts a u32 slope to a u64 scaled value. For large inputs (e.g. m1=4000000000), the result can reach 2^32. rtsc_min() stores th…
-
Unscored —
netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP Weiming Shi says: xt_match and xt_target structs registered with NFPROTO_UNSPEC can be loaded by any pr…
-
Unscored —
netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp process_sdp() declares union nf_inet_addr rtp_addr on the stack and passes it to the nf_nat_sip sdp_session hook …
-
Unscored —
netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD __build_packet_message() manually constructs the NFULA_PAYLOAD netlink attribute using skb_put() and skb_copy_bits(),…
-
Unscored —
btrfs: fix leak of kobject name for sub-group space_info
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix leak of kobject name for sub-group space_info When create_space_info_sub_group() allocates elements of space_info->sub_group[], kobject_init_and_add() is called for each element vi…
-
Unscored —
ext4: convert inline data to extents when truncate exceeds inline size
In the Linux kernel, the following vulnerability has been resolved: ext4: convert inline data to extents when truncate exceeds inline size Add a check in ext4_setattr() to convert files from inline data storage to extent-based storage when truncate() grows th…
-
Unscored —
xfs: stop reclaim before pushing AIL during unmount
In the Linux kernel, the following vulnerability has been resolved: xfs: stop reclaim before pushing AIL during unmount The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken in…
-
Unscored —
mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] Multiple sysfs command paths dereference contexts_arr[0] without first verifying that kdamond->contexts->nr == 1. A user ca…
-
Unscored —
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP …
-
Unscored —
tracing: Fix potential deadlock in cpu hotplug with osnoise
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential deadlock in cpu hotplug with osnoise The following sequence may leads deadlock in cpu hotplug: task1 task2 task3 ----- ----- ----- mutex_lock(&interface_lock) [CPU GOIN…
-
Unscored —
RDMA/irdma: Initialize free_qp completion before using it
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Initialize free_qp completion before using it In irdma_create_qp, if ib_copy_to_udata fails, it will call irdma_destroy_qp to clean up which will attempt to wait on the free_qp co…
-
Unscored —
netfilter: ctnetlink: use netlink policy range checks
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use netlink policy range checks Replace manual range and mask validations with netlink policy annotations in ctnetlink code paths, so that the netlink core rejects inval…
-
Unscored —
netfilter: nf_conntrack_expect: skip expectations in other netns via proc
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: skip expectations in other netns via proc Skip expectations that do not reside in this netns. Similar to e77e6ff502ea ("netfilter: conntrack: do not dump other…
-
Unscored —
udp: Fix wildcard bind conflict check when using hash2
In the Linux kernel, the following vulnerability has been resolved: udp: Fix wildcard bind conflict check when using hash2 When binding a udp_sock to a local address and port, UDP uses two hashes (udptable->hash and udptable->hash2) for collision detection. T…
-
Unscored —
af_key: validate families in pfkey_send_migrate()
In the Linux kernel, the following vulnerability has been resolved: af_key: validate families in pfkey_send_migrate() syzbot was able to trigger a crash in skb_put() [1] Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecreq…
-
Unscored —
esp: fix skb leak with espintcp and async crypto
In the Linux kernel, the following vulnerability has been resolved: esp: fix skb leak with espintcp and async crypto When the TX queue for espintcp is full, esp_output_tail_tcp will return an error and not free the skb, because with synchronous crypto, the co…
-
Unscored —
btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
In the Linux kernel, the following vulnerability has been resolved: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create We have recently observed a number of subvolumes with broken dentries. ls-ing the parent dir looks like: drwxrwxrwt 1 root root 16 Ja…
-
Unscored —
module: Fix kernel panic when a symbol st_shndx is out of bounds
In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol st_shndx is out of bounds The module loader doesn't check for bounds of the ELF section index in simplify_symbols(): for (i = 1; i < symsec->sh_size / s…
-
Unscored —
nvme-pci: ensure we're polling a polled queue
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: ensure we're polling a polled queue A user can change the polled queue count at run time. There's a brief window during a reset where a hipri task may try to poll that queue before …
-
Unscored —
HID: asus: avoid memory leak in asus_report_fixup()
In the Linux kernel, the following vulnerability has been resolved: HID: asus: avoid memory leak in asus_report_fixup() The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc()…
-
Unscored —
drm/i915/gt: Check set_default_submission() before deferencing
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Check set_default_submission() before deferencing When the i915 driver firmware binaries are not present, the set_default_submission pointer is not set. This pointer is dereferen…
-
Unscored —
net: bonding: fix NULL deref in bond_debug_rlb_hash_show
In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix NULL deref in bond_debug_rlb_hash_show rlb_clear_slave intentionally keeps RLB hash-table entries on the rx_hashtbl_used_head list with slave set to NULL when no replacement…
-
Unscored —
futex: Clear stale exiting pointer in futex_lock_pi() retry path
In the Linux kernel, the following vulnerability has been resolved: futex: Clear stale exiting pointer in futex_lock_pi() retry path Fuzzying/stressing futexes triggered: WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock…
-
Unscored —
vxlan: validate ND option lengths in vxlan_na_create
In the Linux kernel, the following vulnerability has been resolved: vxlan: validate ND option lengths in vxlan_na_create vxlan_na_create() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the compute…
-
Unscored —
bridge: br_nd_send: validate ND option lengths
In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: validate ND option lengths br_nd_send() walks ND options according to option-provided lengths. A malformed option can make the parser advance beyond the computed option sp…
-
Unscored —
usb: ulpi: fix double free in ulpi_register_interface() error path
In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix double free in ulpi_register_interface() error path When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release(…
-
Unscored —
drm/ioc32: stop speculation on the drm_compat_ioctl path
In the Linux kernel, the following vulnerability has been resolved: drm/ioc32: stop speculation on the drm_compat_ioctl path The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature m…
-
Unscored —
net/mlx5: lag: Check for LAG device before creating debugfs
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: lag: Check for LAG device before creating debugfs __mlx5_lag_dev_add_mdev() may return 0 (success) even when an error occurs that is handled gracefully. Consequently, the initializa…
-
Unscored —
netfilter: nf_tables: reject immediate NF_QUEUE verdict
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject immediate NF_QUEUE verdict nft_queue is always used from userspace nftables to deliver the NF_QUEUE verdict. Immediately emitting an NF_QUEUE verdict is never use…
-
Unscored —
netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent ctnetlink_alloc_expect() allocates expectations from a non-zeroing slab cache via nf_ct_expect_alloc(). When CTA_EXPECT…
-
Unscored —
netfilter: nf_conntrack_helper: pass helper to expect cleanup
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregi…
-
Unscored —
net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
In the Linux kernel, the following vulnerability has been resolved: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak When building netlink messages, tc_chain_fill_node() never initializes the tcm_info field of…
-
Unscored —
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak When processing Router Advertisements with user options the kernel builds an RTM_NEW…
-
Unscored —
crypto: af-alg - fix NULL pointer dereference in scatterwalk
In the Linux kernel, the following vulnerability has been resolved: crypto: af-alg - fix NULL pointer dereference in scatterwalk The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL) when chaining a new af_alg_tsgl structure. If a sendms…
-
Unscored —
btrfs: reject root items with drop_progress and zero drop_level
In the Linux kernel, the following vulnerability has been resolved: btrfs: reject root items with drop_progress and zero drop_level [BUG] When recovering relocation at mount time, merge_reloc_root() and btrfs_drop_snapshot() both use BUG_ON(level == 0) to gua…
-
Unscored —
scsi: target: tcm_loop: Drain commands in target_reset handler
In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcm_loop: Drain commands in target_reset handler tcm_loop_target_reset() violates the SCSI EH contract: it returns SUCCESS without draining any in-flight commands. The SCSI EH d…
-
Unscored —
serial: 8250: Fix TX deadlock when using DMA
In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Fix TX deadlock when using DMA `dmaengine_terminate_async` does not guarantee that the `__dma_tx_complete` callback will run. The callback is currently the only place where `dma…
-
Unscored —
ext4: always drain queued discard work in ext4_mb_release()
In the Linux kernel, the following vulnerability has been resolved: ext4: always drain queued discard work in ext4_mb_release() While reviewing recent ext4 patch[1], Sashiko raised the following concern[2]: > If the filesystem is initially mounted with the di…
-
Unscored —
ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths During code review, Joseph found that ext4_fc_replay_inode() calls ext4_get_fc_inode_loc() to get the inode location, which holds …
-
Unscored —
ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() There's issue as follows: ... EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 …
-
Unscored —
mptcp: pm: in-kernel: always set ID as avail when rm endp
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always set ID as avail when rm endp Syzkaller managed to find a combination of actions that was generating this warning: WARNING: net/mptcp/pm_kernel.c:1074 at __mark_su…
-
Unscored —
KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() Ignore -EBUSY when checking nested events after exiting a blocking state while L2 is active, as exiting to userspace will…
-
Unscored —
mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree…
-
Unscored —
cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
In the Linux kernel, the following vulnerability has been resolved: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path When kobject_init_and_add() fails, cpufreq_dbs_governor_init() calls kobject_put(&dbs_data->attr_set.kobj). The ko…
-
Unscored —
bpf: reject direct access to nullable PTR_TO_BUF pointers
In the Linux kernel, the following vulnerability has been resolved: bpf: reject direct access to nullable PTR_TO_BUF pointers check_mem_access() matches PTR_TO_BUF via base_type() which strips PTR_MAYBE_NULL, allowing direct dereference without a null check. …
-
Unscored —
btrfs: fix transaction abort on set received ioctl due to item overflow
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on set received ioctl due to item overflow If the set received ioctl fails due to an item overflow when attempting to add the BTRFS_UUID_KEY_RECEIVED_SUBVOL we ha…
-
Unscored —
btrfs: fix transaction abort on file creation due to name hash collision
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on file creation due to name hash collision If we attempt to create several files with names that result in the same hash, we have to pack them in same dir item a…
-
Unscored —
btrfs: fix transaction abort when snapshotting received subvolumes
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort when snapshotting received subvolumes Currently a user can trigger a transaction abort by snapshotting a previously received snapshot a bunch of times until we re…
-
Unscored —
x86/apic: Disable x2apic on resume if the kernel expects so
In the Linux kernel, the following vulnerability has been resolved: x86/apic: Disable x2apic on resume if the kernel expects so When resuming from s2ram, firmware may re-enable x2apic mode, which may have been disabled by the kernel during boot either because…
-
Unscored —
tipc: fix divide-by-zero in tipc_sk_filter_connect()
In the Linux kernel, the following vulnerability has been resolved: tipc: fix divide-by-zero in tipc_sk_filter_connect() A user can set conn_timeout to any value via setsockopt(TIPC_CONN_TIMEOUT), including values less than 4. When a SYN is rejected with TIPC…
-
Unscored —
ceph: fix i_nlink underrun during async unlink
In the Linux kernel, the following vulnerability has been resolved: ceph: fix i_nlink underrun during async unlink During async unlink, we drop the `i_nlink` counter before we receive the completion (that will eventually update the `i_nlink`) because "we assu…
-
Unscored —
usb: class: cdc-wdm: fix reordering issue in read code path
In the Linux kernel, the following vulnerability has been resolved: usb: class: cdc-wdm: fix reordering issue in read code path Quoting the bug report: Due to compiler optimization or CPU out-of-order execution, the desc->length update can be reordered before…
-
Unscored —
USB: core: Limit the length of unkillable synchronous timeouts
In the Linux kernel, the following vulnerability has been resolved: USB: core: Limit the length of unkillable synchronous timeouts The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore allow unlimited timeout durations. And since they…
-
Unscored —
usb: xhci: Fix memory leak in xhci_disable_slot()
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix memory leak in xhci_disable_slot() xhci_alloc_command() allocates a command structure and, when the second argument is true, also allocates a completion structure. Currently, t…
-
Unscored —
cgroup: fix race between task migration and iteration
In the Linux kernel, the following vulnerability has been resolved: cgroup: fix race between task migration and iteration When a task is migrated out of a css_set, cgroup_migrate_add_task() first moves it from cset->tasks to cset->mg_tasks via: list_move_tail…
-
Unscored —
e1000/e1000e: Fix leak in DMA error cleanup
In the Linux kernel, the following vulnerability has been resolved: e1000/e1000e: Fix leak in DMA error cleanup If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Because count is incremented …
-
Unscored —
nvme-pci: Fix race bug in nvme_poll_irqdisable()
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: Fix race bug in nvme_poll_irqdisable() In the following scenario, pdev can be disabled between (1) and (3) by (2). This sets pdev->msix_enabled = 0. Then, pci_irq_vector() will retu…
-
Unscored —
nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set dev->online_queues is a count incremented in nvme_init_queue. Thus, valid indices are 0 through dev->online_queues − 1. This patch fixes the…
-
Unscored —
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helpe…
-
Unscored —
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path nfqnl_recv_verdict() calls find_dequeue_entry() to remove the queue entry from the queue data structures, taking owners…
-
Unscored —
netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() pipapo_drop() passes rulemap[i + 1].n to pipapo_unmap() as the to_offset argument on every iteration, including the la…
-
Unscored —
net/mlx5: Fix deadlock between devlink lock and esw->wq
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix deadlock between devlink lock and esw->wq esw->work_queue executes esw_functions_changed_event_handler -> esw_vfs_changed_event_handler and acquires the devlink lock. .eswitch_m…
-
Unscored —
unshare: fix unshare_fs() handling
In the Linux kernel, the following vulnerability has been resolved: unshare: fix unshare_fs() handling There's an unpleasant corner case in unshare(2), when we have a CLONE_NEWNS in flags and current->fs hadn't been shared at all; in that case copy_mnt_ns() g…
-
Unscored —
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT This resolves the follow splat and lock-up when running with PREEMPT_RT enabled on Hyper-V: [ 415.140818] BUG: scheduling while atomic…
-
Unscored —
KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated Explicitly set/clear CR8 write interception when AVIC is (de)activated to fix a bug where KVM leaves the interception ena…
-
Unscored —
ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
In the Linux kernel, the following vulnerability has been resolved: ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 When allocating initialized blocks from a large unwritten extent, or when splitting an unwritten extent during end I/O and c…
-
Unscored —
ext4: drop extent cache after doing PARTIAL_VALID1 zeroout
In the Linux kernel, the following vulnerability has been resolved: ext4: drop extent cache after doing PARTIAL_VALID1 zeroout When splitting an unwritten extent in the middle and converting it to initialized in ext4_split_extent() with the EXT4_EXT_MAY_ZEROO…
-
Unscored —
ext4: drop extent cache when splitting extent fails
In the Linux kernel, the following vulnerability has been resolved: ext4: drop extent cache when splitting extent fails When the split extent fails, we might leave some extents still being processed and return an error directly, which will result in stale ext…
-
Unscored —
ext4: fix dirtyclusters double decrement on fs shutdown
In the Linux kernel, the following vulnerability has been resolved: ext4: fix dirtyclusters double decrement on fs shutdown fstests test generic/388 occasionally reproduces a warning in ext4_put_super() associated with the dirty clusters count: WARNING: CPU: …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38192.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-38704.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39748.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-39764.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-40135.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68206.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68239.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-68265.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71067.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71161.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71269.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23100.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23113.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23141.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23154.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23157.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23204.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23270.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23271.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23274.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23277.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23292.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23293.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23296.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23300.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23303.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23304.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23317.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23319.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23321.html