Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-43321: In the Linux kernel, the following vulnerability has been resolved: bpf: Properly mark live registers for indirect jumps CVE-2026-43315: In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding CVE-2026-43314: In the Linux kernel, the following vulnerability has been resolved: dm: remove fake timeout to avoid leak request CVE-2026-43313: In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() CVE-2026-43309: In the Linux kernel, the following vulnerability has been resolved: md raid: fix hang when stopping arrays with metadata through dm-raid CVE-2026-43306: In the Linux kernel, the following vulnerability has been resolved: bpf: crypto: Use the correct destructor kfunc type CVE-2026-43304: In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN CVE-2026-43303: In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() CVE-2026-43292: In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node CVE-2026-43289: In the Linux kernel, the following vulnerability has been resolved: kexec: derive purgatory entry from symbol CVE-2026-43288: In the Linux kernel, the following vulnerability has been resolved: ext4: move ext4_percpu_param_init() before ext4_mb_init() CVE-2026-43287: In the Linux kernel, the following vulnerability has been resolved: drm: Account property blob allocations to memcg CVE-2026-43286: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: restore failed global reservations to subpool CVE-2026-43285: In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not access current->mems_allowed_seq if !allow_spin CVE-2026-43281: In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() CVE-2026-43278: In the Linux kernel, the following vulnerability has been resolved: dm: clear cloned request bio pointer when last clone bio completes CVE-2026-43277: In the Linux kernel, the following vulnerability has been resolved: APEI/GHES: ensure that won't go past CPER allocated record CVE-2026-43273: In the Linux kernel, the following vulnerability has been resolved: ceph: supply snapshot context in ceph_zero_partial_object() CVE-2026-43272: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix possible dereference of uninitialized pointer CVE-2026-43266: In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't go past the ARM processor CPER record buffer CVE-2026-43261: In the Linux kernel, the following vulnerability has been resolved: arm64: Add support for TSV110 Spectre-BHB mitigation CVE-2026-43258: In the Linux kernel, the following vulnerability has been resolved: alpha: fix user-space corruption during memory compaction CVE-2026-43254: In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - fix packet extraction from stream CVE-2026-43253: In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move wait_on_sem() out of spinlock CVE-2026-43252: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always set ID as avail when rm endp CVE-2026-43245: In the Linux kernel, the following vulnerability has been resolved: ntfs: ->d_compare() must not block CVE-2026-43244: In the Linux kernel, the following vulnerability has been resolved: kcm: fix zero-frag skb in frag_list on partial sendmsg error CVE-2026-43240: In the Linux kernel, the following vulnerability has been resolved: x86/kexec: add a sanity check on previous kernel's ima kexec buffer CVE-2026-43239: In the Linux kernel, the following vulnerability has been resolved: smb: client: prevent races in ->query_interfaces() CVE-2026-43238: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() CVE-2026-43234: In the Linux kernel, the following vulnerability has been resolved: team: avoid NETDEV_CHANGEMTU event when unregistering slave CVE-2026-43233: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() CVE-2026-43230: In the Linux kernel, the following vulnerability has been resolved: net/rds: Clear reconnect pending bit CVE-2026-43226: In the Linux kernel, the following vulnerability has been resolved: net/rds: No shortcut out of RDS_CONN_ERROR CVE-2026-43224: In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix sgtable leak on mapping failures CVE-2026-43216: In the Linux kernel, the following vulnerability has been resolved: net: Drop the lock in skb_may_tx_timestamp() CVE-2026-43215: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tcon fields CVE-2026-43214: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() CVE-2026-43211: In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_slot_trylock() error handling CVE-2026-43210: In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using CVE-2026-43208: In the Linux kernel, the following vulnerability has been resolved: net: do not pass flow_id to set_rps_cpu() CVE-2026-43201: In the Linux kernel, the following vulnerability has been resolved: APEI/GHES: ARM processor Error: don't go past allocated memory CVE-2026-43199: In the Linux kernel, the
Fixed packages 22
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | bpftool6.18 | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | bpftool6.18-debuginfo | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel-livepatch-6.18.16-18.222 | 1:1.0-0.amzn2023 |
| Amazon Linux · 2023 | kernel6.18 | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-debuginfo | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-debuginfo-common-aarch64 | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-debuginfo-common-x86_64 | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-devel | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-headers | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-libbpf | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-libbpf-debuginfo | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-libbpf-devel | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-libbpf-static | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-modules-extra | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-modules-extra-common | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-tools | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-tools-debuginfo | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | kernel6.18-tools-devel | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | perf6.18 | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | perf6.18-debuginfo | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.18 | 1:6.18.16-18.222.amzn2023 |
| Amazon Linux · 2023 | python3-perf6.18-debuginfo | 1:6.18.16-18.222.amzn2023 |
Vulnerabilities 88
-
Critical 9.8
tls: Fix race condition in tls_sw_cancel_work_tx()
In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit. After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can s…
-
Critical 9.8
ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide how much data to write for each node. It trusts …
-
Critical 9.8
tcp: fix potential race in tcp_v6_syn_recv_sock()
In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is a…
-
Critical 9.8
net: do not pass flow_id to set_rps_cpu()
In the Linux kernel, the following vulnerability has been resolved: net: do not pass flow_id to set_rps_cpu() Blamed commit made the assumption that the RPS table for each receive queue would have the same size, and that it would not change. Compute flow_id i…
-
Critical 9.8
libceph: define and enforce CEPH_MAX_KEY_LEN
In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The…
-
High 8.8
xfs: fix freemap adjustments when adding xattrs to leaf blocks
In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…
-
High 8.8
xfs: delete attr leaf freemap entries when empty
In the Linux kernel, the following vulnerability has been resolved: xfs: delete attr leaf freemap entries when empty Back in commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow"), Brian Foster observed that it's possible for a small freem…
-
High 8.8
cifs: Fix locking usage for tcon fields
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tcon fields We used to use the cifs_tcp_ses_lock to protect a lot of objects that are not just the server, ses or tcon lists. We later introduced srv_lock, ses_loc…
-
High 8.8
smb: client: prevent races in ->query_interfaces()
In the Linux kernel, the following vulnerability has been resolved: smb: client: prevent races in ->query_interfaces() It was possible for two query interface works to be concurrently trying to update the interfaces. Prevent this by checking and updating ifac…
-
High 8.6
xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() xfrm6_get_saddr() does not check the return value of ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable source addres…
-
High 8.2
netfilter: xt_tcpmss: check remaining length before reading optlen
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validatin…
-
High 8.2
netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`, which is still 0 from its initialization at the …
-
High 7.9
KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields cont…
-
High 7.8
espintcp: Fix race condition in espintcp_close()
In the Linux kernel, the following vulnerability has been resolved: espintcp: Fix race condition in espintcp_close() This issue was discovered during a code audit. After cancel_work_sync() is called from espintcp_close(), espintcp_tx_work() can still be sched…
-
High 7.8
cifs: some missing initializations on replay
In the Linux kernel, the following vulnerability has been resolved: cifs: some missing initializations on replay In several places in the code, we have a label to signify the start of the code where a request can be replayed if necessary. However, some of the…
-
High 7.8
RDMA/umem: Fix double dma_buf_unpin in failure path
In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately …
-
High 7.8
perf/arm-cmn: Reject unsupported hardware configurations
In the Linux kernel, the following vulnerability has been resolved: perf/arm-cmn: Reject unsupported hardware configurations So far we've been fairly lax about accepting both unknown CMN models (at least with a warning), and unknown revisions of those which w…
-
High 7.8
xfs: remove xfs_attr_leaf_hasname
In the Linux kernel, the following vulnerability has been resolved: xfs: remove xfs_attr_leaf_hasname The calling convention of xfs_attr_leaf_hasname() is problematic, because it returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer when xfs_at…
-
High 7.8
PCI: Fix pci_slot_trylock() error handling
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_slot_trylock() error handling Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in pci_s…
-
High 7.8
KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() Add SRCU read-side protection when reading PDPTR registers in __get_sregs2(). Reading PDPTRs may trigger access to guest mem…
-
High 7.8
alpha: fix user-space corruption during memory compaction
In the Linux kernel, the following vulnerability has been resolved: alpha: fix user-space corruption during memory compaction Alpha systems can suffer sporadic user-space crashes and heap corruption when memory compaction is enabled. Symptoms include SIGSEGV,…
-
High 7.8
dm: clear cloned request bio pointer when last clone bio completes
In the Linux kernel, the following vulnerability has been resolved: dm: clear cloned request bio pointer when last clone bio completes Stale rq->bio values have been observed to cause double-initialization of cloned bios in request-based device-mapper targets…
-
High 7.8
mm/page_alloc: clear page->private in free_pages_prepare()
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later al…
-
High 7.8
bpf: Properly mark live registers for indirect jumps
In the Linux kernel, the following vulnerability has been resolved: bpf: Properly mark live registers for indirect jumps For a `gotox rX` instruction the rX register should be marked as used in the compute_insn_live_regs() function. Fix this.
-
High 7.5
udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb().
In the Linux kernel, the following vulnerability has been resolved: udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb(). syzbot reported null-ptr-deref of udp_sk(sk)->udp_prod_queue. [0] Since the cited commit, udp_lib_init_sock() can fail, as can udp…
-
High 7.5
net: consume xmit errors of GSO frames
In the Linux kernel, the following vulnerability has been resolved: net: consume xmit errors of GSO frames udpgro_frglist.sh and udpgro_bench.sh are the flakiest tests currently in NIPA. They fail in the same exact way, TCP GRO test stalls occasionally and th…
-
High 7.5
net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query Fix a "scheduling while atomic" bug in mlx5e_ipsec_init_macs() by replacing mlx5_query_mac_address() with ether_addr_copy()…
-
High 7.5
net/rds: No shortcut out of RDS_CONN_ERROR
In the Linux kernel, the following vulnerability has been resolved: net/rds: No shortcut out of RDS_CONN_ERROR RDS connections carry a state "rds_conn_path::cp_state" and transitions from one state to another and are conditional upon an expected state: "rds_c…
-
High 7.5
net/rds: Clear reconnect pending bit
In the Linux kernel, the following vulnerability has been resolved: net/rds: Clear reconnect pending bit When canceling the reconnect worker, care must be taken to reset the reconnect-pending bit. If the reconnect worker has not yet been scheduled before it i…
-
High 7.5
ntfs: ->d_compare() must not block
In the Linux kernel, the following vulnerability has been resolved: ntfs: ->d_compare() must not block ... so don't use __getname() there. Switch it (and ntfs_d_hash(), while we are at it) to kmalloc(PATH_MAX, GFP_NOWAIT). Yes, ntfs_d_hash() almost certainly …
-
High 7.5
iommu/amd: move wait_on_sem() out of spinlock
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move wait_on_sem() out of spinlock With iommu.strict=1, the existing completion wait path can cause soft lockups under stressed environment, as wait_on_sem() busy-waits under the s…
-
High 7.5
ovpn: tcp - fix packet extraction from stream
In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - fix packet extraction from stream When processing TCP stream data in ovpn_tcp_recv, we receive large cloned skbs from __strp_rcv that may contain multiple coalesced packets. The c…
-
High 7.1
erofs: fix interlaced plain identification for encoded extents
In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced plain identification for encoded extents Only plain data whose start position and on-disk physical length are both aligned to the block size should be classified as inte…
-
Unscored —
audit: add fchmodat2() to change attributes class
In the Linux kernel, the following vulnerability has been resolved: audit: add fchmodat2() to change attributes class fchmodat2(), introduced in version 6.6 is currently not in the change attribute class of audit. Calling fchmodat2() to change a file attribut…
-
Unscored —
fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition. A ma…
-
Unscored —
fs: ntfs3: check return value of indx_find to avoid infinite loop
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: check return value of indx_find to avoid infinite loop We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition. A malformed dent…
-
Unscored —
fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition. A malformed NTFS im…
-
Unscored —
fs/buffer: add alert in try_to_free_buffers() for folios without buffers
In the Linux kernel, the following vulnerability has been resolved: fs/buffer: add alert in try_to_free_buffers() for folios without buffers try_to_free_buffers() can be called on folios with no buffers attached when filemap_release_folio() is invoked on a fo…
-
Unscored —
drm/tests: shmem: Hold reservation lock around purge
In the Linux kernel, the following vulnerability has been resolved: drm/tests: shmem: Hold reservation lock around purge Acquire and release the GEM object's reservation lock around calls to the object's purge operation. The tests use drm_gem_shmem_purge_lock…
-
Unscored —
drm/tests: shmem: Hold reservation lock around madvise
In the Linux kernel, the following vulnerability has been resolved: drm/tests: shmem: Hold reservation lock around madvise Acquire and release the GEM object's reservation lock around calls to the object's madvide operation. The tests use drm_gem_shmem_madvis…
-
Unscored —
drm/tests: shmem: Hold reservation lock around vmap/vunmap
In the Linux kernel, the following vulnerability has been resolved: drm/tests: shmem: Hold reservation lock around vmap/vunmap Acquire and release the GEM object's reservation lock around vmap and vunmap operations. The tests use vmap_locked, which led to err…
-
Unscored —
drm/display/dp_mst: Add protection against 0 vcpi
In the Linux kernel, the following vulnerability has been resolved: drm/display/dp_mst: Add protection against 0 vcpi When releasing a timeslot there is a slight chance we may end up with the wrong payload mask due to overflow if the delayed_destroy_work ends…
-
Unscored —
audit: add missing syscalls to read class
In the Linux kernel, the following vulnerability has been resolved: audit: add missing syscalls to read class The "at" variant of getxattr() and listxattr() are missing from the audit read class. Calling getxattrat() or listxattrat() on a file to read its ext…
-
Unscored —
xfs: check for deleted cursors when revalidating two btrees
In the Linux kernel, the following vulnerability has been resolved: xfs: check for deleted cursors when revalidating two btrees The free space and inode btree repair functions will rebuild both btrees at the same time, after which it needs to evaluate both bt…
-
Unscored —
io_uring/zcrx: fix user_ref race between scrub and refill paths
In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix user_ref race between scrub and refill paths The io_zcrx_put_niov_uref() function uses a non-atomic check-then-decrement pattern (atomic_read followed by separate atomic_de…
-
Unscored —
fbcon: check return value of con2fb_acquire_newinfo()
In the Linux kernel, the following vulnerability has been resolved: fbcon: check return value of con2fb_acquire_newinfo() If fbcon_open() fails when called from con2fb_acquire_newinfo() then info->fbcon_par pointer remains NULL which is later dereferenced. Ad…
-
Unscored —
pstore: ram_core: fix incorrect success return when vmap() fails
In the Linux kernel, the following vulnerability has been resolved: pstore: ram_core: fix incorrect success return when vmap() fails In persistent_ram_vmap(), vmap() may return NULL on failure. If offset is non-zero, adding offset_in_page(start) causes the fu…
-
Unscored —
ntfs3: fix circular locking dependency in run_unpack_ex
In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix circular locking dependency in run_unpack_ex Syzbot reported a circular locking dependency between wnd->rw_lock (sbi->used.bitmap) and ni->file.run_lock. The deadlock scenario: 1. …
-
Unscored —
ima: verify the previous kernel's IMA buffer lies in addressable RAM
In the Linux kernel, the following vulnerability has been resolved: ima: verify the previous kernel's IMA buffer lies in addressable RAM Patch series "Address page fault in ima_restore_measurement_list()", v3. When the second-stage kernel is booted via kexec …
-
Unscored —
iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected") relies on…
-
Unscored —
dm-verity: correctly handle dm_bufio_client_create() failure
In the Linux kernel, the following vulnerability has been resolved: dm-verity: correctly handle dm_bufio_client_create() failure If either of the calls to dm_bufio_client_create() in verity_fec_ctr() fails, then dm_bufio_client_destroy() is later called with …
-
Unscored —
mfd: core: Add locking around 'mfd_of_node_list'
In the Linux kernel, the following vulnerability has been resolved: mfd: core: Add locking around 'mfd_of_node_list' Manipulating a list in the kernel isn't safe without some sort of mutual exclusion. Add a mutex any time we access / modify 'mfd_of_node_list'…
-
Unscored —
Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"
In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" This reverts commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"), whic…
-
Unscored —
HID: hid-pl: handle probe errors
In the Linux kernel, the following vulnerability has been resolved: HID: hid-pl: handle probe errors Errors in init must be reported back or we'll follow a NULL pointer the first time FF is used.
-
Unscored —
erofs: fix incorrect early exits in volume label handling
In the Linux kernel, the following vulnerability has been resolved: erofs: fix incorrect early exits in volume label handling Crafted EROFS images containing valid volume labels can trigger incorrect early returns, leading to folio reference leaks. However, t…
-
Unscored —
md/bitmap: fix GPF in write_page caused by resize race
In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-fre…
-
Unscored —
xfrm: always flush state and policy upon NETDEV_UNREGISTER event
In the Linux kernel, the following vulnerability has been resolved: xfrm: always flush state and policy upon NETDEV_UNREGISTER event syzbot is reporting that "struct xfrm_state" refcount is leaking. unregister_netdevice: waiting for netdevsim0 to become free.…
-
Unscored —
drm/buddy: Prevent BUG_ON by validating rounded allocation
In the Linux kernel, the following vulnerability has been resolved: drm/buddy: Prevent BUG_ON by validating rounded allocation When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is rounded up to the next power-of-two via roundup_pow_of_two(). Sim…
-
Unscored —
EFI/CPER: don't dump the entire memory region
In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't dump the entire memory region The current logic at cper_print_fw_err() doesn't check if the error record length is big enough to handle offset. On a bad firmware, if the ofset…
-
Unscored —
erofs: fix incorrect early exits for invalid metabox-enabled images
In the Linux kernel, the following vulnerability has been resolved: erofs: fix incorrect early exits for invalid metabox-enabled images Crafted EROFS images with metadata compression enabled can trigger incorrect early returns, leading to folio reference leak…
-
Unscored —
ceph: do not propagate page array emplacement errors as batch errors
In the Linux kernel, the following vulnerability has been resolved: ceph: do not propagate page array emplacement errors as batch errors When fscrypt is enabled, move_dirty_folio_in_page_array() may fail because it needs to allocate bounce buffers to store th…
-
Unscored —
media: v4l2-async: Fix error handling on steps after finding a match
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: Fix error handling on steps after finding a match Once an async connection is found to be matching with an fwnode, a sub-device may be registered (in case it wasn't already…
-
Unscored —
APEI/GHES: ARM processor Error: don't go past allocated memory
In the Linux kernel, the following vulnerability has been resolved: APEI/GHES: ARM processor Error: don't go past allocated memory If the BIOS generates a very small ARM Processor Error, or an incomplete one, the current logic will fail to deferrence err->sec…
-
Unscored —
tracing: ring-buffer: Fix to check event length before using
In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using Check the event length before adding it for accessing next index in rb_read_data_buffer(). Since this function is used for validat…
-
Unscored —
net: Drop the lock in skb_may_tx_timestamp()
In the Linux kernel, the following vulnerability has been resolved: net: Drop the lock in skb_may_tx_timestamp() skb_may_tx_timestamp() may acquire sock::sk_callback_lock. The lock must not be taken in IRQ context, only softirq is okay. A few drivers receive …
-
Unscored —
io_uring/zcrx: fix sgtable leak on mapping failures
In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix sgtable leak on mapping failures In an unlikely case when io_populate_area_dma() fails, which could only happen on a PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA machine, io_zcrx_ma…
-
Unscored —
team: avoid NETDEV_CHANGEMTU event when unregistering slave
In the Linux kernel, the following vulnerability has been resolved: team: avoid NETDEV_CHANGEMTU event when unregistering slave syzbot is reporting unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3 ref_tracker: netdev@ffff88807dcf86…
-
Unscored —
net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() Commit 38a6f0865796 ("net: sched: support hash selecting tx queue") added SKBEDIT_F_TXQ_SKBHASH support. The inclusive range s…
-
Unscored —
x86/kexec: add a sanity check on previous kernel's ima kexec buffer
In the Linux kernel, the following vulnerability has been resolved: x86/kexec: add a sanity check on previous kernel's ima kexec buffer When the second-stage kernel is booted via kexec with a limiting command line such as "mem=<size>", the physical range that…
-
Unscored —
kcm: fix zero-frag skb in frag_list on partial sendmsg error
In the Linux kernel, the following vulnerability has been resolved: kcm: fix zero-frag skb in frag_list on partial sendmsg error Syzkaller reported a warning in kcm_write_msgs() when processing a message with a zero-fragment skb in the frag_list. When kcm_sen…
-
Unscored —
mptcp: pm: in-kernel: always set ID as avail when rm endp
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always set ID as avail when rm endp Syzkaller managed to find a combination of actions that was generating this warning: WARNING: net/mptcp/pm_kernel.c:1074 at __mark_su…
-
Unscored —
arm64: Add support for TSV110 Spectre-BHB mitigation
In the Linux kernel, the following vulnerability has been resolved: arm64: Add support for TSV110 Spectre-BHB mitigation The TSV110 processor is vulnerable to the Spectre-BHB (Branch History Buffer) attack, which can be exploited to leak information through b…
-
Unscored —
EFI/CPER: don't go past the ARM processor CPER record buffer
In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't go past the ARM processor CPER record buffer There's a logic inside GHES/CPER to detect if the section_length is too small, but it doesn't detect if it is too big. Currently, …
-
Unscored —
ring-buffer: Fix possible dereference of uninitialized pointer
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix possible dereference of uninitialized pointer There is a pointer head_page in rb_meta_validate_events() which is not initialized at the beginning of a function. This pointer …
-
Unscored —
ceph: supply snapshot context in ceph_zero_partial_object()
In the Linux kernel, the following vulnerability has been resolved: ceph: supply snapshot context in ceph_zero_partial_object() The ceph_zero_partial_object function was missing proper snapshot context for its OSD write operations, which could lead to data in…
-
Unscored —
APEI/GHES: ensure that won't go past CPER allocated record
In the Linux kernel, the following vulnerability has been resolved: APEI/GHES: ensure that won't go past CPER allocated record The logic at ghes_new() prevents allocating too large records, by checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, …
-
Unscored —
mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree…
-
Unscored —
mm/slab: do not access current->mems_allowed_seq if !allow_spin
In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not access current->mems_allowed_seq if !allow_spin Lockdep complains when get_from_any_partial() is called in an NMI context, because current->mems_allowed_seq is seqcount_spinlo…
-
Unscored —
mm/hugetlb: restore failed global reservations to subpool
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: restore failed global reservations to subpool Commit a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool") fixed an underflow error for hstate->resv_huge_pages caused b…
-
Unscored —
drm: Account property blob allocations to memcg
In the Linux kernel, the following vulnerability has been resolved: drm: Account property blob allocations to memcg DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized property blobs backed by kernel memory. Currently, the blob data all…
-
Unscored —
ext4: move ext4_percpu_param_init() before ext4_mb_init()
In the Linux kernel, the following vulnerability has been resolved: ext4: move ext4_percpu_param_init() before ext4_mb_init() When running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the `DOUBLE_CHECK` macro defined, the following panic is triggered: ====…
-
Unscored —
kexec: derive purgatory entry from symbol
In the Linux kernel, the following vulnerability has been resolved: kexec: derive purgatory entry from symbol kexec_load_purgatory() derives image->start by locating e_entry inside an SHF_EXECINSTR section. If the purgatory object contains multiple executable…
-
Unscored —
mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node When CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during vmalloc cleanup triggers expensive stack unwinding that acqui…
-
Unscored —
bpf: crypto: Use the correct destructor kfunc type
In the Linux kernel, the following vulnerability has been resolved: bpf: crypto: Use the correct destructor kfunc type With CONFIG_CFI enabled, the kernel strictly enforces that indirect function calls use a function pointer type that matches the target funct…
-
Unscored —
md raid: fix hang when stopping arrays with metadata through dm-raid
In the Linux kernel, the following vulnerability has been resolved: md raid: fix hang when stopping arrays with metadata through dm-raid When using device-mapper's dm-raid target, stopping a RAID array can cause the system to hang under specific conditions. T…
-
Unscored —
ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()
In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE device and then reassigned an ISA dev…
-
Unscored —
dm: remove fake timeout to avoid leak request
In the Linux kernel, the following vulnerability has been resolved: dm: remove fake timeout to avoid leak request Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of blk_mq_complete_request"), drivers are responsible for calling blk_should_fake_…
-
Unscored —
KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding Drop the WARN in svm_set_nested_state() on nested_svm_load_cr3() failing as it is trivially easy to trigger from …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71239.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71265.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71266.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71267.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71295.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71296.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71298.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71301.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-71305.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23239.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23240.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23241.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-23249.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-31693.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43121.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43123.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43124.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43127.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43128.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43129.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43130.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43132.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43133.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43139.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43143.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43147.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43150.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43152.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43153.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43154.html