Summary
Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi
implementation in the Linux kernel did not properly handle aggregated
frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A
physically proximate attacker could use this issue to inject packets.
(CVE-2025-27558)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 architecture;
- Cryptographic API;
- InfiniBand drivers;
- Media drivers;
- NVIDIA Tegra memory controller driver;
- Network drivers;
- NVME drivers;
- File systems infrastructure;
- Ext4 file system;
- OCFS2 file system;
- IPv4 networking;
- Network traffic control;
- TCP network protocol;
- Locking primitives;
- B.A.T.M.A.N. meshing protocol;
- Ceph Core library;
- IPv6 networking;
- Multipath TCP;
- Netfilter;
- SCTP protocol;
- SMC sockets;
- TIPC protocol;
(CVE-2021-47378, CVE-2026-23392, CVE-2026-31405, CVE-2026-31414,
CVE-2026-31448, CVE-2026-31657, CVE-2026-31668, CVE-2026-43071,
CVE-2026-43198, CVE-2026-43493, CVE-2026-43499, CVE-2026-46266,
CVE-2026-46331, CVE-2026-52914, CVE-2026-52924, CVE-2026-52931,
CVE-2026-52955, CVE-2026-52958, CVE-2026-52982, CVE-2026-52986,
CVE-2026-52989, CVE-2026-52993, CVE-2026-52999, CVE-2026-53002,
CVE-2026-53006, CVE-2026-53043, CVE-2026-53045, CVE-2026-53088,
CVE-2026-53176, CVE-2026-53212, CVE-2026-53224, CVE-2026-53225,
CVE-2026-53228, CVE-2026-53246, CVE-2026-53309, CVE-2026-53359)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro FIPS-updates 20.04 LTS Pro:FIPS-updates:20.04:LTS | linux-aws-fips | 5.4.0-1163.174+fips1 |
Vulnerabilities 37
-
Critical 9.8
nvme-rdma: destroy cm id before destroy qp to avoid use after free
In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: destroy cm id before destroy qp to avoid use after free We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use aft…
-
Critical 9.8
media: dvb-net: fix OOB access in ULE extension header tables
In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in handle_one_ule_extension() are declared with 255 eleme…
-
Critical 9.8
netfilter: nf_conntrack_expect: use expect->helper
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is …
-
Critical 9.8
batman-adv: hold claim backbone gateways by reference
In the Linux kernel, the following vulnerability has been resolved: batman-adv: hold claim backbone gateways by reference batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway's last reference while readers still follow the pointer. T…
-
Critical 9.8
seg6: separate dst_cache for input and output paths in seg6 lwtunnel
In the Linux kernel, the following vulnerability has been resolved: seg6: separate dst_cache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These …
-
Critical 9.8
tcp: fix potential race in tcp_v6_syn_recv_sock()
In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is a…
-
Critical 9.8
crypto: pcrypt - Fix handling of MAY_BACKLOG requests
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.
-
Critical 9.8
batman-adv: fix fragment reassembly length accounting
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accountin…
-
Critical 9.8CVE-2026-52924 Public exploit
sctp: purge outqueue on stale COOKIE-ECHO handling
In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, …
-
Critical 9.8
batman-adv: tp_meter: avoid use of uninit sender vars
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER …
-
Critical 9.8
libceph: Fix potential out-of-bounds access in crush_decode()
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. I…
-
Critical 9.8
net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit() when accessing skb->len for tx statistics after usb_subm…
-
Critical 9.8
netfilter: nf_conntrack_sip: don't use simple_strtoul
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request() with a new sip_parse_port() helper tha…
-
Critical 9.8
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_e…
-
Critical 9.8CVE-2026-52993 Public exploit
tipc: fix double-free in tipc_buf_append()
In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a point…
-
Critical 9.8
netfilter: conntrack: remove sprintf usage
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer…
-
Critical 9.8
ipv6: fix possible UAF in icmpv6_rcv()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)-…
-
Critical 9.8
memory: tegra124-emc: Fix dll_change check
In the Linux kernel, the following vulnerability has been resolved: memory: tegra124-emc: Fix dll_change check The code checking whether the specified memory timing enables DLL in the EMRS register was reversed. DLL is enabled if bit A0 is low. Fix the check.
-
Critical 9.8
net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb The write_ptr points to the next open tx_cb. We want to return the tx_cb that gets rewinded, so we must rewind the pointer first then return…
-
Critical 9.8
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus I…
-
Critical 9.8
ipv6: sit: reload inner IPv6 header after GSO offloads
In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For …
-
Critical 9.8
sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is pars…
-
Critical 9.8
ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of qr…
-
Critical 9.4
ext4: avoid infinite loops caused by residual data
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this examp…
-
Critical 9.1CVE-2025-27558 Public exploit
IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected A…
-
Critical 9.1
dcache: Limit the minimal number of bucket to two
In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two There is an OOB read problem on dentry_hashtable when user sets 'dhash_entries=1': BUG: unable to handle page fault for address: ffff888b30b7…
-
Critical 9.1
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255);…
-
Critical 9.1
libceph: Fix potential out-of-bounds access in osdmap_decode()
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state and osd_weight from an incoming osdmap in osdmap_decode(), both are decoded for each osd, i.e., map->max…
-
Critical 9.1
netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once and passed by reference to nf_osf_match_one() for each …
-
Critical 9.1
ocfs2/dlm: validate qr_numregions in dlm_match_regions()
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()". In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION…
-
Critical 9.1
sctp: validate embedded INIT chunk and address list lengths in cookie
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but di…
-
Critical 9.1
sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then ca…
-
High 8.8CVE-2026-53359 Public exploit
KVM: x86: Fix shadow paging use-after-free due to unexpected role
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch betw…
-
High 7.8
netfilter: nf_tables: release flowtable after rcu grace period on error
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtabl…
-
High 7.8CVE-2026-43499 Public exploit
rtmutex: Use waiter::task instead of current in remove_waiter()
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when …
-
High 7.8CVE-2026-46331 Public exploit
net/sched: fix pedit partial COW leading to page cache corruption
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hi…
-
High 7.8
netfilter: nft_tunnel: fix use-after-free on object destroy
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packe…
References
-
report
https://ubuntu.com/security/CVE-2021-47378
-
report
https://ubuntu.com/security/CVE-2025-27558
-
report
https://ubuntu.com/security/CVE-2026-23392
-
report
https://ubuntu.com/security/CVE-2026-31405
-
report
https://ubuntu.com/security/CVE-2026-31414
-
report
https://ubuntu.com/security/CVE-2026-31448
-
report
https://ubuntu.com/security/CVE-2026-31657
-
report
https://ubuntu.com/security/CVE-2026-31668
-
report
https://ubuntu.com/security/CVE-2026-43071
-
report
https://ubuntu.com/security/CVE-2026-43198
-
report
https://ubuntu.com/security/CVE-2026-43493
-
report
https://ubuntu.com/security/CVE-2026-43499
-
report
https://ubuntu.com/security/CVE-2026-46266
-
report
https://ubuntu.com/security/CVE-2026-46331
-
report
https://ubuntu.com/security/CVE-2026-52914
-
report
https://ubuntu.com/security/CVE-2026-52924
-
report
https://ubuntu.com/security/CVE-2026-52931
-
report
https://ubuntu.com/security/CVE-2026-52955
-
report
https://ubuntu.com/security/CVE-2026-52958
-
report
https://ubuntu.com/security/CVE-2026-52982
-
report
https://ubuntu.com/security/CVE-2026-52986
-
report
https://ubuntu.com/security/CVE-2026-52989
-
report
https://ubuntu.com/security/CVE-2026-52993
-
report
https://ubuntu.com/security/CVE-2026-52999
-
report
https://ubuntu.com/security/CVE-2026-53002
-
report
https://ubuntu.com/security/CVE-2026-53006
-
report
https://ubuntu.com/security/CVE-2026-53043
-
report
https://ubuntu.com/security/CVE-2026-53045
-
report
https://ubuntu.com/security/CVE-2026-53088
-
report
https://ubuntu.com/security/CVE-2026-53176
-
report
https://ubuntu.com/security/CVE-2026-53212
-
report
https://ubuntu.com/security/CVE-2026-53224
-
report
https://ubuntu.com/security/CVE-2026-53225
-
report
https://ubuntu.com/security/CVE-2026-53228
-
report
https://ubuntu.com/security/CVE-2026-53246
-
report
https://ubuntu.com/security/CVE-2026-53309
-
report
https://ubuntu.com/security/CVE-2026-53359