Skip to content
OpenAdvisories

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, die möglicherweise zu einer Denial-of-Service- Bedingung führen oder eine Speicherbeschädigung verursachen können.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 55

  • Critical 9.8

    btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node()

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node() Previously, btrfs_get_or_create_delayed_node() set the delayed_node's refcount before acquiring the root->delayed_nodes…

  • Critical 9.8

    libceph: prevent potential out-of-bounds reads in handle_auth_done()

    In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: chang…

  • High 7.8

    usb: phy: isp1301: fix non-OF device reference imbalance

    In the Linux kernel, the following vulnerability has been resolved: usb: phy: isp1301: fix non-OF device reference imbalance A recent change fixing a device reference leak in a UDC driver introduced a potential use-after-free in the non-OF case as the isp1301…

  • High 7.8

    KVM: s390: Fix gmap_helper_zap_one_page() again

    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gmap_helper_zap_one_page() again A few checks were missing in gmap_helper_zap_one_page(), which can lead to memory corruption in the guest under specific circumstances. Add the…

  • High 7.8

    gpio: mpsse: ensure worker is torn down

    In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: ensure worker is torn down When an IRQ worker is running, unplugging the device would cause a crash. The sealevel hardware this driver was written for was not hotpluggable, so I …

  • High 7.8

    dmaengine: tegra-adma: Fix use-after-free

    In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when th…

  • High 7.8

    nfsd: provide locking for v4_end_grace

    In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly. We c…

  • High 7.8

    arp: do not assume dev_hard_header() does not change skb->head

    In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_create() is the only dev_hard_header() caller making assumption about skb->head being unchanged. A recent commit broke this …

  • High 7.8

    net/sched: sch_qfq: do not free existing class in qfq_change_class()

    In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we …

  • High 7.8
    CVE-2026-23001 Public exploit

    macvlan: fix possible UAF in macvlan_forward_source()

    In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointe…

  • High 7.8
    CVE-2026-23004 Public exploit

    dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

    In the Linux kernel, the following vulnerability has been resolved: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() syzbot was able to crash the kernel in rt6_uncached_list_flush_dev() in an interesting way [1] Crash happens in list_del_i…

  • High 7.8
    CVE-2026-23010 Public exploit

    ipv6: Fix use-after-free in inet6_addr_del().

    In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). syzbot reported use-after-free of inet6_ifaddr in inet6_addr_del(). [0] The cited commit accidentally moved ipv6_del_addr() for mngtmpaddr before…

  • High 7.5

    netfilter: nf_conncount: fix leaked ct in error paths

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: fix leaked ct in error paths There are some situations where ct might be leaked as error paths are skipping the refcounted check and return immediately. In order to s…

  • High 7.5

    ksmbd: Fix refcount leak when invalid session is found on session lookup

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix refcount leak when invalid session is found on session lookup When a session is found but its state is not SMB2_SESSION_VALID, It indicates that no valid session was found, but it …

  • High 7.5

    dm-verity: disable recursive forward error correction

    In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two problems with the recursive correction: 1. It may cause denial-of-service. In fec_read_bufs, there is a loop that has 253 i…

  • High 7.5

    libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

    In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is …

  • High 7.5

    libceph: make free_choose_arg_map() resilient to partial allocation

    In the Linux kernel, the following vulnerability has been resolved: libceph: make free_choose_arg_map() resilient to partial allocation free_choose_arg_map() may dereference a NULL pointer if its caller fails after a partial allocation. For example, in decode…

  • High 7.5

    libceph: return the handler error from mon_handle_auth_done()

    In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from mon_handle_auth_done() Currently any error from ceph_auth_handle_reply_done() is propagated via finish_auth() but isn't returned from mon_handle_auth_do…

  • High 7.5

    net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts

    In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is called only when t…

  • High 7.5

    nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

    In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking…

  • High 7.5
    CVE-2026-23003 Public exploit

    ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()

    In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_ma…

  • High 7.0

    net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback

    In the Linux kernel, the following vulnerability has been resolved: net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to ioq_vector. If request_irq() fails part-way, the rollback …

  • Unscored —

    KEYS: trusted: Fix a memory leak in tpm2_load_cmd

    In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix a memory leak in tpm2_load_cmd 'tpm2_load_cmd' allocates a tempoary blob indirectly via 'tpm2_key_decode' but it is not freed in the failure paths. Address this by wrapping…

  • Unscored —

    net/handshake: restore destructor on submit failure

    In the Linux kernel, the following vulnerability has been resolved: net/handshake: restore destructor on submit failure handshake_req_submit() replaces sk->sk_destruct but never restores it when submission fails before the request is hashed. handshake_sk_dest…

  • Unscored —
    CVE-2025-71149 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    cifs: Fix memory and information leak in smb3_reconfigure()

    In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory and information leak in smb3_reconfigure() In smb3_reconfigure(), if smb3_sync_session_ctx_passwords() fails, the function returns immediately without freeing and erasing the…

  • Unscored —

    net: dsa: properly keep track of conduit reference

    In the Linux kernel, the following vulnerability has been resolved: net: dsa: properly keep track of conduit reference Problem description ------------------- DSA has a mumbo-jumbo of reference handling of the conduit net device and its kobject which, sadly, …

  • Unscored —

    ksmbd: Fix memory leak in get_file_all_info()

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix memory leak in get_file_all_info() In get_file_all_info(), if vfs_getattr() fails, the function returns immediately without freeing the allocated filename, leading to a memory leak…

  • Unscored —

    net: usb: rtl8150: fix memory leak on usb_submit_urb() failure

    In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix memory leak on usb_submit_urb() failure In async_set_registers(), when usb_submit_urb() fails, the allocated async_req structure and URB are not freed, causing a memory…

  • Unscored —

    gve: defer interrupt enabling until NAPI registration

    In the Linux kernel, the following vulnerability has been resolved: gve: defer interrupt enabling until NAPI registration Currently, interrupts are automatically enabled immediately upon request. This allows interrupt to fire before the associated NAPI contex…

  • Unscored —

    RDMA/core: always drop device refcount in ib_del_sub_device_and_put()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/core: always drop device refcount in ib_del_sub_device_and_put() Since nldev_deldev() (introduced by commit 060c642b2ab8 ("RDMA/nldev: Add support to add/delete a sub IB device through n…

  • Unscored —

    netfilter: nf_tables: avoid chain re-validation if possible

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: avoid chain re-validation if possible Hamza Mahfooz reports cpu soft lock-ups in nft_chain_validate(): watchdog: BUG: soft lockup - CPU#1 stuck for 27s! [iptables-nft-re…

  • Unscored —

    dmaengine: idxd: fix device leaks on compat bind and unbind

    In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix device leaks on compat bind and unbind Make sure to drop the reference taken when looking up the idxd device as part of the compat bind and unbind sysfs interface.

  • Unscored —

    wifi: avoid kernel-infoleak from struct iw_point

    In the Linux kernel, the following vulnerability has been resolved: wifi: avoid kernel-infoleak from struct iw_point struct iw_point has a 32bit hole on 64bit arches. struct iw_point { void __user *pointer; /* Pointer to the data (in user space) */ __u16 leng…

  • Unscored —

    net: fix memory leak in skb_segment_list for GRO packets

    In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in skb_segment_list for GRO packets When skb_segment_list() is called during packet forwarding, it handles packets that were aggregated by the GRO engine. Historically, t…

  • Unscored —

    idpf: detach and close netdevs while handling a reset

    In the Linux kernel, the following vulnerability has been resolved: idpf: detach and close netdevs while handling a reset Protect the reset path from callbacks by setting the netdevs to detached state and close any netdevs in UP state until the reset handling…

  • Unscored —

    net: mscc: ocelot: Fix crash when adding interface under a lag

    In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: Fix crash when adding interface under a lag Commit 15faa1f67ab4 ("lan966x: Fix crash when adding interface under a lag") fixed a similar issue in the lan966x driver caused …

  • Unscored —

    net: do not write to msg_get_inq in callee

    In the Linux kernel, the following vulnerability has been resolved: net: do not write to msg_get_inq in callee NULL pointer dereference fix. msg_get_inq is an input field from caller to callee. Don't set it in the callee, as the caller may not clear it on str…

  • Unscored —

    idpf: Fix RSS LUT NULL pointer crash on early ethtool operations

    In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations The RSS LUT is not initialized until the interface comes up, causing the following NULL pointer crash when ethtool operations …

  • Unscored —

    gpiolib: fix race condition for gdev->srcu

    In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix race condition for gdev->srcu If two drivers were calling gpiochip_add_data_with_key(), one may be traversing the srcu-protected list in gpio_name_to_desc(), meanwhile other has …

  • Unscored —

    net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy

    In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy syzbot reported a crash in tc_act_in_hw() during netns teardown where tcf_idrinfo_destroy() passed an ERR_PTR(-EBUSY) va…

  • Unscored —

    nfsd: check that server is running in unlock_filesystem

    In the Linux kernel, the following vulnerability has been resolved: nfsd: check that server is running in unlock_filesystem If we are trying to unlock the filesystem via an administrative interface and nfsd isn't running, it crashes the server. This happens c…

  • Unscored —

    idpf: Fix RSS LUT NULL ptr issue after soft reset

    In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL ptr issue after soft reset During soft reset, the RSS LUT is freed and not restored unless the interface is up. If an ethtool command that accesses the rss lut is attem…

  • Unscored —

    bpf: Fix reference count leak in bpf_prog_test_run_xdp()

    In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregister_netdevice: waiting for sit0 to become free. Usage count = 2 problem. A debug printk() patch found that …

  • Unscored —

    ublk: fix use-after-free in ublk_partition_scan_work

    In the Linux kernel, the following vulnerability has been resolved: ublk: fix use-after-free in ublk_partition_scan_work A race condition exists between the async partition scan work and device teardown that can lead to a use-after-free of ub->ub_disk: 1. ubl…

  • Unscored —

    net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv mlx5e_priv is an unstable structure that can be memset(0) if profile attaching fails, mlx5e_priv in mlx5e_dev devlink private is us…

  • Unscored —

    net/mlx5e: Fix crash on profile change rollback failure

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix crash on profile change rollback failure mlx5e_netdev_change_profile can fail to attach a new profile and can fail to rollback to old profile, in such case, we could end up wit…

  • Unscored —
    CVE-2026-23002 Public exploit

    lib/buildid: use __kernel_read() for sleepable context

    In the Linux kernel, the following vulnerability has been resolved: lib/buildid: use __kernel_read() for sleepable context Prevent a "BUG: unable to handle kernel NULL pointer dereference in filemap_read_folio". For the sleepable context, convert freader to u…

  • Unscored —
    CVE-2026-23005 Public exploit

    x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1

    In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 When loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in response to a guest WRMSR, clear XFD-disabled fea…

  • Unscored —
    CVE-2026-23006 Public exploit

    ASoC: tlv320adcx140: fix null pointer

    In the Linux kernel, the following vulnerability has been resolved: ASoC: tlv320adcx140: fix null pointer The "snd_soc_component" in "adcx140_priv" was only used once but never set. It was only used for reaching "dev" which is already present in "adcx140_priv…

  • Unscored —
    CVE-2026-23007 Public exploit

    block: zero non-PI portion of auto integrity buffer

    In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer for writes needs to be fully initialized before being passed to the underlying block device, otherwise …

  • Unscored —
    CVE-2026-23008 Public exploit

    drm/vmwgfx: Fix KMS with 3D on HW version 10

    In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix KMS with 3D on HW version 10 HW version 10 does not have GB Surfaces so there is no backing buffer for surface backed FBs. This would result in a nullptr dereference and crash…

  • Unscored —
    CVE-2026-23009 Public exploit

    xhci: sideband: don't dereference freed ring when removing sideband endpoint

    In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: don't dereference freed ring when removing sideband endpoint xhci_sideband_remove_endpoint() incorrecly assumes that the endpoint is running and has a valid transfer ring. Lia…

  • Unscored —

    ipv4: ip_gre: make ipgre_header() robust

    In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_gre: make ipgre_header() robust Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust") Over the years, syzbot found many ways to crash the kernel in ipgre_header() [1…

  • Unscored —

    mm/damon/core: remove call_control in inactive contexts

    In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: remove call_control in inactive contexts If damon_call() is executed against a DAMON context that is not running, the function returns error while keeping the damon_call_contro…

Revision history

  1. #107

    Neue Updates von Debian aufgenommen

  2. #106

    Neue Updates von Debian aufgenommen

  3. #105

    Neue Updates von Oracle Linux aufgenommen

  4. #104

    Neue Updates von Oracle Linux aufgenommen

  5. #103

    Neue Updates von Red Hat und IBM aufgenommen

  6. #102

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  7. #101

    Neue Updates von Red Hat aufgenommen

  8. #100

    Neue Updates von Red Hat aufgenommen

  9. #99

    Neue Updates von SUSE aufgenommen

  10. #98

    Neue Updates von Ubuntu aufgenommen

  11. #97

    Neue Updates von Oracle Linux aufgenommen

  12. #96

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  13. #95

    Neue Updates von Red Hat, Oracle Linux und Dell aufgenommen

  14. #94

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  15. #93

    Neue Updates von Red Hat aufgenommen

  16. #92

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  17. #91

    Neue Updates von Oracle Linux aufgenommen

  18. #90

    Neue Updates von Red Hat aufgenommen

  19. #89

    Neue Updates von Ubuntu aufgenommen

  20. #88

    Neue Updates von Ubuntu aufgenommen

  21. #87

    Neue Updates von Red Hat aufgenommen

  22. #86

    Neue Updates von IBM aufgenommen

  23. #85

    Neue Updates von Oracle Linux aufgenommen

  24. #84

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  25. #83

    Neue Updates von Ubuntu aufgenommen

References