Summary
Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsmaßnahmen zu umgehen, Informationen offenzulegen, weitere nicht spezifizierte Auswirkungen zu verursachen und potentiell Code auszuführen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 117
-
High 8.8
Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ Currently the code attempts to accept requests regardless of the command identifier which may cause multiple requests to be marke…
-
High 7.8
accel/amdxdna: Prevent ubuf size overflow
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent ubuf size overflow The ubuf size calculation may overflow, resulting in an undersized allocation and possible memory corruption. Use check_add_overflow() helpers to val…
-
High 7.8
accel/amdxdna: Fix out-of-bounds memset in command slot handling
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix out-of-bounds memset in command slot handling The remaining space in a command slot may be smaller than the size of the command header. Clearing the command header with mem…
-
High 7.8
scsi: pm8001: Fix use-after-free in pm8001_queue_command()
In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors pm8001_queue_command(), however it introduces a potentia…
-
High 7.8
drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another loo…
-
High 7.8
wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() There is a use-after-free error in cfg80211_shutdown_all_interfaces found by syzkaller: BUG: KASAN: use-after-free in cfg80211_s…
-
High 7.8
net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
In the Linux kernel, the following vulnerability has been resolved: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs When shrinking the number of real tx queues, netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flus…
-
High 7.8
drm/xe/queue: Call fini on exec queue creation fail
In the Linux kernel, the following vulnerability has been resolved: drm/xe/queue: Call fini on exec queue creation fail Every call to queue init should have a corresponding fini call. Skipping this would mean skipping removal of the queue from GuC list (which…
-
High 7.8
netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Yiming Qian reports Use-after-free in the pipapo set type: Under a large number of expired elements, commit-time GC can run f…
-
High 7.8
nfc: rawsock: cancel tx_work before socket teardown
In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel tx_work before socket teardown In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket. rawsock_tx_work runs on the system …
-
High 7.8
net/sched: act_ife: Fix metalist update behavior
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ife: Fix metalist update behavior Whenever an ife action replace changes the metalist, instead of replacing the old data on the metalist, the current ife code is appending the …
-
High 7.8
bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing struct bpf_plt contains a u64 target field. Currently, the BPF JIT allocator requests an alignment of 4 bytes (size…
-
High 7.8
netfilter: xt_CT: drop pending enqueued packets on template removal
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_CT: drop pending enqueued packets on template removal Templates refer to objects that can go away while packets are sitting in nfqueue refer to: - helper, this can be an issue o…
-
High 7.8
netfilter: nf_tables: release flowtable after rcu grace period on error
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtabl…
-
High 7.8
bridge: cfm: Fix race condition in peer_mep deletion
In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in …
-
High 7.4
ksmbd: Compare MACs in constant time
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant time To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp() with the correct function, crypto_memneq().
-
High 7.0
bpf: Fix race in devmap on PREEMPT_RT
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in devmap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_dev_bulk_queue (bq) can be accessed concurrently by multiple preemptible tasks on the same CPU. The original code …
-
Unscored —
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced at lines 1638 and 1642 without a prior NULL check: ifm…
-
Unscored —
wifi: libertas: fix use-after-free in lbs_free_adapter()
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix use-after-free in lbs_free_adapter() The lbs_free_adapter() function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before the structure …
-
Unscored —
smb: client: fix oops due to uninitialised var in smb2_unlink()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix oops due to uninitialised var in smb2_unlink() If SMB2_open_init() or SMB2_close_init() fails (e.g. reconnect), the iovs set @rqst will be left uninitialised, hence calling S…
-
Unscored —
regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read()
In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read() In fp9931_hwmon_read(), if regmap_read() failed, the function returned the error code without calling pm_runtime_put_au…
-
Unscored —
net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() Reset eBPF program pointer to old_prog and do not decrease its ref-count if mtk_open routine in mtk_…
-
Unscored —
drbd: fix null-pointer dereference on local read error
In the Linux kernel, the following vulnerability has been resolved: drbd: fix null-pointer dereference on local read error In drbd_request_endio(), READ_COMPLETED_WITH_ERROR is passed to __req_mod() with a NULL peer_device: __req_mod(req, what, NULL, &m); The…
-
Unscored —
atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix null-ptr-deref in lec_arp_clear_vccs syzkaller reported a null-ptr-deref in lec_arp_clear_vccs(). This issue can be easily reproduced using the syzkaller reproducer. In the ATM …
-
Unscored —
irqchip/sifive-plic: Fix frozen interrupt due to affinity setting
In the Linux kernel, the following vulnerability has been resolved: irqchip/sifive-plic: Fix frozen interrupt due to affinity setting PLIC ignores interrupt completion message for disabled interrupt, explained by the specification: The PLIC signals it has com…
-
Unscored —
IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
In the Linux kernel, the following vulnerability has been resolved: IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() Fix a user triggerable leak on the system call failure path.
-
Unscored —
net: usb: pegasus: validate USB endpoints
In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: validate USB endpoints The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to …
-
Unscored —
nfc: pn533: properly drop the usb interface reference on disconnect
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: properly drop the usb interface reference on disconnect When the device is disconnected from the driver, there is a "dangling" reference count on the usb interface that was grabbe…
-
Unscored —
scsi: target: Fix recursive locking in __configfs_open_file()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix recursive locking in __configfs_open_file() In flush_write_buffer, &p->frag_sem is acquired and then the loaded store function is called, which, here, is target_core_item_db…
-
Unscored —
net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
In the Linux kernel, the following vulnerability has been resolved: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() …
-
Unscored —
accel/amdxdna: Fix dead lock for suspend and resume
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix dead lock for suspend and resume When an application issues a query IOCTL while auto suspend is running, a deadlock can occur. The query path holds dev_lock and then calls …
-
Unscored —
scsi: core: Fix refcount leak for tagset_refcnt
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix refcount leak for tagset_refcnt This leak will cause a hang when tearing down the SCSI host. For example, iscsid hangs with the following call trace: [130120.652718] scsi_allo…
-
Unscored —
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). syzbot reported memory leak of struct cred. [0] nfsd_nl_threads_set_doit() passes get_current_cred() to nfsd_svc(), but put_cred() is no…
-
Unscored —
can: ucan: Fix infinite loop from zero-length messages
In the Linux kernel, the following vulnerability has been resolved: can: ucan: Fix infinite loop from zero-length messages If a broken ucan device gets a message with the message length field set to 0, then the driver will loop for forever in ucan_read_bulk_c…
-
Unscored —
Bluetooth: purge error queues in socket destructors
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: purge error queues in socket destructors When TX timestamping is enabled via SO_TIMESTAMPING, SKBs may be queued into sk_error_queue and will stay there until consumed. If userspac…
-
Unscored —
net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop When a standalone IPv6 nexthop object is created with a loopback device (e.g., "ip -6 nexthop add id 100 dev lo"), fib6_n…
-
Unscored —
ASoC: SDCA: Add allocation failure check for Entity name
In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add allocation failure check for Entity name Currently find_sdca_entity_iot() can allocate a string for the Entity name but it doesn't check if that allocation succeeded. Add the …
-
Unscored —
net: annotate data-races around sk->sk_{data_ready,write_space}
In the Linux kernel, the following vulnerability has been resolved: net: annotate data-races around sk->sk_{data_ready,write_space} skmsg (and probably other layers) are changing these pointers while other cpus might read them concurrently. Add corresponding …
-
Unscored —
smb: client: Don't log plaintext credentials in cifs_set_cifscreds
In the Linux kernel, the following vulnerability has been resolved: smb: client: Don't log plaintext credentials in cifs_set_cifscreds When debug logging is enabled, cifs_set_cifscreds() logs the key payload and exposes the plaintext username and password. Re…
-
Unscored —
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() l3mdev_master_dev_rcu() can return NULL when the slave device is being un-slaved from a VRF. All other callers deal with this, but we lost…
-
Unscored —
accel/rocket: fix unwinding in error path in rocket_probe
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix unwinding in error path in rocket_probe When rocket_core_init() fails (as could be the case with EPROBE_DEFER), we need to properly unwind by decrementing the counter we jus…
-
Unscored —
can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message When looking at the data in a USB urb, the actual_length is the size of the buffer passed to the driver, not t…
-
Unscored —
pinctrl: equilibrium: fix warning trace on load
In the Linux kernel, the following vulnerability has been resolved: pinctrl: equilibrium: fix warning trace on load The callback functions 'eqbr_irq_mask()' and 'eqbr_irq_ack()' are also called in the callback function 'eqbr_irq_mask_ack()'. This is done to a…
-
Unscored —
tracing: Add NULL pointer check to trigger_data_free()
In the Linux kernel, the following vulnerability has been resolved: tracing: Add NULL pointer check to trigger_data_free() If trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse() jumps to the out_free error path. While kfree() safely handle…
-
Unscored —
bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
In the Linux kernel, the following vulnerability has been resolved: bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded bond_option_mode_set() already rejects mode changes that would make a loaded XDP program incompatible via bond_xdp_c…
-
Unscored —
perf/core: Fix invalid wait context in ctx_sched_in()
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix invalid wait context in ctx_sched_in() Lockdep found a bug in the event scheduling when a pinned event was failed and wakes up the threads in the ring buffer like below. It see…
-
Unscored —
net: usb: kaweth: validate USB endpoints
In the Linux kernel, the following vulnerability has been resolved: net: usb: kaweth: validate USB endpoints The kaweth driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it…
-
Unscored —
i40e: Fix preempt count leak in napi poll tracepoint
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix preempt count leak in napi poll tracepoint Using get_cpu() in the tracepoint assignment causes an obvious preempt count leak because nothing invokes put_cpu() to undo it: softirq: h…
-
Unscored —
regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio()
In the Linux kernel, the following vulnerability has been resolved: regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio() In bq257xx_reg_dt_parse_gpio(), if fails to get subchild, it returns without calling of_node_put(child), caus…
-
Unscored —
wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt76_connac2_mac_write_txwi_80211 in order to avoid a possibl…
-
Unscored —
net: ipv4: fix ARM64 alignment fault in multipath hash seed
In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix ARM64 alignment fault in multipath hash seed `struct sysctl_fib_multipath_hash_seed` contains two u32 fields (user_seed and mp_seed), making it an 8-byte structure with a 4-byt…
-
Unscored —
ALSA: usb-audio: Use correct version for UAC3 header validation
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UAC_VERSION_2, while…
-
Unscored —
bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim The root cause of this bug is that when 'bpf_link_put' reduces the refcount of 'shim_link->link.link' to zero, the resource is consider…
-
Unscored —CVE-2026-23320 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
mptcp: pm: in-kernel: always mark signal+subflow endp as used
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always mark signal+subflow endp as used Syzkaller managed to find a combination of actions that was generating this warning: msk->pm.local_addr_used == 0 WARNING: net/mp…
-
Unscored —
ipmi: Fix use-after-free and list corruption on sender error
In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free and list corruption on sender error The analysis from Breno: When the SMI sender returns an error, smi_work() delivers an error response but then jumps back to restar…
-
Unscored —
hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver
In the Linux kernel, the following vulnerability has been resolved: hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver The recently added macsmc-hwmon driver contained several critical bugs in its sensor population logic and float conversion ro…
-
Unscored —
can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
In the Linux kernel, the following vulnerability has been resolved: can: usb: etas_es58x: correctly anchor the urb in the read bulk callback When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it co…
-
Unscored —
wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt7996_mac_write_txwi_80211 in order to avoid a possible oo…
-
Unscored —
xsk: Fix fragment node deletion to prevent buffer leak
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix fragment node deletion to prevent buffer leak After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"), the list_node field is reused for both the xskb pool list an…
-
Unscored —
cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() cxl_payload_from_user_allowed() casts and dereferences the input payload without first verifying i…
-
Unscored —
accel/amdxdna: Fix NULL pointer dereference of mgmt_chann
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix NULL pointer dereference of mgmt_chann mgmt_chann may be set to NULL if the firmware returns an unexpected error in aie2_send_mgmt_msg_wait(). This can later lead to a NULL…
-
Unscored —
libie: don't unroll if fwlog isn't supported
In the Linux kernel, the following vulnerability has been resolved: libie: don't unroll if fwlog isn't supported The libie_fwlog_deinit() function can be called during driver unload even when firmware logging was never properly initialized. This led to call t…
-
Unscored —
nfc: nci: complete pending data exchange on device close
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: complete pending data exchange on device close In nci_close_device(), complete any pending data exchange before closing. The data exchange callback (e.g. rawsock_data_exchange_compl…
-
Unscored —
udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.
In the Linux kernel, the following vulnerability has been resolved: udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected. Let's say we bind() an UDP socket to the wildcard address with a non-zero port, connect() it to an address, and …
-
Unscored —
cpufreq: intel_pstate: Fix crash during turbo disable
In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix crash during turbo disable When the system is booted with kernel command line argument "nosmt" or "maxcpus" to limit the number of CPUs, disabling turbo via: echo 1…
-
Unscored —CVE-2026-23333 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
can: usb: f81604: handle short interrupt urb messages properly
In the Linux kernel, the following vulnerability has been resolved: can: usb: f81604: handle short interrupt urb messages properly If an interrupt urb is received that is not the correct length, properly detect it and don't attempt to treat the data as valid.
-
Unscored —
RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() struct irdma_create_ah_resp { // 8 bytes, no padding __u32 ah_id; // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx) __u8 r…
-
Unscored —
pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config() In pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns directly. This bypasses the cleanup lo…
-
Unscored —
drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings Userspace can either deliberately pass in the too small num_fences, or the required number can legitimately grow b…
-
Unscored —
nfc: nci: free skb on nci_transceive early error paths
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free skb on nci_transceive early error paths nci_transceive() takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freein…
-
Unscored —
accel/amdxdna: Fix crash when destroying a suspended hardware context
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix crash when destroying a suspended hardware context If userspace issues an ioctl to destroy a hardware context that has already been automatically suspended, the driver may …
-
Unscored —
bpf: Fix race in cpumap on PREEMPT_RT
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in cpumap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_bulk_queue (bq) can be accessed concurrently by multiple preemptible tasks on the same CPU. The original code assu…
-
Unscored —
xdp: produce a warning when calculated tailroom is negative
In the Linux kernel, the following vulnerability has been resolved: xdp: produce a warning when calculated tailroom is negative Many ethernet drivers report xdp Rx queue frag size as being the same as DMA write size. However, the only user of this field, name…
-
Unscored —
crypto: ccp - Fix use-after-free on error path
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix use-after-free on error path In the error path of sev_tsm_init_locked(), the code dereferences 't' after it has been freed with kfree(). The pr_err() statement attempts to a…
-
Unscored —
arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled
In the Linux kernel, the following vulnerability has been resolved: arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled When FEAT_LPA2 is enabled, bits 8-9 of the PTE replace the shareability attribute with bits 50-51 of the output addre…
-
Unscored —
arm64: io: Extract user memory type in ioremap_prot()
In the Linux kernel, the following vulnerability has been resolved: arm64: io: Extract user memory type in ioremap_prot() The only caller of ioremap_prot() outside of the generic ioremap() implementation is generic_access_phys(), which passes a 'pgprot_t' val…
-
Unscored —
can: usb: f81604: correctly anchor the urb in the read bulk callback
In the Linux kernel, the following vulnerability has been resolved: can: usb: f81604: correctly anchor the urb in the read bulk callback When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could …
-
Unscored —
cxl: Fix race of nvdimm_bus object when creating nvdimm objects
In the Linux kernel, the following vulnerability has been resolved: cxl: Fix race of nvdimm_bus object when creating nvdimm objects Found issue during running of cxl-translate.sh unit test. Adding a 3s sleep right before the test seems to make the issue repro…
-
Unscored —
HID: pidff: Fix condition effect bit clearing
In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Fix condition effect bit clearing As reported by MPDarkGuy on discord, NULL pointer dereferences were happening because not all the conditional effects bits were cleared. Properly…
-
Unscored —
x86/efi: defer freeing of boot services memory
In the Linux kernel, the following vulnerability has been resolved: x86/efi: defer freeing of boot services memory efi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE and EFI_BOOT_SERVICES_DATA using memblock_free_late(). There are two is…
-
Unscored —
ice: fix crash in ethtool offline loopback test
In the Linux kernel, the following vulnerability has been resolved: ice: fix crash in ethtool offline loopback test Since the conversion of ice to page pool, the ethtool loopback test crashes: BUG: kernel NULL pointer dereference, address: 000000000000000c #P…
-
Unscored —
x86/fred: Correct speculative safety in fred_extint()
In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no use if the result gets spilled to the stack, as it makes the believed safe-under-speculation value subject to …
-
Unscored —
ata: libata: cancel pending work after clearing deferred_qc
In the Linux kernel, the following vulnerability has been resolved: ata: libata: cancel pending work after clearing deferred_qc Syzbot reported a WARN_ON() in ata_scsi_deferred_qc_work(), caused by ap->ops->qc_defer() returning non-zero before issuing the def…
-
Unscored —
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
In the Linux kernel, the following vulnerability has been resolved: drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Even though we check that we "should" be able to do lc_get_cumulative() while holding the device->al_lock spinlock, it may still fail, if …
-
Unscored —
can: mcp251x: fix deadlock in error path of mcp251x_open
In the Linux kernel, the following vulnerability has been resolved: can: mcp251x: fix deadlock in error path of mcp251x_open The mcp251x_open() function call free_irq() in its error path with the mpc_lock mutex held. But if an interrupt already occurred the i…
-
Unscored —
drm/amdgpu: Fix error handling in slot reset
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix error handling in slot reset If the device has not recovered after slot reset is called, it goes to out label for error handling. There it could make decision based on uniniti…
-
Unscored —
bpf: Fix stack-out-of-bounds write in devmap
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack-out-of-bounds write in devmap get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds. Also the callers assume that…
-
Unscored —
nvme: fix admin queue leak on controller reset
In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin queue leak on controller reset When nvme_alloc_admin_tag_set() is called during a controller reset, a previous admin queue may still exist. Release it properly before allocati…
-
Unscored —
PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry Endpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X interrupt to the host using a writel(), which generates a PCI…
-
Unscored —
can: bcm: fix locking for bcm_op runtime updates
In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix locking for bcm_op runtime updates Commit c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates") added a locking for some variables that can be modified at runtime wh…
-
Unscored —
wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt7925_mac_write_txwi_80211 in order to avoid a possible oo…
-
Unscored —
net: usb: kalmia: validate USB endpoints
In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: validate USB endpoints The kalmia driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it…
-
Unscored —
drm/client: Do not destroy NULL modes
In the Linux kernel, the following vulnerability has been resolved: drm/client: Do not destroy NULL modes 'modes' in drm_client_modeset_probe may fail to kcalloc. If this occurs, we jump to 'out', calling modes_destroy on it, which dereferences it. This may r…
-
Unscored —
wifi: radiotap: reject radiotap with unknown bits
In the Linux kernel, the following vulnerability has been resolved: wifi: radiotap: reject radiotap with unknown bits The radiotap parser is currently only used with the radiotap namespace (not with vendor namespaces), but if the undefined field 18 is used, t…
-
Unscored —
net: phy: register phy led_triggers during probe to avoid AB-BA deadlock
In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock There is an AB-BA deadlock when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled: [ 1362.049207] [<8054e4b8>] …
-
Unscored —
i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"
In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" This reverts commit f707d6b9e7c18f669adfdb443906d46cfbaaa0c1. Under rare circumstances, multiple udev threads can collect i8…
-
Unscored —
platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data set_new_password() hex dumps the entire buffer, which contains plaintext password data, including current and new passwor…
-
Unscored —
sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting Running stress-ng --schedpolicy 0 on an RT kernel on a big machine might lead to the following WARNINGs (edited). sched: DL…
-
Unscored —
wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config This triggers a WARN_ON in ieee80211_hw_conf_init and isn't the expected behavior from the driver - other drivers default to 0 t…
-
Unscored —
blktrace: fix __this_cpu_read/write in preemptible context
In the Linux kernel, the following vulnerability has been resolved: blktrace: fix __this_cpu_read/write in preemptible context tracing_record_cmdline() internally uses __this_cpu_read() and __this_cpu_write() on the per-CPU variable trace_cmdline_save, and tr…
-
Unscored —
mm: thp: deny THP for files on anonymous inodes
In the Linux kernel, the following vulnerability has been resolved: mm: thp: deny THP for files on anonymous inodes file_thp_enabled() incorrectly allows THP for files on anonymous inodes (e.g. guest_memfd and secretmem). These files are created via alloc_fil…
-
Unscored —
nvmet-fcloop: Check remoteport port_state before calling done callback
In the Linux kernel, the following vulnerability has been resolved: nvmet-fcloop: Check remoteport port_state before calling done callback In nvme_fc_handle_ls_rqst_work, the lsrsp->done callback is only set when remoteport->port_state is FC_OBJSTATE_ONLINE. …
-
Unscored —
ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
In the Linux kernel, the following vulnerability has been resolved: ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz The only user of frag_size field in XDP RxQ info is bpf_xdp_frags_increase_tail(). It clearly expects whole buff size inste…
-
Unscored —
net/sched: ets: fix divide by zero in the offload path
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: fix divide by zero in the offload path Offloading ETS requires computing each class' WRR weight: this is done by averaging over the sums of quanta as 'q_sum' and 'q_psum'. Usi…
-
Unscored —
tracing: Fix WARN_ON in tracing_buffers_mmap_close
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix WARN_ON in tracing_buffers_mmap_close When a process forks, the child process copies the parent's VMAs but the user_mapped reference count is not incremented. As a result, when b…
-
Unscored —
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init()…
-
Unscored —
HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
In the Linux kernel, the following vulnerability has been resolved: HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them In commit 2ff5baa9b527 ("HID: appleir: Fix potential NULL dereference at raw event handle"), we handle the fact that raw …
-
Unscored —
RDMA/ionic: Fix kernel stack leak in ionic_create_cq()
In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Fix kernel stack leak in ionic_create_cq() struct ionic_cq_resp resp { __u32 cqid[2]; // offset 0 - PARTIALLY SET (see below) __u8 udma_mask; // offset 8 - SET (resp.udma_mask = v…
-
Unscored —
netfilter: nf_tables: clone set on flush only
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: clone set on flush only Syzbot with fault injection triggered a failing memory allocation with GFP_KERNEL which results in a WARN splat: iter.err WARNING: net/netfilter/…
-
Unscored —
gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL
In the Linux kernel, the following vulnerability has been resolved: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL In DQ-QPL mode, gve_tx_clean_pending_packets() incorrectly uses the RDA buffer cleanup path. It iterates num_bufs tim…
-
Unscored —
pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() devm_add_action_or_reset() already invokes the action on failure, so the explicit put causes a double-put.
-
Unscored —
Squashfs: check metadata block offset is within range
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check metadata block offset is within range Syzkaller reports a "general protection fault in squashfs_copy_data" This is ultimately caused by a corrupted index look-up table, which …
-
Unscored —
ice: Fix memory leak in ice_set_ringparam()
In the Linux kernel, the following vulnerability has been resolved: ice: Fix memory leak in ice_set_ringparam() In ice_set_ringparam, tx_rings and xdp_rings are allocated before rx_rings. If the allocation of rx_rings fails, the code jumps to the done label l…
-
Unscored —
tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow
In the Linux kernel, the following vulnerability has been resolved: tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow The dma_map_sg tracepoint can trigger a perf buffer overflow when tracing large scatter-gather lists. With devices lik…
-
Unscored —
af_unix: Give up GC if MSG_PEEK intervened.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Give up GC if MSG_PEEK intervened. Igor Ushakov reported that GC purged the receive queue of an alive socket due to a race with MSG_PEEK with a nice repro. This is the exact same iss…
Revision history
-
#83
Neue Updates von SUSE aufgenommen
-
#82
Neue Updates von Ubuntu und Oracle Linux aufgenommen
-
#81
Neue Updates von SUSE aufgenommen
-
#80
Neue Updates von Ubuntu aufgenommen
-
#79
Neue Updates von Debian aufgenommen
-
#78
Neue Updates von SUSE aufgenommen
-
#77
Neue Updates von SUSE aufgenommen
-
#76
Neue Updates von SUSE und openSUSE aufgenommen
-
#75
Neue Updates von SUSE aufgenommen
-
#74
Neue Updates von Ubuntu aufgenommen
-
#73
Neue Updates von Ubuntu aufgenommen
-
#72
Neue Updates von IBM aufgenommen
-
#71
Neue Updates von SUSE aufgenommen
-
#70
Neue Updates von openSUSE aufgenommen
-
#69
Neue Updates von Ubuntu aufgenommen
-
#68
Neue Updates von Ubuntu aufgenommen
-
#67
Neue Updates von Oracle Linux aufgenommen
-
#66
Neue Updates von Debian aufgenommen
-
#65
Neue Updates von Dell aufgenommen
-
#64
Neue Updates von Ubuntu aufgenommen
-
#63
Neue Updates von Dell aufgenommen
-
#62
Neue Updates von Ubuntu aufgenommen
-
#61
Neue Updates von SUSE aufgenommen
-
#60
Neue Updates von Ubuntu aufgenommen
-
#59
Neue Updates von Ubuntu aufgenommen
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2026-23279
https://lore.kernel.org/linux-cve-announce/2026032522-CVE-2026-23279-cf34@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23280
https://lore.kernel.org/linux-cve-announce/2026032523-CVE-2026-23280-cd9e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23281
https://lore.kernel.org/linux-cve-announce/2026032523-CVE-2026-23281-2e62@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23282
https://lore.kernel.org/linux-cve-announce/2026032523-CVE-2026-23282-bad0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23283
https://lore.kernel.org/linux-cve-announce/2026032523-CVE-2026-23283-3d92@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23284
https://lore.kernel.org/linux-cve-announce/2026032523-CVE-2026-23284-ca53@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23285
https://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23285-ad41@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23286
https://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23286-8a7e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23287
https://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23287-93b2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23288
https://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23288-1d11@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23289
https://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23289-aa54@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23290
https://lore.kernel.org/linux-cve-announce/2026032525-CVE-2026-23290-af97@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23291
https://lore.kernel.org/linux-cve-announce/2026032525-CVE-2026-23291-eae3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23292
https://lore.kernel.org/linux-cve-announce/2026032525-CVE-2026-23292-67e8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23293
https://lore.kernel.org/linux-cve-announce/2026032525-CVE-2026-23293-b422@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23294
https://lore.kernel.org/linux-cve-announce/2026032525-CVE-2026-23294-1682@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23295
https://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23295-59d2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23296
https://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23296-eb4a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23297
https://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23297-bcad@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23298
https://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23298-fad9@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23299
https://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23299-6471@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23300
https://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23300-9bc4@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23301
https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23301-09e7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23302
https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23302-e03d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23303
https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23303-8e38@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23304
https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23304-485b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23305
https://lore.kernel.org/linux-cve-announce/2026032527-CVE-2026-23305-5fa4@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23306
https://lore.kernel.org/linux-cve-announce/2026032528-CVE-2026-23306-8854@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23307
https://lore.kernel.org/linux-cve-announce/2026032528-CVE-2026-23307-60f2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23308
https://lore.kernel.org/linux-cve-announce/2026032528-CVE-2026-23308-1e72@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23309
https://lore.kernel.org/linux-cve-announce/2026032528-CVE-2026-23309-4243@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23310
https://lore.kernel.org/linux-cve-announce/2026032528-CVE-2026-23310-9b67@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23311
https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23311-8c0b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23312
https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23312-2b11@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23313
https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23313-925e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23314
https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23314-166c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23315
https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23315-9ac1@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23316
https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23316-2ce3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23317
https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23317-0e9e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23318
https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23318-bef0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23319
https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23319-1e3d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23320
https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23320-0ae7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23321
https://lore.kernel.org/linux-cve-announce/2026032530-CVE-2026-23321-6059@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23322
https://lore.kernel.org/linux-cve-announce/2026032531-CVE-2026-23322-9fd3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23323
https://lore.kernel.org/linux-cve-announce/2026032531-CVE-2026-23323-53db@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23324
https://lore.kernel.org/linux-cve-announce/2026032531-CVE-2026-23324-bc9e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23325
https://lore.kernel.org/linux-cve-announce/2026032531-CVE-2026-23325-4e3b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23326
https://lore.kernel.org/linux-cve-announce/2026032531-CVE-2026-23326-ffc6@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23327
https://lore.kernel.org/linux-cve-announce/2026032532-CVE-2026-23327-c497@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23328
https://lore.kernel.org/linux-cve-announce/2026032532-CVE-2026-23328-9600@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23329
https://lore.kernel.org/linux-cve-announce/2026032532-CVE-2026-23329-c743@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23330
https://lore.kernel.org/linux-cve-announce/2026032532-CVE-2026-23330-00fd@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23331
https://lore.kernel.org/linux-cve-announce/2026032532-CVE-2026-23331-735b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23332
https://lore.kernel.org/linux-cve-announce/2026032533-CVE-2026-23332-50e0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23333
https://lore.kernel.org/linux-cve-announce/2026032533-CVE-2026-23333-417f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23334
https://lore.kernel.org/linux-cve-announce/2026032533-CVE-2026-23334-1b12@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23335
https://lore.kernel.org/linux-cve-announce/2026032533-CVE-2026-23335-602d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23336
https://lore.kernel.org/linux-cve-announce/2026032533-CVE-2026-23336-d365@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23337
https://lore.kernel.org/linux-cve-announce/2026032534-CVE-2026-23337-5018@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23338
https://lore.kernel.org/linux-cve-announce/2026032534-CVE-2026-23338-67c7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23339
https://lore.kernel.org/linux-cve-announce/2026032534-CVE-2026-23339-263f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23340
https://lore.kernel.org/linux-cve-announce/2026032534-CVE-2026-23340-1aa9@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23341
https://lore.kernel.org/linux-cve-announce/2026032534-CVE-2026-23341-3f7b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23342
https://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23342-8456@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23343
https://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23343-dc2b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23344
https://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23344-0279@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23345
https://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23345-c154@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23346
https://lore.kernel.org/linux-cve-announce/2026032535-CVE-2026-23346-faed@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23347
https://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23347-fa08@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23348
https://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23348-e792@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23349
https://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23349-aa6a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23350
https://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23350-f4be@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23351
https://lore.kernel.org/linux-cve-announce/2026032536-CVE-2026-23351-637f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23352
https://lore.kernel.org/linux-cve-announce/2026032537-CVE-2026-23352-18f2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23353
https://lore.kernel.org/linux-cve-announce/2026032537-CVE-2026-23353-d0c3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23354
https://lore.kernel.org/linux-cve-announce/2026032537-CVE-2026-23354-d9b2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23355
https://lore.kernel.org/linux-cve-announce/2026032537-CVE-2026-23355-86df@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23356
https://lore.kernel.org/linux-cve-announce/2026032537-CVE-2026-23356-0014@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-23357
https://lore.kernel.org/linux-cve-announce/2026032538-CVE-2026-23357-605e@gregkh/