Summary
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, Informationen offenzulegen, andere nicht näher spezifizierte Auswirkungen zu verursachen und möglicherweise Code auszuführen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 100
-
Critical 9.8
dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() At the end of this function, d is the traversal cursor of flist, but the code completes found instead. This can…
-
Critical 9.8
ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() smb_grant_oplock() has two issues in the oplock publication sequence: 1) opinfo is linked into ci->m_op_list (via opinfo_add) be…
-
Critical 9.8
iomap: fix invalid folio access when i_blkbits differs from I/O granularity
In the Linux kernel, the following vulnerability has been resolved: iomap: fix invalid folio access when i_blkbits differs from I/O granularity Commit aa35dd5cbc06 ("iomap: fix invalid folio access after folio_end_read()") partially addressed invalid folio ac…
-
Critical 9.8
ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"), response buffer management was change…
-
Critical 9.8
net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor. In both emac_rx_packet() and emac_rx_packet_zc(), …
-
Critical 9.4
ext4: avoid infinite loops caused by residual data
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this examp…
-
High 8.8
netfs: Fix read abandonment during retry
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix read abandonment during retry Under certain circumstances, all the remaining subrequests from a read request will get abandoned during retry. The abandonment process expects the 's…
-
High 8.8
ext4: publish jinode after initialization
In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after initialization ext4_inode_attach_jinode() publishes ei->jinode to concurrent users. It used to set ei->jinode before jbd2_journal_init_jbd_inode(), allowing a reade…
-
High 8.2
ksmbd: do not expire session on binding failure
In the Linux kernel, the following vulnerability has been resolved: ksmbd: do not expire session on binding failure When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED…
-
High 8.1
scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() A malicious or compromised VIO server can return a num_written value in the discover targets MAD response that exceeds max_targe…
-
High 8.1
Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req Syzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd() that is triggered by a malformed Enhanced Credit B…
-
High 7.8
net/packet: fix a race in packet_set_ring() and packet_notifier()
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This …
-
High 7.8
dmaengine: idxd: Fix possible invalid memory access after FLR
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix possible invalid memory access after FLR In the case that the first Function Level Reset (FLR) concludes correctly, but in the second FLR the scratch area for the saved c…
-
High 7.8
ext4: fix use-after-free in update_super_work when racing with umount
In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in update_super_work when racing with umount Commit b98535d09179 ("ext4: fix bug_on in start_this_handle during umount filesystem") moved ext4_unregister_sysfs() befo…
-
High 7.8
ext4: reject mount if bigalloc with s_first_data_block != 0
In the Linux kernel, the following vulnerability has been resolved: ext4: reject mount if bigalloc with s_first_data_block != 0 bigalloc with s_first_data_block != 0 is not supported, reject mounting it.
-
High 7.8
ext4: validate p_idx bounds in ext4_ext_correct_indexes
In the Linux kernel, the following vulnerability has been resolved: ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4_ext_correct_indexes() walks up the extent tree correcting index entries when the first extent in a leaf is modified. Before access…
-
High 7.8
xfs: avoid dereferencing log items after push callbacks
In the Linux kernel, the following vulnerability has been resolved: xfs: avoid dereferencing log items after push callbacks After xfsaild_push_item() calls iop_push(), the log item may have been freed if the AIL lock was dropped during the push. Background in…
-
High 7.8
xfs: save ailp before dropping the AIL lock in push callbacks
In the Linux kernel, the following vulnerability has been resolved: xfs: save ailp before dropping the AIL lock in push callbacks In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is dropped to perform buffer IO. Once the cluster buffer n…
-
High 7.8
vfio/pci: Fix double free in dma-buf feature
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Fix double free in dma-buf feature The error path through vfio_pci_core_feature_dma_buf() ignores its own advice to only use dma_buf_put() after dma_buf_export(), instead falling th…
-
High 7.8
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false A UAF issue occurs when the virtio_net driver is configured with napi_tx=N and the device's IFF_XMIT_D…
-
High 7.8
xfrm: iptfs: only publish mode_data after clone setup
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: only publish mode_data after clone setup iptfs_clone_state() stores x->mode_data before allocating the reorder window. If that allocation fails, the code frees the cloned state a…
-
High 7.8
media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
In the Linux kernel, the following vulnerability has been resolved: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object clea…
-
High 7.8
can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_e…
-
High 7.8
ASoC: sma1307: fix double free of devm_kzalloc() memory
In the Linux kernel, the following vulnerability has been resolved: ASoC: sma1307: fix double free of devm_kzalloc() memory A previous change added NULL checks and cleanup for allocation failures in sma1307_setting_loaded(). However, the cleanup for mode_set …
-
High 7.8
drm/xe: always keep track of remap prev/next
In the Linux kernel, the following vulnerability has been resolved: drm/xe: always keep track of remap prev/next During 3D workload, user is reporting hitting: [ 413.361679] WARNING: drivers/gpu/drm/xe/xe_vm.c:1217 at vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe]…
-
High 7.8
drm/amd/display: Do not skip unrelated mode changes in DSC validation
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commit 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in atomic check"), amdgpu resets the CRTC sta…
-
High 7.8
drm/xe/pf: Fix use-after-free in migration restore
In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Fix use-after-free in migration restore When an error is returned from xe_sriov_pf_migration_restore_produce(), the data pointer is not set to NULL, which can trigger use-after-fre…
-
High 7.8
net: macb: use the current queue number for stats
In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential mismatch between the memory reserved for statistics and the amount of memory written. gem_get_sset_count() correctly comp…
-
High 7.8
team: fix header_ops type confusion with non-Ethernet ports
In the Linux kernel, the following vulnerability has been resolved: team: fix header_ops type confusion with non-Ethernet ports Similar to commit 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()") team has the same class of header_ops type …
-
High 7.8
net: fix fanout UAF in packet_release() via NETDEV_UP race
In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registra…
-
High 7.8
iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
In the Linux kernel, the following vulnerability has been resolved: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the value could change in runtime, we should use num_tx_queues inst…
-
High 7.8
net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores the pointer in pipe_buffer.private. The…
-
High 7.8
net: openvswitch: Avoid releasing netdev before teardown completes
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. A…
-
High 7.8
Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete This fixes the condition checking so mgmt_pending_valid is executed whenever status != -ECANCELED otherwise cal…
-
High 7.8
xfrm: prevent policy_hthresh.work from racing with netns teardown
In the Linux kernel, the following vulnerability has been resolved: xfrm: prevent policy_hthresh.work from racing with netns teardown A XFRM_MSG_NEWSPDINFO request can queue the per-net work item policy_hthresh.work onto the system workqueue. The queued callb…
-
High 7.8CVE-2026-31525 Public exploit
bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN The BPF interpreter's signed 32-bit division and modulo handlers use the kernel abs() macro on s32 operands. The abs() macro d…
-
High 7.8
perf: Make sure to use pmu_ctx->pmu for groups
In the Linux kernel, the following vulnerability has been resolved: perf: Make sure to use pmu_ctx->pmu for groups Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access when group_sched_in() fails and needs to roll back. This *should…
-
High 7.8
can: raw: fix ro->uniq use-after-free in raw_rcv()
In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a …
-
High 7.5
erofs: add GFP_NOIO in the bio completion if needed
In the Linux kernel, the following vulnerability has been resolved: erofs: add GFP_NOIO in the bio completion if needed The bio completion path in the process context (e.g. dm-verity) will directly call into decompression rather than trigger another workqueue…
-
High 7.5
ksmbd: fix memory leaks and NULL deref in smb2_lock()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memory leaks and NULL deref in smb2_lock() smb2_lock() has three error handling issues after list_del() detaches smb_lock from lock_list at no_check_cl: 1) If vfs_lock_file() retur…
-
High 7.1
virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length Validate host controlled value `quote_buf->out_len` that determines how many bytes of the quote are copied out to guest …
-
High 7.1
io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check
In the Linux kernel, the following vulnerability has been resolved: io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check __io_uring_show_fdinfo() iterates over pending SQEs and, for 128-byte SQEs on an IORING_SETUP_SQE_MIXED ring, needs to detect when the se…
-
High 7.1
hwmon: (pmbus/core) Protect regulator operations with mutex
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PM…
-
Unscored —
btrfs: fix leak of kobject name for sub-group space_info
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix leak of kobject name for sub-group space_info When create_space_info_sub_group() allocates elements of space_info->sub_group[], kobject_init_and_add() is called for each element vi…
-
Unscored —
netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry When a write subrequest is marked NETFS_SREQ_NEED_RETRY, the retry path in netfs_unbuffered_write() unconditionally ca…
-
Unscored —
netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators When a process crashes and the kernel writes a core dump to a 9P filesystem, __kernel_write() creates an ITER_KVEC iterator…
-
Unscored —
dmaengine: xilinx: xdma: Fix regmap init error handling
In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx: xdma: Fix regmap init error handling devm_regmap_init_mmio returns an ERR_PTR() upon error, not NULL. Fix the error check and also fix the error message. Use the error code…
-
Unscored —
dmaengine: idxd: Fix leaking event log memory
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix leaking event log memory During the device remove process, the device is reset, causing the configuration registers to go back to their default state, which is zero. As t…
-
Unscored —
dmaengine: idxd: Fix memory leak when a wq is reset
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix memory leak when a wq is reset idxd_wq_disable_cleanup() which is called from the reset path for a workqueue, sets the wq type to NONE, which for other parts of the drive…
-
Unscored —
dmaengine: idxd: Fix crash when the event log is disabled
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix crash when the event log is disabled If reporting errors to the event log is not supported by the hardware, and an error that causes Function Level Reset (FLR) is receive…
-
Unscored —
mm/damon/core: avoid use of half-online-committed context
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid use of half-online-committed context One major usage of damon_call() is online DAMON parameters update. It is done by calling damon_commit_ctx() inside the damon_call() c…
-
Unscored —
ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
In the Linux kernel, the following vulnerability has been resolved: ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio Replace BUG_ON() with proper error handling when inline data size exceeds PAGE_SIZE. This prevents kernel panic and a…
-
Unscored —
ext4: convert inline data to extents when truncate exceeds inline size
In the Linux kernel, the following vulnerability has been resolved: ext4: convert inline data to extents when truncate exceeds inline size Add a check in ext4_setattr() to convert files from inline data storage to extent-based storage when truncate() grows th…
-
Unscored —
xfs: stop reclaim before pushing AIL during unmount
In the Linux kernel, the following vulnerability has been resolved: xfs: stop reclaim before pushing AIL during unmount The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken in…
-
Unscored —
mm/pagewalk: fix race between concurrent split and refault
In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix race between concurrent split and refault The splitting of a PUD entry in walk_pud_range() can race with a concurrent thread refaulting the PUD leaf entry causing it to try w…
-
Unscored —
mm/damon/sysfs: check contexts->nr in repeat_call_fn
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts->nr in repeat_call_fn damon_sysfs_repeat_call_fn() calls damon_sysfs_upd_tuned_intervals(), damon_sysfs_upd_schemes_stats(), and damon_sysfs_upd_schemes_effecti…
-
Unscored —
mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] Multiple sysfs command paths dereference contexts_arr[0] without first verifying that kdamond->contexts->nr == 1. A user ca…
-
Unscored —
mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure Patch series "mm/damon/sysfs: fix memory leak and NULL dereference issues", v4. DAMON_SYSFS can leak memory under allo…
-
Unscored —
drm/amd/display: check if ext_caps is valid in BL setup
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if ext_caps is valid in BL setup LVDS connectors don't have extended backlight caps so check if the pointer is valid before accessing it. (cherry picked from commit 3f7…
-
Unscored —
drm/amd/display: Fix drm_edid leak in amdgpu_dm
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix drm_edid leak in amdgpu_dm [WHAT] When a sink is connected, aconnector->drm_edid was overwritten without freeing the previous allocation, causing a memory leak on resume.…
-
Unscored —
drm/amdgpu: prevent immediate PASID reuse case
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: prevent immediate PASID reuse case PASID resue could cause interrupt issue when process immediately runs into hw state left by previous process exited with the same PASID, it's po…
-
Unscored —
writeback: don't block sync for filesystems with no data integrity guarantees
In the Linux kernel, the following vulnerability has been resolved: writeback: don't block sync for filesystems with no data integrity guarantees Add a SB_I_NO_DATA_INTEGRITY superblock flag for filesystems that cannot guarantee data persistence on sync (eg f…
-
Unscored —
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP …
-
Unscored —
xfrm: iptfs: validate inner IPv4 header length in IPTFS payload
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: validate inner IPv4 header length in IPTFS payload Add validation of the inner IPv4 packet tot_len and ihl fields parsed from decrypted IPTFS payloads in __input_process_payload(…
-
Unscored —
tracing: Fix potential deadlock in cpu hotplug with osnoise
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential deadlock in cpu hotplug with osnoise The following sequence may leads deadlock in cpu hotplug: task1 task2 task3 ----- ----- ----- mutex_lock(&interface_lock) [CPU GOIN…
-
Unscored —
tracing: Drain deferred trigger frees if kthread creation fails
In the Linux kernel, the following vulnerability has been resolved: tracing: Drain deferred trigger frees if kthread creation fails Boot-time trigger registration can fail before the trigger-data cleanup kthread exists. Deferring those frees until late init i…
-
Unscored —
s390/entry: Scrub r12 register on kernel entry
In the Linux kernel, the following vulnerability has been resolved: s390/entry: Scrub r12 register on kernel entry Before commit f33f2d4c7c80 ("s390/bp: remove TIF_ISOLATE_BP"), all entry handlers loaded r12 with the current task pointer (lg %r12,__LC_CURRENT…
-
Unscored —
s390/syscalls: Add spectre boundary for syscall dispatch table
In the Linux kernel, the following vulnerability has been resolved: s390/syscalls: Add spectre boundary for syscall dispatch table The s390 syscall number is directly controlled by userspace, but does not have an array_index_nospec() boundary to prevent acces…
-
Unscored —
spi: spi-fsl-lpspi: fix teardown order issue (UAF)
In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-lpspi: fix teardown order issue (UAF) There is a teardown order issue in the driver. The SPI controller is registered using devm_spi_register_controller(), which delays unregistr…
-
Unscored —
spi: use generic driver_override infrastructure
In the Linux kernel, the following vulnerability has been resolved: spi: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_…
-
Unscored —
spi: meson-spicc: Fix double-put in remove path
In the Linux kernel, the following vulnerability has been resolved: spi: meson-spicc: Fix double-put in remove path meson_spicc_probe() registers the controller with devm_spi_register_controller(), so teardown already drops the controller reference via devm c…
-
Unscored —
RDMA/irdma: Harden depth calculation functions
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Harden depth calculation functions An issue was exposed where OS can pass in U32_MAX for SQ/RQ/SRQ size. This can cause integer overflow and truncation of SQ/RQ/SRQ depth returnin…
-
Unscored —
RDMA/irdma: Initialize free_qp completion before using it
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Initialize free_qp completion before using it In irdma_create_qp, if ib_copy_to_udata fails, it will call irdma_destroy_qp to clean up which will attempt to wait on the free_qp co…
-
Unscored —
RDMA/efa: Fix use of completion ctx after free
In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix use of completion ctx after free On admin queue completion handling, if the admin command completed with error we print data from the completion context. The issue is that we al…
-
Unscored —
netfilter: ctnetlink: use netlink policy range checks
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use netlink policy range checks Replace manual range and mask validations with netlink policy annotations in ctnetlink code paths, so that the netlink core rejects inval…
-
Unscored —
netfilter: nf_conntrack_expect: skip expectations in other netns via proc
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: skip expectations in other netns via proc Skip expectations that do not reside in this netns. Similar to e77e6ff502ea ("netfilter: conntrack: do not dump other…
-
Unscored —
Bluetooth: btusb: clamp SCO altsetting table indices
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: clamp SCO altsetting table indices btusb_work() maps the number of active SCO links to USB alternate settings through a three-entry lookup table when CVSD traffic uses trans…
-
Unscored —
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop l2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED state to support L2CAP reconfiguration (e.g. MTU changes…
-
Unscored —
Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() l2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer and id_addr_timer while holding conn->lock. However, the work function…
-
Unscored —
Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock btintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET and Intel exception-info retrieval) without holding …
-
Unscored —
udp: Fix wildcard bind conflict check when using hash2
In the Linux kernel, the following vulnerability has been resolved: udp: Fix wildcard bind conflict check when using hash2 When binding a udp_sock to a local address and port, UDP uses two hashes (udptable->hash and udptable->hash2) for collision detection. T…
-
Unscored —
net: bcmasp: fix double free of WoL irq
In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix double free of WoL irq We do not need to free wol_irq since it was instantiated with devm_request_irq(). So devres will free for us.
-
Unscored —
nfc: nci: fix circular locking dependency in nci_close_device
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix circular locking dependency in nci_close_device nci_close_device() flushes rx_wq and tx_wq while holding req_lock. This causes a circular locking dependency because nci_rx_work(…
-
Unscored —
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Before using sk pointer, check if it is null. Fix the following: KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000…
-
Unscored —
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without f…
-
Unscored —
erofs: set fileio bio failed in short read case
In the Linux kernel, the following vulnerability has been resolved: erofs: set fileio bio failed in short read case For file-backed mount, IO requests are handled by vfs_iocb_iter_read(). However, it can be interrupted by SIGKILL, returning the number of byte…
-
Unscored —
af_key: validate families in pfkey_send_migrate()
In the Linux kernel, the following vulnerability has been resolved: af_key: validate families in pfkey_send_migrate() syzbot was able to trigger a crash in skb_put() [1] Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecreq…
-
Unscored —
xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly In iptfs_reassem_cont(), IP-TFS attempts to append data to the new inner packet 'newskb' that is being reassembled. First …
-
Unscored —
esp: fix skb leak with espintcp and async crypto
In the Linux kernel, the following vulnerability has been resolved: esp: fix skb leak with espintcp and async crypto When the TX queue for espintcp is full, esp_output_tail_tcp will return an error and not free the skb, because with synchronous crypto, the co…
-
Unscored —
btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
In the Linux kernel, the following vulnerability has been resolved: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create We have recently observed a number of subvolumes with broken dentries. ls-ing the parent dir looks like: drwxrwxrwt 1 root root 16 Ja…
-
Unscored —
HID: apple: avoid memory leak in apple_report_fixup()
In the Linux kernel, the following vulnerability has been resolved: HID: apple: avoid memory leak in apple_report_fixup() The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() do…
-
Unscored —
module: Fix kernel panic when a symbol st_shndx is out of bounds
In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol st_shndx is out of bounds The module loader doesn't check for bounds of the ELF section index in simplify_symbols(): for (i = 1; i < symsec->sh_size / s…
-
Unscored —
HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: avoid memory leak in magicmouse_report_fixup() The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of re…
-
Unscored —
nvme-pci: ensure we're polling a polled queue
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: ensure we're polling a polled queue A user can change the polled queue count at run time. There's a brief window during a reset where a hipri task may try to poll that queue before …
-
Unscored —
HID: asus: avoid memory leak in asus_report_fixup()
In the Linux kernel, the following vulnerability has been resolved: HID: asus: avoid memory leak in asus_report_fixup() The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc()…
-
Unscored —
bpf: Fix exception exit lock checking for subprogs
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix exception exit lock checking for subprogs process_bpf_exit_full() passes check_lock = !curframe to check_resource_leak(), which is false in cases when bpf_throw() is called from a st…
-
Unscored —
driver core: platform: use generic driver_override infrastructure
In the Linux kernel, the following vulnerability has been resolved: driver core: platform: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus acc…
-
Unscored —
cxl/region: Fix leakage in __construct_region()
In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix leakage in __construct_region() Failing the first sysfs_update_group() needs to explicitly kfree the resource as it is too early for cxl_region_iomem_release() to do so.
-
Unscored —
cxl/port: Fix use after free of parent_port in cxl_detach_ep()
In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use after free of parent_port in cxl_detach_ep() cxl_detach_ep() is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each…
-
Unscored —
ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
In the Linux kernel, the following vulnerability has been resolved: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() When querying a nexthop object via RTM_GETNEXTHOP, the kernel currently allocates a fixed-size skb using NLMSG_GOODSIZE. While suf…
Revision history
-
#99
Neue Updates von Debian aufgenommen
-
#98
Neue Updates von Ubuntu aufgenommen
-
#97
Neue Updates von Debian aufgenommen
-
#96
Neue Updates von SUSE aufgenommen
-
#95
Neue Updates von SUSE aufgenommen
-
#94
Neue Updates von Red Hat aufgenommen
-
#93
Neue Updates von SUSE aufgenommen
-
#92
Neue Updates von Ubuntu aufgenommen
-
#91
Neue Updates von Red Hat und IBM aufgenommen
-
#90
Neue Updates von SUSE aufgenommen
-
#89
Neue Updates von SUSE aufgenommen
-
#88
Neue Updates von Ubuntu aufgenommen
-
#87
Neue Updates von openSUSE und SUSE aufgenommen
-
#86
Neue Updates von Ubuntu und SUSE aufgenommen
-
#85
Neue Updates von Ubuntu aufgenommen
-
#84
Neue Updates von SUSE aufgenommen
-
#83
Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen
-
#82
Neue Updates von Rocky Enterprise Software Foundation, SUSE und Oracle Linux aufgenommen
-
#81
Neue Updates von Red Hat und SUSE aufgenommen
-
#80
Neue Updates von SUSE aufgenommen
-
#79
Neue Updates von Oracle Linux aufgenommen
-
#78
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#77
Neue Updates von Red Hat aufgenommen
-
#76
Neue Updates von Oracle Linux aufgenommen
-
#75
Neue Updates von Dell und Oracle Linux aufgenommen
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2026-31434
https://lore.kernel.org/linux-cve-announce/2026042240-CVE-2026-31434-87f3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31435
https://lore.kernel.org/linux-cve-announce/2026042242-CVE-2026-31435-f0f5@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31436
https://lore.kernel.org/linux-cve-announce/2026042242-CVE-2026-31436-7ac7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31437
https://lore.kernel.org/linux-cve-announce/2026042243-CVE-2026-31437-7cba@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31438
https://lore.kernel.org/linux-cve-announce/2026042243-CVE-2026-31438-66c2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31439
https://lore.kernel.org/linux-cve-announce/2026042243-CVE-2026-31439-b890@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31440
https://lore.kernel.org/linux-cve-announce/2026042244-CVE-2026-31440-78bd@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31441
https://lore.kernel.org/linux-cve-announce/2026042244-CVE-2026-31441-eb92@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31442
https://lore.kernel.org/linux-cve-announce/2026042244-CVE-2026-31442-dece@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31443
https://lore.kernel.org/linux-cve-announce/2026042245-CVE-2026-31443-0b7d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31444
https://lore.kernel.org/linux-cve-announce/2026042245-CVE-2026-31444-8b6e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31445
https://lore.kernel.org/linux-cve-announce/2026042246-CVE-2026-31445-cbbf@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31446
https://lore.kernel.org/linux-cve-announce/2026042246-CVE-2026-31446-8993@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31447
https://lore.kernel.org/linux-cve-announce/2026042246-CVE-2026-31447-ed33@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31448
https://lore.kernel.org/linux-cve-announce/2026042247-CVE-2026-31448-3c50@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31449
https://lore.kernel.org/linux-cve-announce/2026042247-CVE-2026-31449-0942@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31450
https://lore.kernel.org/linux-cve-announce/2026042247-CVE-2026-31450-19fa@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31451
https://lore.kernel.org/linux-cve-announce/2026042248-CVE-2026-31451-cec9@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31452
https://lore.kernel.org/linux-cve-announce/2026042248-CVE-2026-31452-9f5b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31453
https://lore.kernel.org/linux-cve-announce/2026042248-CVE-2026-31453-6c3f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31454
https://lore.kernel.org/linux-cve-announce/2026042249-CVE-2026-31454-ae01@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31455
https://lore.kernel.org/linux-cve-announce/2026042249-CVE-2026-31455-1c26@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31456
https://lore.kernel.org/linux-cve-announce/2026042249-CVE-2026-31456-3db6@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31457
https://lore.kernel.org/linux-cve-announce/2026042250-CVE-2026-31457-601a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31458
https://lore.kernel.org/linux-cve-announce/2026042250-CVE-2026-31458-5a8e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31459
https://lore.kernel.org/linux-cve-announce/2026042250-CVE-2026-31459-0600@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31460
https://lore.kernel.org/linux-cve-announce/2026042251-CVE-2026-31460-2405@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31461
https://lore.kernel.org/linux-cve-announce/2026042251-CVE-2026-31461-2b9c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31462
https://lore.kernel.org/linux-cve-announce/2026042251-CVE-2026-31462-d050@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31463
https://lore.kernel.org/linux-cve-announce/2026042252-CVE-2026-31463-7bc8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31464
https://lore.kernel.org/linux-cve-announce/2026042252-CVE-2026-31464-f9c5@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31465
https://lore.kernel.org/linux-cve-announce/2026042252-CVE-2026-31465-66a4@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31466
https://lore.kernel.org/linux-cve-announce/2026042253-CVE-2026-31466-4fba@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31467
https://lore.kernel.org/linux-cve-announce/2026042253-CVE-2026-31467-914b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31468
https://lore.kernel.org/linux-cve-announce/2026042253-CVE-2026-31468-13b8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31469
https://lore.kernel.org/linux-cve-announce/2026042254-CVE-2026-31469-65d8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31470
https://lore.kernel.org/linux-cve-announce/2026042254-CVE-2026-31470-350c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31471
https://lore.kernel.org/linux-cve-announce/2026042254-CVE-2026-31471-d8ba@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31472
https://lore.kernel.org/linux-cve-announce/2026042255-CVE-2026-31472-396d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31473
https://lore.kernel.org/linux-cve-announce/2026042255-CVE-2026-31473-fad0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31474
https://lore.kernel.org/linux-cve-announce/2026042256-CVE-2026-31474-8673@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31475
https://lore.kernel.org/linux-cve-announce/2026042256-CVE-2026-31475-74ed@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31476
https://lore.kernel.org/linux-cve-announce/2026042256-CVE-2026-31476-bb58@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31477
https://lore.kernel.org/linux-cve-announce/2026042257-CVE-2026-31477-2808@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31478
https://lore.kernel.org/linux-cve-announce/2026042257-CVE-2026-31478-7be0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31479
https://lore.kernel.org/linux-cve-announce/2026042257-CVE-2026-31479-3a31@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31480
https://lore.kernel.org/linux-cve-announce/2026042258-CVE-2026-31480-c2bf@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31481
https://lore.kernel.org/linux-cve-announce/2026042258-CVE-2026-31481-390e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31482
https://lore.kernel.org/linux-cve-announce/2026042258-CVE-2026-31482-b482@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31483
https://lore.kernel.org/linux-cve-announce/2026042259-CVE-2026-31483-9bc8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31484
https://lore.kernel.org/linux-cve-announce/2026042259-CVE-2026-31484-3268@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31485
https://lore.kernel.org/linux-cve-announce/2026042259-CVE-2026-31485-e15c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31486
https://lore.kernel.org/linux-cve-announce/2026042200-CVE-2026-31486-52d4@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31487
https://lore.kernel.org/linux-cve-announce/2026042200-CVE-2026-31487-a0ca@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31488
https://lore.kernel.org/linux-cve-announce/2026042200-CVE-2026-31488-fe04@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31489
https://lore.kernel.org/linux-cve-announce/2026042201-CVE-2026-31489-3a01@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31490
https://lore.kernel.org/linux-cve-announce/2026042201-CVE-2026-31490-8635@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31491
https://lore.kernel.org/linux-cve-announce/2026042201-CVE-2026-31491-e599@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31492
https://lore.kernel.org/linux-cve-announce/2026042202-CVE-2026-31492-2f6c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31493
https://lore.kernel.org/linux-cve-announce/2026042202-CVE-2026-31493-4d67@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31494
https://lore.kernel.org/linux-cve-announce/2026042202-CVE-2026-31494-647e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31495
https://lore.kernel.org/linux-cve-announce/2026042203-CVE-2026-31495-f86b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31496
https://lore.kernel.org/linux-cve-announce/2026042203-CVE-2026-31496-e130@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31497
https://lore.kernel.org/linux-cve-announce/2026042203-CVE-2026-31497-f54a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31498
https://lore.kernel.org/linux-cve-announce/2026042204-CVE-2026-31498-1aee@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31499
https://lore.kernel.org/linux-cve-announce/2026042204-CVE-2026-31499-0142@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31500
https://lore.kernel.org/linux-cve-announce/2026042204-CVE-2026-31500-c032@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31501
https://lore.kernel.org/linux-cve-announce/2026042205-CVE-2026-31501-113b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31502
https://lore.kernel.org/linux-cve-announce/2026042205-CVE-2026-31502-4b98@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31503
https://lore.kernel.org/linux-cve-announce/2026042206-CVE-2026-31503-602a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31504
https://lore.kernel.org/linux-cve-announce/2026042206-CVE-2026-31504-10f4@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31505
https://lore.kernel.org/linux-cve-announce/2026042206-CVE-2026-31505-a1db@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31506
https://lore.kernel.org/linux-cve-announce/2026042207-CVE-2026-31506-31d7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31507
https://lore.kernel.org/linux-cve-announce/2026042207-CVE-2026-31507-cbc0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31508
https://lore.kernel.org/linux-cve-announce/2026042207-CVE-2026-31508-4def@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31509
https://lore.kernel.org/linux-cve-announce/2026042208-CVE-2026-31509-8609@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31510
https://lore.kernel.org/linux-cve-announce/2026042208-CVE-2026-31510-1c90@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31511
https://lore.kernel.org/linux-cve-announce/2026042208-CVE-2026-31511-b569@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-31512
https://lore.kernel.org/linux-cve-announce/2026042209-CVE-2026-31512-b386@gregkh/