Skip to content
OpenAdvisories

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder potentiell beliebigen Programmcode auszuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 62

  • Critical 9.8

    ext4: handle wraparound when searching for blocks for indirect mapped blocks

    In the Linux kernel, the following vulnerability has been resolved: ext4: handle wraparound when searching for blocks for indirect mapped blocks Commit 4865c768b563 ("ext4: always allocate blocks only from groups inode can use") restricts what blocks will be …

  • Critical 9.4

    netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipa…

  • Critical 9.1

    dcache: Limit the minimal number of bucket to two

    In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two There is an OOB read problem on dentry_hashtable when user sets 'dhash_entries=1': BUG: unable to handle page fault for address: ffff888b30b7…

  • Critical 9.1

    net: ioam6: fix OOB and missing lock

    In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to…

  • Critical 9.1

    btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()

    In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will…

  • High 8.8

    wifi: brcmfmac: validate bsscfg indices in IF events

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw b…

  • High 8.8

    fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

    In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic …

  • High 8.8

    wifi: wl1251: validate packet IDs before indexing tx_frames

    In the Linux kernel, the following vulnerability has been resolved: wifi: wl1251: validate packet IDs before indexing tx_frames wl1251_tx_packet_cb() uses the firmware completion ID directly to index the fixed 16-entry wl->tx_frames[] array. The ID is a raw u…

  • High 7.8

    netfilter: nft_ct: drop pending enqueued packets on removal

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: drop pending enqueued packets on removal Packets sitting in nfqueue might hold a reference to: - templates that specify the conntrack zone, because a percpu area is used an…

  • High 7.8

    xfs: don't irele after failing to iget in xfs_attri_recover_work

    In the Linux kernel, the following vulnerability has been resolved: xfs: don't irele after failing to iget in xfs_attri_recover_work xlog_recovery_iget* never set @ip to a valid pointer if they return an error, so this irele will walk off a dangling pointer. …

  • High 7.8

    bpf: Reset register ID for BPF_END value tracking

    In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register ID for BPF_END value tracking When a register undergoes a BPF_END (byte swap) operation, its scalar value is mutated in-place. If this register previously shared a scalar …

  • High 7.8
    CVE-2026-43074 Public exploit

    eventpoll: defer struct eventpoll free to RCU grace period

    In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurr…

  • High 7.8

    ocfs2: fix out-of-bounds write in ocfs2_write_end_inline

    In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2_write_end_inline KASAN reports a use-after-free write of 4086 bytes in ocfs2_write_end_inline, called from ocfs2_write_end_nolock during a copy_file_ra…

  • High 7.8

    ocfs2: validate inline data i_size during inode read

    In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline data i_size during inode read When reading an inode from disk, ocfs2_validate_inode_block() performs various sanity checks but does not validate the size of inline data…

  • High 7.8

    crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl

    In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl When page reassignment was added to af_alg_pull_tsgl the original loop wasn't updated so it may try to reassign one more pa…

  • High 7.8

    netfilter: nfnetlink_queue: make hash table per queue

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: make hash table per queue Sharing a global hash table among all queues is tempting, but it can cause crash: BUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0…

  • High 7.8

    xfrm: Wait for RCU readers during policy netns exit

    In the Linux kernel, the following vulnerability has been resolved: xfrm: Wait for RCU readers during policy netns exit xfrm_policy_fini() frees the policy_bydst hash tables after flushing the policy work items and deleting all policies, but it does not wait …

  • High 7.8

    xsk: tighten UMEM headroom validation to account for tailroom and min frame

    In the Linux kernel, the following vulnerability has been resolved: xsk: tighten UMEM headroom validation to account for tailroom and min frame The current headroom validation in xdp_umem_reg() could leave us with insufficient space dedicated to even receive …

  • High 7.8

    cachefiles: fix incorrect dentry refcount in cachefiles_cull()

    In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix incorrect dentry refcount in cachefiles_cull() The patch mentioned below changed cachefiles_bury_object() to expect 2 references to the 'rep' dentry. Three of the callers were…

  • High 7.8

    HID: roccat: fix use-after-free in roccat_report_event

    In the Linux kernel, the following vulnerability has been resolved: HID: roccat: fix use-after-free in roccat_report_event roccat_report_event() iterates over the device->readers list without holding the readers_lock. This allows a concurrent roccat_release()…

  • High 7.8

    netfilter: ctnetlink: ensure safe access to master conntrack

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. …

  • High 7.8

    RDMA/irdma: Fix double free related to rereg_user_mr

    In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix double free related to rereg_user_mr If IB_MR_REREG_TRANS is set during rereg_user_mr, the umem will be released and a new one will be allocated in irdma_rereg_mr_trans. If an…

  • High 7.5

    ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

    In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: fix null-ptr-deref in icmp_build_probe() ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the IPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing…

  • High 7.5

    ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() We need to check __in6_dev_get() for possible NULL value, as suggested by Yiming Qian. Also add skb_dst_dev_rcu() inst…

  • High 7.1

    Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() l2cap_ecred_reconf_rsp() casts the incoming data to struct l2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with…

  • Unscored —

    Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") introduced mgmt_pending_valid(), which not only validates …

  • Unscored —

    serial: 8250: Fix TX deadlock when using DMA

    In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Fix TX deadlock when using DMA `dmaengine_terminate_async` does not guarantee that the `__dma_tx_complete` callback will run. The callback is currently the only place where `dma…

  • Unscored —

    dmaengine: idxd: Fix not releasing workqueue on .release()

    In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix not releasing workqueue on .release() The workqueue associated with an DSA/IAA device is not released when the object is freed.

  • Unscored —

    ext4: always drain queued discard work in ext4_mb_release()

    In the Linux kernel, the following vulnerability has been resolved: ext4: always drain queued discard work in ext4_mb_release() While reviewing recent ext4 patch[1], Sashiko raised the following concern[2]: > If the filesystem is initially mounted with the di…

  • Unscored —

    ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths During code review, Joseph found that ext4_fc_replay_inode() calls ext4_get_fc_inode_loc() to get the inode location, which holds …

  • Unscored —

    ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()

    In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() There's issue as follows: ... EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 …

  • Unscored —

    Bluetooth: hci_ll: Fix firmware leak on error path

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_ll: Fix firmware leak on error path Smatch reports: drivers/bluetooth/hci_ll.c:587 download_firmware() warn: 'fw' from request_firmware() not released on lines: 544. In downloa…

  • Unscored —

    drm/vc4: platform_get_irq_byname() returns an int

    In the Linux kernel, the following vulnerability has been resolved: drm/vc4: platform_get_irq_byname() returns an int platform_get_irq_byname() will return a negative value if an error happens, so it should be checked and not just passed directly into devm_re…

  • Unscored —

    x86-64: rename misleadingly named '__copy_user_nocache()' function

    In the Linux kernel, the following vulnerability has been resolved: x86-64: rename misleadingly named '__copy_user_nocache()' function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It i…

  • Unscored —

    crypto: algif_aead - Fix minimum RX size check for decryption

    In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Fix minimum RX size check for decryption The check for the minimum receive buffer size did not take the tag size into account during decryption. Fix this by adding the re…

  • Unscored —

    perf/x86/intel/uncore: Skip discovery table for offline dies

    In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Skip discovery table for offline dies This warning can be triggered if NUMA is disabled and the system boots with fewer CPUs than the number of CPUs in die 0. WARNING: …

  • Unscored —

    l2tp: Drop large packets with UDP encap

    In the Linux kernel, the following vulnerability has been resolved: l2tp: Drop large packets with UDP encap syzbot reported a WARN on my patch series [1]. The actual issue is an overflow of 16-bit UDP length field, and it exists in the upstream code. My serie…

  • Unscored —

    net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+

    In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ Fix the field masks to match the hardware layout documented in downstream GSI (GSI_V3_0_EE_n_GSI_EE_GENERIC_CMD_*). Notably this f…

  • Unscored —

    net: txgbe: leave space for null terminators on property_entry

    In the Linux kernel, the following vulnerability has been resolved: net: txgbe: leave space for null terminators on property_entry Lists of struct property_entry are supposed to be terminated with an empty property, this driver currently seems to be allocatin…

  • Unscored —

    netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator When batching multiple NFLOG messages (inst->qlen > 1), __nfulnl_send() appends an NLMSG_DONE terminator with sizeof(str…

  • Unscored —

    ipvs: fix NULL deref in ip_vs_add_service error path

    In the Linux kernel, the following vulnerability has been resolved: ipvs: fix NULL deref in ip_vs_add_service error path When ip_vs_bind_scheduler() succeeds in ip_vs_add_service(), the local variable sched is set to NULL. If ip_vs_start_estimator() subsequen…

  • Unscored —

    pinctrl: mcp23s08: Disable all pin interrupts during probe

    In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Disable all pin interrupts during probe A chip being probed may have the interrupt-on-change feature enabled on some of its pins, for example after a reboot. This can cause…

  • Unscored —

    net: af_key: zero aligned sockaddr tail in PF_KEY exports

    In the Linux kernel, the following vulnerability has been resolved: net: af_key: zero aligned sockaddr tail in PF_KEY exports PF_KEY export paths use `pfkey_sockaddr_size()` when reserving sockaddr payload space, so IPv6 addresses occupy 32 bytes on the wire.…

  • Unscored —

    xfrm_user: fix info leak in build_mapping()

    In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_mapping() struct xfrm_usersa_id has a one-byte padding hole after the proto field, which ends up never getting set to zero before copying out to userspace. F…

  • Unscored —

    xfrm: fix refcount leak in xfrm_migrate_policy_find

    In the Linux kernel, the following vulnerability has been resolved: xfrm: fix refcount leak in xfrm_migrate_policy_find syzkaller reported a memory leak in xfrm_policy_alloc: BUG: memory leak unreferenced object 0xffff888114d79000 (size 1024): comm "syz.1.17"…

  • Unscored —

    xsk: validate MTU against usable frame size on bind

    In the Linux kernel, the following vulnerability has been resolved: xsk: validate MTU against usable frame size on bind AF_XDP bind currently accepts zero-copy pool configurations without verifying that the device MTU fits into the usable frame space provided…

  • Unscored —

    ixgbevf: add missing negotiate_features op to Hyper-V ops table

    In the Linux kernel, the following vulnerability has been resolved: ixgbevf: add missing negotiate_features op to Hyper-V ops table Commit a7075f501bd3 ("ixgbevf: fix mailbox API compatibility by negotiating supported features") added the .negotiate_features …

  • Unscored —

    ASoC: SDCA: Fix errors in IRQ cleanup

    In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Fix errors in IRQ cleanup IRQs are enabled through sdca_irq_populate() from component probe using devm_request_threaded_irq(), this however means the IRQs can persist if the sound…

  • Unscored —

    mshv: Fix infinite fault loop on permission-denied GPA intercepts

    In the Linux kernel, the following vulnerability has been resolved: mshv: Fix infinite fault loop on permission-denied GPA intercepts Prevent infinite fault loops when guests access memory regions without proper permissions. Currently, mshv_handle_gpa_interce…

  • Unscored —

    PCI: hv: Fix double ida_free in hv_pci_probe error path

    In the Linux kernel, the following vulnerability has been resolved: PCI: hv: Fix double ida_free in hv_pci_probe error path If hv_pci_probe() fails after storing the domain number in hbus->bridge->domain_nr, there is a call to free this domain_nr via pci_bus_…

  • Unscored —

    nfc: s3fwrn5: allocate rx skb before consuming bytes

    In the Linux kernel, the following vulnerability has been resolved: nfc: s3fwrn5: allocate rx skb before consuming bytes s3fwrn82_uart_read() reports the number of accepted bytes to the serdev core. The current code consumes bytes into recv_skb and may alread…

  • Unscored —

    bridge: guard local VLAN-0 FDB helpers against NULL vlan group

    In the Linux kernel, the following vulnerability has been resolved: bridge: guard local VLAN-0 FDB helpers against NULL vlan group When CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and nbp_vlan_group() return NULL (br_private.h stub definitions). …

  • Unscored —

    net: airoha: Fix memory leak in airoha_qdma_rx_process()

    In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix memory leak in airoha_qdma_rx_process() If an error occurs on the subsequents buffers belonging to the non-linear part of the skb (e.g. due to an error in the payload length …

  • Unscored —

    net: lapbether: handle NETDEV_PRE_TYPE_CHANGE

    In the Linux kernel, the following vulnerability has been resolved: net: lapbether: handle NETDEV_PRE_TYPE_CHANGE lapbeth_data_transmit() expects the underlying device type to be ARPHRD_ETHER. Returning NOTIFY_BAD from lapbeth_device_event() makes sure bondin…

  • Unscored —

    drm/vc4: Fix a memory leak in hang state error path

    In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Fix a memory leak in hang state error path When vc4_save_hang_state() encounters an early return condition, it returns without freeing the previously allocated `kernel_state`, leakin…

  • Unscored —

    drm/vc4: Fix memory leak of BO array in hang state

    In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Fix memory leak of BO array in hang state The hang state's BO array is allocated separately with kzalloc() in vc4_save_hang_state() but never freed in vc4_free_hang_state(). Add the …

  • Unscored —

    xfrm: account XFRMA_IF_ID in aevent size calculation

    In the Linux kernel, the following vulnerability has been resolved: xfrm: account XFRMA_IF_ID in aevent size calculation xfrm_get_ae() allocates the reply skb with xfrm_aevent_msgsize(), then build_aevent() appends attributes including XFRMA_IF_ID when x->if_…

  • Unscored —

    soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei

    In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei It looks element length declared in servreg_loc_pfr_req_ei for reason not matching servreg_loc_pfr_req's reason field due wh…

  • Unscored —

    x86: shadow stacks: proper error handling for mmap lock

    In the Linux kernel, the following vulnerability has been resolved: x86: shadow stacks: proper error handling for mmap lock 김영민 reports that shstk_pop_sigframe() doesn't check for errors from mmap_read_lock_killable(), which is a silly oversight, and also sho…

  • Unscored —

    srcu: Use irq_work to start GP in tiny SRCU

    In the Linux kernel, the following vulnerability has been resolved: srcu: Use irq_work to start GP in tiny SRCU Tiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(), which acquires the workqueue pool->lock. This causes a lockdep splat when cal…

  • Unscored —

    btrfs: fix zero size inode with non-zero size after log replay

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix zero size inode with non-zero size after log replay When logging that an inode exists, as part of logging a new name or logging new dir entries for a directory, we always set the g…

  • Unscored —

    Bluetooth: hci_sync: annotate data-races around hdev->req_status

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: annotate data-races around hdev->req_status __hci_cmd_sync_sk() sets hdev->req_status under hdev->req_lock: hdev->req_status = HCI_REQ_PEND; However, several other functi…

Revision history

  1. #105

    Neue Updates von Debian aufgenommen

  2. #104

    Neue Updates von Red Hat aufgenommen

  3. #103

    Neue Updates von Ubuntu aufgenommen

  4. #102

    Neue Updates von SUSE aufgenommen

  5. #101

    Neue Updates von SUSE aufgenommen

  6. #100

    Neue Updates von Debian aufgenommen

  7. #99

    Neue Updates von SUSE aufgenommen

  8. #98

    Neue Updates von Red Hat aufgenommen

  9. #97

    Neue Updates von SUSE aufgenommen

  10. #96

    Neue Updates von Oracle Linux und Debian aufgenommen

  11. #95

    Neue Updates von Oracle Linux aufgenommen

  12. #94

    Neue Updates von Oracle Linux aufgenommen

  13. #93

    Neue Updates von Ubuntu aufgenommen

  14. #92

    Neue Updates von Ubuntu aufgenommen

  15. #91

    Neue Updates von Oracle Linux aufgenommen

  16. #90

    Neue Updates von Ubuntu aufgenommen

  17. #89

    Neue Updates von IBM aufgenommen

  18. #88

    Neue Updates von Red Hat und SUSE aufgenommen

  19. #87

    Neue Updates von Red Hat aufgenommen

  20. #86

    Neue Updates von openSUSE aufgenommen

  21. #85

    Neue Updates von SUSE aufgenommen

  22. #84

    Neue Updates von Ubuntu aufgenommen

  23. #83

    Neue Updates von Red Hat und SUSE aufgenommen

  24. #82

    Neue Updates von Red Hat aufgenommen

  25. #81

    Neue Updates von Red Hat, Oracle Linux und SUSE aufgenommen

References