Summary
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht spezifizierte Angriffe durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 178
-
Critical 9.8
dlm: validate length in dlm_search_rsb_tree
In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-…
-
Critical 9.8
ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed …
-
Critical 9.8
ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide how much data to write for each node. It trusts …
-
Critical 9.8
tcp: fix potential race in tcp_v6_syn_recv_sock()
In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is a…
-
Critical 9.8
net: do not pass flow_id to set_rps_cpu()
In the Linux kernel, the following vulnerability has been resolved: net: do not pass flow_id to set_rps_cpu() Blamed commit made the assumption that the RPS table for each receive queue would have the same size, and that it would not change. Compute flow_id i…
-
Critical 9.1
netconsole: avoid OOB reads, msg is not nul-terminated
In the Linux kernel, the following vulnerability has been resolved: netconsole: avoid OOB reads, msg is not nul-terminated msg passed to netconsole from the console subsystem is not guaranteed to be nul-terminated. Before recent commit 7eab73b18630 ("netconso…
-
High 8.8
xfs: fix freemap adjustments when adding xattrs to leaf blocks
In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test V…
-
High 8.8
wifi: iwlwifi: fix 22000 series SMEM parsing
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix 22000 series SMEM parsing If the firmware were to report three LMACs (which doesn't exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is an overrun of the array. Rejec…
-
High 8.8
wifi: rtw89: pci: validate release report content before using for RTL8922DE
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: validate release report content before using for RTL8922DE The commit 957eda596c76 ("wifi: rtw89: pci: validate sequence number of TX release report") does validation on exi…
-
High 8.8
xfs: delete attr leaf freemap entries when empty
In the Linux kernel, the following vulnerability has been resolved: xfs: delete attr leaf freemap entries when empty Back in commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow"), Brian Foster observed that it's possible for a small freem…
-
High 8.8
cifs: Fix locking usage for tcon fields
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tcon fields We used to use the cifs_tcp_ses_lock to protect a lot of objects that are not just the server, ses or tcon lists. We later introduced srv_lock, ses_loc…
-
High 8.8
net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
In the Linux kernel, the following vulnerability has been resolved: net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets When the FarSync T-series card is being detached, the fst_card_info is deallocated in fst_remove_one(). However, the f…
-
High 8.8
smb: client: prevent races in ->query_interfaces()
In the Linux kernel, the following vulnerability has been resolved: smb: client: prevent races in ->query_interfaces() It was possible for two query interface works to be concurrently trying to update the interfaces. Prevent this by checking and updating ifac…
-
High 8.8
9p/xen: protect xen_9pfs_front_free against concurrent calls
In the Linux kernel, the following vulnerability has been resolved: 9p/xen: protect xen_9pfs_front_free against concurrent calls The xenwatch thread can race with other back-end change notifications and call xen_9pfs_front_free() twice, hitting the observed g…
-
High 8.8
net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle dma_free_coherent() in error path takes priv->rx_buf.alloc_len as the dma handle. This would lead to improper unmapping of the buffer…
-
High 8.6
xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() xfrm6_get_saddr() does not check the return value of ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable source addres…
-
High 8.4
mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()
In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq() The cluster_cfg array is dynamically allocated to hold per-CPU configuration structures, with its size based…
-
High 8.2
netfilter: xt_tcpmss: check remaining length before reading optlen
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validatin…
-
High 8.2
netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`, which is still 0 from its initialization at the …
-
High 8.1
Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ This adds a check for encryption key size upon receiving L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which e…
-
High 7.9
KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields cont…
-
High 7.8
rpmsg: core: fix race in driver_override_show() and use core helper
In the Linux kernel, the following vulnerability has been resolved: rpmsg: core: fix race in driver_override_show() and use core helper The driver_override_show function reads the driver_override string without holding the device_lock. However, the store func…
-
High 7.8
ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls The size of the data behind of scontrol->ipc_control_data for bytes controls is: [1] sizeof(struct sof_ipc4_control_da…
-
High 7.8
ALSA: mixer: oss: Add card disconnect checkpoints
In the Linux kernel, the following vulnerability has been resolved: ALSA: mixer: oss: Add card disconnect checkpoints ALSA OSS mixer layer calls the kcontrol ops rather individually, and pending calls might be not always caught at disconnecting the device. Fo…
-
High 7.8
RDMA/umem: Fix double dma_buf_unpin in failure path
In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately …
-
High 7.8
perf/arm-cmn: Reject unsupported hardware configurations
In the Linux kernel, the following vulnerability has been resolved: perf/arm-cmn: Reject unsupported hardware configurations So far we've been fairly lax about accepting both unknown CMN models (at least with a warning), and unknown revisions of those which w…
-
High 7.8
xfs: remove xfs_attr_leaf_hasname
In the Linux kernel, the following vulnerability has been resolved: xfs: remove xfs_attr_leaf_hasname The calling convention of xfs_attr_leaf_hasname() is problematic, because it returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer when xfs_at…
-
High 7.8
procfs: fix possible double mmput() in do_procmap_query()
In the Linux kernel, the following vulnerability has been resolved: procfs: fix possible double mmput() in do_procmap_query() When user provides incorrectly sized buffer for build ID for PROCMAP_QUERY we return with -ENAMETOOLONG error. After recent changes t…
-
High 7.8
net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
In the Linux kernel, the following vulnerability has been resolved: net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls netif_stop_queue() and netif_wake_queue(). These are TX queue fl…
-
High 7.8
drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. Th…
-
High 7.8
media: mtk-mdp: Fix error handling in probe function
In the Linux kernel, the following vulnerability has been resolved: media: mtk-mdp: Fix error handling in probe function Add mtk_mdp_unregister_m2m_device() on the error handling path to prevent resource leak. Add check for the return value of vpu_get_plat_de…
-
High 7.8
PCI: Fix pci_slot_trylock() error handling
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_slot_trylock() error handling Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in pci_s…
-
High 7.8
LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE The arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE - which is a valid index - so add a check for this.
-
High 7.8
KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() Add SRCU read-side protection when reading PDPTR registers in __get_sregs2(). Reading PDPTRs may trigger access to guest mem…
-
High 7.8
media: verisilicon: AV1: Fix tile info buffer size
In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: AV1: Fix tile info buffer size Each tile info is composed of: row_sb, col_sb, start_pos and end_pos (4 bytes each). So the total required memory is AV1_MAX_TILES * 16 byte…
-
High 7.8
drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
In the Linux kernel, the following vulnerability has been resolved: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying the atmel_hlcdc_plane state structure without properly…
-
High 7.8
drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 This commit simplifies the amdgpu_gem_va_ioctl function, key updates include: - Moved the lo…
-
High 7.8
vhost: move vdpa group bound check to vhost_vdpa
In the Linux kernel, the following vulnerability has been resolved: vhost: move vdpa group bound check to vhost_vdpa Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them. While we're at it, fix a bug in v…
-
High 7.8
media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
In the Linux kernel, the following vulnerability has been resolved: media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() vfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop bound and passes the index to vfe_isr_reg_update().…
-
High 7.8
alpha: fix user-space corruption during memory compaction
In the Linux kernel, the following vulnerability has been resolved: alpha: fix user-space corruption during memory compaction Alpha systems can suffer sporadic user-space crashes and heap corruption when memory compaction is enabled. Symptoms include SIGSEGV,…
-
High 7.8
media: chips-media: wave5: Fix Null reference while testing fluster
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix Null reference while testing fluster When multi instances are created/destroyed, many interrupts happens and structures for decoder are removed. "struct vpu_ins…
-
High 7.8
dm: clear cloned request bio pointer when last clone bio completes
In the Linux kernel, the following vulnerability has been resolved: dm: clear cloned request bio pointer when last clone bio completes Stale rq->bio values have been observed to cause double-initialization of cloned bios in request-based device-mapper targets…
-
High 7.8
ALSA: usb-audio: Add sanity check for OOB writes at silencing
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received pac…
-
High 7.5
jfs: nlink overflow in jfs_rename
In the Linux kernel, the following vulnerability has been resolved: jfs: nlink overflow in jfs_rename If nlink is maximal for a directory (-1) and inside that directory you perform a rename for some child directory (not moving from the parent), then the nlink…
-
High 7.5
udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb().
In the Linux kernel, the following vulnerability has been resolved: udplite: Fix null-ptr-deref in __udp_enqueue_schedule_skb(). syzbot reported null-ptr-deref of udp_sk(sk)->udp_prod_queue. [0] Since the cited commit, udp_lib_init_sock() can fail, as can udp…
-
High 7.5
rnbd-srv: Zero the rsp buffer before using it
In the Linux kernel, the following vulnerability has been resolved: rnbd-srv: Zero the rsp buffer before using it Before using the data buffer to send back the response message, zero it completely. This prevents any stray bytes to be picked up by the client s…
-
High 7.5
net: consume xmit errors of GSO frames
In the Linux kernel, the following vulnerability has been resolved: net: consume xmit errors of GSO frames udpgro_frglist.sh and udpgro_bench.sh are the flakiest tests currently in NIPA. They fail in the same exact way, TCP GRO test stalls occasionally and th…
-
High 7.5
net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query Fix a "scheduling while atomic" bug in mlx5e_ipsec_init_macs() by replacing mlx5_query_mac_address() with ether_addr_copy()…
-
High 7.5
atm: fore200e: fix use-after-free in tasklets during device removal
In the Linux kernel, the following vulnerability has been resolved: atm: fore200e: fix use-after-free in tasklets during device removal When the PCA-200E or SBA-200E adapter is being detached, the fore200e is deallocated. However, the tx_tasklet or rx_tasklet…
-
High 7.5
wifi: rtw89: pci: validate sequence number of TX release report
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: validate sequence number of TX release report Hardware rarely reports abnormal sequence number in TX release report, which will access out-of-bounds of wd_ring->pages array,…
-
High 7.5
net/rds: No shortcut out of RDS_CONN_ERROR
In the Linux kernel, the following vulnerability has been resolved: net/rds: No shortcut out of RDS_CONN_ERROR RDS connections carry a state "rds_conn_path::cp_state" and transitions from one state to another and are conditional upon an expected state: "rds_c…
-
High 7.5
net/rds: Clear reconnect pending bit
In the Linux kernel, the following vulnerability has been resolved: net/rds: Clear reconnect pending bit When canceling the reconnect worker, care must be taken to reset the reconnect-pending bit. If the reconnect worker has not yet been scheduled before it i…
-
High 7.5
ntfs: ->d_compare() must not block
In the Linux kernel, the following vulnerability has been resolved: ntfs: ->d_compare() must not block ... so don't use __getname() there. Switch it (and ntfs_d_hash(), while we are at it) to kmalloc(PATH_MAX, GFP_NOWAIT). Yes, ntfs_d_hash() almost certainly …
-
High 7.5
iommu/amd: move wait_on_sem() out of spinlock
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move wait_on_sem() out of spinlock With iommu.strict=1, the existing completion wait path can cause soft lockups under stressed environment, as wait_on_sem() busy-waits under the s…
-
High 7.5
ovpn: tcp - fix packet extraction from stream
In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - fix packet extraction from stream When processing TCP stream data in ovpn_tcp_recv, we receive large cloned skbs from __strp_rcv that may contain multiple coalesced packets. The c…
-
High 7.1
fs/ntfs3: handle attr_set_size() errors when truncating files
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_set_size() fails while truncating down, the error is silently ignored and the inode may be left in an inconsistent state.
-
High 7.1
erofs: fix interlaced plain identification for encoded extents
In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced plain identification for encoded extents Only plain data whose start position and on-disk physical length are both aligned to the block size should be classified as inte…
-
High 7.1
drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise When user provides a bogus pat_index value through the madvise IOCTL, the xe_pat_index_get_coh_mode() function perf…
-
Unscored —
hfsplus: ensure sb->s_fs_info is always cleaned up
In the Linux kernel, the following vulnerability has been resolved: hfsplus: ensure sb->s_fs_info is always cleaned up When hfsplus was converted to the new mount api a bug was introduced by changing the allocation pattern of sb->s_fs_info. If setup_bdev_supe…
-
Unscored —
most: core: fix resource leak in most_register_interface error paths
In the Linux kernel, the following vulnerability has been resolved: most: core: fix resource leak in most_register_interface error paths The function most_register_interface() did not correctly release resources if it failed early (before registering the devi…
-
Unscored —
wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() Simplify the code by using device managed memory allocations. This also fixes a memory leak in rtw_register_hw(). The supported ban…
-
Unscored —
net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels MHI stack offers the 'auto_queue' feature, which allows the MHI stack to auto queue the buffers for the RX path (DL channel). T…
-
Unscored —
memory: mtk-smi: fix device leak on larb probe
In the Linux kernel, the following vulnerability has been resolved: memory: mtk-smi: fix device leak on larb probe Make sure to drop the reference taken when looking up the SMI device during larb probe on late probe failure (e.g. probe deferral) and on driver…
-
Unscored —
memory: mtk-smi: fix device leaks on common probe
In the Linux kernel, the following vulnerability has been resolved: memory: mtk-smi: fix device leaks on common probe Make sure to drop the reference taken when looking up the SMI device during common probe on late probe failure (e.g. probe deferral) and on d…
-
Unscored —
misc: ti_fpc202: fix a potential memory leak in probe function
In the Linux kernel, the following vulnerability has been resolved: misc: ti_fpc202: fix a potential memory leak in probe function Use for_each_child_of_node_scoped() to simplify the code and ensure the device node reference is automatically released when the…
-
Unscored —
misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
In the Linux kernel, the following vulnerability has been resolved: misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() In the function bcm_vk_read(), the pointer entry is checked, indicating that it can be NULL. If entry is NULL and rc is s…
-
Unscored —
drm/amdgpu/ras: Move ras data alloc before bad page check
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/ras: Move ras data alloc before bad page check In the rare event if eeprom has only invalid address entries, allocation is skipped, this causes following NULL pointer issue [ 547.1…
-
Unscored —
drm/amdgpu: fix NULL pointer issue buffer funcs
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix NULL pointer issue buffer funcs If SDMA block not enabled, buffer_funcs will not initialize, fix the null pointer issue if buffer_funcs not initialized.
-
Unscored —
fs/buffer: add alert in try_to_free_buffers() for folios without buffers
In the Linux kernel, the following vulnerability has been resolved: fs/buffer: add alert in try_to_free_buffers() for folios without buffers try_to_free_buffers() can be called on folios with no buffers attached when filemap_release_folio() is invoked on a fo…
-
Unscored —
io_uring/zcrx: fix user_ref race between scrub and refill paths
In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix user_ref race between scrub and refill paths The io_zcrx_put_niov_uref() function uses a non-atomic check-then-decrement pattern (atomic_read followed by separate atomic_de…
-
Unscored —CVE-2026-43122 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
fbcon: check return value of con2fb_acquire_newinfo()
In the Linux kernel, the following vulnerability has been resolved: fbcon: check return value of con2fb_acquire_newinfo() If fbcon_open() fails when called from con2fb_acquire_newinfo() then info->fbcon_par pointer remains NULL which is later dereferenced. Ad…
-
Unscored —
pstore: ram_core: fix incorrect success return when vmap() fails
In the Linux kernel, the following vulnerability has been resolved: pstore: ram_core: fix incorrect success return when vmap() fails In persistent_ram_vmap(), vmap() may return NULL on failure. If offset is non-zero, adding offset_in_page(start) causes the fu…
-
Unscored —
ntfs3: fix circular locking dependency in run_unpack_ex
In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix circular locking dependency in run_unpack_ex Syzbot reported a circular locking dependency between wnd->rw_lock (sbi->used.bitmap) and ni->file.run_lock. The deadlock scenario: 1. …
-
Unscored —
ima: verify the previous kernel's IMA buffer lies in addressable RAM
In the Linux kernel, the following vulnerability has been resolved: ima: verify the previous kernel's IMA buffer lies in addressable RAM Patch series "Address page fault in ima_restore_measurement_list()", v3. When the second-stage kernel is booted via kexec …
-
Unscored —
iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected") relies on…
-
Unscored —
drm/amd/pm: Fix null pointer dereference issue
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Fix null pointer dereference issue If SMU is disabled, during RAS initialization, there will be null pointer dereference issue here.
-
Unscored —
dm-verity: correctly handle dm_bufio_client_create() failure
In the Linux kernel, the following vulnerability has been resolved: dm-verity: correctly handle dm_bufio_client_create() failure If either of the calls to dm_bufio_client_create() in verity_fec_ctr() fails, then dm_bufio_client_destroy() is later called with …
-
Unscored —
media: cx23885: Add missing unmap in snd_cx23885_hw_params()
In the Linux kernel, the following vulnerability has been resolved: media: cx23885: Add missing unmap in snd_cx23885_hw_params() In error path, add cx23885_alsa_dma_unmap() to release the resource acquired by cx23885_alsa_dma_map().
-
Unscored —
HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() Do not crash when a report has no fields. Fake USB gadgets can send their own HID report descriptors and can define report str…
-
Unscored —
ASoC: SOF: Intel: hda: Fix NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix NULL pointer dereference If there's a mismatch between the DAI links in the machine driver and the topology, it is possible that the playback/capture widget is not …
-
Unscored —
reset: gpio: suppress bind attributes in sysfs
In the Linux kernel, the following vulnerability has been resolved: reset: gpio: suppress bind attributes in sysfs This is a special device that's created dynamically and is supposed to stay in memory forever. We also currently don't have a devlink between it…
-
Unscored —
HID: magicmouse: Do not crash on missing msc->input
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: Do not crash on missing msc->input Fake USB devices can send their own report descriptors for which the input_mapping() hook does not get called. In this case, msc->input sta…
-
Unscored —
ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut Number of MW LUTs depends on NTB configuration and can be set to zero, in such scenario rounddown_pow_of_two will cause undefined b…
-
Unscored —
media: iris: gen1: Destroy internal buffers after FW releases
In the Linux kernel, the following vulnerability has been resolved: media: iris: gen1: Destroy internal buffers after FW releases After the firmware releases internal buffers, the driver was not destroying them. This left stale allocations that were no longer…
-
Unscored —
mfd: core: Add locking around 'mfd_of_node_list'
In the Linux kernel, the following vulnerability has been resolved: mfd: core: Add locking around 'mfd_of_node_list' Manipulating a list in the kernel isn't safe without some sort of mutual exclusion. Add a mutex any time we access / modify 'mfd_of_node_list'…
-
Unscored —
wifi: brcmfmac: Fix potential kernel oops when probe fails
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential kernel oops when probe fails When probe of the sdio brcmfmac device fails for some reasons (i.e. missing firmware), the sdiodev->bus is set to error instead of N…
-
Unscored —
remoteproc: imx_rproc: Fix invalid loaded resource table detection
In the Linux kernel, the following vulnerability has been resolved: remoteproc: imx_rproc: Fix invalid loaded resource table detection imx_rproc_elf_find_loaded_rsc_table() may incorrectly report a loaded resource table even when the current firmware does not…
-
Unscored —
media: iris: Add buffer to list only after successful allocation
In the Linux kernel, the following vulnerability has been resolved: media: iris: Add buffer to list only after successful allocation Move `list_add_tail()` to after `dma_alloc_attrs()` succeeds when creating internal buffers. Previously, the buffer was enqueu…
-
Unscored —
Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"
In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" This reverts commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"), whic…
-
Unscored —
powerpc/smp: Add check for kcalloc() failure in parse_thread_groups()
In the Linux kernel, the following vulnerability has been resolved: powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() As kcalloc() may fail, check its return value to avoid a NULL pointer dereference when passing it to of_property_read_u32…
-
Unscored —
net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
In the Linux kernel, the following vulnerability has been resolved: net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() The priv->rx_buffer and priv->tx_buffer are alloc'd together as contiguous buffers in uhdlc_init() but freed as two buffers …
-
Unscored —
Revert "media: iris: Add sanity check for stop streaming"
In the Linux kernel, the following vulnerability has been resolved: Revert "media: iris: Add sanity check for stop streaming" This reverts commit ad699fa78b59241c9d71a8cafb51525f3dab04d4. Revert the check that skipped stop_streaming when the instance was in I…
-
Unscored —
HID: hid-pl: handle probe errors
In the Linux kernel, the following vulnerability has been resolved: HID: hid-pl: handle probe errors Errors in init must be reported back or we'll follow a NULL pointer the first time FF is used.
-
Unscored —
erofs: fix incorrect early exits in volume label handling
In the Linux kernel, the following vulnerability has been resolved: erofs: fix incorrect early exits in volume label handling Crafted EROFS images containing valid volume labels can trigger incorrect early returns, leading to folio reference leaks. However, t…
-
Unscored —
mux: mmio: fix regmap leak on probe failure
In the Linux kernel, the following vulnerability has been resolved: mux: mmio: fix regmap leak on probe failure The mmio regmap that may be allocated during probe is never freed. Switch to using the device managed allocator so that the regmap is released on p…
-
Unscored —
net: usb: pegasus: enable basic endpoint checking
In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: enable basic endpoint checking pegasus_probe() fills URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usb_rcvbulkpipe(dev, 1) for RX data - …
-
Unscored —
octeontx2-af: CGX: fix bitmap leaks
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: fix bitmap leaks The RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap) are allocated by cgx_lmac_init() but never freed in cgx_lmac_exit(). Unbinding and reb…
-
Unscored —
staging: rtl8723bs: fix null dereference in find_network
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix null dereference in find_network The variable pwlan has the possibility of being NULL when passed into rtw_free_network_nolock() which would later dereference the vari…
-
Unscored —
mfd: macsmc: Initialize mutex
In the Linux kernel, the following vulnerability has been resolved: mfd: macsmc: Initialize mutex Initialize struct apple_smc's mutex in apple_smc_probe(). Using the mutex uninitialized surprisingly resulted only in occasional NULL pointer dereferences in app…
-
Unscored —
iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode PCIe endpoints with ATS enabled and passed through to userspace (e.g., QEMU, DPDK) can hard-lock the host w…
-
Unscored —
media: tegra-video: Fix memory leak in __tegra_channel_try_format()
In the Linux kernel, the following vulnerability has been resolved: media: tegra-video: Fix memory leak in __tegra_channel_try_format() The state object allocated by __v4l2_subdev_state_alloc() must be freed with __v4l2_subdev_state_free() when it is no longe…
-
Unscored —
md/bitmap: fix GPF in write_page caused by resize race
In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-fre…
-
Unscored —
hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nct7363) Fix a resource leak in nct7363_present_pwm_fanin When calling of_parse_phandle_with_args(), the caller is responsible to call of_node_put() to release the reference of device…
-
Unscored —
xfrm: always flush state and policy upon NETDEV_UNREGISTER event
In the Linux kernel, the following vulnerability has been resolved: xfrm: always flush state and policy upon NETDEV_UNREGISTER event syzbot is reporting that "struct xfrm_state" refcount is leaking. unregister_netdevice: waiting for netdevsim0 to become free.…
-
Unscored —
ocfs2: fix reflink preserve cleanup issue
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix reflink preserve cleanup issue commit c06c303832ec ("ocfs2: fix xattr array entry __counted_by error") doesn't handle all cases and the cleanup job for preserved xattr entries stil…
-
Unscored —
drm/buddy: Prevent BUG_ON by validating rounded allocation
In the Linux kernel, the following vulnerability has been resolved: drm/buddy: Prevent BUG_ON by validating rounded allocation When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is rounded up to the next power-of-two via roundup_pow_of_two(). Sim…
-
Unscored —
usb: dwc3: gadget: Move vbus draw to workqueue context
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Move vbus draw to workqueue context Currently dwc3_gadget_vbus_draw() can be called from atomic context, which in turn invokes power-supply-core APIs. And some these PMIC A…
-
Unscored —
EFI/CPER: don't dump the entire memory region
In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't dump the entire memory region The current logic at cper_print_fw_err() doesn't check if the error record length is big enough to handle offset. On a bad firmware, if the ofset…
-
Unscored —
net: ethernet: xscale: Check for PTP support properly
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: xscale: Check for PTP support properly In ixp4xx_get_ts_info() ixp46x_ptp_find() is called unconditionally despite this feature only existing on ixp46x, leading to the followin…
-
Unscored —
io_uring/zcrx: fix post open error handling
In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix post open error handling Closing a queue doesn't guarantee that all associated page pools are terminated right away, let the refcounting do the work instead of releasing th…
-
Unscored —
clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
In the Linux kernel, the following vulnerability has been resolved: clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 The 9FGV0841 has 8 outputs and registers 8 struct clk_hw, make sure there are 8 slots for those newly registered clk_hw pointers, else…
-
Unscored —
media: ipu6: Fix RPM reference leak in probe error paths
In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Fix RPM reference leak in probe error paths Several error paths in ipu6_pci_probe() were jumping directly to out_ipu6_bus_del_devices without releasing the runtime PM reference. …
-
Unscored —
erofs: fix incorrect early exits for invalid metabox-enabled images
In the Linux kernel, the following vulnerability has been resolved: erofs: fix incorrect early exits for invalid metabox-enabled images Crafted EROFS images with metadata compression enabled can trigger incorrect early returns, leading to folio reference leak…
-
Unscored —
gpio: sysfs: fix chip removal with GPIOs exported over sysfs
In the Linux kernel, the following vulnerability has been resolved: gpio: sysfs: fix chip removal with GPIOs exported over sysfs Currently if we export a GPIO over sysfs and unbind the parent GPIO controller, the exported attribute will remain under /sys/clas…
-
Unscored —
media: ccs: Avoid possible division by zero
In the Linux kernel, the following vulnerability has been resolved: media: ccs: Avoid possible division by zero Calculating maximum M for scaler configuration involves dividing by MIN_X_OUTPUT_SIZE limit register's value. Albeit the value is presumably non-ze…
-
Unscored —
media: cx25821: Fix a resource leak in cx25821_dev_setup()
In the Linux kernel, the following vulnerability has been resolved: media: cx25821: Fix a resource leak in cx25821_dev_setup() Add release_mem_region() if ioremap() fails to release the memory region obtained by cx25821_get_resources().
-
Unscored —
ceph: do not propagate page array emplacement errors as batch errors
In the Linux kernel, the following vulnerability has been resolved: ceph: do not propagate page array emplacement errors as batch errors When fscrypt is enabled, move_dirty_folio_in_page_array() may fail because it needs to allocate bounce buffers to store th…
-
Unscored —
media: v4l2-async: Fix error handling on steps after finding a match
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: Fix error handling on steps after finding a match Once an async connection is found to be matching with an fwnode, a sub-device may be registered (in case it wasn't already…
-
Unscored —
drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 [Why] A backport of the change made for DCN401 that addresses an issue where we turn off the PHY PLL when disab…
-
Unscored —
dm mpath: Add missing dm_put_device when failing to get scsi dh name
In the Linux kernel, the following vulnerability has been resolved: dm mpath: Add missing dm_put_device when failing to get scsi dh name When commit fd81bc5cca8f ("scsi: device_handler: Return error pointer in scsi_dh_attached_handler_name()") added code to f…
-
Unscored —
nfsd: fix nfs4_file refcount leak in nfsd_get_dir_deleg()
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_file refcount leak in nfsd_get_dir_deleg() Claude pointed out that there is a nfs4_file refcount leak in nfsd_get_dir_deleg(). Ensure that the reference to "fp" is released bef…
-
Unscored —
drm/amdgpu: validate user queue size constraints
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate user queue size constraints Add validation to ensure user queue sizes meet hardware requirements: - Size must be a power of two for efficient ring buffer wrapping - Size …
-
Unscored —
soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
In the Linux kernel, the following vulnerability has been resolved: soc: ti: pruss: Fix double free in pruss_clk_mux_setup() In the pruss_clk_mux_setup(), the devm_add_action_or_reset() indirectly calls pruss_of_free_clk_provider(), which calls of_node_put(cl…
-
Unscored —
PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions struct configfs_item_operations callbacks are defined like the following: int (*allow_link)(struct …
-
Unscored —
APEI/GHES: ARM processor Error: don't go past allocated memory
In the Linux kernel, the following vulnerability has been resolved: APEI/GHES: ARM processor Error: don't go past allocated memory If the BIOS generates a very small ARM Processor Error, or an incomplete one, the current logic will fail to deferrence err->sec…
-
Unscored —
fbdev: vt8500lcdfb: fix missing dma_free_coherent()
In the Linux kernel, the following vulnerability has been resolved: fbdev: vt8500lcdfb: fix missing dma_free_coherent() fbi->fb.screen_buffer is allocated with dma_alloc_coherent() but is not freed if the error path is reached.
-
Unscored —
ASoC: qcom: q6asm: drop DSP responses for closed data streams
In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: q6asm: drop DSP responses for closed data streams 'Commit a354f030dbce ("ASoC: qcom: q6asm: handle the responses after closing")' attempted to ignore DSP responses arriving after …
-
Unscored —
dpaa2-switch: validate num_ifs to prevent out-of-bounds write
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: validate num_ifs to prevent out-of-bounds write The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes() but never validates it against DPSW_MAX_IF (64). This …
-
Unscored —
minix: Add required sanity checking to minix_check_superblock()
In the Linux kernel, the following vulnerability has been resolved: minix: Add required sanity checking to minix_check_superblock() The fs/minix implementation of the minix filesystem does not currently support any other value for s_log_zone_size than 0. This…
-
Unscored —
tracing: ring-buffer: Fix to check event length before using
In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using Check the event length before adding it for accessing next index in rb_read_data_buffer(). Since this function is used for validat…
-
Unscored —
net: Drop the lock in skb_may_tx_timestamp()
In the Linux kernel, the following vulnerability has been resolved: net: Drop the lock in skb_may_tx_timestamp() skb_may_tx_timestamp() may acquire sock::sk_callback_lock. The lock must not be taken in IRQ context, only softirq is okay. A few drivers receive …
-
Unscored —
media: iris: gen2: Add sanity check for session stop
In the Linux kernel, the following vulnerability has been resolved: media: iris: gen2: Add sanity check for session stop In iris_kill_session, inst->state is set to IRIS_INST_ERROR and session_close is executed, which will kfree(inst_hfi_gen2->packet). If sto…
-
Unscored —
media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
In the Linux kernel, the following vulnerability has been resolved: media: i2c/tw9903: Fix potential memory leak in tw9903_probe() In one of the error paths in tw9903_probe(), the memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not fre…
-
Unscored —
net: cpsw_new: Fix potential unregister of netdev that has not been registered yet
In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: Fix potential unregister of netdev that has not been registered yet If an error occurs during register_netdev() for the first MAC in cpsw_register_ports(), even though cpsw->sl…
-
Unscored —
iommu/amd: serialize sequence allocation under concurrent TLB invalidations
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: serialize sequence allocation under concurrent TLB invalidations With concurrent TLB invalidations, completion wait randomly gets timed out because cmd_sem_val was incremented outs…
-
Unscored —
ipmi: ipmb: initialise event handler read bytes
In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: initialise event handler read bytes IPMB doesn't use i2c reads, but the handler needs to set a value. Otherwise an i2c read will return an uninitialised value from the bus driver.
-
Unscored —
media: pvrusb2: fix URB leak in pvr2_send_request_ex
In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix URB leak in pvr2_send_request_ex When pvr2_send_request_ex() submits a write URB successfully but fails to submit the read URB (e.g. returns -ENOMEM), it returns immediate…
-
Unscored —
io_uring/zcrx: fix sgtable leak on mapping failures
In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix sgtable leak on mapping failures In an unlikely case when io_populate_area_dma() fails, which could only happen on a PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA machine, io_zcrx_ma…
-
Unscored —
staging: rtl8723bs: fix memory leak on failure path
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix memory leak on failure path cfg80211_inform_bss_frame() may return NULL on failure. In that case, the allocated buffer 'buf' is not freed and the function returns earl…
-
Unscored —
clocksource/drivers/sh_tmu: Always leave device running after probe
In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/sh_tmu: Always leave device running after probe The TMU device can be used as both a clocksource and a clockevent provider. The driver tries to be smart and power itself o…
-
Unscored —
hfs: Replace BUG_ON with error handling for CNID count checks
In the Linux kernel, the following vulnerability has been resolved: hfs: Replace BUG_ON with error handling for CNID count checks In a06ec283e125 next_id, folder_count, and file_count in the super block info were expanded to 64 bits, and BUG_ONs were added to…
-
Unscored —
media: chips-media: wave5: Fix device cleanup order to prevent kernel panic
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix device cleanup order to prevent kernel panic Move video device unregistration to the beginning of the remove function to ensure all video operations are stopped…
-
Unscored —
media: radio-keene: fix memory leak in error path
In the Linux kernel, the following vulnerability has been resolved: media: radio-keene: fix memory leak in error path Fix a memory leak in usb_keene_probe(). The v4l2 control handler is initialized and controls are added, but if v4l2_device_register() or vide…
-
Unscored —
team: avoid NETDEV_CHANGEMTU event when unregistering slave
In the Linux kernel, the following vulnerability has been resolved: team: avoid NETDEV_CHANGEMTU event when unregistering slave syzbot is reporting unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 3 ref_tracker: netdev@ffff88807dcf86…
-
Unscored —
media: iris: Add missing platform data entries for SM8750
In the Linux kernel, the following vulnerability has been resolved: media: iris: Add missing platform data entries for SM8750 Two platform-data fields for SM8750 were missed: - get_vpu_buffer_size = iris_vpu33_buf_size Without this, the driver fails to alloca…
-
Unscored —
net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() Commit 38a6f0865796 ("net: sched: support hash selecting tx queue") added SKBEDIT_F_TXQ_SKBHASH support. The inclusive range s…
-
Unscored —
x86/kexec: add a sanity check on previous kernel's ima kexec buffer
In the Linux kernel, the following vulnerability has been resolved: x86/kexec: add a sanity check on previous kernel's ima kexec buffer When the second-stage kernel is booted via kexec with a limiting command line such as "mem=<size>", the physical range that…
-
Unscored —
ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS, This patch protects against invalid index out of bounds a…
-
Unscored —
soc: ti: k3-socinfo: Fix regmap leak on probe failure
In the Linux kernel, the following vulnerability has been resolved: soc: ti: k3-socinfo: Fix regmap leak on probe failure The mmio regmap allocated during probe is never freed. Switch to using the device managed allocator so that the regmap is released on pro…
-
Unscored —
drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src Trying to access link enc on a dpia link will cause a crash otherwise
-
Unscored —
kcm: fix zero-frag skb in frag_list on partial sendmsg error
In the Linux kernel, the following vulnerability has been resolved: kcm: fix zero-frag skb in frag_list on partial sendmsg error Syzkaller reported a warning in kcm_write_msgs() when processing a message with a zero-fragment skb in the frag_list. When kcm_sen…
-
Unscored —
media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
In the Linux kernel, the following vulnerability has been resolved: media: i2c/tw9906: Fix potential memory leak in tw9906_probe() In one of the error paths in tw9906_probe(), the memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not fre…
-
Unscored —
media: chips-media: wave5: Fix SError of kernel panic when closed
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix SError of kernel panic when closed SError of kernel panic rarely happened while testing fluster. The root cause was to enter suspend mode because timeout of aut…
-
Unscored —
usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() The ChipIdea UDC driver can encounter "not page aligned sg buffer" errors when a USB device is reconnected after being disconnected du…
-
Unscored —
HID: prodikeys: Check presence of pm->input_ep82
In the Linux kernel, the following vulnerability has been resolved: HID: prodikeys: Check presence of pm->input_ep82 Fake USB devices can send their own report descriptors for which the input_mapping() hook does not get called. In this case, pm->input_ep82 st…
-
Unscored —
mptcp: pm: in-kernel: always set ID as avail when rm endp
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always set ID as avail when rm endp Syzkaller managed to find a combination of actions that was generating this warning: WARNING: net/mptcp/pm_kernel.c:1074 at __mark_su…
-
Unscored —
wifi: libertas: fix WARNING in usb_tx_block
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix WARNING in usb_tx_block The function usb_tx_block() submits cardp->tx_urb without ensuring that any previous transmission on this URB has completed. If a second call occur…
-
Unscored —
media: cx88: Add missing unmap in snd_cx88_hw_params()
In the Linux kernel, the following vulnerability has been resolved: media: cx88: Add missing unmap in snd_cx88_hw_params() In error path, add cx88_alsa_dma_unmap() to release resource acquired by cx88_alsa_dma_map().
-
Unscored —
phy: fsl-imx8mq-usb: set platform driver data
In the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: set platform driver data Add missing platform_set_drvdata() as the data will be used in remove().
-
Unscored —
bnxt_en: Fix RSS context delete logic
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the V…
-
Unscored —
arm64: Add support for TSV110 Spectre-BHB mitigation
In the Linux kernel, the following vulnerability has been resolved: arm64: Add support for TSV110 Spectre-BHB mitigation The TSV110 processor is vulnerable to the Spectre-BHB (Branch History Buffer) attack, which can be exploited to leak information through b…
-
Unscored —
gfs2: fiemap page fault fix
In the Linux kernel, the following vulnerability has been resolved: gfs2: fiemap page fault fix In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode glock. This can lead to recursive glock taking if the fiemap buffer is memory mapped to the…
-
Unscored —
fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
In the Linux kernel, the following vulnerability has been resolved: fbdev: of: display_timing: fix refcount leak in of_get_display_timings() of_parse_phandle() returns a device_node with refcount incremented, which is stored in 'entry' and then copied to 'nat…
-
Unscored —
KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() Ignore -EBUSY when checking nested events after exiting a blocking state while L2 is active, as exiting to userspace will…
-
Unscored —
EFI/CPER: don't go past the ARM processor CPER record buffer
In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: don't go past the ARM processor CPER record buffer There's a logic inside GHES/CPER to detect if the section_length is too small, but it doesn't detect if it is too big. Currently, …
-
Unscored —
wifi: rtw89: fix potential zero beacon interval in beacon tracking
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix potential zero beacon interval in beacon tracking During fuzz testing, it was discovered that bss_conf->beacon_int might be zero, which could result in a division by zero err…
-
Unscored —
hfsplus: pretend special inodes as regular files
In the Linux kernel, the following vulnerability has been resolved: hfsplus: pretend special inodes as regular files Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ S_I…
-
Unscored —
drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
In the Linux kernel, the following vulnerability has been resolved: drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback After several commits, the slab memory increases. Some drm_crtc_commit objects are not freed. The atomic_destroy_state …
-
Unscored —
media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
In the Linux kernel, the following vulnerability has been resolved: media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() In mtk_mdp_probe(), vpu_get_plat_device() increases the reference count of the returned platform device. Add platform_device_put()…
-
Unscored —
md-cluster: fix NULL pointer dereference in process_metadata_update
In the Linux kernel, the following vulnerability has been resolved: md-cluster: fix NULL pointer dereference in process_metadata_update The function process_metadata_update() blindly dereferences the 'thread' pointer (acquired via rcu_dereference_protected) w…
-
Unscored —
ring-buffer: Fix possible dereference of uninitialized pointer
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix possible dereference of uninitialized pointer There is a pointer head_page in rb_meta_validate_events() which is not initialized at the beginning of a function. This pointer …
-
Unscored —
ceph: supply snapshot context in ceph_zero_partial_object()
In the Linux kernel, the following vulnerability has been resolved: ceph: supply snapshot context in ceph_zero_partial_object() The ceph_zero_partial_object function was missing proper snapshot context for its OSD write operations, which could lead to data in…
-
Unscored —
scsi: ufs: core: Flush exception handling work when RPM level is zero
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Flush exception handling work when RPM level is zero Ensure that the exception event handling work is explicitly flushed during suspend when the runtime power management leve…
-
Unscored —
net: mana: Fix double destroy_workqueue on service rescan PCI path
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix double destroy_workqueue on service rescan PCI path While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path. When mana_serv_re…
-
Unscored —
APEI/GHES: ensure that won't go past CPER allocated record
In the Linux kernel, the following vulnerability has been resolved: APEI/GHES: ensure that won't go past CPER allocated record The logic at ghes_new() prevents allocating too large records, by checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, …
-
Unscored —
mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
In the Linux kernel, the following vulnerability has been resolved: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree…
-
Unscored —
RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_port
In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_port The function ionic_query_port() calls ib_device_get_netdev() without checking the return value which could lead to NULL …
Revision history
-
#102
Neue Updates von SUSE aufgenommen
-
#101
Neue Updates von Red Hat und SUSE aufgenommen
-
#100
Neue Updates von Red Hat und Ubuntu aufgenommen
-
#99
Neue Updates von SUSE aufgenommen
-
#98
Neue Updates von Ubuntu aufgenommen
-
#97
Neue Updates von Debian aufgenommen
-
#96
Neue Updates von SUSE aufgenommen
-
#95
Neue Updates von SUSE aufgenommen
-
#94
Neue Updates von Debian, openSUSE und Oracle Linux aufgenommen
-
#93
Neue Updates von Oracle Linux aufgenommen
-
#92
Neue Updates von IBM und Ubuntu aufgenommen
-
#91
Neue Updates von Red Hat und Oracle Linux aufgenommen
-
#90
Neue Updates von Red Hat aufgenommen
-
#89
Neue Updates von Oracle Linux aufgenommen
-
#88
Neue Updates von Ubuntu aufgenommen
-
#87
Neue Updates von IBM und Debian aufgenommen
-
#86
Neue Updates von SUSE und Debian aufgenommen
-
#85
Neue Updates von SUSE aufgenommen
-
#84
Neue Updates von Ubuntu aufgenommen
-
#83
Neue Updates von openSUSE und F5 aufgenommen
-
#82
Neue Updates von Ubuntu und SUSE aufgenommen
-
#81
Neue Updates von Ubuntu aufgenommen
-
#80
Neue Updates von Rocky Enterprise Software Foundation, Debian und Oracle Linux aufgenommen
-
#79
Neue Updates von SUSE und Red Hat aufgenommen
-
#78
Neue Updates von Rocky Enterprise Software Foundation, Oracle Linux und Red Hat aufgenommen
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2025-71271
https://lore.kernel.org/linux-cve-announce/2026050614-CVE-2025-71271-6cab@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71272
https://lore.kernel.org/linux-cve-announce/2026050617-CVE-2025-71272-85da@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71273
https://lore.kernel.org/linux-cve-announce/2026050617-CVE-2025-71273-842f@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71274
https://lore.kernel.org/linux-cve-announce/2026050617-CVE-2025-71274-6af4@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71285
https://lore.kernel.org/linux-cve-announce/2026050630-CVE-2025-71285-4521@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71286
https://lore.kernel.org/linux-cve-announce/2026050630-CVE-2025-71286-9591@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71287
https://lore.kernel.org/linux-cve-announce/2026050630-CVE-2025-71287-54ce@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71288
https://lore.kernel.org/linux-cve-announce/2026050631-CVE-2025-71288-989a@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71289
https://lore.kernel.org/linux-cve-announce/2026050631-CVE-2025-71289-c62c@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71290
https://lore.kernel.org/linux-cve-announce/2026050631-CVE-2025-71290-f031@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71291
https://lore.kernel.org/linux-cve-announce/2026050632-CVE-2025-71291-0029@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71292
https://lore.kernel.org/linux-cve-announce/2026050632-CVE-2025-71292-9638@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71293
https://lore.kernel.org/linux-cve-announce/2026050632-CVE-2025-71293-609e@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71294
https://lore.kernel.org/linux-cve-announce/2026050633-CVE-2025-71294-05de@gregkh/
-
Linux Kernel CVE Announcement CVE-2025-71295
https://lore.kernel.org/linux-cve-announce/2026050633-CVE-2025-71295-621a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43121
https://lore.kernel.org/linux-cve-announce/2026050618-CVE-2026-43121-2a26@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43122
https://lore.kernel.org/linux-cve-announce/2026050618-CVE-2026-43122-6d5d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43123
https://lore.kernel.org/linux-cve-announce/2026050618-CVE-2026-43123-1166@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43124
https://lore.kernel.org/linux-cve-announce/2026050619-CVE-2026-43124-8141@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43125
https://lore.kernel.org/linux-cve-announce/2026050619-CVE-2026-43125-c9f9@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43126
https://lore.kernel.org/linux-cve-announce/2026050619-CVE-2026-43126-5b1d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43127
https://lore.kernel.org/linux-cve-announce/2026050620-CVE-2026-43127-aa44@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43128
https://lore.kernel.org/linux-cve-announce/2026050620-CVE-2026-43128-5ff4@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43129
https://lore.kernel.org/linux-cve-announce/2026050621-CVE-2026-43129-14c2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43130
https://lore.kernel.org/linux-cve-announce/2026050621-CVE-2026-43130-50f6@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43131
https://lore.kernel.org/linux-cve-announce/2026050621-CVE-2026-43131-67fa@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43132
https://lore.kernel.org/linux-cve-announce/2026050622-CVE-2026-43132-42ed@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43133
https://lore.kernel.org/linux-cve-announce/2026050622-CVE-2026-43133-ffea@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43134
https://lore.kernel.org/linux-cve-announce/2026050622-CVE-2026-43134-ce6b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43135
https://lore.kernel.org/linux-cve-announce/2026050623-CVE-2026-43135-df5a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43136
https://lore.kernel.org/linux-cve-announce/2026050623-CVE-2026-43136-99fb@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43137
https://lore.kernel.org/linux-cve-announce/2026050623-CVE-2026-43137-d02e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43138
https://lore.kernel.org/linux-cve-announce/2026050624-CVE-2026-43138-ccd2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43139
https://lore.kernel.org/linux-cve-announce/2026050624-CVE-2026-43139-64a2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43140
https://lore.kernel.org/linux-cve-announce/2026050624-CVE-2026-43140-1367@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43141
https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43141-a84a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43142
https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43142-42a0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43143
https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43143-1513@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43144
https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43144-720d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43145
https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43145-59af@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43146
https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43146-c0ee@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43147
https://lore.kernel.org/linux-cve-announce/2026050627-CVE-2026-43147-4a3c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43148
https://lore.kernel.org/linux-cve-announce/2026050627-CVE-2026-43148-224c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43149
https://lore.kernel.org/linux-cve-announce/2026050627-CVE-2026-43149-cd24@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43150
https://lore.kernel.org/linux-cve-announce/2026050628-CVE-2026-43150-987f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43151
https://lore.kernel.org/linux-cve-announce/2026050628-CVE-2026-43151-e861@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43152
https://lore.kernel.org/linux-cve-announce/2026050629-CVE-2026-43152-1029@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43153
https://lore.kernel.org/linux-cve-announce/2026050629-CVE-2026-43153-9294@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43154
https://lore.kernel.org/linux-cve-announce/2026050629-CVE-2026-43154-9c24@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43155
https://lore.kernel.org/linux-cve-announce/2026050630-CVE-2026-43155-32e0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43156
https://lore.kernel.org/linux-cve-announce/2026050630-CVE-2026-43156-1fc4@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43157
https://lore.kernel.org/linux-cve-announce/2026050630-CVE-2026-43157-b4de@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43158
https://lore.kernel.org/linux-cve-announce/2026050631-CVE-2026-43158-cc20@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43159
https://lore.kernel.org/linux-cve-announce/2026050631-CVE-2026-43159-aeee@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43160
https://lore.kernel.org/linux-cve-announce/2026050631-CVE-2026-43160-163c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43161
https://lore.kernel.org/linux-cve-announce/2026050632-CVE-2026-43161-50a7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43162
https://lore.kernel.org/linux-cve-announce/2026050632-CVE-2026-43162-7fcc@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43163
https://lore.kernel.org/linux-cve-announce/2026050632-CVE-2026-43163-86e1@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43164
https://lore.kernel.org/linux-cve-announce/2026050633-CVE-2026-43164-c1bc@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43165
https://lore.kernel.org/linux-cve-announce/2026050633-CVE-2026-43165-a628@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43166
https://lore.kernel.org/linux-cve-announce/2026050633-CVE-2026-43166-b297@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43167
https://lore.kernel.org/linux-cve-announce/2026050634-CVE-2026-43167-6243@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43168
https://lore.kernel.org/linux-cve-announce/2026050634-CVE-2026-43168-3cc3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43169
https://lore.kernel.org/linux-cve-announce/2026050634-CVE-2026-43169-0e63@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43170
https://lore.kernel.org/linux-cve-announce/2026050635-CVE-2026-43170-01fa@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43171
https://lore.kernel.org/linux-cve-announce/2026050635-CVE-2026-43171-8549@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43172
https://lore.kernel.org/linux-cve-announce/2026050635-CVE-2026-43172-6ed1@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43173
https://lore.kernel.org/linux-cve-announce/2026050636-CVE-2026-43173-a8ba@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43174
https://lore.kernel.org/linux-cve-announce/2026050636-CVE-2026-43174-3a76@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43175
https://lore.kernel.org/linux-cve-announce/2026050636-CVE-2026-43175-99a1@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43176
https://lore.kernel.org/linux-cve-announce/2026050637-CVE-2026-43176-c8ee@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43177
https://lore.kernel.org/linux-cve-announce/2026050637-CVE-2026-43177-ff1a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43178
https://lore.kernel.org/linux-cve-announce/2026050638-CVE-2026-43178-3c95@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43179
https://lore.kernel.org/linux-cve-announce/2026050638-CVE-2026-43179-4b12@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43180
https://lore.kernel.org/linux-cve-announce/2026050638-CVE-2026-43180-f0ea@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43181
https://lore.kernel.org/linux-cve-announce/2026050639-CVE-2026-43181-2c8c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43182
https://lore.kernel.org/linux-cve-announce/2026050639-CVE-2026-43182-33d2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43183
https://lore.kernel.org/linux-cve-announce/2026050639-CVE-2026-43183-f048@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-43184
https://lore.kernel.org/linux-cve-announce/2026050640-CVE-2026-43184-17d4@gregkh/