Summary
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenlegen oder Root-Rechte erlangen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 154
-
Critical 10.0
veth: fix skb length accounting after XDP frag adjustment
In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, veth_xdp_rcv_skb() copies xdp…
-
Critical 10.0
udp: fix potential use-after-free in tunnel segmentation
In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head…
-
Critical 9.8
net: ipv6: clear suppressed fib6 rule result
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule sup…
-
Critical 9.8CVE-2026-74586 Public exploit
sctp: clear new_transport when removing a peer
In the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer sctp_process_asconf_param() stores a newly added peer transport in asoc->new_transport. After all parameters in the ASCONF chunk have been proce…
-
Critical 9.8
sctp: fix use-after-free of cached ASCONF chunk
In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer…
-
Critical 9.8
sctp: keep chunk->transport in step with the list it is queued on
In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: …
-
Critical 9.8
mm/filemap: __filemap_add_folio() restore index before retrying
In the Linux kernel, the following vulnerability has been resolved: mm/filemap: __filemap_add_folio() restore index before retrying In __filemap_add_folio()'s split-a-conflict loop, xas_set_order() is applied repeatedly: each application modifies xas.xa_index…
-
Critical 9.8
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip6ip6_err() ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone …
-
Critical 9.8
smb: client: Fix use-after-free in cifs_try_adding_channels()
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_try_adding_channels() cifs_try_adding_channels() takes a temporary reference to an interface before dropping iface_lock. If cifs_ses_add_channel() fail…
-
Critical 9.8
tls: rx: restore msg_iter before TLS 1.3 optimistic retry
In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_iter before TLS 1.3 optimistic retry tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record tu…
-
Critical 9.8
xdp: reject clones that overrun skb_shared_info tailroom
In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that…
-
Critical 9.8
dibs: initialise dibs->lock in dibs_dev_alloc()
In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs->lock in dibs_dev_alloc() dibs->lock is initialised by dibs_dev_add(), but a dibs device can already take interrupts before that call: ism_probe() runs ism_dev_init(), a…
-
Critical 9.8
net/x25: fix use-after-free of the socket by its timers
In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket and a …
-
Critical 9.8
inet: frags: publish queues before arming timer
In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zer…
-
Critical 9.8
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, …
-
Critical 9.8
sctp: clear control chunk transport if it is being removed
In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok i…
-
Critical 9.8
btrfs: lzo: reject inline extents without valid headers
In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers [BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: sl…
-
Critical 9.8CVE-2026-74727 Public exploit
ovpn: skip rehash for peers already removed from by_id
In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from by_id ovpn_nl_peer_set_doit() resolves the target peer via ovpn_peer_get_by_id() before taking ovpn->lock. In the window between the lookup (w…
-
Critical 9.8
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix th…
-
Critical 9.3
vdpa/mlx5: Fix buffer length in create_direct_keys()
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in create_direct_keys() We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmd_exec+0x550/0xca0 [mlx5_core] Read of size 272 at…
-
Critical 9.1
net: fix skb length accounting after generic XDP frag adjustment
In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, bpf_prog_run_ge…
-
High 8.8CVE-2026-74580 Public exploit
vhost: reset the vring metadata cache on vring reconfiguration
In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cach…
-
High 8.8
KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Serialize accesses to the owner and mirror list with separate lock Interaction between KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM and KVM_CAP_VM_COPY_ENC_CONTEXT_FROM can cause two separate i…
-
High 8.8
vxlan: do not arm the ageing timer on a device that is down
In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlan_changelink() arms vxlan->age_timer whenever the requested ageing interval differs from the configured one: if (conf.age_inter…
-
High 8.8
net/dibs: Correct freeing of dmb_clientid_arr
In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmb_clientid_arr A dibs device interrupt handler can be active after dibs_dev_del() and may still access dmb_clientid_arr. (UAF) In case of a failure in dibs_dev_…
-
High 8.8
staging: rtl8723bs: fix missing shared-key auth challenge length check
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking …
-
High 8.8
serial: qcom-geni: fix TX DMA buffer flush
In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uar…
-
High 8.8
net: thunderbolt: Tear down DMA paths before stopping the rings
In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Tear down DMA paths before stopping the rings tbnet_tear_down() stops both rings and frees their frame buffers before calling tb_xdomain_disable_paths(). tb_ring_stop() zero…
-
High 8.8
vhost-scsi: reject feature changes after endpoint
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates each command's protection scatterlist array (prot_sgl) according t…
-
High 8.4
bpf, sockmap: Fix sk_redir use-after-free in send verdict
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix sk_redir use-after-free in send verdict sk_psock_msg_verdict() takes a socket reference for psock->sk_redir. tcp_bpf_send_verdict() copies that pointer while holding the sou…
-
High 8.4
Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
In the Linux kernel, the following vulnerability has been resolved: Revert "thermal/drivers/hwmon: Cleanup coding style a bit" Revert commit 030a48b0f6ce ("thermal/drivers/hwmon: Cleanup coding style a bit") that introduced a use-after-free into the error pat…
-
High 8.4
vsock/virtio: read virtqueues under worker locks
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore in…
-
High 8.4
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc_rx_splice smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In t…
-
High 8.4
s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ism_dev_exit() A ism interrupt handler can be active in parallel with ism_dev_exit(), accessing freed data structures. No new interrupts will be genera…
-
High 8.4
hwmon: (pmbus) Fix type confusion in notification logic
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus) Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbus_notify(), the code unconditionally casts every attribute to a struct sensor_device_a…
-
High 8.2
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption EOP (End of frame padding) on the AGG ring may cause overlapping of zero padding at the end of one segment with the next s…
-
High 8.2
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter The sch_cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. Th…
-
High 8.1
ima: Instantiate file_truncate and path_truncate hooks
In the Linux kernel, the following vulnerability has been resolved: ima: Instantiate file_truncate and path_truncate hooks Instantiate the file_truncate and path_truncate LSM hooks to reset the action cache flags (IMA_DONE_MASK) as soon as truncation is reque…
-
High 8.1
staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough,…
-
High 7.8
packet: use consistent hard_header_len in non-ring send paths
In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can chang…
-
High 7.8CVE-2026-74583 Public exploit
net/sched: cls_route: fix fastmap use-after-free on filter
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The read…
-
High 7.8
fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
In the Linux kernel, the following vulnerability has been resolved: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however,…
-
High 7.8
sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
In the Linux kernel, the following vulnerability has been resolved: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() psi_schedule_rtpoll_work() is called locklessly from the scheduler hotpath and can race psi_trigger_destroy() taking down the last rtpol…
-
High 7.8
fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() fscrypt_ioctl_set_policy() calls inode_owner_or_capable() with &nop_mnt_idmap before allowing an encryption poli…
-
High 7.8
ring-buffer: Use current_context for safe per-CPU buffer swap
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Use current_context for safe per-CPU buffer swap The ring_buffer_swap_cpu() function currently checks the per-CPU committing counter to determine if a buffer is actively being wr…
-
High 7.8
eventfs: Use children field for rcu head and add memory barriers
In the Linux kernel, the following vulnerability has been resolved: eventfs: Use children field for rcu head and add memory barriers When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list fi…
-
High 7.8
eventfs: Fix use-after-free in eventfs_remove_rec()
In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfs_remove_rec() eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() ad…
-
High 7.8
tipc: read le->link under the node lock in tipc_node_link_down()
In the Linux kernel, the following vulnerability has been resolved: tipc: read le->link under the node lock in tipc_node_link_down() tipc_node_link_down() caches the link pointer before taking n->lock: struct tipc_link *l = le->link; /* unlocked */ if (!l) re…
-
High 7.8
tls: don't leave a full plaintext sk_msg ring unpushed
In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext sk_msg ring unpushed When the copy path in tls_sw_sendmsg_locked() adds the fragment that fills the plaintext sk_msg ring, it does not set full_record, so th…
-
High 7.8
vsock/virtio: avoid refilling the RX queue after teardown
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: avoid refilling the RX queue after teardown Commit b917507e5ad9 ("vsock/virtio: stop workers during the .remove()") made the RX worker jump to its common exit when rx_run is cle…
-
High 7.8
net: devmem: prevent net-iov / page mixing
In the Linux kernel, the following vulnerability has been resolved: net: devmem: prevent net-iov / page mixing We should either have net_iov or page backed frags in a single skb, otherwise it blows up down the stack. Don't allow mixing in zerocopy_fill_skb_fr…
-
High 7.8
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6_dev_get() from resurrecting inet6_dev in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and …
-
High 7.8
mm/huge_memory: fix huge_zero_pfn race
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix huge_zero_pfn race Patch series "mm/huge_memory: fix huge_zero_pfn race", v2. There is a subtle race in the reference-counted huge_zero_folio implementation. The fast path…
-
High 7.8
ring-buffer: Prevent subbuf order change when resizing is disabled
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ring_buffer_subbuf_order_set() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming read…
-
High 7.8
fbdev: bitblit: bound-check glyph index in bit_cursor()
In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_cursor() bit_cursor() fetches the glyph under the cursor with c = scr_readw(vc_pos); src = vc_font.data + ((c & charmask) * w * height); where c…
-
High 7.8
perf/core: Fix group leader use-after-free after sibling detach
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perf_group_detach() handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted…
-
High 7.8
ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcp_meter_ctl_get() fcp_ioctl_set_meter_map() bounds the user-supplied Level Meter map size by the driver's own limit of 255 if (map.map_size < 1 || map.map_size >…
-
High 7.8
ALSA: usx2y: bound the hwdep mmap fault offset
In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf->pgoff << PAGE_SHIFT; vadd…
-
High 7.8
misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, wait_for_completion_interruptible() returns -ERESTARTSYS and fastrpc_internal_i…
-
High 7.8
misc: fastrpc: Remove buffer from list prior to unmap operation
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Remove buffer from list prior to unmap operation fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from …
-
High 7.8
staging: rtl8723bs: validate monitor transmit frame lengths
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking tha…
-
High 7.8
serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, s…
-
High 7.8
ipv4: fix use-after-free in fib_nhc_update_mtu()
In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fib_nhc_update_mtu() fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk…
-
High 7.8
netfilter: ebt_nflog: pin the NFLOG backend
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebt_nflog: pin the NFLOG backend nf_log_unregister() runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net bindi…
-
High 7.8
mac802154: fix netdev use-after-free in beacon worker
In the Linux kernel, the following vulnerability has been resolved: mac802154: fix netdev use-after-free in beacon worker mac802154_beacon_worker() reads local->beacon_req under RCU and derives the sub-interface from the request, but then drops the RCU read l…
-
High 7.8
net/sched: reject overly deep qdisc hierarchies
In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cov…
-
High 7.8
packet: synchronize pressure clearing with ring reconfiguration
In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packet_set_ring() updates the RX ring state under sk_receive_queue.lock, but used to publish the tpacket receive mode through p…
-
High 7.8
net/packet: reset the MAC header on the packet-socket transmit path
In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packet_parse_headers() resets the MAC header only for a SOCK_RAW frame whose socket did not bind a protocol. A protocol-bou…
-
High 7.8
packet: use consistent hard_header_len in TX_RING send path
In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in TX_RING send path tpacket_snd() reads dev->hard_header_len independently for skb allocation and header construction in tpacket_fill_skb(). Concurrent…
-
High 7.8
ipvs: stop estimator after disabled calc phase
In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown c…
-
High 7.8
mm: fix incorrect flush address in direct page table reclaim
In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zap_pte_range reclaims a page table, it does: pte_free_tlb(tlb, pmd_pgtable(pmdval), addr); and this is unconditionally wrong…
-
High 7.8
vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under …
-
High 7.8
watchdog: at91sam9_wdt: prevent timer rearm during teardown
In the Linux kernel, the following vulnerability has been resolved: watchdog: at91sam9_wdt: prevent timer rearm during teardown at91_ping() rearms the watchdog timer from its callback. timer_delete() neither waits for a running callback nor prevents it from r…
-
High 7.8
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tc_new_tfilter where a tcf_proto can be fou…
-
High 7.8
net/openvswitch: check Ethernet header length in key_extract()
In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key_extract() When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flow_key_extract() trusts the user-provided skb->protocol field: …
-
High 7.8
xsk: validate metadata when processing requests
In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request.…
-
High 7.8
xsk: validate launch-time metadata size
In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsk_tx_metadata. Reject the request when the registered metadata area does not contain…
-
High 7.8
xsk: require at least 16 bytes of TX metadata
In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AF_XDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request fie…
-
High 7.8
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto the ehash chain, drops the bucket lock, and only afterwa…
-
High 7.8
bpf: Fix netns reference imbalance in conntrack kfuncs
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read o…
-
High 7.8
bpf: Preserve pointer state for commuted arithmetic
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer…
-
High 7.8
accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
In the Linux kernel, the following vulnerability has been resolved: accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages() Two error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma) before returning an error code to the caller. This i…
-
High 7.8
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which…
-
High 7.8
enic: fix tx_hang_reset use-after-free on device removal
In the Linux kernel, the following vulnerability has been resolved: enic: fix tx_hang_reset use-after-free on device removal enic_remove() cancels the reset and change_mtu_work items but does not cancel tx_hang_reset. A TX timeout that fires while the device …
-
High 7.8
sched_ext: Skip sub-disable teardown for never-linked sub-schedulers
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scx_link_sched() links the sched into the hierarchy, e.g. when the parent is alread…
-
High 7.8
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or wr…
-
High 7.5
ipv6: fix Route Information option length validation
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6_route_rcv() validates the Route Information option (RFC 4191) length against the prefix length, but both checks are off by one. rinfo-…
-
High 7.5
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix sk_buff leak when the header checks reject a packet tcf_ct_handle_fragments() runs its header sanity checks before handing anything to the defragmentation engine: if (f…
-
High 7.5
netfilter: nf_conntrack: defer invalid log until after unlock
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock is still held. When invalid logging is routed to nfnetli…
-
High 7.5
netfilter: bridge: release template ct on non-IP path
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6…
-
High 7.5
NTB: ntb_netdev: Preserve RX queue depth on allocation failure
In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_netdev: Preserve RX queue depth on allocation failure ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement. If the allocation fails, …
-
High 7.5
net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() When the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing…
-
High 7.5
net/smc: fix TOCTOU race between smc_listen_out() and listener close
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smc_listen_out() and listener close smc_listen_out() reads lsmc->sk.sk_state without the listener lock, then acquires lock_sock_nested() only after the check …
-
High 7.5
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-cou…
-
High 7.5
tcp: fix TFO max_qlen accounting across reuseport migration
In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reuseport migration A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured…
-
High 7.5
net/mlx5: fw_tracer, return NULL on create error
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, return NULL on create error Tracer creation can fail by returning either NULL or ERR_PTR. The return value is stored without a check on the device, and users treat ERR_PT…
-
High 7.3
bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing…
-
High 7.1
RDMA/bnxt_re: zero shared page before exposing to userspace
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: zero shared page before exposing to userspace bnxt_re_alloc_ucontext() allocates uctx->shpg via __get_free_page(GFP_KERNEL). The buddy allocator does not zero pages without __GF…
-
High 7.1
ptp: ocp: Fix board ID over-read
In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix board ID over-read The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlink_info_version_fixed_put() treats…
-
High 7.1
net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") f…
-
High 7.1
net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() vcc_setsockopt() contained an ineffective optlen check: if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname)) return -…
-
High 7.1
vhost-scsi: Validate T10 PI scatterlist counts
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed reques…
-
High 7.1
vhost_iotlb: bound map allocation in add_range
In the Linux kernel, the following vulnerability has been resolved: vhost_iotlb: bound map allocation in add_range vhost_iotlb_add_range_ctx() only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOST_IOTLB_FL…
-
Unscored —
thunderbolt: Bound the DROM dual link port number before indexing sw->ports
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound the DROM dual link port number before indexing sw->ports tb_drom_parse_entry_port() validates the device-supplied header->index against sw->config.max_port_number before in…
-
Unscored —
sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Take cgroup_lock() first in scx_cgroup_lock() scx_cgroup_lock() write-locks scx_cgroup_ops_rwsem and then takes cgroup_lock(), which can deadlock through kernfs: scx enable/disable…
-
Unscored —
fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
In the Linux kernel, the following vulnerability has been resolved: fs,fsverity: remove check for fsverity being enabled in setattr_prepare() The check that fs-verity is available in the kernel is not necessary here. Filesystems could have fsverity files even…
-
Unscored —
mm/ptdump: always stabilise against page table freeing using init_mm
In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: always stabilise against page table freeing using init_mm Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on ini…
-
Unscored —
mm/page_table_check: skip special zero mappings
In the Linux kernel, the following vulnerability has been resolved: mm/page_table_check: skip special zero mappings page_table_check_set() and page_table_check_clear() account mappings based on PageAnon(). Shared zero-page PTEs and huge zero PMDs are special …
-
Unscored —
ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() In rb_allocate_cpu_buffer(), bpage->order was omitted, leaving it as 0. This is an issue for a ring-buffer with subbufs b…
-
Unscored —
binfmt_misc: don't warn when the mount is completed from another user namespace
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't warn when the mount is completed from another user namespace fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. Nothing…
-
Unscored —
ovl: don't warn when the mount is completed from another user namespace
In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. Nothing ties th…
-
Unscored —
net/sched: act_gact, act_police: range check the fallback control action
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gact, act_police: range check the fallback control action tcf_action_check_ctrlact() range checks the primary control action: if (!opcode) ret = action > TC_ACT_VALUE_MAX ? -EI…
-
Unscored —
net: atlantic: free RX pages of consumed but not refilled buffers
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aq_ring_rx_deinit() only walks [sw_head, sw_tail), the region posted to hardware. Since the page reuse strategy was added, a …
-
Unscored —
net: atlantic: free stranded TX buffers on ring deinit
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free stranded TX buffers on ring deinit aq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean() call, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors …
-
Unscored —
tracing: Fix NULL pointer dereference in module event cache removal
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL event_mod->match when foo has not been loaded. If a lat…
-
Unscored —
tracing: Fix race between update_event_fields and, event_define_fields
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between update_event_fields and, event_define_fields The following sequence may leads race between event_define_fields() and update_event_fields(): CPU0 (loads module A) CPU…
-
Unscored —
drm/v3d: Serialize the scheduler timeout handlers
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues (BIN, RENDER, TFU and CSD) but has only a single, global reset. A timeout on any one queue th…
-
Unscored —
ALSA: us144mkii: re-anchor capture URBs on resubmission
In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission capture_urb_complete() resubmits each capture URB without anchoring it: usb_get_urb(urb); ret = usb_submit_urb(urb, GFP_ATOMIC); Anchor…
-
Unscored —
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in ump_to_endpoint() caused another UAF because it tries to dereference the UMP endpoint object, but this might be ex…
-
Unscored —
samples/damon/mtier: error out for zero quota goal target values
In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damos_quota_score()". DAMON_SAMPLE_MTIER and DAMON_LRU_SORT allow the user…
-
Unscored —
mm/damon/ops-common: putback folios on invalid migrate nid
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: putback folios on invalid migrate nid damon_pa_migrate() and damos_va_migrate() isolate folios into a local list and then call damon_migrate_pages(). When target_nid is i…
-
Unscored —
mm/damon/lru_sort: error out for >10000 active_mem_bp
In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: error out for >10000 active_mem_bp damos_quota_score() can trigger division by zero if the target value is zero. DAMON_LRU_SORT lets users set the target value for the hot …
-
Unscored —
staging: rtl8723bs: fix OOB read in WMM_param_handler()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMM_param_handler() WMM_param_handler() copies a fixed-size WMM parameter element out of a received information element without checking that the element i…
-
Unscored —
serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART (PORT_LPC3220) can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UART_IIR_…
-
Unscored —
serial: 8250_dma: Clear stale RX state on shutdown
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dma: Clear stale RX state on shutdown serial8250_release_dma() terminates RX DMA and releases the channel, but leaves rx_running set. If the port is closed while an RX transfer i…
-
Unscored —
ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops fib_nlmsg_size() still estimates nexthop space as if every gateway is encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an I…
-
Unscored —
futex: Prevent robust futex exit race some more
In the Linux kernel, the following vulnerability has been resolved: futex: Prevent robust futex exit race some more A robust futex unlock stores 0 over the whole futex value - wiping FUTEX_WAITERS - and wakes a single waiter. That wakeup is a one-shot notific…
-
Unscored —
net: bridge: mrp: fix uninitialised bytes on the wire
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mrp: fix uninitialised bytes on the wire br_mrp_alloc_test_skb() builds MRP test frames on an skb from dev_alloc_skb(), which does not clear the linear data area. On the MRA ring…
-
Unscored —
net: openvswitch: reallocate update replies for mismatched IDs
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovs_flow_cmd_new() preallocates the optional reply skb before it takes ovs_mutex and before it knows which existing flow will be…
-
Unscored —
ima: fix out-of-bounds read in xattr_verify()
In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattr_verify() The digest-length check in xattr_verify() mixes int and size_t: if (xattr_len - sizeof(xattr_value->type) - hash_start >= iint->ima_hash->length)…
-
Unscored —
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into tw…
-
Unscored —
Input: evdev - fix information leak in evdev_pass_values()
In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdev_pass_values() In evdev_pass_values(), the input_event structure is allocated on the kernel stack and populated field-by-field. However, it is neve…
-
Unscored —
vt: add permission check for KDSKBMETA ioctl
In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vt_k_ioctl() enforce, allowing a process …
-
Unscored —
net: usb: ipheth: fix carrier_work UAF on disconnect
In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrier_work UAF on disconnect ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero URB status: else schedule_delayed_work(&dev->carrier_work, 0); No…
-
Unscored —
usb: gadget: f_ncm: Use unsigned int for ndp_index
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Use unsigned int for ndp_index The variable ndp_index is declared as a signed integer, but it stores the return value of get_ncm(), which is unsigned. A malicious host can…
-
Unscored —
usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() If cxacru_cm() encounters an error while submitting or waiting for snd_urb, it aborts and returns the error without killing the…
-
Unscored —
usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check in usbio_bulk_msg() compares it against txbuf_len — the bu…
-
Unscored —
ALSA: usb-audio: fix OOB write on Type II inbound URBs
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs data_ep_set_params() sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u->packets = urb_packs; u->buf…
-
Unscored —
Input: evdev - sanitize event type index when fetching event masks
In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evde…
-
Unscored —
hwmon: (ltc4282) Clamp negative current limits
In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Clamp negative current limits When a negative value is passed to ltc4282_write_curr(), the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282_write_curr…
-
Unscored —
rqspinlock: Reset tail when preserving queue on deadlock
In the Linux kernel, the following vulnerability has been resolved: rqspinlock: Reset tail when preserving queue on deadlock Currently, the destruction of the waiter queue is suppressed for rqspinlock in cases where a deadlock is detected. Deadlock checks hap…
-
Unscored —
net: prestera: validate firmware header length
In the Linux kernel, the following vulnerability has been resolved: net: prestera: validate firmware header length prestera_fw_hdr_parse() reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struc…
-
Unscored —
net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length ncsi_send_cmd_nl() takes the number of bytes to copy from the attacker-controlled ncsi_pkt_hdr.length field of the in-band pack…
-
Unscored —
net/mlx5e: fix BQL reset on SQ re-activation
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation mlx5e_queue_start() deactivates and re-activates all channels but closes only the queue being restarted. mlx5e_activate_txqsq() then unconditional…
-
Unscored —
drm/xe: Fix memory leak in exec_queue_set_hang_replay_state()
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() The q->replay_state is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdup_user(). Re…
-
Unscored —
bnge: Fix NULL pointer dereference in aux device release
In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxr_dev fails during auxiliary device setup, the error path calls auxiliary_device_uninit(), which eventually invoke…
-
Unscored —
xsk: clear metadata pointer when no timestamp is requested
In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is requested User space can change metadata flags after request processing. Rereading them during completion can therefore make the kernel write …
-
Unscored —
accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages() In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears VM_PFNMAP. If an unprivileged userspace process m…
-
Unscored —
devlink: fix net namespace reference leak in reload
In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlink_nl_reload_doit() calls devlink_netns_get(), which returns a net with a held reference. When the requested namespace differs from th…
-
Unscored —
net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in smc_llc_event_handler() stores an incomi…
-
Unscored —
btrfs: fix memory leak in btrfs_do_encoded_write()
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak in btrfs_do_encoded_write() Local fuzzing of 6.12.94 has found the following memory leak: Unreferenced object 0xffff888018050a80 (size 64): comm "syz.0.17", pid 10297, …
-
Unscored —
xfs: handle NULL b_addr in xfs_buf_free
In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL b_addr in xfs_buf_free When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with bp->b_addr still NULL. The code falls through to the folio_put path which calls v…
-
Unscored —
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read put_fifo_with_discard() acts as both producer and consumer on the kfifo: it calls kfifo_skip() (advances out) and kfifo_put() …
-
Unscored —CVE-2026-74732 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Revision history
-
#53
Neue Updates von SUSE und Red Hat aufgenommen
-
#52
Neue Updates von SUSE und Red Hat aufgenommen
-
#51
Neue Updates von Red Hat, Ubuntu und Oracle Linux aufgenommen
-
#50
Neue Updates von SUSE aufgenommen
-
#49
Neue Updates von Red Hat und Oracle Linux aufgenommen
-
#48
Neue Updates von SUSE, Oracle Linux und Red Hat aufgenommen
-
#47
Neue Updates von Red Hat und SUSE aufgenommen
-
#46
Neue Updates von SUSE, Red Hat und IBM aufgenommen
-
#45
Neue Updates von SUSE und Debian aufgenommen
-
#44
Neue Updates von SUSE und Red Hat aufgenommen
-
#43
Neue Updates von SUSE, Red Hat und Oracle Linux aufgenommen
-
#42
Neue Updates von Red Hat und Oracle Linux aufgenommen
-
#41
Neue Updates von Oracle Linux und Red Hat aufgenommen
-
#40
Neue Updates von SUSE und Oracle Linux aufgenommen
-
#39
Neue Updates von Red Hat aufgenommen
-
#38
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#37
Neue Updates von Rocky Enterprise Software Foundation und SUSE aufgenommen
-
#36
Neue Updates von Red Hat aufgenommen
-
#35
Neue Updates von Oracle Linux, openSUSE, Rocky Enterprise Software Foundation und SUSE aufgenommen
-
#34
Neue Updates von SUSE aufgenommen
-
#33
Neue Updates von SUSE, Red Hat und Oracle Linux aufgenommen
-
#32
PoC aufgenommen Vghost CVE-2026-74580
-
#31
Neue Updates von Oracle Linux und Red Hat aufgenommen
-
#30
Neue Updates von SUSE, Red Hat und Rocky Enterprise Software Foundation aufgenommen
-
#29
Neue Updates von SUSE, Red Hat und Rocky Enterprise Software Foundation aufgenommen
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2026-74580
https://lore.kernel.org/linux-cve-announce/2026082158-CVE-2026-74580-5db9@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74581
https://lore.kernel.org/linux-cve-announce/2026082100-CVE-2026-74581-47ca@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74582
https://lore.kernel.org/linux-cve-announce/2026082100-CVE-2026-74582-3296@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74583
https://lore.kernel.org/linux-cve-announce/2026082100-CVE-2026-74583-70cb@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74584
https://lore.kernel.org/linux-cve-announce/2026082236-CVE-2026-74584-3800@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74585
https://lore.kernel.org/linux-cve-announce/2026082209-CVE-2026-74585-8fe6@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74586
https://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74586-9beb@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74587
https://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74587-d6f8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74588
https://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74588-29ed@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74589
https://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74589-30de@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74590
https://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74590-5358@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74591
https://lore.kernel.org/linux-cve-announce/2026082213-CVE-2026-74591-72ed@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74592
https://lore.kernel.org/linux-cve-announce/2026082213-CVE-2026-74592-c153@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74593
https://lore.kernel.org/linux-cve-announce/2026082213-CVE-2026-74593-f241@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74594
https://lore.kernel.org/linux-cve-announce/2026082213-CVE-2026-74594-644a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74595
https://lore.kernel.org/linux-cve-announce/2026082214-CVE-2026-74595-9491@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74596
https://lore.kernel.org/linux-cve-announce/2026082214-CVE-2026-74596-8356@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74597
https://lore.kernel.org/linux-cve-announce/2026082214-CVE-2026-74597-98fc@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74598
https://lore.kernel.org/linux-cve-announce/2026082214-CVE-2026-74598-d1ac@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74599
https://lore.kernel.org/linux-cve-announce/2026082215-CVE-2026-74599-b213@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74600
https://lore.kernel.org/linux-cve-announce/2026082215-CVE-2026-74600-f520@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74601
https://lore.kernel.org/linux-cve-announce/2026082215-CVE-2026-74601-7bba@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74602
https://lore.kernel.org/linux-cve-announce/2026082215-CVE-2026-74602-b084@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74603
https://lore.kernel.org/linux-cve-announce/2026082215-CVE-2026-74603-955f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74604
https://lore.kernel.org/linux-cve-announce/2026082216-CVE-2026-74604-c7bc@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74605
https://lore.kernel.org/linux-cve-announce/2026082216-CVE-2026-74605-94d2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74606
https://lore.kernel.org/linux-cve-announce/2026082216-CVE-2026-74606-f26d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74607
https://lore.kernel.org/linux-cve-announce/2026082216-CVE-2026-74607-533e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74608
https://lore.kernel.org/linux-cve-announce/2026082216-CVE-2026-74608-dfb0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74609
https://lore.kernel.org/linux-cve-announce/2026082217-CVE-2026-74609-e7db@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74610
https://lore.kernel.org/linux-cve-announce/2026082217-CVE-2026-74610-3bed@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74611
https://lore.kernel.org/linux-cve-announce/2026082217-CVE-2026-74611-1af7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74612
https://lore.kernel.org/linux-cve-announce/2026082217-CVE-2026-74612-c760@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74613
https://lore.kernel.org/linux-cve-announce/2026082217-CVE-2026-74613-3b63@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74614
https://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74614-b5a1@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74615
https://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74615-832f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74616
https://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74616-73b5@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74617
https://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74617-52a0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74618
https://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74618-15d4@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74619
https://lore.kernel.org/linux-cve-announce/2026082219-CVE-2026-74619-ff9d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74620
https://lore.kernel.org/linux-cve-announce/2026082219-CVE-2026-74620-9726@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74621
https://lore.kernel.org/linux-cve-announce/2026082219-CVE-2026-74621-81bd@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74622
https://lore.kernel.org/linux-cve-announce/2026082219-CVE-2026-74622-505f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74623
https://lore.kernel.org/linux-cve-announce/2026082219-CVE-2026-74623-32eb@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74624
https://lore.kernel.org/linux-cve-announce/2026082220-CVE-2026-74624-2bd0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74625
https://lore.kernel.org/linux-cve-announce/2026082220-CVE-2026-74625-e32d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74626
https://lore.kernel.org/linux-cve-announce/2026082220-CVE-2026-74626-b133@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74627
https://lore.kernel.org/linux-cve-announce/2026082220-CVE-2026-74627-6aa8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74628
https://lore.kernel.org/linux-cve-announce/2026082220-CVE-2026-74628-c08b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74629
https://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74629-6db1@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74630
https://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74630-8fae@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74631
https://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74631-4134@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74632
https://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74632-2ec3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74633
https://lore.kernel.org/linux-cve-announce/2026082222-CVE-2026-74633-6b87@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74634
https://lore.kernel.org/linux-cve-announce/2026082222-CVE-2026-74634-71a0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74635
https://lore.kernel.org/linux-cve-announce/2026082222-CVE-2026-74635-df73@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74636
https://lore.kernel.org/linux-cve-announce/2026082222-CVE-2026-74636-9590@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74637
https://lore.kernel.org/linux-cve-announce/2026082222-CVE-2026-74637-9bf7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74638
https://lore.kernel.org/linux-cve-announce/2026082223-CVE-2026-74638-bed1@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74639
https://lore.kernel.org/linux-cve-announce/2026082223-CVE-2026-74639-61eb@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74640
https://lore.kernel.org/linux-cve-announce/2026082223-CVE-2026-74640-054b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74641
https://lore.kernel.org/linux-cve-announce/2026082223-CVE-2026-74641-92d7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74642
https://lore.kernel.org/linux-cve-announce/2026082223-CVE-2026-74642-68fd@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74643
https://lore.kernel.org/linux-cve-announce/2026082224-CVE-2026-74643-de06@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74644
https://lore.kernel.org/linux-cve-announce/2026082224-CVE-2026-74644-d0a1@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74645
https://lore.kernel.org/linux-cve-announce/2026082224-CVE-2026-74645-b952@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74646
https://lore.kernel.org/linux-cve-announce/2026082224-CVE-2026-74646-c5af@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74647
https://lore.kernel.org/linux-cve-announce/2026082225-CVE-2026-74647-7eb8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74648
https://lore.kernel.org/linux-cve-announce/2026082225-CVE-2026-74648-1dcb@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74649
https://lore.kernel.org/linux-cve-announce/2026082225-CVE-2026-74649-aa8b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74650
https://lore.kernel.org/linux-cve-announce/2026082225-CVE-2026-74650-516c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74651
https://lore.kernel.org/linux-cve-announce/2026082225-CVE-2026-74651-f9b9@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74652
https://lore.kernel.org/linux-cve-announce/2026082226-CVE-2026-74652-3d26@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74653
https://lore.kernel.org/linux-cve-announce/2026082226-CVE-2026-74653-913a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74654
https://lore.kernel.org/linux-cve-announce/2026082226-CVE-2026-74654-5975@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74655
https://lore.kernel.org/linux-cve-announce/2026082226-CVE-2026-74655-093d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74656
https://lore.kernel.org/linux-cve-announce/2026082226-CVE-2026-74656-f697@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74657
https://lore.kernel.org/linux-cve-announce/2026082227-CVE-2026-74657-70ac@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74658
https://lore.kernel.org/linux-cve-announce/2026082227-CVE-2026-74658-3974@gregkh/