Summary
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Ausweitung von Berechtigungen, die Offenlegung von Informationen, die Manipulation von Daten oder Denial-of-Service-Zustände.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 92
-
Critical 9.8
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descrip…
-
Critical 9.8
macvlan: inherit needed_headroom and needed_tailroom from lowerdev
In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroom and needed_tailroom from lowerdev macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom s…
-
Critical 9.8
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to…
-
Critical 9.8
netfilter: flowtable: publish GC-visible tuple last
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe an…
-
Critical 9.8
sctp: validate cookie AUTH state before use
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM len…
-
Critical 9.8
ovpn: finish crypto callback cleanup before peer release
In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer ref…
-
Critical 9.8
ceph: avoid fs reclaim while using current->journal_info
In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current->journal_info handle_reply() stores a `ceph_mds_request` pointer in `current->journal_info` while filling the inode and dentry cache from an MDS rep…
-
Critical 9.8
libceph: fix OOB read in decode_watchers() via missing bounds check
In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via missing bounds check ceph_start_decoding() validates that struct_len bytes remain in the buffer after the encoding header, but accepts struct_le…
-
Critical 9.8
libceph: Avoid using invalid osd indices from primary_temp
In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_…
-
Critical 9.8
libceph: fix multiple unsafe decodes in decode_locker()
In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decode_locker() decode_locker() in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-…
-
Critical 9.8
mptcp: options: reset DSS fields in case of unexpected size
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboptio…
-
Critical 9.8CVE-2026-80587 Public exploit
mptcp: avoid combining some incoming suboptions
In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combi…
-
Critical 9.8
block: stop the timeout timer when releasing a never added disk
In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_e…
-
Critical 9.4
riscv: lib: Fix ZBB strnlen reading past count boundary
In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen reading past count boundary The ZBB-optimized strnlen loop loads one word ahead before checking the aligned boundary: REG_L t1, SZREG(t0) // load next word addi t0…
-
Critical 9.4
mptcp: fastopen: only mark MPTFO subflows with SYN data
In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intenti…
-
Critical 9.3
s390/vfio_ccw: Ensure first IDAW remains constant
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size …
-
Critical 9.3
s390/vfio_ccw: Limit the number of channel program segments
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architec…
-
High 8.8
s390/vfio_ccw: Implement a crw lock
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Implement a crw lock Unlike the channel_program struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous …
-
High 8.8
s390/vfio_ccw: Selectively expand io_mutex
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Selectively expand io_mutex The io_mutex was defined to serialize the io_regions, but then has also sort of been associated with the I/O themselves because of the close relatio…
-
High 8.8
s390/vfio_ccw: Ensure index for read/write regions are within range
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but ne…
-
High 8.8
s390/vfio_ccw: Cancel existing workqueues
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues The initialization of the io_work and crw_work workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup t…
-
High 8.8
drm/amdgpu: reject oversized IBs with per-ring packet limits
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through to ib->length_dw without a limit, while ring_emit_ib() encod…
-
High 8.4
xfs: bounds-check buffer log item's dirty bitmap
In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpy(xfs_…
-
High 8.4
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates …
-
High 8.4
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP and ARP query ioctls qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by a user-supplied length (udata_len) without checking …
-
High 8.2
s390/vfio_ccw: Move cp cleanup out of not operational
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup out of not operational The fsm_notoper() routine is called when the device has been lost, and is (by definition) no longer operational. Since this can happen as…
-
High 7.9
s390/vfio_ccw: Fix out of bounds check on CCW array
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Fix out of bounds check on CCW array The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program,…
-
High 7.8
net/sched: cls_bpf: reject dev-bound programs bound to a different device
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-bound programs bound to a different device cls_bpf_prog_from_efd() obtained a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bou…
-
High 7.8
net/sched: cls_u32: skip hash tables in u32_bind_class()
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash tables in u32_bind_class() u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode through the walker callback. u32_bind_class() unconditionally casts…
-
High 7.8
ipvs: revalidate ihl to prevent out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent out-of-bounds access While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them f…
-
High 7.8
netfilter: ipset: fix refcount race between list:set GC and swap
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap __ip_set_put_byindex() resolved the index to a set pointer under RCU, then took ip_set_ref_lock in __ip_set_put() to decrement…
-
High 7.8
perf: Reject exited events as group leaders
In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perf_event_remove_on_exec() sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can re…
-
High 7.8CVE-2026-80521 Public exploit
af_unix: Unlink scc_entry in unix_del_edge().
In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--' 2) Run the followin…
-
High 7.8
crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The cu…
-
High 7.8
ASoC: tas2562: Validate values for volume writes
In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562_volume_control_put() does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed si…
-
High 7.8
xfs: avoid UAF on sc->tempip in xrep_tempfile_create
In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc->tempip in xrep_tempfile_create LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc->tempip. Fix that.
-
High 7.8
xfs: fix off-by-one in rtrefcount btree root level validation
In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfs_rtrefcountbt_compute_maxlevels() sets mp->m_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1; where the trailing "+ 1" al…
-
High 7.8
drm/amdgpu: Fix UVD decode image min size calculation
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD decode image min size calculation This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow. (cherry picked from commit b41c8cb12e202b2203533…
-
High 7.8
drm/amdgpu: validate GEM_CREATE domain combinations
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEM_CREATE domain combinations AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK, but did not validate domain combinations. Userspace could combine CPU…
-
High 7.8
s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing The zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct overlays to access and modify the domain field in the EP11 …
-
High 7.8
s390/zcrypt: Improve EP11 CPRB length and overflow checks
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB length and overflow checks The xcrb_msg_to_type6_ep11cprb_msgx() function lacks proper input validation, creating security vulnerabilities: 1. Missing minimum s…
-
High 7.8
s390/zcrypt: Improve CCA CPRB length and overflow checks
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrb_msg_to_type6cprb_msgx() function lacks proper input validation, creating security vulnerabilities: 1. Integer overflow after …
-
High 7.8
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition In atmci_probe, &host->bh_work is bound with atmci_work_func, and atmci_interrupt, atmci_timeout_timer and atmci_dma_c…
-
High 7.8
Input: sur40 - fix input device registration ordering
In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40_probe(), input_register_device() was previously called early before the V4L2 video device and vb2_queue components were fully in…
-
High 7.8
openrisc: signal: do not restore privileged SR bits on sigreturn
In the Linux kernel, the following vulnerability has been resolved: openrisc: signal: do not restore privileged SR bits on sigreturn restore_sigcontext() copies the whole supervision register (SR) from the signal frame and only clears SPR_SR_SM before the val…
-
High 7.8
crypto: qce - fix error path in devm_qce_register_algs
In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in devm_qce_register_algs If ops->register_algs() fails, the error path repeatedly calls the same ops->unregister_algs() from the failed registration. Use the loo…
-
High 7.8
Input: synaptics-rmi4 - block s_input when F54 queue is busy
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block s_input when F54 queue is busy Changing the input (diagnostic report type) mid-stream changes the report size. Since V4L2 buffers are allocated based on the size…
-
High 7.8
Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer rmi_f54_work() reads a diagnostics report from the device into f54->report_data, sizing the transfer with rmi_f54_get…
-
High 7.8
Input: synaptics-rmi4 - zero report size on F54 work error
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the 'error' label, …
-
High 7.8
Input: byd - synchronize timer deletion before freeing private data
In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses timer_delete() before freeing the driver's private data. This does not wait for a running byd_clear_t…
-
High 7.8
Input: cs40l50-vibra - validate custom data from user space
In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50_add() copies the custom data of an FF_PERIODIC/FF_CUSTOM effect straight from the ff_effect the user passed to EVIOCSFF, wi…
-
High 7.8
fbdev: clear fb_info->mode before deleting a videomode
In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fb_info->mode before deleting a videomode fb_set_var() can delete a mode from info->modelist when userspace passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code chec…
-
High 7.8
fbdev: bound mode sysfs output to the sysfs buffer
In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value int…
-
High 7.8
drm/shmem_helper: Check VMA boundaries for PMD mappings
In the Linux kernel, the following vulnerability has been resolved: drm/shmem_helper: Check VMA boundaries for PMD mappings In the ->huge_fault handler do not install a PMD huge page mapping if the huge page exceeds the boundaries of the VMA. All other ->huge…
-
High 7.8
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their value thr…
-
High 7.5
net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode (such as legacy INTx or single MSI), wx->msix_entry is not allocated or initialized. Calling NGBE_INT…
-
High 7.5
veth: fix queue index used to wake the peer txq in veth_poll
In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in veth_poll veth_poll() derives the index of the peer TX queue to wake from rq->xdp_rxq.queue_index. That field is only initialized by xdp_rxq…
-
High 7.5
eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier (…
-
High 7.5
ovpn: defer key slot crypto freeing to workqueue
In the Linux kernel, the following vulnerability has been resolved: ovpn: defer key slot crypto freeing to workqueue Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU callback. That is not safe for all c…
-
High 7.5
ovpn: fix NULL dereference when killing missing key
In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missing key ovpn_crypto_kill_key assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer …
-
High 7.5
ceph: fix hanging __ceph_get_caps() with stale mds_wanted
In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging __ceph_get_caps() with stale mds_wanted A reader can hang forever in __ceph_get_caps() when the client no longer holds `FILE_RD`, but local cap state still says that the cap…
-
High 7.5
mptcp: reclaim forward-allocated memory on RX path errors
In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"), errors in the receive path prior to queueing skbs into the r…
-
High 7.3
fbdev: core: Fix pointer desynchronization in fb_io_read()
In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fb_io_read() In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to a faulty user buffer), the loop adjusts the chunk size 'c' …
-
High 7.1
clk: spacemit: k3: set hdma clock as critical
In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsible for the internal TCM access path of X100 RISC-V core, so set the clock flag as critical to prevent it from being shut o…
-
High 7.1
xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN When exchanging two full-file ranges, xmi_can_exchange_reflink_flags() can move the reflink inode flag from the file that…
-
High 7.1
xfs: propagate errors from xfs_rtginode_load
In the Linux kernel, the following vulnerability has been resolved: xfs: propagate errors from xfs_rtginode_load xfs_rtginode_ensure() treats every xfs_rtginode_load() error other than -ENOENT as success. This can leave the realtime group inode unset after an…
-
High 7.1
s390/vfio_ccw: Free all memory if cp_init() fails
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() f…
-
Unscored —
firewire: ohci: fix NULL pointer dereference in ar_context_release
In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointer dereference in ar_context_release During the error handling path of the driver's probe function, a NULL pointer dereference can occur in ar_context_release().…
-
Unscored —
l2tp: fix tunnel and session refcount leak on seq_file release
In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session refcount leak on seq_file release In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state (pd->tunnel and pd->session) is kept in seq_file private data t…
-
Unscored —
regmap: sdw-mbq: don't call an unset readable_reg callback
In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readable_reg callback regmap_sdw_mbq_poll_busy() decides whether to poll the Function Busy bit by calling ctx->readable_reg(), which is a straight copy of…
-
Unscored —
net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain tcf_action_exec() handles TC_ACT_GOTO_CHAIN by first checking rcu_access_pointer(a->goto_chain) and then calling tcf_action_goto_cha…
-
Unscored —
rseq: Prevent hard lockup on granted time slice extension
In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension __exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with interrupts enabled. If the extension is granted it invokes h…
-
Unscored —
scsi: core: pair EH runtime PM get and put
In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM get and put shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autop…
-
Unscored —
optee: ffa: Add NULL check in optee_ffa_lend_protmem
In the Linux kernel, the following vulnerability has been resolved: optee: ffa: Add NULL check in optee_ffa_lend_protmem Sashiko (locally) reports a possible null dereference under memory pressure due to the lack of validation of the allocated pointer. Fix th…
-
Unscored —
ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup The ipc_config_data buffer for copier widgets is built once during ipc_prepare (called from sof_pcm_setup_connected_wi…
-
Unscored —
xfs: don't swallow dquot recovery verification errors
In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and j…
-
Unscored —
xfs: fix another iunlink infinite loop bug in online fsck
In the Linux kernel, the following vulnerability has been resolved: xfs: fix another iunlink infinite loop bug in online fsck xrep_iunlink_resolve_bucket is supposed to reconstruct as much of the incore prev and next unlinked list pointers based on what it fi…
-
Unscored —
xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
In the Linux kernel, the following vulnerability has been resolved: xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair LOLLM noticed a longstanding bug where xrep_iunlink_walk_ondisk_bucket tries to walk ragi->sc->sa.agi_bp to rebuild the unlin…
-
Unscored —
xfs: fix ilock leak on error in xfs_dq_get_next_id
In the Linux kernel, the following vulnerability has been resolved: xfs: fix ilock leak on error in xfs_dq_get_next_id xfs_dq_get_next_id() takes the quota inode ILOCK before calling xfs_iread_extents(). If xfs_iread_extents() fails, the function returns imme…
-
Unscored —
xfs: don't double-lock when deleting a self-referential directory
In the Linux kernel, the following vulnerability has been resolved: xfs: don't double-lock when deleting a self-referential directory LOLLM notices that the dirtree scrubber can detect a directory that refers to itself. In this case, it's not correct for the …
-
Unscored —
drm/amdgpu: disallow multiple FENCE chunks in one submit
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple FENCE chunks in one submit amdgpu_cs_pass1() dispatches on chunk_id once per chunk without rejecting repeated ids. p->uf_bo is a single-slot field, so a submissi…
-
Unscored —
drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream when vblank is enabled/queried from DRM_IOCTL_MODE_CR…
-
Unscored —
s390/zcrypt: Pad trailing CCA or EP11 message with zeros
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Pad trailing CCA or EP11 message with zeros The both functions xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() copy the user space message into a kernel buffer…
-
Unscored —
gpio: ml-ioh: use raw_spinlock_t for the register lock
In the Linux kernel, the following vulnerability has been resolved: gpio: ml-ioh: use raw_spinlock_t for the register lock ioh_irq_type() is registered as the irq_chip .irq_set_type callback and takes chip->spinlock with spin_lock_irqsave(). This callback is …
-
Unscored —
gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
In the Linux kernel, the following vulnerability has been resolved: gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind The "trigger" debugfs file has a hand-rolled ->write handler (trigger_write()) that dereferences the per-device g…
-
Unscored —
gve: fix NULL dereference due to missing ptp adjfine
In the Linux kernel, the following vulnerability has been resolved: gve: fix NULL dereference due to missing ptp adjfine Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as follows: sudo ./testptp -d /dev/ptp…
-
Unscored —
Input: hynitron_cstxxx - validate touch count and finger IDs
In the Linux kernel, the following vulnerability has been resolved: Input: hynitron_cstxxx - validate touch count and finger IDs The driver allocates max_touch_num input slots, which are indexed from zero through max_touch_num - 1. The current check allows a …
-
Unscored —
Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Previously, rmi_f54_buffer_queue() waited for the worker thread to finish but ignored whether it succeeded. If the worker fai…
-
Unscored —
powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In papr_phy_attest_create_handle(), the params->cmd.length is not validated before use, which can result in a buffer over…
-
Unscored —
Input: iforce - validate input packet lengths
In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforce_process_packet() reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the share…
-
Unscored —
drm/panthor: skip zero-sized firmware sections
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized firmware sections panthor_fw_load_section_entry() skips BO creation when the firmware section VA range is empty. If such a section is added to the firmware sectio…
-
Unscored —
ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout Ignore IPC errors for pipeline state change if the firmware state is crashed or the IPC has timed out. If the firmwar…
Revision history
-
#45
Neue Updates von SUSE aufgenommen
-
#44
Neue Updates von SUSE und Red Hat aufgenommen
-
#43
Neue Updates von Ubuntu und Red Hat aufgenommen
-
#42
Neue Updates von SUSE und Amazon aufgenommen
-
#41
Neue Updates von Oracle Linux und SUSE aufgenommen
-
#40
Neue Updates von SUSE und Red Hat aufgenommen
-
#39
Neue Updates von SUSE und IBM aufgenommen
-
#38
Neue Updates von Oracle Linux und Debian aufgenommen
-
#37
Neue Updates von Red Hat aufgenommen
-
#36
Neue Updates von SUSE, Oracle Linux und Red Hat aufgenommen
-
#35
Neue Updates von Oracle Linux aufgenommen
-
#34
Neue Updates von Oracle Linux aufgenommen
-
#33
Neue Updates von Rocky Enterprise Software Foundation, SUSE und Oracle Linux aufgenommen
-
#32
Neue Updates von Red Hat aufgenommen
-
#31
Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen
-
#30
Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen
-
#29
Neue Updates von SUSE und Rocky Enterprise Software Foundation aufgenommen
-
#28
Neue Updates von Red Hat aufgenommen
-
#27
Neue Updates von SUSE, Oracle Linux, openSUSE und Debian aufgenommen
-
#26
Neue Updates von SUSE aufgenommen
-
#25
Neue Updates von SUSE, Oracle Linux und Rocky Enterprise Software Foundation aufgenommen
-
#24
Neue Updates von SUSE und Oracle Linux aufgenommen
-
#23
Neue Updates von Oracle Linux, Red Hat und Amazon aufgenommen
-
#22
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#21
Neue Updates von Red Hat aufgenommen
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2026-74734
https://lore.kernel.org/linux-cve-announce/2026082653-CVE-2026-74734-fc5b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74735
https://lore.kernel.org/linux-cve-announce/2026082656-CVE-2026-74735-e7ef@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74736
https://lore.kernel.org/linux-cve-announce/2026082656-CVE-2026-74736-d864@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74737
https://lore.kernel.org/linux-cve-announce/2026082656-CVE-2026-74737-bf95@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74738
https://lore.kernel.org/linux-cve-announce/2026082656-CVE-2026-74738-4552@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74739
https://lore.kernel.org/linux-cve-announce/2026082657-CVE-2026-74739-5fd6@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74740
https://lore.kernel.org/linux-cve-announce/2026082657-CVE-2026-74740-dae7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74741
https://lore.kernel.org/linux-cve-announce/2026082657-CVE-2026-74741-6e2b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74742
https://lore.kernel.org/linux-cve-announce/2026082657-CVE-2026-74742-9e90@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74743
https://lore.kernel.org/linux-cve-announce/2026082658-CVE-2026-74743-ba1f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74744
https://lore.kernel.org/linux-cve-announce/2026082658-CVE-2026-74744-db6f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74745
https://lore.kernel.org/linux-cve-announce/2026082658-CVE-2026-74745-fe41@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74746
https://lore.kernel.org/linux-cve-announce/2026082658-CVE-2026-74746-c2f9@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74747
https://lore.kernel.org/linux-cve-announce/2026082658-CVE-2026-74747-32a0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74748
https://lore.kernel.org/linux-cve-announce/2026082659-CVE-2026-74748-e77a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74749
https://lore.kernel.org/linux-cve-announce/2026082659-CVE-2026-74749-2cf1@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74750
https://lore.kernel.org/linux-cve-announce/2026082659-CVE-2026-74750-8690@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74751
https://lore.kernel.org/linux-cve-announce/2026082659-CVE-2026-74751-a9d8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74752
https://lore.kernel.org/linux-cve-announce/2026082600-CVE-2026-74752-6509@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74753
https://lore.kernel.org/linux-cve-announce/2026082600-CVE-2026-74753-9105@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-74754
https://lore.kernel.org/linux-cve-announce/2026082600-CVE-2026-74754-2bb1@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80519
https://lore.kernel.org/linux-cve-announce/2026082600-CVE-2026-80519-45ff@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80520
https://lore.kernel.org/linux-cve-announce/2026082601-CVE-2026-80520-0d47@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80521
https://lore.kernel.org/linux-cve-announce/2026082601-CVE-2026-80521-2b35@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80522
https://lore.kernel.org/linux-cve-announce/2026082601-CVE-2026-80522-a340@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80523
https://lore.kernel.org/linux-cve-announce/2026082601-CVE-2026-80523-34bb@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80524
https://lore.kernel.org/linux-cve-announce/2026082601-CVE-2026-80524-2d28@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80525
https://lore.kernel.org/linux-cve-announce/2026082602-CVE-2026-80525-f83f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80526
https://lore.kernel.org/linux-cve-announce/2026082602-CVE-2026-80526-fb32@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80527
https://lore.kernel.org/linux-cve-announce/2026082602-CVE-2026-80527-449e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80528
https://lore.kernel.org/linux-cve-announce/2026082602-CVE-2026-80528-0b2f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80529
https://lore.kernel.org/linux-cve-announce/2026082603-CVE-2026-80529-4cf2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80530
https://lore.kernel.org/linux-cve-announce/2026082603-CVE-2026-80530-4a96@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80531
https://lore.kernel.org/linux-cve-announce/2026082603-CVE-2026-80531-36dd@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80532
https://lore.kernel.org/linux-cve-announce/2026082603-CVE-2026-80532-6860@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80533
https://lore.kernel.org/linux-cve-announce/2026082604-CVE-2026-80533-0138@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80534
https://lore.kernel.org/linux-cve-announce/2026082604-CVE-2026-80534-b7cd@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80535
https://lore.kernel.org/linux-cve-announce/2026082604-CVE-2026-80535-abd7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80536
https://lore.kernel.org/linux-cve-announce/2026082604-CVE-2026-80536-5666@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80537
https://lore.kernel.org/linux-cve-announce/2026082605-CVE-2026-80537-c51a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80538
https://lore.kernel.org/linux-cve-announce/2026082605-CVE-2026-80538-30fb@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80539
https://lore.kernel.org/linux-cve-announce/2026082605-CVE-2026-80539-ee80@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80540
https://lore.kernel.org/linux-cve-announce/2026082605-CVE-2026-80540-2460@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80541
https://lore.kernel.org/linux-cve-announce/2026082605-CVE-2026-80541-d0ea@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80542
https://lore.kernel.org/linux-cve-announce/2026082606-CVE-2026-80542-ede3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80543
https://lore.kernel.org/linux-cve-announce/2026082606-CVE-2026-80543-592a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80544
https://lore.kernel.org/linux-cve-announce/2026082606-CVE-2026-80544-3bae@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80545
https://lore.kernel.org/linux-cve-announce/2026082606-CVE-2026-80545-f190@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80546
https://lore.kernel.org/linux-cve-announce/2026082607-CVE-2026-80546-79bb@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80547
https://lore.kernel.org/linux-cve-announce/2026082607-CVE-2026-80547-4c7e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80548
https://lore.kernel.org/linux-cve-announce/2026082607-CVE-2026-80548-bcfc@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80549
https://lore.kernel.org/linux-cve-announce/2026082607-CVE-2026-80549-2908@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80550
https://lore.kernel.org/linux-cve-announce/2026082608-CVE-2026-80550-5cb8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80551
https://lore.kernel.org/linux-cve-announce/2026082608-CVE-2026-80551-e413@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80552
https://lore.kernel.org/linux-cve-announce/2026082608-CVE-2026-80552-feb6@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80553
https://lore.kernel.org/linux-cve-announce/2026082608-CVE-2026-80553-ed22@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80554
https://lore.kernel.org/linux-cve-announce/2026082608-CVE-2026-80554-aead@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80555
https://lore.kernel.org/linux-cve-announce/2026082609-CVE-2026-80555-d7d3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80556
https://lore.kernel.org/linux-cve-announce/2026082609-CVE-2026-80556-04cc@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80557
https://lore.kernel.org/linux-cve-announce/2026082609-CVE-2026-80557-5359@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80558
https://lore.kernel.org/linux-cve-announce/2026082609-CVE-2026-80558-e557@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80559
https://lore.kernel.org/linux-cve-announce/2026082610-CVE-2026-80559-9595@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80560
https://lore.kernel.org/linux-cve-announce/2026082610-CVE-2026-80560-6927@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80561
https://lore.kernel.org/linux-cve-announce/2026082610-CVE-2026-80561-57d4@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80562
https://lore.kernel.org/linux-cve-announce/2026082610-CVE-2026-80562-30aa@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80563
https://lore.kernel.org/linux-cve-announce/2026082611-CVE-2026-80563-188c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80564
https://lore.kernel.org/linux-cve-announce/2026082611-CVE-2026-80564-9a1f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80565
https://lore.kernel.org/linux-cve-announce/2026082611-CVE-2026-80565-01f5@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80566
https://lore.kernel.org/linux-cve-announce/2026082611-CVE-2026-80566-0da4@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80567
https://lore.kernel.org/linux-cve-announce/2026082612-CVE-2026-80567-15b0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80568
https://lore.kernel.org/linux-cve-announce/2026082612-CVE-2026-80568-d3e3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80569
https://lore.kernel.org/linux-cve-announce/2026082612-CVE-2026-80569-5c4f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80570
https://lore.kernel.org/linux-cve-announce/2026082612-CVE-2026-80570-2cb3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80571
https://lore.kernel.org/linux-cve-announce/2026082612-CVE-2026-80571-b189@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80572
https://lore.kernel.org/linux-cve-announce/2026082613-CVE-2026-80572-fc32@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80573
https://lore.kernel.org/linux-cve-announce/2026082613-CVE-2026-80573-c85c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80574
https://lore.kernel.org/linux-cve-announce/2026082613-CVE-2026-80574-72f3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80575
https://lore.kernel.org/linux-cve-announce/2026082613-CVE-2026-80575-644f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-80576
https://lore.kernel.org/linux-cve-announce/2026082614-CVE-2026-80576-2f9d@gregkh/