Summary
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise einen Denial-of-Service-Angriff auszulösen, Daten zu manipulieren oder offenzulegen oder Sicherheitsmaßnahmen zu umgehen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 207
-
Critical 9.8
RDMA/siw: Bound fragmented header copies by the remaining length
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most …
-
Critical 9.8
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access mr_check_range() validates that [iova, iova+length) falls within the registered MR range using wraparound-prone arithm…
-
High 8.8
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compoun…
-
High 8.8
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified IOBA parameter checking across KVM and VFIO into iom…
-
High 8.8
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops mmu_lock before calling kvmhv_emulate_tlbie_lp…
-
High 8.8
wifi: cfg80211: don't filter by BSS type when removing stale entries
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211_update_assoc_bss_entry() removes that entry …
-
High 8.1
net: lan743x: fix RX checksum use-after-free
In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743x_rx_process_buffer() adds each non-first receive buffer to the head skb's frag_list. On the last descriptor, lan743x_rx_trim_skb() lineariz…
-
High 8.1
cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server use-after-free in cifs_chan_skip_or_disable() When a secondary channel is no longer supported by the server, cifs_chan_skip_or_disable() drops the channel reference with cifs…
-
High 8.1
IB/isert: wait for deferred control PDU completions before releasing the connection
In the Linux kernel, the following vulnerability has been resolved: IB/isert: wait for deferred control PDU completions before releasing the connection isert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and ISTATE_SEND_TEXTRSP completions off …
-
High 7.8
drm/ttm: fix swapped-out resources never leaving their bulk_move range
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulk_move range ttm_tt_swapout() returns the number of pages swapped out on success and a negative error code on failure; for a populate…
-
High 7.8
mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ
In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ On I6500 CPU cores, lld and scd give no ordering guarantees (same as all other instructions). To respect the assumption that a…
-
High 7.8
xfrm: save input state data before secpath resets
In the Linux kernel, the following vulnerability has been resolved: xfrm: save input state data before secpath resets xfrm_input() stores the current xfrm_state in the skb secpath while it continues receive-side processing. Some input paths can reset that sec…
-
High 7.8
ipv6: xfrm: use full sockets in local error paths
In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6_local_rxpmtu() and xfrm6_local_error() dereference skb->sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP S…
-
High 7.8
openvswitch: avoid reallocating confirmed conntrack labels
In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovs_ct_get_conn_labels() adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read lockle…
-
High 7.8
RDMA/ucma: Serialize join and leave on copy_to_user failure
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copy_to_user failure rdma_join_multicast() queues RoCE work that later reads the ucma_multicast through event->param.ud.private_data, then list_add()s t…
-
High 7.8
swiotlb: use the adjusted address for the highmem page lookup
In the Linux kernel, the following vulnerability has been resolved: swiotlb: use the adjusted address for the highmem page lookup swiotlb_bounce() reads the page frame number from the slot's recorded orig_addr, then advances orig_addr by tlb_offset to reach t…
-
High 7.8CVE-2026-98256 Public exploit
signal: Prevent exec() race
In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec() race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in __send_signal_locked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by tas…
-
High 7.8CVE-2026-98258 Public exploit
posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cpu_timer::firing from a tri…
-
High 7.8CVE-2026-98260 Public exploit
exec: Cleanup POSIX timers right after de_thread()
In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that threa…
-
High 7.8
net: lock the socket in sock_gettstamp()
In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sock_gettstamp() sk->sk_flags must only be changed while holding the socket lock, because sock_set_flag() and sock_reset_flag() use non atomic operations (__set_bit() …
-
High 7.8
futex: Also allocate private hash on vfork()
In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork() As Jann demonstrated, it is entirely feasible to access the mm through vfork(). Therefore we need to allocate a private hash on vfork() as well as…
-
High 7.8
net: dsa: mxl862xx: disable the stats poll on teardown
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xx_setup() arms the stats poll before mxl862xx_setup_mdio(), and nothing stops it until dsa_register_switch() has returned an erro…
-
High 7.8
wifi: virt_wifi: don't transfer operstate before register
In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: don't transfer operstate before register virt_wifi_newlink() calls netif_stacked_transfer_operstate() before register_netdevice(). If the lower device is dormant, that queues…
-
High 7.8
ntfs: protect runlist updates with the runlist lock
In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfs_non_resident_attr_shrink() calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and t…
-
High 7.8
smb: client: validate absolute native symlink targets before NT fixups
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an…
-
High 7.8
netfilter: flowtable: hold reference on ct until flow is released
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from…
-
High 7.8
dmaengine: pxa: fix double counting of the hw descriptors
In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxad_alloc_desc() was converted from kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc), GFP_NOWAIT) to kzalloc_flex(), which sets the…
-
High 7.8
wifi: cfg80211: don't free driver-owned scan requests
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't free driver-owned scan requests When an interface goes down while a scan is running, cfg80211 completes the scan towards userspace and frees the scan request. However, t…
-
High 7.8
RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths Commit 0b261d7c1cd3 ("RDMA/rxe: Break endless pagefault loop for RO pages") dropped the access permission test from rxe_check_pagefaul…
-
High 7.8
xfrm: hold net_device reference under RCU in bundle creation
In the Linux kernel, the following vulnerability has been resolved: xfrm: hold net_device reference under RCU in bundle creation xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into a local pointer without taking a device reference, then pas…
-
High 7.8
RDMA/rxe: validate access flags before swapping the MR's PD
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxe_rereg_user_mr() reassigns mr->ibmr.pd first and only then validates the IB_MR_REREG_ACCESS argument: if (flags & IB_MR_REREG_PD…
-
High 7.8
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept We need to clear cep before release state_lock as siw_qp_llp_close and siw_qp_modify->siw_qp_llp_close did. Otherwi…
-
High 7.8
esp: downgrade zerocopy managed frags before mutating skb frags
In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path (esp->inplace == false) ESP rewrites the skb frag array: esp_output_head() appends a trailer fr…
-
High 7.8
xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() syzbot reported a suspicious RCU usage warning in ip6_pkt_drop(): WARNING: suspicious RCU usage in …
-
High 7.5
smb: client: fix use-after-free of iface in cifs_try_adding_channels()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifs_try_adding_channels() cifs_try_adding_channels() iterates ses->iface_list with list_for_each_entry_safe_from(), which captures the next entry …
-
High 7.5
smb: client: fix rlist race and missing initialization
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next and ->prev to NULL instead of pointing to itself, making list_emp…
-
High 7.5
smb: client: cancel reconnect work in clean_demultiplex_info()
In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in clean_demultiplex_info() clean_demultiplex_info() cancels server->echo delayed work but not server->reconnect, which can cause a use-after-free when the …
-
High 7.5
rds: ib: use rds_conn_drop() on protocol version mismatch
In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rds_conn_drop() on protocol version mismatch rds_ib_cm_connect_complete() runs from the RDMA-CM event handler with conn->c_cm_lock held. When the peer negotiates a protocol versi…
-
High 7.5
Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcomm_sock_cleanup_listen() closes unaccepted child sockets through rfcomm_sock_close(), which takes the child socket lock …
-
High 7.1
smb: client: fix potential OOB read in smb3_enum_snapshots()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3_enum_snapshots() If snapshot_array_size is smaller than GMT_TOKEN_SIZE, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array…
-
High 7.1CVE-2026-98180 Public exploit
drm/msm: RCU-free the scheduler-containing ring and VM objects
In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msm_ringbuffer and struct msm_gem_vm embed a struct drm_gpu_scheduler. msm_ringbuffer_destroy() and the VM free call…
-
High 7.1
IB/hfi1: Fix the PIO_CRED credit-return mmap
In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIO_CRED credit-return mmap hfi1_file_mmap()'s PIO_CRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or th…
-
High 7.1
dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3
In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops poin…
-
High 7.1
wifi: libipw: reject too-short association responses
In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipw_handle_assoc_resp() reads the capability, status and aid fields of the 30-byte association response prefix and then computes the in…
-
High 7.1
wifi: libipw: reject too-short beacon and probe responses
In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipw_process_probe_response() and the libipw_network_init() call it makes assume the frame contains the full 36-byte beacon and pro…
-
High 7.0
hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove When the fan/pwm 4-5 pins are not used as GPIO, w83791d_probe() creates the w83791d_group_fanpwm45 sysfs group on the I2C client devi…
-
High 7.0
xfrm: use hlist_del_init_rcu for state_cache and state_cache_input
In the Linux kernel, the following vulnerability has been resolved: xfrm: use hlist_del_init_rcu for state_cache and state_cache_input Commit 14acf9652e56 ("xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete") converted bydst/bysrc/byseq/byspi f…
-
High 7.0
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() iwpm_get_nlmsg_request() initializes refcount _after_ list_add_tail() making it accessible to global list where another CPU can kref_ge…
-
High 7.0
wifi: cfg80211: get the wiphy out of a dying network namespace
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: get the wiphy out of a dying network namespace When a network namespace is destroyed, cfg80211_pernet_exit() moves any wiphy back to the initial namespace, and just warns if t…
-
High 7.0
wifi: mac80211: unlist vifs when their netdev is unregistered
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: unlist vifs when their netdev is unregistered mac80211 only removes vifs from the local->interfaces list when an interface is removed via ieee80211_if_remove(), before it unre…
-
High 7.0
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed ib_device_get_netdev() intentionally returns a referenced net_device even when it is unregistering, so matching and cleanup callers…
-
High 7.0
RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds rxe_get_mcg() publishes a newly allocated multicast group in rxe->mcg_tree before programming the backing Ethernet multi…
-
Unscored —CVE-2026-98165 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
smb: client: fix server->total_read for compound encrypted PDUs
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server->total_read for compound encrypted PDUs In receive_encrypted_standard(), server->total_read is left at the full decrypted frame size when walking sub-PDUs of a compoun…
-
Unscored —
smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the star…
-
Unscored —
smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() In move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is insufficient. It allows iteration to continue even if t…
-
Unscored —
smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbd_connection leak on cifs_get_tcp_session() error When an RDMA connection is successfully established via smbd_get_connection() but cifs_get_tcp_session() later fails (e.g…
-
Unscored —
drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits of cp_hqd_eop_control store the base-2 logarithm of the EOP ring size. This was calculated as ffs(q->eop_ring…
-
Unscored —
drm/amdkfd: Avoid integer underflow in EOP ring size calculation.
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow in EOP ring size calculation. The low 6 bits of cp_hqd_eop_control store the base-2 logarithm of the EOP ring size. This was calculated as order_base_2(q->…
-
Unscored —
drm/amdgpu: Skip KFD mapping clear before initialization
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Skip KFD mapping clear before initialization amdgpu_amdkfd_clear_kfd_mapping() assumes that a non-NULL kfd_dev has a fully populated node array. This is not true when KFD device i…
-
Unscored —
drm/amdgpu: fix rmmio iounmap skipped on device removal
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix rmmio iounmap skipped on device removal amdgpu_pci_remove() calls drm_dev_unplug() before fini_sw(), so drm_dev_enter() is already false there and the iounmap() guarded by it …
-
Unscored —
drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gud_plane_atomic_check() The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing `num_properties`…
-
Unscored —
wifi: mac80211: refuse to make a monitor active when it has no queue
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: refuse to make a monitor active when it has no queue A monitor interface only gets a TXQ if it's created active, and one can't be added later. Setting the flag on a down inter…
-
Unscored —
wifi: mac80211: avoid out-of-bounds read for empty PREQ elements
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211_mesh_preq_size_ok() derives the location of the PREQ bottom fields before checking whether the element contains even…
-
Unscored —
wifi: mwifiex: prevent authentication frame length truncation
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiex_cfg80211_authenticate() derives the authentication frame length from req->ie_len and req->auth_data_len, both of type siz…
-
Unscored —
wifi: mwifiex: validate scan response extents
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiex_ret_802_11_scan() subtracts the fixed response fields and the firmware-provided BSS length from resp->size without first proving that eit…
-
Unscored —
wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length mwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a beacon/probe-response RSN or WPA information element a…
-
Unscored —
wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST The PDR_INTERFACE_LIST loop only checks that the record start is within the entry before reading an entire struct exp_if from it.…
-
Unscored —
wifi: p54: validate curve data length in the calibration curve converters
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54_convert_rev0() and p54_convert_rev1() read calibration curve data from the device-supplied EEPROM entry using cha…
-
Unscored —
wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() wilc_wlan_handle_isr_ext() takes the RX transfer size from the device-reported interrupt status register (a 15-bit field …
-
Unscored —
wifi: wilc1000: fix out-of-bounds read in P2P public action frames
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilc_wfi_p2p_rx() and mgmt_tx() start parsing a frame once ieee80211_is_public_action() returns true. That helper only verif…
-
Unscored —
wifi: wlcore: release runtime PM ref on regdomain config failure
In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure wlcore_regdomain_config() gets a runtime PM reference before sending the regulatory-domain command. When wlcore_cmd_regdomain_…
-
Unscored —
wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(), which only dequeues the timer and does not wait for …
-
Unscored —
wifi: libipw: reject TKIP frames without a full MIC
In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipw_michael_mic_verify() assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wr…
-
Unscored —
wifi: libertas_tf: fix UAF in lbtf_free_adapter()
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas_tf: fix UAF in lbtf_free_adapter() lbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command buffers before calling timer_delete_sync() to wait for the command timer…
-
Unscored —
wifi: iwlegacy: fix broadcast stations deallocation
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of __il4965_up(), il_dealloc_bcast_stations() clears only IL_STA_UCODE_ACTIVE, leaving IL_STA_BCAST set. This causes the …
-
Unscored —
wifi: brcmsmac: fix UAF in brcms_free_timer()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcms_free_timer() brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous cancel_delayed_work() to cancel the timer's underlying delayed work. If…
-
Unscored —
hwmon: (pwm-fan) Stop RPM timer before freeing tach data
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pwm-fan) Stop RPM timer before freeing tach data sample_timer() rearms the RPM timer and accesses the devm-managed ctx->tachs and ctx->pulses_per_revolution arrays. The cleanup action…
-
Unscored —
hwmon: (pmbus/core) increase number of phases and add new mask
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) increase number of phases and add new mask Increase the number of phases to 16 as a new upcoming device supports such a number. While at it, add a new mask for controlling…
-
Unscored —
hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
In the Linux kernel, the following vulnerability has been resolved: hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() nsensor->current_state is dynamically replaced as the sensor's state changes. update_numeric_sensor_from_wobj() does this by free…
-
Unscored —
Input: zero ff_effect before compat copy in input_ff_effect_from_user
In the Linux kernel, the following vulnerability has been resolved: Input: zero ff_effect before compat copy in input_ff_effect_from_user In the compat path input_ff_effect_from_user() aliases the caller's native struct ff_effect with the smaller struct ff_ef…
-
Unscored —
Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound Transport drivers (such as rmi_i2c and rmi_spi) invoke rmi_driver_suspend() and rmi_driver_resume() on their child rmi_dev d…
-
Unscored —
Input: soc_button_array - check btns_desc->package.count
In the Linux kernel, the following vulnerability has been resolved: Input: soc_button_array - check btns_desc->package.count Check that btns_desc->package.count is not 0 before accessing btns_desc->package.elements[0].
-
Unscored —
Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
In the Linux kernel, the following vulnerability has been resolved: Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() When chunking writes into SMBus blocks in rmi_smb_write_block(), the loop calculates block_len using the original total leng…
-
Unscored —
Input: evdev - zero absinfo before partial copy in EVIOCSABS
In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct input_absinfo: if (copy_fr…
-
Unscored —
Input: cyttsp5 - clamp the HID report size before memcpy
In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy() length into response_buf, which is CY_MAX_INPUT bytes.
-
Unscored —
mmc: spi: reset bytes_xfered before retrying CRC failures
In the Linux kernel, the following vulnerability has been resolved: mmc: spi: reset bytes_xfered before retrying CRC failures mmc_spi_data_do() updates data->bytes_xfered after each block has been transferred successfully. If a later block in the same data re…
-
Unscored —
mmc: sdio_uart: fix xmit_fifo leak when the port table is full
In the Linux kernel, the following vulnerability has been resolved: mmc: sdio_uart: fix xmit_fifo leak when the port table is full sdio_uart_add_port() allocates the transmit fifo before claiming a slot in sdio_uart_table[]. When all UART_NR slots are taken, …
-
Unscored —
mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-of-aspeed: Remove children before releasing SDC resources Probe failure and removal leave SDHCI child devices registered after the parent clock and managed resources are released. …
-
Unscored —
mmc: mxcmmc: cancel data work and watchdog on remove
In the Linux kernel, the following vulnerability has been resolved: mmc: mxcmmc: cancel data work and watchdog on remove mxcmci_remove() frees the host through the devm tail, but neither it nor mmc_remove_host() drains the driver's own asynchronous state. hos…
-
Unscored —
mmc: mmci: Fix use-after-free in busy-timeout work
In the Linux kernel, the following vulnerability has been resolved: mmc: mmci: Fix use-after-free in busy-timeout work ux500_busy_complete() can queue ux500_busy_timeout_work for an R1b command, but mmci_remove() never cancels it. The work can subsequently de…
-
Unscored —
mmc: hsq: Fix use-after-free in retry work
In the Linux kernel, the following vulnerability has been resolved: mmc: hsq: Fix use-after-free in retry work mmc_hsq_pump_requests() queues retry_work when request_atomic() returns -EBUSY; today sdhci-sprd is the only consumer that implements request_atomic…
-
Unscored —
mmc: core: Cancel SDIO IRQ work before freeing host
In the Linux kernel, the following vulnerability has been resolved: mmc: core: Cancel SDIO IRQ work before freeing host A host controller that uses sdio_signal_irq() schedules host->sdio_irq_work from its interrupt handler. That work is only cancelled on the …
-
Unscored —
selinux: recheck intermediate backing files on mprotect()
In the Linux kernel, the following vulnerability has been resolved: selinux: recheck intermediate backing files on mprotect() mprotect() can be used to bypass the SELinux checks that mmap() performs against the intermediate layers of a stacked filesystem. mma…
-
Unscored —
selinux: preserve user SID across nested backing files
In the Linux kernel, the following vulnerability has been resolved: selinux: preserve user SID across nested backing files SELinux saves the user file SID in a backing-file security blob so it remains available after mmap() replaces vma->vm_file with a backin…
-
Unscored —
IB/mlx4: Fix use-after-free on pkey sysfs registration failure
In the Linux kernel, the following vulnerability has been resolved: IB/mlx4: Fix use-after-free on pkey sysfs registration failure register_pkey_tree() ignores errors from register_one_pkey_tree() and continues registering the remaining slaves. The per-slave …
-
Unscored —
i2c: atr: fix dangling adapter pointer on add failure
In the Linux kernel, the following vulnerability has been resolved: i2c: atr: fix dangling adapter pointer on add failure i2c_atr_add_adapter() stores atr->adapter[chan_id] before i2c_add_adapter() so that the I2C bus notifier can match child clients during r…
-
Unscored —
sched_ext: Close the pre-enable ops error claim window
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Close the pre-enable ops error claim window scx_alloc_and_add_sched() publishes ops->priv before scx_root_enable_workfn() switches the state to SCX_ENABLING. An error claimed via s…
-
Unscored —
sched_ext: Fix NULL sched deref in kfunc sub-sched error paths
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix NULL sched deref in kfunc sub-sched error paths When the root scheduler has sub-scheds attached, the COMPAT kfunc wrappers scx_bpf_select_cpu_and() and scx_bpf_dsq_insert_vtime…
-
Unscored —
KEYS: trusted: Fix tpm2_load_cmd() boundary check
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2_load_cmd() boundary check tpm2_load_cmd() does boundary checks against the ASN.1 size i.e., payload->blob_len. Address this by passing the decoded blob size to tpm2_lo…
-
Unscored —
KEYS: encrypted: fix integer overflow of datablob_len
In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of datablob_len encrypted_key_alloc() stores datablob_len in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16_MA…
-
Unscored —
mm: filemap: retain mapped dropbehind folios
In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a com…
-
Unscored —
mm/vma: correctly unaccount on mmap_prepare() failure
In the Linux kernel, the following vulnerability has been resolved: mm/vma: correctly unaccount on mmap_prepare() failure __mmap_setup() accounts memory for relevant mappings via: security_vm_enough_memory_mm() -> __vm_enough_memory() -> vm_acct_memory() If _…
-
Unscored —
mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem
In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem With cgroup.memory=nokmem, shrinker_memcg_alloc() bails out early and never allocates an id, so shrinker->id keeps the 0 it…
-
Unscored —
mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count
In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count SWAP_USAGE_OFFLIST_BIT is embedded in the si->inuse_pages usage counter, and is meant to sit above any value that counter …
-
Unscored —
memstick: ms_block: destroy io_queue workqueue on removal
In the Linux kernel, the following vulnerability has been resolved: memstick: ms_block: destroy io_queue workqueue on removal msb_init_disk() creates the per-card ordered workqueue msb->io_queue with alloc_ordered_workqueue(). It is torn down with destroy_wor…
-
Unscored —
xfrm: serialize state GC with device state flush
In the Linux kernel, the following vulnerability has been resolved: xfrm: serialize state GC with device state flush The deferred-device pass in xfrm_dev_state_flush() finds states under xfrm_state_dev_gc_lock, but drops the lock before calling xfrm_dev_state…
-
Unscored —
scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() scsi_cdl_enable() uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A targe…
-
Unscored —
net/packet: clear RX owner on VNET header error
In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 ("net/packet: tpacket_rcv: avoid a producer race condition") added rx_owner_map and made tpacket_rcv() claim a V1 or V2 rin…
-
Unscored —
net/sched: hhf: cap hh_flows_limit at change time
In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: cap hh_flows_limit at change time hhf_change() stores TCA_HHF_HH_FLOWS_LIMIT with no upper bound. A huge hh_flows_limit lets each new heavy-hitter flow pass the hh_flows_curre…
-
Unscored —
net/sched: act_api: release tail references on DELACTION failure
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: release tail references on DELACTION failure A batched RTM_DELACTION request takes a temporary reference on each action before attempting any deletion. tcf_action_delete()…
-
Unscored —
net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value mhi_mbim_rx() ignores the return value of skb_copy_bits() when it copies each datagram out of the NTB. The datagram offset and len…
-
Unscored —
net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain The NDP traversal in mhi_mbim_rx() only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that p…
-
Unscored —
net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() The netif index carried in the DPMAIF PIT header is five bits wide, but ccmni_inst[] only has room for NIC_DEV_MAX (21) entr…
-
Unscored —
net: ip_tunnel: initialize `options_len` before referencing options
In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: initialize `options_len` before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ enc…
-
Unscored —
dma-buf: Fix silent overflow for phys vec to sgt
In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA (whi…
-
Unscored —
btrfs: clear free space tree creation state on rebuild failure
In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfs_rebuild_free_space_tree() sets BTRFS_FS_CREATING_FREE_SPACE_TREE before rebuilding the free space tree. Several error path…
-
Unscored —
btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()
In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() mark_block_group_to_copy() iterates over the commit root with skip_locking=true. A concurrent transaction commit…
-
Unscored —
Bluetooth: hci_sync: Serialize local codec list cleanup
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Serialize local codec list cleanup hci_dev_close_sync() clears hdev->local_codecs after releasing hdev->lock. Codec list additions and both traversals in sco_sock_getsock…
-
Unscored —
Bluetooth: hci_codec: validate vendor codec count length
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_codec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Althoug…
-
Unscored —
arm64: percpu: Fix LSE operations on {8,16}-bit types
In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on {8,16}-bit types The assembly for __percpu_##name##_case_##sz() and __percpu_##name##_return_case_##sz() doesn't use the 'sfx' macro argument to form the …
-
Unscored —
arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc swsusp_arch_suspend_exit() reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is n…
-
Unscored —
nfsd: fix handling of NFSEXP_PNFS in the netlink codepath
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of NFSEXP_PNFS in the netlink codepath The rework of how block layouts were checked moved the check for NFSEXP_PNFS out of nfsd4_setup_layout_type() and into the callers. T…
-
Unscored —
tcp: exclude old ACKs from tcp fast path
In the Linux kernel, the following vulnerability has been resolved: tcp: exclude old ACKs from tcp fast path Exclude old ACKs before SND.UNA from the tcp fast path as well as ACKs after SND.NXT. Such ACKs will fall through to the slow path, where tcp_ack() pe…
-
Unscored —
fs/dax: check zero or empty entry before converting xarray entry
In the Linux kernel, the following vulnerability has been resolved: fs/dax: check zero or empty entry before converting xarray entry Calling dax_to_folio() with empty entry causes kernel panic below when booting a VM with DAX enabled storage. This patch check…
-
Unscored —
ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
In the Linux kernel, the following vulnerability has been resolved: ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY A user reported that commit 105c42566a55 ("ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585") made the JMicron JMB585 unusa…
-
Unscored —
ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is …
-
Unscored —
ALSA: virtio: reset device before deleting virtqueues
In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: reset device before deleting virtqueues virtsnd_remove() and virtsnd_freeze() delete the virtqueues before resetting the device. del_vqs() frees the vring backing, but does not …
-
Unscored —
ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity data_ep_set_params() allocates each data URB for exactly u->packets isochronous frames, so urb->iso_frame_desc[] has u->p…
-
Unscored —
ALSA: core: Fix potential UAF after asynchronous card release
In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix potential UAF after asynchronous card release Usually a sound driver releases the resources assigned to the card via snd_card_free(), and it synchronizes with the whole releas…
-
Unscored —
9p: Fix v9fs_issue_write() to update i_size and remote_i_size
In the Linux kernel, the following vulnerability has been resolved: 9p: Fix v9fs_issue_write() to update i_size and remote_i_size Fix v9fs_issue_write() to update i_size and remote_i_size to the new size of the server file if we made it larger, using the star…
-
Unscored —
perf: Fix null pointer access in is_include_guest_event()
In the Linux kernel, the following vulnerability has been resolved: perf: Fix null pointer access in is_include_guest_event() A typical module unload occurring event when there is an active perf connection leads to freeing of the pmu pointer. The call log is …
-
Unscored —
btrfs: abort transaction on failure to update inode for hole punching and reflinking
In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on failure to update inode for hole punching and reflinking If we fail to update the inode we error out without aborting the transaction, which can result in a persis…
-
Unscored —
net: skbuff: do not leave stale header offsets after pskb_carve()
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: do not leave stale header offsets after pskb_carve() pskb_carve_inside_header() and pskb_carve_inside_nonlinear() remove the first bytes of a packet and reallocate skb->head. All…
-
Unscored —
net: mvpp2: prevent buffer overflow in page_pool allocation
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in page_pool allocation The per‑processor buffering scheme is supported only if the number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8). Thi…
-
Unscored —
x86/kprobes: Fix crash when probing CS CALL instructions
In the Linux kernel, the following vulnerability has been resolved: x86/kprobes: Fix crash when probing CS CALL instructions When using eBPF to probe CS CALL instructions within a function, a crash can be triggered. The eBPF tool probes offset 257 of the __hr…
-
Unscored —
net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()
In the Linux kernel, the following vulnerability has been resolved: net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() PSP conflicts with TLS ULP in its usage of both skb->decrypted and sk->sk_validate_xmit_skb(). Make PSP mutually exclu…
-
Unscored —
net: ethernet: cortina: Ack RX overrun interrupt correctly
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Ack RX overrun interrupt correctly The RX overrun interrupt is reported in interrupt status register 4, but gmac_irq() acknowledges it using the RX descriptor error bi…
-
Unscored —
eth: fbnic: ring the doorbell if a burst ends in a drop
In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnic_tx_map() skips the doorbell write, and the completion request, for every packet handed to it with xmit_more set, counting on the …
-
Unscored —
net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check
In the Linux kernel, the following vulnerability has been resolved: net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check ipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the route to the tunnel's remote endpoint and set ctx->…
-
Unscored —
btrfs: handle lack of space when cleaning up verity items
In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enable_verity() hits the qgroup limit, rollback_verity() needs its own metadata reservation. When the qgroup limit or lack of sp…
-
Unscored —
drm/xe/i2c: Disable IRQ on unbind
In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: Disable IRQ on unbind Currently, struct xe_i2c is freed before SGUnit IRQ is disabled in unbind path, leaving a potential UAF in case I2C IRQ is hit during this small window. Expl…
-
Unscored —
netlink: do not free nlk->groups while lockless readers can use it
In the Linux kernel, the following vulnerability has been resolved: netlink: do not free nlk->groups while lockless readers can use it netlink_realloc_groups() uses krealloc() under netlink_table_grab(). Whenever NLGRPSZ(groups) lands in a different kmalloc b…
-
Unscored —
net: bridge: vlan: fix bugs caused by switchdev deletion errors
In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix bugs caused by switchdev deletion errors Allowing switchdev to prevent vlan deletion and error out in __vlan_del could cause multiple different issues - inconsistent st…
-
Unscored —
drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown
In the Linux kernel, the following vulnerability has been resolved: drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown In drop_monitor teardown paths (net_dm_trace_off_set(), net_dm_hw_monitor_stop(), and error unwind paths in n…
-
Unscored —
pppoatm: ensure a writable skb header and linear data
In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatm_send(), LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the …
-
Unscored —
net: stmmac: fix TSO header length truncation
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmac_tso_xmit() stores the protocol header length returned by stmmac_tso_header_size() in a u8. stmmac_tso_valid_packet() admits headers up to …
-
Unscored —
af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().
In the Linux kernel, the following vulnerability has been resolved: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). Commit bfdb01283ee8 ("af_unix: Assign a unique index to SCC.") changed Tarjan's algorithm to update lowlink with lowlink, wh…
-
Unscored —
Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit btintel_pcie_submit_rx() used frbd_index > rxq->count to guard the FRBD array access, allowing frbd_index == rxq->count to pa…
-
Unscored —
Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtk_hci_wmt_evt and read its op/flag…
-
Unscored —
Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() iso_get_sock() returns the parent socket with a reference held, which is dropped by sock_put() once the child socket has been set up…
-
Unscored —
Bluetooth: hci_qca: Do not write to the serial port after it is closed
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Do not write to the serial port after it is closed hci_uart_close() closes the serdev port if HCI_QUIRK_NON_PERSISTENT_SETUP is set (for example, for the WCN399x family). …
-
Unscored —
Bluetooth: coredump: Quiesce dump work on unregister
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hci_devcd_handle_pkt_init() arms dump_timeout and coredump producers queue dump_rx without holding an hdev reference. Unregister leaves bo…
-
Unscored —
Bluetooth: btintel_pcie: validate TX skb length in send_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate TX skb length in send_sync btintel_pcie_prepare_tx() copies skb->len bytes into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA slot via an unchecked memcpy. Ove…
-
Unscored —
Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work unconditionally. They can run from the L2CAP/SCO/ISO …
-
Unscored —
dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist putting each entry into 'sg', but the entry length is …
-
Unscored —
tcp: do not let tcp_rmem be set below 4096
In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcp_rmem be set below 4096 We can hit a division by zero crash in tcp_rcvbuf_grow() and tcp_rcv_space_adjust(): divide error: 0000 [#1] PREEMPT SMP RIP: 0010:tcp_rcvbuf_grow+0…
-
Unscored —
tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). tcp_v6_do_rcv() no longer calls skb_clone_and_charge_r() for TCP_LISTEN since commit 073d89808c06 ("net: fix…
-
Unscored —
net: bridge: mst: move switchdev call outside rcu
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. br_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs while …
-
Unscored —
net: fddi: skfp: fix NULL deref when setting the MAC address while down
In the Linux kernel, the following vulnerability has been resolved: net: fddi: skfp: fix NULL deref when setting the MAC address while down skfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without checking netif_running(). ResetAdapter() first…
-
Unscored —
ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup When the forward output route cannot be used in icmp_route_lookup(), it enters the "reverse path" and calls ip_route_input…
-
Unscored —
net: bcmgenet: restore the hardware filters on open
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: restore the hardware filters on open bcmgenet_hfb_init() runs INIT_LIST_HEAD() on priv->rxnfc_list, which drops every rule off the list, and bcmgenet_open() calls it on each if…
-
Unscored —
seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrf_ip6_rcv() sets IP6SKB_L3SLAVE in IP6CB, but decap_and_vali…
-
Unscored —
wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() When mac80211 removes a sta, it calls .sta_state() which in turn calls ath11k_mac_station_remove(). In that function we clean up b…
-
Unscored —
ALSA: hda: trace PCM open only after assigning a stream
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses t…
-
Unscored —
drm/vc4: Use managed KMS polling to fix UAF on unbind
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Use managed KMS polling to fix UAF on unbind vc4_kms_load() calls drm_kms_helper_poll_init() but the driver provides no matching drm_kms_helper_poll_fini(). The output poll work stay…
-
Unscored —
drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory
In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory __xe_shrinker_walk() walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memor…
-
Unscored —
ALSA: 6fire: fix OOB write from device-reported iso length
In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6fire_pcm_in_urb_handler() sizes each outgoing isochronous packet as (actual_length - 4) / (in_n_analog << 2) * (out_n_analog << …
-
Unscored —
drm/msm/dp: skip PUSH_IDLE when the link was never enabled
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSH_IDLE when the link was never enabled msm_dp_display_atomic_enable() returns early when link training fails, leaving ->power_on false and the main link down. msm_dp_displ…
-
Unscored —
ALSA: pcm: set timer->private_data before registering the PCM timer
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer->private_data before registering the PCM timer snd_pcm_timer_init() calls snd_device_register() to link the new struct snd_timer into the global timer list while it still…
-
Unscored —
ALSA: bcd2000: Fix race between rawmidi and disconnect
In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when…
-
Unscored —
neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.
In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. NDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses .validation_type, so no validation is applied: # ynl --family rt-neigh …
-
Unscored —
drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
In the Linux kernel, the following vulnerability has been resolved: drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr When an out_fence_ptr is provided but DRM_MODE_PAGE_FLIP_EVENT is not set, a drm_pending_vblank_event will be allocated.…
-
Unscored —
netfilter: nf_nat: unregister and release hooks on error
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat: unregister and release hooks on error If nf_hook_entries_insert_raw() fails, the NAT hooks get never released, resulting in a memleak. Postpone setting nat_proto_net->nat_h…
-
Unscored —
netfilter: nft_nat: fully initialise new_addr in netmap setup
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_nat: fully initialise new_addr in netmap setup nft_nat_setup_netmap() builds the mapped address in an on-stack union nf_inet_addr. For an IPv4 mapping it writes only the 4-byte…
-
Unscored —
wifi: mac80211: set up the TX info early to fix failure paths
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f ("wifi: mac80211: free ack status frame on TX header build failure") cleaned up the leak, but st…
-
Unscored —
wifi: mac80211: mesh: release the channel if start fails
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211_join_mesh() acquires a channel context and then calls ieee80211_start_mesh(), which can fail. In that case, the chanctx isn'…
-
Unscored —
wifi: mac80211: mesh: reset the CSA state when leaving
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() and only freed in ieee80211_mesh_finish_csa(), i.e. when the channel switch compl…
-
Unscored —
wifi: mac80211: add HE 6 GHz capability in the scan elems len
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scan_ies_le…
-
Unscored —
wifi: mac80211: don't allow injecting frames wider than the chanctx
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't allow injecting frames wider than the chanctx Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the…
-
Unscored —
wifi: mac80211: only operate on TDLS peers in the TDLS code
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: only operate on TDLS peers in the TDLS code ieee80211_tdls_oper() can operate on the AP station, which then yields various warnings when the AP station is removed then or at a…
-
Unscored —
wifi: mac80211: reset the LED state when ifup fails
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the LED state when ifup fails When the first interface comes up, the radio LED is turned on. This can start the TPT trigger timer, which continues running. But if bringi…
-
Unscored —
wifi: mac80211: reset state when starting AP fails
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset state when starting AP fails ieee80211_start_ap() can set enable_beacon (and beacon_int) and fail later, leaving it set forever. Scanning can then attempt to restore bea…
-
Unscored —
wifi: mac80211: abort chanswitch when leaving a mesh
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211_stop_mesh() leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: …
-
Unscored —
wifi: mac80211: don't offload TC setup on AP_VLAN interfaces
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't offload TC setup on AP_VLAN interfaces AP_VLAN interfaces are purely virtual, so don't try to offload TC setup to drivers. We can't really use the AP interface either si…
-
Unscored —
wifi: mac80211: don't start a ROC while scanning
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't start a ROC while scanning The ROC work can be pending when a scan starts (which requires ROC list to be empty, but that's possible), and then a new ROC can be added to …
-
Unscored —
wifi: cfg80211: ibss: ref BSS entry for joined event
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: ibss: ref BSS entry for joined event When the IBSS is joined, we only record the BSSID/channel in the event and look up the BSS entry when processing it. However, that's racy,…
-
Unscored —
wifi: cfg80211: only group hidden BSSes with beacon entries
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: only group hidden BSSes with beacon entries When a probe response for an unknown BSS comes in, __cfg80211_bss_update() looks for an existing entry with the same BSSID and a hi…
-
Unscored —
dmaengine: wait for RCU readers before releasing dma_device
In the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dma_device dma_issue_pending_all() walks the dma_device_list with list_for_each_entry_rcu() under rcu_read_lock(). dma_device_release() unlink…
-
Unscored —
dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() When dma_device_put() drops the last reference on chan->device->ref, dma_device_release() runs and may free the dma_d…
-
Unscored —
dmaengine: Fix device kref underflow in dma_chan_put()
In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dma_chan_put() dma_chan_get() takes chan->device->ref only on the slow path: /* no kref on fast path */ if (chan->client_count) { __module_get(owner); …
-
Unscored —
wifi: cfg80211: check IP header size in cfg80211_classify8021d()
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211_classify8021d() A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value…
-
Unscored —
wifi: cfg80211: don't get the radio mask for netdev-less wdevs
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with wdev->netdev, which can be NULL and then crashes in mac80211. To a…
-
Unscored —
IB/IPoIB: Avoid restoring OPER_UP after multicast flush
In the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPER_UP after multicast flush ipoib_ib_dev_flush_light() temporarily clears IPOIB_FLAG_OPER_UP to prevent multicast joins while ipoib_mcast_dev_flush() is running, a…
-
Unscored —
wifi: brcmfmac: cyw: pass PMKID to firmware if present
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: pass PMKID to firmware if present Zero out auth_status on initialization. Otherwise, garbage will leak from the stack to the firmware (when ssid is less than 32 bytes and…
-
Unscored —
wifi: virt_wifi: free skb when disconnected
In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: free skb when disconnected When the simulated link is disconnected, virt_wifi_start_xmit() returns NET_XMIT_DROP without freeing the skb. dev_hard_start_xmit() treats this re…
-
Unscored —
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted The client borrows shared CQ credits in the ADDR_RESOLVED handler via ib_cq_pool_get(), before the peer is connected. create_cm() c…
-
Unscored —
RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables
In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables Locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. If an interrupt arrives while the create…
-
Unscored —
RDMA/mad: Fix receive buffer leak when PKey enforcement fails
In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ib_mad_complete_recv() initializes mad_recv_wc->rmpp_list and then runs ib_mad_enforce_security() before linking recv_buf onto th…
-
Unscored —
RDMA/rtrs: guard against null kobj name
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if `init_path()` errors, the callee tries to clean up with `rtrs_clt_close_conns()`. However, this can lead to calling the event tracing…
-
Unscored —
RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup bnxt_re_init_dcb_wq() ignores a failed allocation. The async DCB handler later calls queue_work() on the NULL pointer.
-
Unscored —
IB/iser: reject a remote invalidation of an unregistered direction
In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iser_reg_mem_fastreg() takes the DMA key pa…
-
Unscored —
clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate dvfs_get_idx() may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were re…
-
Unscored —
firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS scpi_dvfs_get_info() already rejected a zero opp_count, but still trusted any larger value from the SCP firmware. The shared-memo…
-
Unscored —
xfrm: fix compat ALLOCSPI request use-after-free
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrm_state_netlink() builds the ALLOCSPI response with dump_one_state(), which already calls alloc_compat() with the response skb and header. …
-
Unscored —
xfrm: iptfs: fix runt reassembly panic from short inner tot_len
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short inner tot_len When the start of an inner packet is split across two outer packets such that fewer than 4 bytes land at the end of the first o…
-
Unscored —
xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk() iptfs_skb_reset_frag_walk() advances to the fragment containing @offset with an unbounded loop: while (offset >= walk->past + wa…
Revision history
-
#22
Neue Updates von SUSE aufgenommen
-
#21
Neue Updates von SUSE und Red Hat aufgenommen
-
#20
Neue Updates von Ubuntu und Red Hat aufgenommen
-
#19
Neue Updates von SUSE, Amazon und Red Hat aufgenommen
-
#18
Neue Updates von Red Hat aufgenommen
-
#17
Neue Updates von SUSE aufgenommen
-
#16
Neue Updates von SUSE aufgenommen
-
#15
Neue Updates von Oracle Linux aufgenommen
-
#14
Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen
-
#13
Neue Updates von Oracle Linux und SUSE aufgenommen
-
#12
Neue Updates von Red Hat und Oracle Linux aufgenommen
-
#11
Neue Updates von Oracle Linux aufgenommen
-
#10
Neue Updates von Oracle Linux, SUSE und Red Hat aufgenommen
-
#9
Neue Updates von openSUSE und SUSE aufgenommen
-
#8
Neue Updates von Debian aufgenommen
-
#7
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#6
Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen
-
#5
PoC aufgenommen CVE-2026-98260 and CVE-2026-98256
-
#4
Neue Updates von Oracle Linux, Debian und Red Hat aufgenommen
-
#3
Neue Updates von Oracle Linux aufgenommen
-
#2
Referenz(en) aufgenommen: EUVD-2026-93349, EUVD-2026-93348, EUVD-2026-93357, EUVD-2026-93355, EUVD-2026-93356, EUVD-2026-93354, EUVD-2026-93352, EUVD-2026-93351, EUVD-2026-93350, EUVD-2026-93338, EUVD-2026-93353
-
#1
Initiale Fassung
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2026-98165
https://lore.kernel.org/linux-cve-announce/2026100627-CVE-2026-98165-0c11@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98166
https://lore.kernel.org/linux-cve-announce/2026100629-CVE-2026-98166-db99@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98167
https://lore.kernel.org/linux-cve-announce/2026100629-CVE-2026-98167-b283@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98168
https://lore.kernel.org/linux-cve-announce/2026100630-CVE-2026-98168-3c57@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98169
https://lore.kernel.org/linux-cve-announce/2026100630-CVE-2026-98169-2a8d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98170
https://lore.kernel.org/linux-cve-announce/2026100630-CVE-2026-98170-fc53@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98171
https://lore.kernel.org/linux-cve-announce/2026100630-CVE-2026-98171-6c15@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98172
https://lore.kernel.org/linux-cve-announce/2026100631-CVE-2026-98172-645c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98173
https://lore.kernel.org/linux-cve-announce/2026100631-CVE-2026-98173-c984@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98174
https://lore.kernel.org/linux-cve-announce/2026100631-CVE-2026-98174-6740@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98175
https://lore.kernel.org/linux-cve-announce/2026100631-CVE-2026-98175-1f00@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98176
https://lore.kernel.org/linux-cve-announce/2026100632-CVE-2026-98176-8b1a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98177
https://lore.kernel.org/linux-cve-announce/2026100632-CVE-2026-98177-86ea@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98178
https://lore.kernel.org/linux-cve-announce/2026100632-CVE-2026-98178-8dcf@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98179
https://lore.kernel.org/linux-cve-announce/2026100632-CVE-2026-98179-c369@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98180
https://lore.kernel.org/linux-cve-announce/2026100632-CVE-2026-98180-3554@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98181
https://lore.kernel.org/linux-cve-announce/2026100633-CVE-2026-98181-cd5a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98182
https://lore.kernel.org/linux-cve-announce/2026100633-CVE-2026-98182-9e5b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98183
https://lore.kernel.org/linux-cve-announce/2026100633-CVE-2026-98183-9a51@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98184
https://lore.kernel.org/linux-cve-announce/2026100633-CVE-2026-98184-dfb1@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98185
https://lore.kernel.org/linux-cve-announce/2026100633-CVE-2026-98185-6e40@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98186
https://lore.kernel.org/linux-cve-announce/2026100634-CVE-2026-98186-b0f7@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98187
https://lore.kernel.org/linux-cve-announce/2026100634-CVE-2026-98187-d030@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98188
https://lore.kernel.org/linux-cve-announce/2026100634-CVE-2026-98188-4781@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98189
https://lore.kernel.org/linux-cve-announce/2026100634-CVE-2026-98189-7ee2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98190
https://lore.kernel.org/linux-cve-announce/2026100634-CVE-2026-98190-11bb@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98191
https://lore.kernel.org/linux-cve-announce/2026100635-CVE-2026-98191-9051@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98192
https://lore.kernel.org/linux-cve-announce/2026100635-CVE-2026-98192-11fd@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98193
https://lore.kernel.org/linux-cve-announce/2026100635-CVE-2026-98193-2cf0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98194
https://lore.kernel.org/linux-cve-announce/2026100635-CVE-2026-98194-9b44@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98195
https://lore.kernel.org/linux-cve-announce/2026100635-CVE-2026-98195-5f12@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98196
https://lore.kernel.org/linux-cve-announce/2026100636-CVE-2026-98196-d22c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98197
https://lore.kernel.org/linux-cve-announce/2026100636-CVE-2026-98197-6c8c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98198
https://lore.kernel.org/linux-cve-announce/2026100636-CVE-2026-98198-d447@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98199
https://lore.kernel.org/linux-cve-announce/2026100636-CVE-2026-98199-aabf@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98200
https://lore.kernel.org/linux-cve-announce/2026100636-CVE-2026-98200-5da3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98201
https://lore.kernel.org/linux-cve-announce/2026100637-CVE-2026-98201-6ff8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98202
https://lore.kernel.org/linux-cve-announce/2026100637-CVE-2026-98202-eccd@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98203
https://lore.kernel.org/linux-cve-announce/2026100637-CVE-2026-98203-838b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98204
https://lore.kernel.org/linux-cve-announce/2026100637-CVE-2026-98204-0b5c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98205
https://lore.kernel.org/linux-cve-announce/2026100637-CVE-2026-98205-e2ea@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98206
https://lore.kernel.org/linux-cve-announce/2026100638-CVE-2026-98206-1e37@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98207
https://lore.kernel.org/linux-cve-announce/2026100638-CVE-2026-98207-ebd9@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98208
https://lore.kernel.org/linux-cve-announce/2026100638-CVE-2026-98208-fa27@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98209
https://lore.kernel.org/linux-cve-announce/2026100638-CVE-2026-98209-b385@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98210
https://lore.kernel.org/linux-cve-announce/2026100638-CVE-2026-98210-45fd@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98211
https://lore.kernel.org/linux-cve-announce/2026100639-CVE-2026-98211-6b70@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98212
https://lore.kernel.org/linux-cve-announce/2026100639-CVE-2026-98212-e0cd@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98213
https://lore.kernel.org/linux-cve-announce/2026100639-CVE-2026-98213-b667@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98214
https://lore.kernel.org/linux-cve-announce/2026100640-CVE-2026-98214-cedd@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98215
https://lore.kernel.org/linux-cve-announce/2026100640-CVE-2026-98215-4a93@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98216
https://lore.kernel.org/linux-cve-announce/2026100640-CVE-2026-98216-e3b4@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98217
https://lore.kernel.org/linux-cve-announce/2026100641-CVE-2026-98217-520d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98218
https://lore.kernel.org/linux-cve-announce/2026100641-CVE-2026-98218-5592@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-98220
https://lore.kernel.org/linux-cve-announce/2026100642-CVE-2026-98220-676d@gregkh/
-
Oracle Linux Security Advisory ELSA-2026-500394 vom 2026-10-16
https://linux.oracle.com/errata/ELSA-2026-500394.html
-
Oracle Linux Security Advisory ELSA-2026-500395 vom 2026-10-16
https://linux.oracle.com/errata/ELSA-2026-500395.html
-
Oracle Linux Security Advisory ELSA-2026-500398 vom 2026-10-19
https://linux.oracle.com/errata/ELSA-2026-500398.html
-
Debian Security Advisory DLA-4841 vom 2026-10-17
https://lists.debian.org/debian-lts-announce/2026/10/msg00035.html
-
Red Hat Security Advisory RHSA-2026:83707 vom 2026-10-16
https://access.redhat.com/errata/RHSA-2026:83707
-
Red Hat Security Advisory RHSA-2026:83738 vom 2026-10-16
https://access.redhat.com/errata/RHSA-2026:83738
-
Red Hat Security Advisory RHSA-2026:83739 vom 2026-10-16
https://access.redhat.com/errata/RHSA-2026:83739
-
Red Hat Security Advisory RHSA-2026:83797 vom 2026-10-16
https://access.redhat.com/errata/RHSA-2026:83797
-
Red Hat Security Advisory RHSA-2026:83775 vom 2026-10-16
https://access.redhat.com/errata/RHSA-2026:83775
-
Red Hat Security Advisory RHSA-2026:83797 vom 2026-10-17
https://access.redhat.com/errata/RHSA-2026:83797
-
Debian Security Advisory DSA-6568 vom 2026-10-16
https://security-tracker.debian.org/tracker/DSA-6568-1
-
Red Hat Security Advisory RHSA-2026:85773 vom 2026-10-20
https://access.redhat.com/errata/RHSA-2026:85773
-
Red Hat Security Advisory RHSA-2026:85321 vom 2026-10-20
https://access.redhat.com/errata/RHSA-2026:85321
-
Red Hat Security Advisory RHSA-2026:85774 vom 2026-10-20
https://access.redhat.com/errata/RHSA-2026:85774
-
Rocky Linux Security Advisory RLSA-2026:85774 vom 2026-10-21
https://errata.build.resf.org/RLSA-2026:85774
-
Rocky Linux Security Advisory RLSA-2026:85773 vom 2026-10-21
https://errata.build.resf.org/RLSA-2026:85773
-
Red Hat Security Advisory RHSA-2026:86033 vom 2026-10-21
https://access.redhat.com/errata/RHSA-2026:86033
-
Rocky Linux Security Advisory RLSA-2026:85321 vom 2026-10-21
https://errata.build.resf.org/RLSA-2026:85321
-
Debian Security Advisory DLA-4850 vom 2026-10-22
https://lists.debian.org/debian-lts-announce/2026/10/msg00044.html
-
openSUSE Security Update OPENSUSE-SU-2026:22167-1 vom 2026-10-25
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GLCMU2SLJBWI2XO2YE3G7IVWFZZJTT4O/
-
SUSE Security Update SUSE-SU-2026:4892-1 vom 2026-10-23
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030049.html
-
openSUSE Security Update OPENSUSE-SU-2026:12131-1 vom 2026-10-25
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2JWIHW6K4LPRWLNIPIQXVHMMNVRZEBUQ/
-
Oracle Linux Security Advisory ELSA-2026-88477 vom 2026-10-27
http://linux.oracle.com/errata/ELSA-2026-88477.html
-
SUSE Security Update SUSE-SU-2026:24371-1 vom 2026-10-27
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030162.html