Summary
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise einen Denial-of-Service-Angriff auszulösen, Daten zu manipulieren oder offenzulegen oder Sicherheitsmaßnahmen zu umgehen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 116
-
Critical 9.8
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to c…
-
Critical 9.8
scsi: libiscsi: Reject a negative task index from parse_pdu_itt
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse_pdu_itt A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups bound it from above only…
-
High 8.8
namespace: a mount that copy_tree() leaves out can't take over a lock
In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copy_tree() leaves out can't take over a lock Since commit c62a4766937e ("move_mount: transfer MNT_LOCKED") a mount can be moved beneath a locked mount. The lock moves…
-
High 8.8
firewire: core: fix race condition in split transaction handling
In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw_core_handle_response() or split_transaction_timeout_callback() may manipulate the same tran…
-
High 8.4
Drivers: hv: Don't reset VMBus connection state on error/exit paths
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmb…
-
High 8.2
xfs: fix capability check in xfs
In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas …
-
High 7.8
ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize ntfs_new_attr_flags() passes the wrong MFT record to ntfs_attr_record_resize(). When the attribute is in an extent rec…
-
High 7.8
smb: client: reject SetEA requests that do not fit the request buffer
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA() copies the caller's extended attribute value into the SMB request buffer without checking that it fits. Th…
-
High 7.8
net: psp: do not inherit the Rx association on clone
In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on clone sk->psp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into every socket accepted from a listener without taking a reference, w…
-
High 7.8
net: bridge: mcast: don't truncate the port group walk on teardown
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown __br_multicast_disable_port_ctx() and br_multicast_del_port() walk port->mglist with hlist_for_each_entry_safe(). However, b…
-
High 7.8
tracing: Keep the predicate limit separate from program capacity
In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicate_parse() adds two to nr_preds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as th…
-
High 7.8
scsi: st: Fix use-after-free race between st_remove() and st_open()
In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between st_remove() and st_open() st_remove() drops the probe reference on the scsi_tape with kref_put() and only afterwards removes its index from st_index_…
-
High 7.8
tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields
In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In check_synth_field(), when a synthetic event field is a stacktrace (field->is_stack) and the histogram field…
-
High 7.8
spi: imx: fix slab corruption from undersized DMA bounce buffers
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e ("spi: imx: support dynamic burst length for ECSPI DMA mode"), the driver allocates its private DMA …
-
High 7.8
net/sched: fix use-after-free in __tcf_action_put()
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these o…
-
High 7.8
eventfs: Free the eventfs_inode after an rcu grace period too
In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace period too tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in r…
-
High 7.8
KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sev_gmem_post_populate() set_page_dirty() requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That…
-
High 7.8
unicode: free the map after a grace period
In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rc…
-
High 7.8
pipe: preserve existing fasync readers on writer setup failure
In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure F_SETFL and FIOASYNC decide whether to invoke ->fasync() before pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO …
-
High 7.8
vsock: treat TCP_CLOSING as once-established
In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP_CLOSING as once-established Handle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHE…
-
High 7.5
scsi: libiscsi: Validate the task named by a management response
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case I…
-
High 7.3
vsock/vmci: validate packet source for connected sockets
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmci_transport_recv_stream_cb() looks up sockets first by the full source and destination tuple, then by destination only in the bound…
-
High 7.1
net/sched: cls_flower: validate mask pointer after nla_next()
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flower: validate mask pointer after nla_next() fl_set_enc_opt() iterates the key's nested tunnel-option attributes with nla_for_each_attr() while advancing a single mask pointe…
-
High 7.1
vsock/virtio: validate packet source for connected sockets
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtio_transport_recv_pkt() looks up sockets first by the full source and destination tuple, then by destination only in the bound t…
-
High 7.1
tracing: Check operator stack capacity before pushing
In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push then increments top before writin…
-
High 7.0
smb: client: fix heap overflow in cifs_do_set_acl()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifs_do_set_acl() cifs_set_acl() validates ACL size using posix_acl_xattr_size(): 4 + (count * 8) // 4-byte header + 8 bytes per ACE cifs_do_set_acl() then c…
-
High 7.0
dm-crypt: fix a tiny race condition in crypt_dec_pending
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in crypt_dec_pending crypt_dec_pending reads io->error before calling atomic_dec_and_test. Another context, for example crypt_endio called from an interrup…
-
High 7.0
drm/amdgpu: keep the eviction fence until the last handle is closed
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpu_gem_object_close() detaches the user queue eviction fence from the BO before it checks bo_va->ref_count, so closing …
-
High 7.0
net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straight back to the rdma_cm on RDM…
-
Unscored —
ntfs: move attribute payload before shrinking its record
In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its record ntfs_new_attr_flags() resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offse…
-
Unscored —
ntfs: take invalidate_lock in ntfs_setattr_size()
In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidate_lock in ntfs_setattr_size() ntfs_setattr_size() updates i_size and resizes the on-disk attribute without holding mapping->invalidate_lock. Page faults take the lock shar…
-
Unscored —
workqueue: Fix unbound pool lifetime for pending pwqs
In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound worker_pool in node_activate_pending_pwq(): BUG: KASAN: slab-use-after-free in _raw_spin_try…
-
Unscored —
sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scx_bypass() claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the d…
-
Unscored —
sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ With SCX_OPS_ENQ_LAST, the last runnable task on a CPU is passed to ops.enqueue() instead of bein…
-
Unscored —
drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parser_bos amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ra…
-
Unscored —
ntfs: fix FITRIM range alignment
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix FITRIM range alignment ntfs_trim_fs() aligns the start of a free extent up to the device discard granularity, but derives the discard length by aligning the original extent length d…
-
Unscored —
smb: client: fix data corruption with concurrent writes and O_TRUNC
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix data corruption with concurrent writes and O_TRUNC cifs_do_truncate() flushes dirty pages with filemap_write_and_wait() and truncates the file on the server, but in the old c…
-
Unscored —
ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in smb2_get_info_filesystem() reports 64 bytes for FS_OBJECT_ID_INFORMATION, that is the whole of struct object_id_info, but …
-
Unscored —
ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION smb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION, that is the whole of struct smb2_fs_control_info, bu…
-
Unscored —
ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION smb2_get_info_filesystem() reports 56 bytes for FS_POSIX_INFORMATION, that is the whole of FILE_SYSTEM_POSIX_INFO, but never assigns F…
-
Unscored —
drm/i915/dmc: Harden DMC firmware payload parsing
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size…
-
Unscored —
drm/amdgpu/userq: actually validate userq BOs
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: actually validate userq BOs This was supposed to loop over the individual evicted list, as the kernel and always_valid evicted lists were already handled in amdgpu_vm_valida…
-
Unscored —
KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes produced for shadowed NPT. …
-
Unscored —
ipv4: avoid divide by zero in fib_rebalance
In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fib_rebalance fib_rebalance() computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignore_ro…
-
Unscored —
s390/pci: Fix leak of uninitialized kernel data in SCLP report
In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix leak of uninitialized kernel data in SCLP report While report_error_write() checks that the provided buffer is at least as large as the header struct, but not that it is large e…
-
Unscored —
s390/pai: Handle multiple PMU stop callback invocations
In the Linux kernel, the following vulnerability has been resolved: s390/pai: Handle multiple PMU stop callback invocations Handle the following scenario: The kernel protects itself against a very high sampling load and throttles the sampling using: perf_even…
-
Unscored —
s390/ctcm: Prevent XID null dereference
In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Prevent XID null dereference The mpc_validate_xid() function sets grp->saved_xid2->xid2_flag2 to 0x40 to signal XID validation error. If peer XID is NULL or r/w channel pairing mis…
-
Unscored —
page_pool: keep frag_offset aligned for odd-sized requests
In the Linux kernel, the following vulnerability has been resolved: page_pool: keep frag_offset aligned for odd-sized requests page_pool_alloc_frag_netmem() rounds the requested fragment size with size = ALIGN(size, dma_get_cache_alignment()); dma_get_cache_a…
-
Unscored —
sctp: validate chunk length in the inqueue parser
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctp_inq_pop() currently accepts shorter declared lengths. A zero-length chunk lea…
-
Unscored —
selinux: fix BPF token permission checks
In the Linux kernel, the following vulnerability has been resolved: selinux: fix BPF token permission checks Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via the resolved path/dentry …
-
Unscored —
io_uring/cancel: don't spin on local work the task can't run
In the Linux kernel, the following vulnerability has been resolved: io_uring/cancel: don't spin on local work the task can't run io_uring_cancel_generic() refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task i…
-
Unscored —
xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), which flushes the CIL push…
-
Unscored —
net/iucv: fix the recvmsg window update
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucv_sock_recvmsg() sends the HiperSockets-only AF_IUCV_FLAG_WIN without testing the transport, so on a classic z/VM socket iucv_send_ctrl() sizes the …
-
Unscored —
mac802154: fix data race and NULL deref on local->assoc_dev
In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local->assoc_dev local->assoc_dev is shared between the association path and the association-response worker without common synchronization. mac8021…
-
Unscored —
dm-integrity: fix infinite loop on discard with large tag size
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integrity_metadata handles a discard, it fills a buffer with DISCARD_FILLER and writes it over the tags, max_blocks blocks …
-
Unscored —
cifs: don't update i_size in cifs_do_truncate without a cached handle
In the Linux kernel, the following vulnerability has been resolved: cifs: don't update i_size in cifs_do_truncate without a cached handle If find_writable_file() returns null, cifs_file_flush will return 0 without issuing set_file_size, and the outer 'if (!rc…
-
Unscored —
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the get_info function pointer without rcu_read_lock(). With BPF struct_o…
-
Unscored —
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) do_tcp_getsockopt() reads icsk->icsk_ca_ops->name without holding rcu_read_lock(). Since commit 0baf26b0fcd7 ("bpf: tcp: Support t…
-
Unscored —
tracing: Fix hist trigger timestamps for buffered events
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix hist trigger timestamps for buffered events Syzkaller triggered a WARN_ON_ONCE(!nest) warning: WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_event_time_stamp Call trace:…
-
Unscored —
tracing: Fix crash in print_graph_function_event()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print_graph_function_event() tracing_set_tracer() assigns the flags of the newly selected tracer with: tr->current_trace_flags = t->flags ? : t->tracer->flags; If the ne…
-
Unscored —
sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until run_deferred()…
-
Unscored —
drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on …
-
Unscored —
drm/i915/dmc: Add sanity check for DMC load address
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmc_info->start_mmioaddr and later used by dmc_load_program(). Un…
-
Unscored —
drm/exec: don't immediately add prelocked obj to array of locked objs
In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to array of locked objs When a contention is detected the drm_exec object grabs a reference to the contended object, unlocks all other objects an…
-
Unscored —
drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns -ENOMEM right away and skips the cleanup every other error pa…
-
Unscored —
drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to users…
-
Unscored —
drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions allocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() both use ASSERT(stream->sink) before dereferencing st…
-
Unscored —
scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
In the Linux kernel, the following vulnerability has been resolved: scsi: xen/scsifront: Check for a NULL shadow entry on a backend response scsifront_do_response() validates the rqid in a backend response against VSCSIIF_MAX_REQS before using it to index inf…
-
Unscored —
scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies bsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per job, but struct ufs_rpmb_reply is 104 bytes: a 40-…
-
Unscored —
ring-buffer: Fix false warning in ring_buffer_map_get_reader()
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ring_buffer_map_get_reader() The mmap reader can warn when it catches up with a writer that is still committing events. rb_get_reader_page() returns NULL in …
-
Unscored —
ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx() On a persistent ring buffer, rb_meta_subbuf_idx() can return an index one sub-buffer too high. rb_setup_ids_meta_page() then…
-
Unscored —
ring-buffer: Do not show buffer_meta for CPUs without a buffer
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffer_meta for CPUs without a buffer The per_cpu/cpuN/buffer_meta files are created for every possible CPU, but buffer->buffers[cpu] is only allocated once that CPU …
-
Unscored —
i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
In the Linux kernel, the following vulnerability has been resolved: i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() In wmt_i2c_probe(), i2c->clk is acquired using of_clk_get(). If any subsequent operation fails or when the module is unloaded, the clock ref…
-
Unscored —
gpio: shared: fix use-after-free bug when adding shared proxies
In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup->dev_id.…
-
Unscored —
sctp: revalidate output stream after association connect wait
In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate output stream after association connect wait When message interleaving is enabled, the first send waits for association establishment before building its data chunks. The wai…
-
Unscored —
net: rds: fix uninitialized trans dereference in CM event handler
In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA device is an InfiniBand CA (RDMA_NODE_IB_CA). On any other d…
-
Unscored —
mshv_vtl: Check per-CPU register page before mmap
In the Linux kernel, the following vulnerability has been resolved: mshv_vtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshv_vtl_configure_reg_page() warns and leaves that CPU's …
-
Unscored —
futex: Fix mm reuse handling for FUT_OFF_MMSHARED
In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUT_OFF_MMSHARED A FUT_OFF_MMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM b…
-
Unscored —
ntfs3: free the sbi after a grace period
In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. nt…
-
Unscored —
ipc: drop the mqueue mount with kern_unmount() on setup failure
In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kern_unmount() on setup failure mq_init_ns() creates the mqueue mount with fc_mount_longterm(), so its ->mnt_ns is MNT_NS_INTERNAL. When setting up the mqueue …
-
Unscored —
ext4: free the sbi after a grace period
In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4_get_link() follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4_getblk(EXT4_GET_BLOCKS_CACHED_NOWAIT). That read…
-
Unscored —
fsnotify: prevent mark additions during connector teardown
In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotify_destroy_marks() keeps a reference to its current mark while it drops conn->lock to destroy the mark. This stabilizes the fo…
-
Unscored —
KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, …
-
Unscored —
x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags…
-
Unscored —
watch_queue: Fix note pool publication race in watch_queue_set_size()
In the Linux kernel, the following vulnerability has been resolved: watch_queue: Fix note pool publication race in watch_queue_set_size() There is a race between watch_queue_set_size() and post_one_notification(). watch_queue_set_size() publishes wqueue->note…
-
Unscored —
autofs: ignore notification errors from a replaced pipe
In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofs_notify_daemon() takes a reference to the current notification pipe under wq_mutex, then drops the mutex before writing the reque…
-
Unscored —
ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono capture stream, such as a SmartMic, aggregat…
-
Unscored —
accel/rocket: search every core slot when looking up a scheduler
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler sched_to_core() walks rdev->cores[] up to rdev->num_cores, and rocket_remove() decrements num_cores for every core it removes.…
-
Unscored —
accel/rocket: search every core slot when a core is removed
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocket_remove() decrements rdev->num_cores for each core it removes, while find_core_for_dev() searches slots 0 to num_cores - 1. U…
-
Unscored —
x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()
In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx() Commit 45e1dccc0653 ("x86/insn: Simplify for_each_insn_prefix()") made for_each_insn_prefix() declare its own loop coun…
-
Unscored —
perf: Fix perf_pmu_migrate_context() leaving events behind
In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pmu_migrate_context() leaving events behind __perf_pmu_remove() walks the group leaders of a CPU and PMU with perf_event_groups_for_cpu_pmu(), removing each one as it goes. per…
-
Unscored —
net: stmmac: dwmac1000: clear the RGMII status interrupt
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac1000: clear the RGMII status interrupt Since commit 2e2c878a3141 ("net: stmmac: remove SGMII/RGMII/SMII interrupt handling") nothing on the RGMII path reads GMAC_RGSMIIIS, s…
-
Unscored —
gpio: mxc: fix race between chained IRQ handler install and probe completion
In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxc_update_irq_chained_handler() is called before the IRQ domain, the generic IRQ chip, and the port list entry ar…
-
Unscored —
gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths
In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochip_set_multiple(), gpiod_set_array_value() r…
-
Unscored —
calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() calipso_skbuff_setattr() adjusts payload_len by the length of the option it inserts or resizes: payload = ntohs(ip6_hdr->payload_…
-
Unscored —
net: bcmgenet: unshare the skb before writing the control block
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: unshare the skb before writing the control block bcmgenet stores first_cb, last_cb and bytes_sent in the skb control block and reads them back on completion to free the skb and…
-
Unscored —
net: ti: icssm-prueth: Move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: Move setting of netops to fix crash icssm_prueth_netdev_init() calls of_phy_get_and_connect() before ndev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_…
-
Unscored —
net: ethernet: aeroflex: move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash greth_of_probe() calls greth_mdio_init(), which connects the PHY, before dev->netdev_ops is assigned. phy_attach_direct() -> phy_l…
-
Unscored —
net: ethoc: move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: ethoc: move setting of netops to fix crash ethoc_probe() calls ethoc_mdio_probe(), which connects the PHY, before netdev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add…
-
Unscored —
net: au1000: move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: au1000: move setting of netops to fix crash au1000_probe() calls au1000_mii_probe(), which connects the PHY, before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_…
-
Unscored —
net: mv643xx: move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xx_eth_probe() connects the PHY before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops…
-
Unscored —
net: ethernet: actions: Move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owl_emac_probe() calls owl_emac_phy_init(), which connects the PHY, before netdev->netdev_ops is assigned. phy_attach_direct() -> p…
-
Unscored —
net: hisilicon: hip04_eth: Move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04_eth: Move setting of netops to fix crash hip04_mac_probe() calls of_phy_connect() before ndev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() rea…
-
Unscored —
net: hisilicon: hisi_femac: Move setting of netops to fix crash
In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisi_femac: Move setting of netops to fix crash hisi_femac_drv_probe() connects the PHY before dev->netdev_ops is assigned. phy_attach_direct() -> phy_link_topo_add_phy() read…
-
Unscored —
netlink: avoid hashing the network namespace pointer
In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics …
-
Unscored —
scsi: libsas: Fix SMP IO deadlock during HA resume
In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smp_execute_task_sg() calls pm_runtime_get_sync() on the host before issuing an SMP command. When that command is itself issued from the HA …
-
Unscored —
ocfs2/dlm: Protect the recovery list during debugfs reads
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debug_state_print() walks reco.node_data and formats their fields. The formatter…
-
Unscored —
sched/core: Call wakeup_preempt() for queued tasks during class change
In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeup_preempt() for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being com…
-
Unscored —
scsi: target: iscsi: Fix race in discovery auth updates
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi_updat…
-
Unscored —
scsi: target: Disable interrupts while holding delayed_cmd_lock
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayed_cmd_lock target_do_delayed_work() takes dev->delayed_cmd_lock with a plain spin_lock(). It runs from system_percpu_wq, so interrupts sta…
-
Unscored —
drm/xe/oa: Zero OA buffer at allocation
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able…
-
Unscored —
drm/xe: skip eviction of a BO with no resource
In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xe_evict_flags() switches on tbo->resource->mem_type to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an …
-
Unscored —
accel/rocket: clear rdev on device init failure
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocket_probe() stores the return value from rocket_device_init() in the file-scoped rdev pointer before checking whether it is an error pointer…
-
Unscored —
netlink: reset skb headers before unicast and multicast filtering
In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to an skb's network and MAC headers. Netlink producers may…
-
Unscored —
drm/vc4: hdmi: Move packet RAM enable to PM runtime
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Move packet RAM enable to PM runtime Audio can be triggered by the HPD handler and start up before video has been restored, calling vc4_hdmi_write_infoframe() for the audio inf…
-
Unscored —
power: supply: core: prevent unregistering a power supply while a callback runs
In the Linux kernel, the following vulnerability has been resolved: power: supply: core: prevent unregistering a power supply while a callback runs Once a power supply is registered, its callbacks can immediately start firing from other contexts, such as exte…
Revision history
-
#6
Neue Updates von Oracle Linux und SUSE aufgenommen
-
#5
Neue Updates von Red Hat und SUSE aufgenommen
-
#4
Neue Updates von Red Hat aufgenommen
-
#3
Neue Updates von SUSE aufgenommen
-
#2
Neue Updates von Debian aufgenommen
-
#1
Initiale Fassung
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2026-99101
https://lore.kernel.org/linux-cve-announce/2026102848-CVE-2026-99101-9d06@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99102
https://lore.kernel.org/linux-cve-announce/2026102852-CVE-2026-99102-c4fa@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99103
https://lore.kernel.org/linux-cve-announce/2026102852-CVE-2026-99103-675f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99104
https://lore.kernel.org/linux-cve-announce/2026102852-CVE-2026-99104-2dda@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99105
https://lore.kernel.org/linux-cve-announce/2026102853-CVE-2026-99105-81cb@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99106
https://lore.kernel.org/linux-cve-announce/2026102853-CVE-2026-99106-e89a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99107
https://lore.kernel.org/linux-cve-announce/2026102853-CVE-2026-99107-4de8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99108
https://lore.kernel.org/linux-cve-announce/2026102853-CVE-2026-99108-218d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99109
https://lore.kernel.org/linux-cve-announce/2026102854-CVE-2026-99109-d03d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99110
https://lore.kernel.org/linux-cve-announce/2026102854-CVE-2026-99110-66b3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99111
https://lore.kernel.org/linux-cve-announce/2026102854-CVE-2026-99111-9e37@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99112
https://lore.kernel.org/linux-cve-announce/2026102854-CVE-2026-99112-f9aa@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99113
https://lore.kernel.org/linux-cve-announce/2026102855-CVE-2026-99113-09b2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99114
https://lore.kernel.org/linux-cve-announce/2026102855-CVE-2026-99114-3543@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99115
https://lore.kernel.org/linux-cve-announce/2026102855-CVE-2026-99115-e2bd@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99116
https://lore.kernel.org/linux-cve-announce/2026102855-CVE-2026-99116-fb7c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99117
https://lore.kernel.org/linux-cve-announce/2026102855-CVE-2026-99117-68fa@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99118
https://lore.kernel.org/linux-cve-announce/2026102856-CVE-2026-99118-281a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99119
https://lore.kernel.org/linux-cve-announce/2026102856-CVE-2026-99119-cda5@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99120
https://lore.kernel.org/linux-cve-announce/2026102856-CVE-2026-99120-9a3e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99121
https://lore.kernel.org/linux-cve-announce/2026102856-CVE-2026-99121-b36f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99122
https://lore.kernel.org/linux-cve-announce/2026102857-CVE-2026-99122-43f9@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99123
https://lore.kernel.org/linux-cve-announce/2026102857-CVE-2026-99123-fef2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99124
https://lore.kernel.org/linux-cve-announce/2026102857-CVE-2026-99124-1466@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99125
https://lore.kernel.org/linux-cve-announce/2026102857-CVE-2026-99125-3e27@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99126
https://lore.kernel.org/linux-cve-announce/2026102858-CVE-2026-99126-fd05@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99127
https://lore.kernel.org/linux-cve-announce/2026102858-CVE-2026-99127-642a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99128
https://lore.kernel.org/linux-cve-announce/2026102858-CVE-2026-99128-6f44@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99129
https://lore.kernel.org/linux-cve-announce/2026102858-CVE-2026-99129-d390@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99130
https://lore.kernel.org/linux-cve-announce/2026102858-CVE-2026-99130-2687@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99131
https://lore.kernel.org/linux-cve-announce/2026102859-CVE-2026-99131-0cb0@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99132
https://lore.kernel.org/linux-cve-announce/2026102859-CVE-2026-99132-0ac9@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99133
https://lore.kernel.org/linux-cve-announce/2026102859-CVE-2026-99133-b9b5@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99134
https://lore.kernel.org/linux-cve-announce/2026102859-CVE-2026-99134-5523@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99135
https://lore.kernel.org/linux-cve-announce/2026102800-CVE-2026-99135-59f5@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99136
https://lore.kernel.org/linux-cve-announce/2026102800-CVE-2026-99136-5b79@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99137
https://lore.kernel.org/linux-cve-announce/2026102800-CVE-2026-99137-8fae@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99138
https://lore.kernel.org/linux-cve-announce/2026102800-CVE-2026-99138-127e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99139
https://lore.kernel.org/linux-cve-announce/2026102801-CVE-2026-99139-b4b2@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99140
https://lore.kernel.org/linux-cve-announce/2026102801-CVE-2026-99140-5b9b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99141
https://lore.kernel.org/linux-cve-announce/2026102801-CVE-2026-99141-79ea@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99142
https://lore.kernel.org/linux-cve-announce/2026102801-CVE-2026-99142-d9e8@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99143
https://lore.kernel.org/linux-cve-announce/2026102801-CVE-2026-99143-6a17@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99144
https://lore.kernel.org/linux-cve-announce/2026102802-CVE-2026-99144-0b39@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99145
https://lore.kernel.org/linux-cve-announce/2026102802-CVE-2026-99145-4338@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99146
https://lore.kernel.org/linux-cve-announce/2026102802-CVE-2026-99146-230d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99147
https://lore.kernel.org/linux-cve-announce/2026102802-CVE-2026-99147-340d@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99148
https://lore.kernel.org/linux-cve-announce/2026102802-CVE-2026-99148-c823@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99149
https://lore.kernel.org/linux-cve-announce/2026102803-CVE-2026-99149-d642@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99150
https://lore.kernel.org/linux-cve-announce/2026102803-CVE-2026-99150-ccae@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99151
https://lore.kernel.org/linux-cve-announce/2026102803-CVE-2026-99151-2227@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99152
https://lore.kernel.org/linux-cve-announce/2026102803-CVE-2026-99152-d7da@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99153
https://lore.kernel.org/linux-cve-announce/2026102803-CVE-2026-99153-985f@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99154
https://lore.kernel.org/linux-cve-announce/2026102804-CVE-2026-99154-4ac5@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99155
https://lore.kernel.org/linux-cve-announce/2026102804-CVE-2026-99155-244e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99156
https://lore.kernel.org/linux-cve-announce/2026102804-CVE-2026-99156-a564@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99157
https://lore.kernel.org/linux-cve-announce/2026102804-CVE-2026-99157-f0dc@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99158
https://lore.kernel.org/linux-cve-announce/2026102805-CVE-2026-99158-9107@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99159
https://lore.kernel.org/linux-cve-announce/2026102805-CVE-2026-99159-31c1@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99160
https://lore.kernel.org/linux-cve-announce/2026102805-CVE-2026-99160-5cce@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99161
https://lore.kernel.org/linux-cve-announce/2026102805-CVE-2026-99161-e087@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99162
https://lore.kernel.org/linux-cve-announce/2026102805-CVE-2026-99162-8832@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99163
https://lore.kernel.org/linux-cve-announce/2026102806-CVE-2026-99163-d756@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99164
https://lore.kernel.org/linux-cve-announce/2026102806-CVE-2026-99164-148e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99165
https://lore.kernel.org/linux-cve-announce/2026102806-CVE-2026-99165-1897@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99166
https://lore.kernel.org/linux-cve-announce/2026102806-CVE-2026-99166-bdbc@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99167
https://lore.kernel.org/linux-cve-announce/2026102806-CVE-2026-99167-68b3@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99168
https://lore.kernel.org/linux-cve-announce/2026102807-CVE-2026-99168-438c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99169
https://lore.kernel.org/linux-cve-announce/2026102807-CVE-2026-99169-48dd@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99170
https://lore.kernel.org/linux-cve-announce/2026102807-CVE-2026-99170-436c@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99171
https://lore.kernel.org/linux-cve-announce/2026102807-CVE-2026-99171-4fcb@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99172
https://lore.kernel.org/linux-cve-announce/2026102808-CVE-2026-99172-411e@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99173
https://lore.kernel.org/linux-cve-announce/2026102808-CVE-2026-99173-c21a@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99174
https://lore.kernel.org/linux-cve-announce/2026102808-CVE-2026-99174-1742@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99175
https://lore.kernel.org/linux-cve-announce/2026102808-CVE-2026-99175-d023@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99176
https://lore.kernel.org/linux-cve-announce/2026102809-CVE-2026-99176-c52b@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99177
https://lore.kernel.org/linux-cve-announce/2026102809-CVE-2026-99177-67d6@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99178
https://lore.kernel.org/linux-cve-announce/2026102809-CVE-2026-99178-00ac@gregkh/
-
Linux Kernel CVE Announcement CVE-2026-99179
https://lore.kernel.org/linux-cve-announce/2026102809-CVE-2026-99179-23eb@gregkh/