2,226 results · Clear filters · Feed
-
High 7.8
namespace: don't inherit MNT_UMOUNT in clone_mnt()
In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT_UMOUNT in clone_mnt() MNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has taken out of its namespace. It's never cleared. __detach_mounts() u…
-
High 8.8
namespace: unhash a dentry before detaching the mounts on it
In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(), rmdir() and rename() remove the entry from the filesystem, call detach_mounts() on the entry with the inode locked and t…
-
High 8.8
namei: don't reveal overmounted entries in refwalk
In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. step_into() step_into() rechecks d_seq and __follow_mount_rcu() rechecks mount_loc…
-
High 8.4
namespace: never expire a locked mount
In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. do_umount() refuses to unmount locked mounts but shrin…
-
High 7.8
xfs: stop exchanging reflink flags when exchanging mappings
In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to i_disk_size, xmi_can_exchange_reflink_flags() assumes every mapping moved and h…
-
High 8.1
amt: send the relay's General Query directly from the receive path
In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb->cb. For example, with igmp_qrv s…
-
High 7.5
nvmet: use the local P2P device on metadata allocation failure
In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data and metadata SGL allocations succeed. If the data allocat…
-
High 7.8
HID: steam: Rearrange teardown sequence
In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer…
-
High 7.8
HID: steam: Refactor registration
In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic fo…
-
High 7.4
EDAC/altera: Fix use-after-free in error paths
In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altr_edac_a10_device_add() and altr_portb_setup(), the error path freed the dci structure before releasing the devres group. Since the m…
-
High 7.5
dpaa2-switch: fix the error path in dpaa2_switch_rx()
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect since …
-
High 7.8
netfilter: ipset: mark the rcu locked areas properly
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same r…
-
High 7.0
net/mlx5: HWS, Handle destroying table that has a miss table
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hws_table_set_default_miss' API function, its miss_tbl keeps the table that p…
-
High 7.8
wifi: iwlwifi: mvm: fix sched scan IE sizing
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq buffer before length valid…
-
High 7.5
llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure In llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init() fails, kfree_skb(skb) is called instead of kfree_skb(nskb). Th…
-
High 7.5
tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow Commit 48a5fe38772b ("tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG") rejected duplicate/stale ACKs in …
-
High 8.1
ipv6: do not let ipv6_find_hdr() return an offset past the packet end
In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6_find_hdr() return an offset past the packet end ipv6_find_hdr() walks the extension header chain, skipping each header by the length that header itself declares. ipv6_op…
-
High 7.8
rds: ib: Clear the sg list when mapping an MR fails
In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpi…
-
High 7.8
drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM nouveau_uvmm_sm() calls op_map(), which passes bo->resource through nouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_…
-
High 7.8
drm/nouveau: fix double-free in nvif_vmm_dtor
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvif_vmm_dtor On failure, nouveau_cli_init() calls nouveau_cli_fini() to tear the client down. Then, nouveau_drm_open() also enters into its cleanup path and c…
-
High 7.8
mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish On arm64 server, we find that a task trying to grab the anon_vma lock triggers hungtask. INFO: task main:2354726 b…
-
High 7.1
HID: alps: fix use-after-free on input2 registration failure
In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alps_input_configured() stores data->input2 before calling input_register_device(). If registration fails, input_free_device() fre…
-
High 8.1CVE-2026-98499 Public exploit
HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an invalid offset to hid_field_extract(), resulting in memory r…
-
High 7.8
net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of…
-
High 7.1
netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read rt_mt6_check() permits rules to be configured with rtinfo->addrnr == 0 even when address matching (IP6T_RT_FST_MASK) i…
-
High 7.5
scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Check the data direction of a Data-In PDU The Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task and copies the PDU's data segment into that command's sc…
-
High 7.1
KVM: SEV: Do cache maintenance on the source VM during intra-host migration
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM during intra-host migration Manually perform cache maintenance on the source VM during intra-host migration to ensure no stale data is left in …
-
High 8.2
KVM: arm64: Transfer the hyp stack pages out of the host stage-2
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fix_host_ownership() walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private…
-
High 7.0
RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVM_RUN. As a result, kvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and …
-
High 7.0
Bluetooth: mgmt: fix race in read_unconf_index_list()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_index_list() read_unconf_index_list() counts unconfigured controllers before allocating its response, then checks the device flags again while filling…
-
High 8.1
smb: client: fix create context out-of-bounds reads
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it. A …
-
High 8.8
smb: client: use finish_no_open() for non-regular inodes
In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a…
-
High 7.8
xfs: fix cursor and pointer handling when recovering iunlink buckets
In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlog_recover_iunlink_bucket: 1. We don't null out prev_ip after releasing it, which can lead to…
-
High 7.8
net/sched: act_ct: fix helper UAF due to extensions realloc
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: -> nf_ct_helper() -> helper->help(…
-
High 7.8
net/sched: act_ct: avoid modifying shared unconfirmed ct entry
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up processing both again but with different sets of ext…
-
High 7.8
accel/amdxdna: Disable device buffer exporting
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device buffer exporting Device buffers are never intended to be exported. Disable exporting support explicitly.
-
High 7.0
drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix out-of-bounds write in reset_per_cpu_data() In reset_per_cpu_data(), al is computed as: al = sizeof(struct net_dm_alert_msg); al += dm_hit_limit * sizeof(struct net_dm_drop_…
-
High 8.1
smb: client: fix missing iov bounds check in parse_posix_sids()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parse_posix_sids() In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual l…
-
High 7.5
net: iptunnel: fix stale transport header during tunnel decapsulation
In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: fix stale transport header during tunnel decapsulation Syzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale transport_header offset after tunnel decapsulation…
-
High 7.8
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL An LWT_SEG6LOCAL program can invalidate its cached SRH with bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter may rea…