8,102 results · Feed
-
High 8.8
namespace: unhash a dentry before detaching the mounts on it
In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(), rmdir() and rename() remove the entry from the filesystem, call detach_mounts() on the entry with the inode locked and t…
-
High 8.8
namei: don't reveal overmounted entries in refwalk
In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. step_into() step_into() rechecks d_seq and __follow_mount_rcu() rechecks mount_loc…
-
High 8.4
namespace: never expire a locked mount
In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. do_umount() refuses to unmount locked mounts but shrin…
-
Unscored —
namespace: handle mount locking for automounts correctly
In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attach_recursive_mnt() locks every copy of the source mount to protect overmounts fro…
-
High 7.8
xfs: stop exchanging reflink flags when exchanging mappings
In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to i_disk_size, xmi_can_exchange_reflink_flags() assumes every mapping moved and h…
-
Unscored —
cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() After seeing the patch [1] to guard is_in_v2_mode() with RCU, it makes me realize that is_in_v2_mode() may be called in …
-
Unscored —
drm/vc4: Free the BO cache size list on teardown
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4_bo_cache_destroy() purges the cached BOs but never frees the size list, leaking it on every unbind.
-
Unscored —
net/sched: em_text: reject unterminated algo before autoload
In the Linux kernel, the following vulnerability has been resolved: net/sched: em_text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a ("net/sched: fix potential stack infoleak in em_text_dump()"), which zero-initialised t…
-
Critical 9.8
btrfs: fix xattr replace when multiple xattrs are packed in the same item
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs_dir_item item that packs multiple xattrs and then we replace the value of one of them (with the se…
-
Unscored —
flow_dissector: avoid u16 truncation of skb->len when computing thoff
In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of skb->len when computing thoff __skb_flow_dissect() computes key_control->thoff using: key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen); mi…
-
Unscored —
net: always dissect GSO packets in __virtio_net_hdr_to_skb()
In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in __virtio_net_hdr_to_skb() Commit 9e8db5913264 ("net: avoid false positives in untrusted gso validation") added a '&& skb->network_header' check before flow-…
-
Unscored —
flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen). If hlen is bigger than 65…
-
Unscored —
vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmci_transport_recv_dgram_cb() During the closure of a datagram socket, the vmci_transport_recv_dgram_cb() function may be called, which will add the packets to the …
-
High 7.8
HID: steam: Rearrange teardown sequence
In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer…
-
High 7.8
HID: steam: Refactor registration
In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic fo…
-
Unscored —
sched_ext: Build the cid tables privately and publish them with RCU
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before fi…
-
Unscored —CVE-2026-98937 Public exploit
perf/core: Check kernel access when kernel callchains are requested
In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel. However, users can still request kernel…
-
Unscored —
rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak
In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak The struct rtc_wkalrm has padding holes after the 'pending' member. When returned to userspace via the RTC_WKALRM_RD io…
-
Unscored —
ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() Since commit d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") __skb_flow_dissect() needs a net pointer, either fro…
-
High 7.4
EDAC/altera: Fix use-after-free in error paths
In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altr_edac_a10_device_add() and altr_portb_setup(), the error path freed the dci structure before releasing the devres group. Since the m…
-
Unscored —
KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When __inject_sigp_stop() is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pend…
-
Unscored —
macsec: initialize SecY before registering the netdevice
In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsg_ifinfo_build_skb() when IPv4 fo…
-
Unscored —
drm/amd/display: Remove sink usage from DPMS
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS [Why] stream->sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences …
-
Unscored —
fs: avoid repeated scans in evict_inodes()
In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evict_inodes() We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fs_bd…
-
Unscored —
parisc: Increase kernel stack size to 32kb
In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size (THREAD_SIZE_ORDER) to 32 kB, in order to avoid kernel crashes which have been trig…
-
Unscored —
wifi: nl80211: check link is beaconing for color change
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link.
-
Unscored —
media: video-i2c: use vb2_video_unregister_device on driver removal
In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2_video_unregister_device on driver removal The driver uses vb2_fop_release() as its file release operation, so vb2_video_unregister_device() should be used instead of…
-
Unscored —
drm/amdgpu: cap ATOM command table nesting depth
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with execute_depth and return -ELOOP when exceeded.
-
Unscored —
net: thunderx: fix PTP device ref leak in nicvf_probe()
In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf_probe() cavium_ptp_get() acquires a reference to the PTP PCI device through pci_get_device(). If any initialization step fails after cavium_ptp…
-
Unscored —
ALSA: seq: oss: Reject reads that cannot fit the next event
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it fro…
-
High 7.5
dpaa2-switch: fix the error path in dpaa2_switch_rx()
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect since …
-
Unscored —
drm/amdkfd: Unwind debug trap enable on copy_to_user failure
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying runtime_info to userspace, it had already activated the trap, set debug_trap_enabled,…
-
Unscored —
net: cpsw_new: unregister devlink on port registration failure
In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the error path only unregister…
-
Unscored —
net: microchip: sparx5: clean up PSFP resources on flower setup failure
In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP act…
-
Unscored —
btrfs: protect sb_write_pointer() with invalidate lock
In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has the same race with BLKBS…
-
Unscored —
net: lan966x: restore RX state on reload failure
In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x_fdma_reload() backs up rx->page_pool and rx->fdma before reallocating the RX resources for the new MTU. If the allocation fails, the r…
-
Unscored —
drm/amdkfd: Properly acquire queue buffers in CRIU restore
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfd_queue_acquire_buffers() was split off from set_queue_properties_from_user(), set_queue_properties_from_criu() was missed. T…
-
Unscored —
mailbox: imx: Use devm_pm_runtime_enable()
In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm_pm_runtime_enable() sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm_runtime_enable() into the r…
-
Unscored —
mailbox: imx: Add a channel shutdown field
In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imx_mu_isr() imx_mu_shutdown() imx_mu_xcr_rmw(priv, IMX_MU_RCR, 0, IMX_…
-
Unscored —
md/raid5: let stripe batch bm_seq comparison wrap-safe
In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq comparison wrap-safe Once the 32-bit seq wraps, a newer bm_seq can look smaller than old, so .. covert to wrap-safe calculate way.