Description
In the Linux kernel, the following vulnerability has been resolved:
mm/ksm: fix flag-dropping behavior in ksm_madvise
syzkaller discovered the following crash: (kernel BUG)
[ 44.607039] ------------[ cut here ]------------
[ 44.607422] kernel BUG at mm/userfaultfd.c:2067!
[ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
[ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none)
[ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460
<snip other registers, drop unreliable trace>
[ 44.617726] Call Trace:
[ 44.617926] <TASK>
[ 44.619284] userfaultfd_release+0xef/0x1b0
[ 44.620976] __fput+0x3f9/0xb60
[ 44.621240] fput_close_sync+0x110/0x210
[ 44.622222] __x64_sys_close+0x8f/0x120
[ 44.622530] do_syscall_64+0x5b/0x2f0
[ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 44.623244] RIP: 0033:0x7f365bb3f227
Kernel panics because it detects UFFD inconsistency during
userfaultfd_release_all(). Specifically, a VMA which has a valid pointer
to vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags.
The inconsistency is caused in ksm_madvise(): when user calls madvise()
with MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode,
it accidentally clears all flags stored in the upper 32 bits of
vma->vm_flags.
Assuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and
int are 32-bit wide. This setup causes the following mishap during the &=
~VM_MERGEABLE assignment.
VM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000.
After ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then
promoted to unsigned long before the & operation. This promotion fills
upper 32 bits with leading 0s, as we're doing unsigned conversion (and
even for a signed conversion, this wouldn't help as the leading bit is 0).
& operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff
instead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears
the upper 32-bits of its value.
Fix it by changing `VM_MERGEABLE` constant to unsigned long, using the
BIT() macro.
Note: other VM_* flags are not affected: This only happens to the
VM_MERGEABLE flag, as the other VM_* flags are all constants of type int
and after ~ operation, they end up with leading 1 and are thus converted
to unsigned long with leading 1s.
Note 2:
After commit 31defc3b01d9 ("userfaultfd: remove (VM_)BUG_ON()s"), this is
no longer a kernel BUG, but a WARNING at the same place:
[ 45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067
but the root-cause (flag-drop) remains the same.
[akpm@linux-foundation.org: rust bindgen wasn't able to handle BIT(), from Miguel]
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 4.6 | 5.4.302 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.17.6-1 | — |
| Debian 13 | linux | 6.12.57-1 | — |
| Debian 12 | linux | 6.1.158-1 | DSA-6053-1 |
| Debian 11 | linux-6.1 | 6.1.158-1~deb11u1 | DLA-4379-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | No fix yet | — |
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1086.88 | — |
| Ubuntu 25.10 | linux | 6.17.0-14.14 | USN-8029-1 |
| Ubuntu 25.10 | linux-aws +2 | 6.17.0-1007.7 | USN-8030-1, USN-8029-2 |
| Ubuntu 25.10 | linux-azure +1 | 6.17.0-1008.8 | USN-8029-3, USN-8029-1 |
| Ubuntu 25.10 | linux-azure-fde | No fix yet | — |
| Ubuntu 25.10 | linux-realtime | 6.17.0-1006.7 | USN-8029-1 |
| Ubuntu 25.10 | linux-riscv | 6.17.0-14.14.1 | — |
| Ubuntu 24.04 LTS | linux +35 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-aws-6.17 +1 | 6.17.0-1007.7~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-gcp-6.17 | 6.17.0-1008.8~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-nvidia-6.17 | 6.17.0-1008.8 | — |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1035.38 | USN-8781-1 |
| Ubuntu 24.04 LTS | linux-oem-6.17 | 6.17.0-1011.11 | USN-8048-1 |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-173.183 | USN-8096-1 |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1103.110 | USN-8096-1 |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1109.118 | USN-8163-2 |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1109.118.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1103.112 | USN-8096-1 |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1099.105 | USN-8096-3 |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1086.94 | USN-8096-1 |
| Ubuntu 22.04 LTS | linux-ibm +1 | 5.15.0-1097.100 | USN-8141-1, USN-8096-1 |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1098.104 | USN-8096-1 |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1095.100 | USN-8096-1 |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1098.99 | USN-8096-1 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra | 5.15.0-1055.55 | USN-8096-1 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra-igx | 5.15.0-1044.44 | USN-8096-5 |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1100.106 | USN-8096-1 |
| Ubuntu 22.04 LTS | linux-riscv +42 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-xilinx-zynqmp | 5.15.0-1067.71 | USN-8096-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime +2 | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.17 | 6.17.0-1006.7~24.04.1 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1094.96 | USN-8116-1 |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1102.111 | USN-8096-4 |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-aws-fips | 5.15.0-1103.110+fips1 | USN-8096-2 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-azure-fips | 5.15.0-1109.118+fips1 | USN-8163-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips | 5.15.0-173.183+fips1 | USN-8096-2 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-gcp-fips | 5.15.0-1103.112+fips1 | USN-8096-2 |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux-aws-5.15 | 5.15.0-1103.110~20.04.1 | USN-8096-3 |
| Ubuntu Pro 20.04 LTS | linux-azure-5.15 | 5.15.0-1110.119~20.04.1 | USN-8243-1 |
| Ubuntu Pro 20.04 LTS | linux-gcp-5.15 | 5.15.0-1103.112~20.04.1 | USN-8096-3 |
| Ubuntu Pro 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-173.183~20.04.1 | USN-8096-3 |
| Ubuntu Pro 20.04 LTS | linux-ibm-5.15 | 5.15.0-1097.100~20.04.1 | USN-8096-1 |
| Ubuntu Pro 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1098.104~20.04.1 | USN-8096-3 |
| Ubuntu Pro 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1055.55~20.04.1 | USN-8096-1 |
| Ubuntu Pro 20.04 LTS | linux-oracle-5.15 | 5.15.0-1100.106~20.04.1 | USN-8096-3 |
| Ubuntu Pro 20.04 LTS | linux-riscv-5.15 | 5.15.0-1097.101~20.04.1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kernel-64kb +5 | 6.4.0-150700.53.25.1 | SUSE-SU-2025:4393-1 |
| SLES 15 SP7 | kernel-azure +2 | 6.4.0-150700.20.21.1 | SUSE-SU-2025:4517-1 |
| SLES 15 SP7 | kernel-default-base | 6.4.0-150700.53.25.1.150700.17.17.1 | SUSE-SU-2025:4393-1 |
| SLES 15 SP7 | kernel-docs | 6.4.0-150700.53.25.2 | SUSE-SU-2025:4393-1 |
| SLES 15 SP6 | kernel-64kb +3 | 6.4.0-150600.23.81.3 | SUSE-SU-2025:4422-1 |
| SLES 15 SP6 | kernel-azure +2 | 6.4.0-150600.8.58.1 | SUSE-SU-2025:4505-1 |
| SLES 15 SP6 | kernel-default-base | 6.4.0-150600.23.81.3.150600.12.36.3 | SUSE-SU-2025:4422-1 |
| SLES 15 SP6 | kernel-docs +1 | 6.4.0-150600.23.81.1 | SUSE-SU-2025:4422-1 |
| SLES 15 SP6 | kernel-source | 6.4.0-150600.23.81.2 | SUSE-SU-2025:4422-1 |
| SLES 15 SP5 | kernel-64kb +4 | 5.14.21-150500.55.130.3 | SUSE-SU-2025:4506-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.130.3.150500.6.63.3 | SUSE-SU-2025:4506-1 |
| SLES 15 SP5 | kernel-docs +1 | 5.14.21-150500.55.130.1 | SUSE-SU-2025:4506-1 |
| SLES 15 SP4 | kernel-64kb +4 | 5.14.21-150400.24.187.3 | SUSE-SU-2026:0029-1 |
| SLES 15 SP4 | kernel-default-base | 5.14.21-150400.24.187.3.150400.24.96.3 | SUSE-SU-2026:0029-1 |
| SLES 15 SP4 | kernel-docs +1 | 5.14.21-150400.24.187.1 | SUSE-SU-2026:0029-1 |
| SLES 15 SP3 | kernel-64kb +5 | 5.3.18-150300.59.229.3 | SUSE-SU-2025:4530-1 |
| SLES 15 SP3 | kernel-default-base | 5.3.18-150300.59.229.3.150300.18.136.3 | SUSE-SU-2025:4530-1 |
| SLES 15 SP3 | kernel-docs | 5.3.18-150300.59.229.2 | SUSE-SU-2025:4530-1 |
| SLES 15 SP3 | kernel-syms | 5.3.18-150300.59.229.1 | SUSE-SU-2025:4530-1 |
Show 27 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | kernel-syms +2 | 4.12.14-122.283.1 | SUSE-SU-2025:4515-1 |
| SLES for SAP 16.0 | kernel-64kb +7 | 6.12.0-160000.7.1 | SUSE-SU-2025:21147-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.6.1.160000.2.4 | SUSE-SU-2025:21147-1 |
| SLES for SAP 15 SP5 | kernel-default-base | 5.14.21-150500.55.130.3.150500.6.63.3 | SUSE-SU-2025:4506-1 |
| SLES for SAP 15 SP5 | kernel-docs +1 | 5.14.21-150500.55.130.1 | SUSE-SU-2025:4506-1 |
| SLES for SAP 15 SP5 | kernel-source +2 | 5.14.21-150500.55.130.3 | SUSE-SU-2025:4506-1 |
| SLES for SAP 15 SP4 | kernel-default-base | 5.14.21-150400.24.187.3.150400.24.96.3 | SUSE-SU-2026:0029-1 |
| SLES for SAP 15 SP4 | kernel-docs +1 | 5.14.21-150400.24.187.1 | SUSE-SU-2026:0029-1 |
| SLES for SAP 15 SP4 | kernel-source +2 | 5.14.21-150400.24.187.3 | SUSE-SU-2026:0029-1 |
| SLES for SAP 15 SP3 | kernel-default-base | 5.3.18-150300.59.229.3.150300.18.136.3 | SUSE-SU-2025:4530-1 |
| SLES for SAP 15 SP3 | kernel-docs | 5.3.18-150300.59.229.2 | SUSE-SU-2025:4530-1 |
| SLES for SAP 15 SP3 | kernel-source +3 | 5.3.18-150300.59.229.3 | SUSE-SU-2025:4530-1 |
| SLES for SAP 15 SP3 | kernel-syms | 5.3.18-150300.59.229.1 | SUSE-SU-2025:4530-1 |
| SLES 16.0 | kernel-64kb +7 | 6.12.0-160000.7.1 | SUSE-SU-2025:21180-1, SUSE-SU-2025:21147-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.6.1.160000.2.4 | SUSE-SU-2025:21147-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.6.1.160000.2.4 | SUSE-SU-2025:21080-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.7.1 | SUSE-SU-2026:20561-1, SUSE-SU-2025:21080-1 |
| SLE Micro 6.1 | kernel-default-base | 6.4.0-38.1.21.15 | SUSE-SU-2026:20496-1 |
| SLE Micro 6.1 | kernel-rt +1 | 6.4.0-39.1 | SUSE-SU-2026:20059-1 |
| SLE Micro 6.1 | kernel-source +2 | 6.4.0-38.1 | SUSE-SU-2026:20496-1 |
| SLE Micro 6.0 | kernel-default-base | 6.4.0-38.1.21.15 | SUSE-SU-2026:20473-1 |
| SLE Micro 6.0 | kernel-rt +1 | 6.4.0-39.1 | SUSE-SU-2026:20039-1 |
| SLE Micro 6.0 | kernel-source +2 | 6.4.0-38.1 | SUSE-SU-2026:20473-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.130.3.150500.6.63.3 | SUSE-SU-2025:4506-1 |
| SLE Micro 5.5 | kernel-rt | 5.14.21-150500.13.115.2 | SUSE-SU-2026:0034-1 |
| SLE Micro 5.5 | kernel-source +1 | 5.14.21-150500.55.130.3 | SUSE-SU-2025:4506-1 |
| SLE Micro 5.5 | kernel-source-rt | 5.14.21-150500.13.115.1 | SUSE-SU-2026:0034-1 |
| SLE Micro 5.4 | kernel-default | 5.14.21-150400.24.187.3 | SUSE-SU-2026:0029-1 |
| SLE Micro 5.4 | kernel-default-base | 5.14.21-150400.24.187.3.150400.24.96.3 | SUSE-SU-2026:0029-1 |
| SLE Micro 5.4 | kernel-rt | 5.14.21-150400.15.139.2 | SUSE-SU-2026:0033-1 |
| SLE Micro 5.4 | kernel-source-rt | 5.14.21-150400.15.139.1 | SUSE-SU-2026:0033-1 |
| SLE Micro 5.3 | kernel-default | 5.14.21-150400.24.187.3 | SUSE-SU-2026:0029-1 |
| SLE Micro 5.3 | kernel-default-base | 5.14.21-150400.24.187.3.150400.24.96.3 | SUSE-SU-2026:0029-1 |
| SLE Micro 5.3 | kernel-rt | 5.14.21-150400.15.139.2 | SUSE-SU-2026:0033-1 |
| SLE Micro 5.3 | kernel-source-rt | 5.14.21-150400.15.139.1 | SUSE-SU-2026:0033-1 |
| SLE Micro 5.2 | kernel-default | 5.3.18-150300.59.229.3 | SUSE-SU-2025:4530-1 |
| SLE Micro 5.2 | kernel-default-base | 5.3.18-150300.59.229.3.150300.18.136.3 | SUSE-SU-2025:4530-1 |
| SLE Micro 5.2 | kernel-rt | 5.3.18-150300.229.2 | SUSE-SU-2026:0032-1 |
| SLE Micro 5.2 | kernel-source-rt | 5.3.18-150300.229.1 | SUSE-SU-2026:0032-1 |
| SLE Live Patching 15 SP7 | kernel-default | 6.4.0-150700.53.25.1 | SUSE-SU-2025:4393-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_7 | 1-150700.1.3.1 | SUSE-SU-2025:4516-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_7 | 1-150700.15.3.1 | SUSE-SU-2025:4393-1 |
| SLE Live Patching 15 SP6 | kernel-default | 6.4.0-150600.23.81.3 | SUSE-SU-2025:4422-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_18 | 1-150600.1.3.1 | SUSE-SU-2025:4521-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_18 | 1-150600.13.3.3 | SUSE-SU-2025:4422-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.130.3 | SUSE-SU-2025:4506-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_33 | 1-150500.11.3.3 | SUSE-SU-2025:4506-1 |
| SLE Live Patching 15 SP4 | kernel-default | 5.14.21-150400.24.187.3 | SUSE-SU-2026:0029-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_47 | 1-150400.9.3.3 | SUSE-SU-2026:0029-1 |
| SLE Live Patching 15 SP3 | kernel-default | 5.3.18-150300.59.229.3 | SUSE-SU-2025:4530-1 |
| SLE Live Patching 15 SP3 | kernel-livepatch-SLE15-SP3_Update_64 | 1-150300.7.3.3 | SUSE-SU-2025:4530-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.283.1 | SUSE-SU-2025:4515-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_75 | 1-8.3.1 | SUSE-SU-2025:4515-1 |
| SLE HPC 15 SP5 | kernel-64kb +3 | 5.14.21-150500.55.130.3 | SUSE-SU-2025:4506-1 |
| SLE HPC 15 SP5 | kernel-default-base | 5.14.21-150500.55.130.3.150500.6.63.3 | SUSE-SU-2025:4506-1 |
| SLE HPC 15 SP5 | kernel-docs +1 | 5.14.21-150500.55.130.1 | SUSE-SU-2025:4506-1 |
| SLE HPC 15 SP4 | kernel-64kb +3 | 5.14.21-150400.24.187.3 | SUSE-SU-2026:0029-1 |
| SLE HPC 15 SP4 | kernel-default-base | 5.14.21-150400.24.187.3.150400.24.96.3 | SUSE-SU-2026:0029-1 |
| SLE HPC 15 SP4 | kernel-docs +1 | 5.14.21-150400.24.187.1 | SUSE-SU-2026:0029-1 |
| SLE HPC 15 SP3 | kernel-64kb +4 | 5.3.18-150300.59.229.3 | SUSE-SU-2025:4530-1 |
| SLE HPC 15 SP3 | kernel-default-base | 5.3.18-150300.59.229.3.150300.18.136.3 | SUSE-SU-2025:4530-1 |
| SLE HPC 15 SP3 | kernel-docs | 5.3.18-150300.59.229.2 | SUSE-SU-2025:4530-1 |
| SLE HPC 15 SP3 | kernel-syms | 5.3.18-150300.59.229.1 | SUSE-SU-2025:4530-1 |
| SUSE Real Time Module 15 SP7 | kernel-rt +2 | 6.4.0-150700.7.25.1 | SUSE-SU-2025:4516-1 |
| SUSE Real Time Module 15 SP6 | kernel-rt +3 | 6.4.0-150600.10.61.1 | SUSE-SU-2025:4521-1 |
| SUSE Manager Server LTS 4.3 | kernel-default-base | 5.14.21-150400.24.187.3.150400.24.96.3 | SUSE-SU-2026:0029-1 |
| SUSE Manager Server LTS 4.3 | kernel-source +2 | 5.14.21-150400.24.187.3 | SUSE-SU-2026:0029-1 |
| SUSE Manager Server LTS 4.3 | kernel-syms | 5.14.21-150400.24.187.1 | SUSE-SU-2026:0029-1 |
| SUSE Manager Proxy LTS 4.3 | kernel-default-base | 5.14.21-150400.24.187.3.150400.24.96.3 | SUSE-SU-2026:0029-1 |
| SUSE Manager Proxy LTS 4.3 | kernel-source +1 | 5.14.21-150400.24.187.3 | SUSE-SU-2026:0029-1 |
| SUSE Manager Proxy LTS 4.3 | kernel-syms | 5.14.21-150400.24.187.1 | SUSE-SU-2026:0029-1 |
| SUSE Enterprise Storage 7.1 | kernel-64kb +4 | 5.3.18-150300.59.229.3 | SUSE-SU-2025:4530-1 |
| SUSE Enterprise Storage 7.1 | kernel-default-base | 5.3.18-150300.59.229.3.150300.18.136.3 | SUSE-SU-2025:4530-1 |
| SUSE Enterprise Storage 7.1 | kernel-docs | 5.3.18-150300.59.229.2 | SUSE-SU-2025:4530-1 |
| SUSE Enterprise Storage 7.1 | kernel-syms | 5.3.18-150300.59.229.1 | SUSE-SU-2025:4530-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 6.17.7-1.1 | openSUSE-SU-2025:15702-1 |
| openSUSE Tumbleweed | kernel-source-longterm | 6.18.16-1.1 | openSUSE-SU-2026:10301-1 |
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.6.1.160000.2.4 | openSUSE-SU-2025:20091-1 |
| openSUSE Leap 16.0 | kernel-rt +10 | 6.12.0-160000.7.1 | openSUSE-SU-2025:20091-1 |
| openSUSE Leap 15.6 | dtb-aarch64 +3 | 6.4.0-150600.23.81.1 | SUSE-SU-2025:4422-1 |
| openSUSE Leap 15.6 | kernel-64kb +5 | 6.4.0-150600.23.81.3 | SUSE-SU-2025:4422-1 |
| openSUSE Leap 15.6 | kernel-azure +2 | 6.4.0-150600.8.58.1 | SUSE-SU-2025:4505-1 |
| openSUSE Leap 15.6 | kernel-default-base | 6.4.0-150600.23.81.3.150600.12.36.3 | SUSE-SU-2025:4422-1 |
| openSUSE Leap 15.6 | kernel-rt +3 | 6.4.0-150600.10.61.1 | SUSE-SU-2025:4521-1 |
| openSUSE Leap 15.6 | kernel-source | 6.4.0-150600.23.81.2 | SUSE-SU-2025:4422-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.12.55-74.119 +1 | 1:1.0-0.amzn2023 | ALAS2023-2025-1316, ALAS2023-2025-1297 |
| Amazon Linux 2023 | perf +14 | 1:6.1.158-178.288.amzn2023 | ALAS2023-2025-1297 |
| Amazon Linux 2023 | perf6.12 +14 | 1:6.12.55-74.119.amzn2023 | ALAS2023-2025-1316 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.117.1-1 | — |
| Azure Linux 2 (CBL-Mariner) | kernel | 5.15.200.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | kernel-uek +34 | 6.12.0-106.55.4.1.el10uek | ELSA-2025-28040 |
| Oracle Linux 8 | bpftool +18 | 5.15.0-317.197.5.1.el9uek | ELSA-2026-50113 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882 ★ 12 · Dec 1, 2025
3 linux kernel bugs chains to do secure comm app using side channel to establish key and establish covert channe;
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 48
- WID-SEC-2025-2431 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-8781-1 linux-nvidia-tegra vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8096-1 linux, linux-aws, linux-gcp, linux-gkeop, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle, linux-xilinx-zynqmp vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8243-1 linux-azure-5.15 vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8096-3 linux-aws-5.15, linux-gcp-5.15, linux-gke, linux-hwe-5.15, linux-intel-iotg-5.15, linux-lowlatency-hwe-5.15, linux-oracle-5.15 vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8116-1 linux-intel-iot-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8096-2 linux-fips, linux-aws-fips, linux-gcp-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8163-1 linux-azure-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8141-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8163-2 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8096-5 linux-nvidia-tegra-igx vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8096-4 linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8029-2 linux-aws, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-8048-1 linux-oem-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-8029-3 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-8030-1 linux-gcp vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-8029-1 linux, linux-raspi, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- WID-SEC-2026-0349 Dell Avamar und NetWorker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- SUSE-SU-2026:20561-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 9, 2026
- openSUSE-SU-2025:20091-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15702-1 kernel-devel-6.17.7-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20496-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20059-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20039-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4517-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20473-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4530-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4515-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4422-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4393-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21147-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21080-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0029-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4516-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4521-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:21180-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:10301-1 kernel-devel-longterm-6.18.16-1.1 on GA media SUSE / openSUSE Security Updates · Mar 8, 2026
- ELSA-2026-50113 Important: Unbreakable Enterprise kernel security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 15, 2026
- ALAS2023-2025-1297 Important: kernel security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 8, 2026
- SUSE-SU-2025:4505-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2026:0033-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2026:0034-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:4506-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2026:0032-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2023-2025-1316 Important: kernel6.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Dec 19, 2025
- ELSA-2025-28040 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Dec 10, 2025
- DLA-4379-1 linux-6.1 - security update Debian Security (DSA / DLA) · Nov 25, 2025
- DSA-6053-1 linux - security update Debian Security (DSA / DLA) · Nov 11, 2025
References
- https://git.kernel.org/stable/c/850f1ea245bdc0ce6a3fd36bfb80d8cf9647cb71
- https://git.kernel.org/stable/c/788e5385d0ff69cdba1cabccb9dab8d9647b9239
- https://git.kernel.org/stable/c/b69f19244c2b6475c8a6eb72f0fb0d53509e48cd
- https://git.kernel.org/stable/c/41cb9fd904fe0c39d52e82dd84dc3c96b7aa9693
- https://git.kernel.org/stable/c/92b82e232b8d8b116ac6e57aeae7a6033db92c60
- https://git.kernel.org/stable/c/ac50c6e0a8f91a02b681af81abb2362fbb67cc18
- https://git.kernel.org/stable/c/76385629f45740b7888f8fcd83bde955b10f61fe
- https://git.kernel.org/stable/c/f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93