CVE-2026-31507
Siemens ProductCERT Advisory SSA-019113
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores the pointer in pipe_buffer.private. The pipe_buf_operations for these buffers used .get = generic_pipe_buf_get, which only increments the page reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv pointer itself was not handled, so after tee() both the original and the cloned pipe_buffer share the same smc_spd_priv *. When both pipes are subsequently released, smc_rx_pipe_buf_release() is called twice against the same object: 1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct] 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF] KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which then escalates to a NULL-pointer dereference and kernel panic via smc_rx_update_consumer() when it chases the freed priv->smc pointer: BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0 Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x650 kasan_report+0xc6/0x100 smc_rx_pipe_buf_release+0x78/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:smc_rx_update_consumer+0x8d/0x350 Call Trace: <TASK> smc_rx_pipe_buf_release+0x121/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Kernel panic - not syncing: Fatal exception Beyond the memory-safety problem, duplicating an SMC splice buffer is semantically questionable: smc_rx_update_cons() would advance the consumer cursor twice for the same data, corrupting receive-window accounting. A refcount on smc_spd_priv could fix the double-free, but the cursor-accounting issue would still need to be addressed separately. The .get callback is invoked by both tee(2) and splice_pipe_to_pipe() for partial transfers; both will now return -EFAULT. Users who need to duplicate SMC socket data must use a copy-based read path.
Metrics
Affected operating systems
linux
amazon / amazon_linux
linux
ubuntu / awsbionic
linux
ubuntu / awsjammy
linux
ubuntu / awsnoble
linux
ubuntu / awsresolute
linux
ubuntu / awsxenial
linux
ubuntu / aws-6.8jammy
linux
ubuntu / aws-hwexenial
linux
ubuntu / azurejammy
linux
ubuntu / azurenoble
linux
ubuntu / azureresolute
linux
ubuntu / azurexenial
linux
ubuntu / azure-4.15bionic
linux
suse / basesystem_module15
linux
debian / debian_linux11.0
linux
debian / debian_linux12.0
linux
debian / debian_linux13.0
linux
suse / development_tools_module15
linux
redhat / enterprise_linux10.0
linux
redhat / enterprise_linux7.0
linux
redhat / enterprise_linux8.0
linux
redhat / enterprise_linux9.0
linux
redhat / enterprise_linux_aus8.4
linux
redhat / enterprise_linux_aus8.6
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
arista
cloudvision_agni2024.4.0 – 2025.2.2
arista
cloudvision_portal2024.2.0 – 2026.1.0
arista
velocloud_edge4.5.0 – 6.4.1
arista
velocloud_gateway
arista
velocloud_orchestrator
canonical
ubuntu_linux
Citrix Systems
Hypervisor8.2 CU1 LTSR
Citrix Systems
XenServer8.4
Dell
ECS3.8.1.0-3.8.1.7
Dell
NetWorkerVirtual Edition
Dell
NetWorkervProxy 19.13.0.3
Dell
NetWorkervProxy 19.14
Dell
PowerScale OneFS13.2.3
Dell
PowerScale OneFSOneFS
Dell
Secure Connect GatewayAppliance 5.32.00.18
gnupg
libgcrypt1.11.0 – 1.11.3
gnupg
libgcrypt1.12.0 – 1.12.2
gnupg
libgcrypt1.8.8 – 1.10.4
Intel
ProzessorCore Ultra 5
Intel
ProzessorCore Ultra 7
Intel
ProzessorCore Ultra 9
julia
openssh_jll
netapp
active_iq_unified_manager
netapp
clustered_data_ontap
References & sources
- https://git.kernel.org/stable/c/fa4c14a82747886d333d8baef0d26da86ba1ccf7
- https://git.kernel.org/stable/c/5858448a6c65d8ee3f8600570d3ce19febcb33be
- https://git.kernel.org/stable/c/fe546f5c50fc474daca6bee72caa7ab68a74c33d
- https://git.kernel.org/stable/c/e59a52e429e13df3feb34f4853a8e36d121ed937
- https://git.kernel.org/stable/c/3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://git.kernel.org/stable/c/368c22aea490f6f50df831b4f9e3623787686c5beuvd
- https://git.kernel.org/stable/c/d1399632ba255d2e02c757af5d9f5d9279ce168ceuvd
- https://git.kernel.org/stable/c/d552bcfca323d175664d7444989b04f55666978aeuvd
- https://git.kernel.org/stable/c/15d209bccf9273b4a8b4e579ba0e92d065b6ec8ceuvd
- https://git.kernel.org/stable/c/1f3083aec8836213da441270cdb1ab612dd82cf4euvd
- https://git.kernel.org/stable/c/296f18e1c3a87c915a92ed27832d5040a22d1072
- https://git.kernel.org/stable/c/9e2182865de781c41ab16b7985e9d26dcefea867
- https://git.kernel.org/stable/c/57cc509d82b46150a11dcecc8b25eaa177eda34d
- https://git.kernel.org/stable/c/414fc5e5a5aff776c150f1b86770e0a25a35df3aeuvd
- https://git.kernel.org/stable/c/02f3ecadb23558bbe068e6504118f1b712d4ece0euvd
- https://git.kernel.org/stable/c/0e43e0a3c94044acc74b8e0927c27972eb5a59e8euvd
- https://git.kernel.org/stable/c/aa9facde6c5005205874c37db3fd25799d741bafeuvd
- https://git.kernel.org/stable/c/5d70eb25b41e9b010828cd12818b06a0c3b04412euvd
- https://git.kernel.org/stable/c/2694d408b0e595024e0fc1d64ff9db0358580f74euvd
Linked CVEs
- CVE-2026-64560
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wong…
highCVSSv3 7.8 - CVE-2026-64552
In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the…
highCVSSv3 8.4 - CVE-2026-64545
In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master…
highCVSSv3 7.5 - CVE-2026-64538
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
— - CVE-2026-64425
In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item c…
mediumCVSSv3 5.5 - CVE-2026-64423
In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruc…
highCVSSv3 7.8 - CVE-2026-64422
In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes R…
mediumCVSSv3 5.5 - CVE-2026-64413
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: lookin…
mediumCVSSv3 5.5 - CVE-2026-64412
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need t…
mediumCVSSv3 5.5 - CVE-2026-64411
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before find_table_lock()…
highCVSSv3 7.1 - CVE-2026-64375
In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace_may_access() with exec_update_lock (FD links)…
highCVSSv3 7.1 - CVE-2026-64371
In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace_may_access() with exec_update_lock (part 1) Fi…
mediumCVSSv3 5.5 - CVE-2026-64370
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error…
mediumCVSSv3 5.5 - CVE-2026-64317
In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record get_sym…
mediumCVSSv3 5.5 - CVE-2026-64279
In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter deregistration race Adapters can be looked u…
mediumCVSSv3 4.7 - CVE-2026-63810
In the Linux kernel, the following vulnerability has been resolved: block: Avoid mounting the bdev pseudo-filesystem in userspace The b…
highCVSSv3 7.1 - CVE-2026-53400
In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up…
highCVSSv3 7.5 - CVE-2026-53352
In the Linux kernel, the following vulnerability has been resolved: signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()…
mediumCVSSv3 5.5 - CVE-2026-53295
In the Linux kernel, the following vulnerability has been resolved: mailbox: add sanity check for channel array Fail gracefully if ther…
mediumCVSSv3 5.5 - CVE-2026-53275
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When pr…
highCVSSv3 8.8 - CVE-2026-53269
In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: add mutex to guard hook reference counting As…
mediumCVSSv3 5.5 - CVE-2026-53268
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When pars…
highCVSSv3 8.2 - CVE-2026-53249
In the Linux kernel, the following vulnerability has been resolved: ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options This patch restric…
highCVSSv3 7.0 - CVE-2026-53239
In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel…
highCVSSv3 7.8
Show 406 more CVEs
- CVE-2026-53236
In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SO_ATTACH_FILTER to priv users This patch restricts t…
highCVSSv3 7.0 - CVE-2026-53223
In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queu…
highCVSSv3 7.1 - CVE-2026-53219
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: avoid leaking percpu counter pointers The nati…
mediumCVSSv3 5.5 - CVE-2026-53218
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag nft…
highCVSSv3 7.0 - CVE-2026-53134
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_fib: fix stale stack leak via the OIFNAME register F…
mediumCVSSv3 5.5 - CVE-2026-53050
In the Linux kernel, the following vulnerability has been resolved: quota: Fix race of dquot_scan_active() with quota deactivation dquo…
highCVSSv3 7.8 - CVE-2026-53012
In the Linux kernel, the following vulnerability has been resolved: nexthop: fix IPv6 route referencing IPv4 nexthop syzbot reported a…
mediumCVSSv3 5.5 - CVE-2026-53006
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr befo…
criticalCVSSv3 9.8 - CVE-2026-53002
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprint…
criticalCVSSv3 9.8 - CVE-2026-53001
In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: restrict several matches to inet family This is…
mediumCVSSv3 5.5 - CVE-2026-52999
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching…
criticalCVSSv3 9.1 - CVE-2026-52998
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl chec…
highCVSSv3 7.5 - CVE-2026-52986
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsaf…
criticalCVSSv3 9.8 - CVE-2026-52970
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: fix missing expect put in obj eval nft_ct_expect…
mediumCVSSv3 5.5 - CVE-2026-52946
In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling A SOFTI…
highCVSSv3 7.5 - CVE-2026-52943
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers p…
highCVSSv3 7.8 - CVE-2026-52942
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it Th…
highCVSSv3 7.1 - CVE-2026-52933
In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: fix signed comparison in io_poll_get_ownership() io_…
highCVSSv3 7.8 - CVE-2026-52930
In the Linux kernel, the following vulnerability has been resolved: ipc/shm: serialize orphan cleanup with shm_nattch updates shm_destr…
mediumCVSSv3 5.5 - CVE-2026-52912
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_fram…
highCVSSv3 7.8 - CVE-2026-52910
In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period.
highCVSSv3 7.8 - CVE-2026-46333
In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of…
highCVSSv3 7.1 - CVE-2026-46323
In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently co…
highCVSSv3 7.8 - CVE-2026-46306
In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7…
highCVSSv3 7.5 - CVE-2026-46303
In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume siz…
highCVSSv3 8.2 - CVE-2026-46300
A flaw was found in the Linux kernel's XFRM ESP-in-TCP subsystem.
highCVSSv3 7.8 - CVE-2026-46193
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah: account for ESN high bits in async callbacks AH allocates…
mediumCVSSv3 5.5 - CVE-2026-46174
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2'…
highCVSSv3 8.8 - CVE-2026-46173
In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-…
highCVSSv3 7.8 - CVE-2026-46172
In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() xfrm6_rcv_en…
mediumCVSSv3 5.5 - CVE-2026-46132
In the Linux kernel, the following vulnerability has been resolved: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rt…
mediumCVSSv3 5.5 - CVE-2026-46116
In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KA…
highCVSSv3 7.8 - CVE-2026-46101
In the Linux kernel, the following vulnerability has been resolved: netfilter: reject zero shift in nft_bitwise Reject zero shift opera…
mediumCVSSv3 5.5 - CVE-2026-46086
In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB…
mediumCVSSv3 5.5 - CVE-2026-46046
In the Linux kernel, the following vulnerability has been resolved: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() The co…
mediumCVSSv3 5.5 - CVE-2026-46040
In the Linux kernel, the following vulnerability has been resolved: inotify: fix watch count leak when fsnotify_add_inode_mark_locked()…
mediumCVSSv3 5.5 - CVE-2026-46037
A flaw was found in the Linux kernel, specifically within its IPv4 Internet Control Message Protocol (ICMP) component.
highCVSSv3 8.2 - CVE-2026-46033
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject short ahash digests during instance crea…
highCVSSv3 7.1 - CVE-2026-46021
In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone governor cleanup issues If thermal_…
mediumCVSSv3 5.5 - CVE-2026-46015
In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after listener migration When inet_csk_li…
highCVSSv3 7.8 - CVE-2026-45841
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO nf_o…
mediumCVSSv3 5.5 - CVE-2026-43501
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv…
criticalCVSSv3 9.8 - CVE-2026-43499
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() rem…
highCVSSv3 7.8 - CVE-2026-43492
In the Linux kernel, the following vulnerability has been resolved: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() Y…
mediumCVSSv3 5.5 - CVE-2026-43303
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several…
highCVSSv3 7.8 - CVE-2026-43284
A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems.
highCVSSv3 8.8 - CVE-2026-43216
In the Linux kernel, the following vulnerability has been resolved: net: Drop the lock in skb_may_tx_timestamp() skb_may_tx_timestamp()…
mediumCVSSv3 5.5 - CVE-2026-43116
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holdin…
highCVSSv3 7.8 - CVE-2026-43089
In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_mapping() struct xfrm_usersa_id h…
mediumCVSSv3 5.5 - CVE-2026-43085
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminat…
mediumCVSSv3 5.5 - CVE-2026-43071
In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two There is an OOB r…
criticalCVSSv3 9.1 - CVE-2026-43057
In the Linux kernel, the following vulnerability has been resolved: net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback NE…
highCVSSv3 7.5 - CVE-2026-43040
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX…
highCVSSv3 7.1 - CVE-2026-43038
In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashik…
criticalCVSSv3 9.8 - CVE-2026-43035
In the Linux kernel, the following vulnerability has been resolved: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info t…
mediumCVSSv3 5.5 - CVE-2026-43033
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-pla…
highCVSSv3 7.8 - CVE-2026-43030
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix regsafe() for pointers to packet In case rold->reg->range…
highCVSSv3 7.8 - CVE-2026-43028
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: ensure names are nul-terminated Reject names t…
highCVSSv3 7.1 - CVE-2026-43027
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_co…
highCVSSv3 7.8 - CVE-2026-43026
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT abs…
mediumCVSSv3 5.5 - CVE-2026-43025
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helper on new expectations Us…
highCVSSv3 7.3 - CVE-2026-43024
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject immediate NF_QUEUE verdict nft_queue i…
mediumCVSSv3 5.5 - CVE-2026-43011
In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x…
criticalCVSSv3 9.8 - CVE-2026-41989
Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.
mediumCVSSv3 6.7 - CVE-2026-40355
A flaw was found in MIT Kerberos 5 (krb5).
mediumCVSSv3 5.9 - CVE-2026-3497
A flaw was found in the OpenSSH GSSAPI (Generic Security Service Application Program Interface) delta patches, as included in various Lin…
highCVSSv3 7.5 - CVE-2026-31768
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() Add a D…
highCVSSv3 7.8 - CVE-2026-31761
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: mpu3050: Move iio_device_register() to correct location…
highCVSSv3 7.8 - CVE-2026-31752
In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: validate ND option lengths br_nd_send() walks N…
mediumCVSSv3 5.5 - CVE-2026-31737
In the Linux kernel, the following vulnerability has been resolved: net: ftgmac100: fix ring allocation unwind on open failure ftgmac10…
mediumCVSSv3 5.5 - CVE-2026-31700
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() In…
highCVSSv3 7.8 - CVE-2026-31682
In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_s…
criticalCVSSv3 9.1 - CVE-2026-31681
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_multiport: validate range encoding in checkentry port…
mediumCVSSv3 5.5 - CVE-2026-31680
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: flowlabel: defer exclusive option free until RCU teardown…
highCVSSv3 7.8 - CVE-2026-31674
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() Rejec…
highCVSSv3 7.1 - CVE-2026-31671
In the Linux kernel, the following vulnerability has been resolved: xfrm_user: fix info leak in build_report() struct xfrm_user_report…
mediumCVSSv3 5.5 - CVE-2026-31670
In the Linux kernel, the following vulnerability has been resolved: net: rfkill: prevent unlimited numbers of rfkill events from being c…
mediumCVSSv3 5.5 - CVE-2026-31669
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The eha…
criticalCVSSv3 9.8 - CVE-2026-31665
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: fix use-after-free in timeout object destroy nft…
highCVSSv3 7.8 - CVE-2026-31664
In the Linux kernel, the following vulnerability has been resolved: xfrm: clear trailing padding in build_polexpire() build_expire() cl…
mediumCVSSv3 5.5 - CVE-2026-31658
In the Linux kernel, the following vulnerability has been resolved: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit…
mediumCVSSv3 5.5 - CVE-2026-31651
In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix NULL-deref on disconnect Make sure to deregister t…
mediumCVSSv3 5.5 - CVE-2026-31649
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underflow in chain mode The jumbo_frm() ch…
criticalCVSSv3 9.8 - CVE-2026-31634
In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix reference count leak in rxrpc_server_keyring() This patc…
mediumCVSSv3 5.5 - CVE-2026-31628
In the Linux kernel, the following vulnerability has been resolved: x86/CPU: Fix FPDSS on Zen1 Zen1's hardware divider can leave, under…
mediumCVSSv3 5.5 - CVE-2026-31565
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix deadlock during netdev reset with active connections…
mediumCVSSv3 5.5 - CVE-2026-31563
In the Linux kernel, the following vulnerability has been resolved: net: macb: Use dev_consume_skb_any() to free TX SKBs The napi_consu…
highCVSSv3 7.5 - CVE-2026-31555
In the Linux kernel, the following vulnerability has been resolved: futex: Clear stale exiting pointer in futex_lock_pi() retry path Fu…
mediumCVSSv3 5.5 - CVE-2026-31546
In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix NULL deref in bond_debug_rlb_hash_show rlb_clear_…
mediumCVSSv3 5.5 - CVE-2026-31533
In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryptio…
criticalCVSSv3 9.8 - CVE-2026-31521
In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol st_shndx is out of bounds Th…
mediumCVSSv3 5.5 - CVE-2026-31518
In the Linux kernel, the following vulnerability has been resolved: esp: fix skb leak with espintcp and async crypto When the TX queue…
mediumCVSSv3 5.5 - CVE-2026-31515
In the Linux kernel, the following vulnerability has been resolved: af_key: validate families in pfkey_send_migrate() syzbot was able t…
mediumCVSSv3 5.5 - CVE-2026-31508
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes…
highCVSSv3 7.8 - CVE-2026-31504
In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_…
highCVSSv3 7.8 - CVE-2026-31503
In the Linux kernel, the following vulnerability has been resolved: udp: Fix wildcard bind conflict check when using hash2 When binding…
mediumCVSSv3 5.5 - CVE-2026-31496
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: skip expectations in other netns via…
mediumCVSSv3 5.5 - CVE-2026-31495
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use netlink policy range checks Replace manua…
mediumCVSSv3 5.5 - CVE-2026-31494
In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potenti…
highCVSSv3 7.8 - CVE-2026-31485
In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-lpspi: fix teardown order issue (UAF) There is a teard…
highCVSSv3 7.8 - CVE-2026-31469
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared…
highCVSSv3 7.8 - CVE-2026-31466
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() On ar…
mediumCVSSv3 4.7 - CVE-2026-31452
In the Linux kernel, the following vulnerability has been resolved: ext4: convert inline data to extents when truncate exceeds inline si…
highCVSSv3 7.8 - CVE-2026-31450
In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after initialization ext4_inode_attach_jinode(…
highCVSSv3 8.8 - CVE-2026-31449
In the Linux kernel, the following vulnerability has been resolved: ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4_ext_co…
highCVSSv3 7.8 - CVE-2026-31448
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mkn…
criticalCVSSv3 9.4 - CVE-2026-31447
In the Linux kernel, the following vulnerability has been resolved: ext4: reject mount if bigalloc with s_first_data_block != 0 bigallo…
highCVSSv3 7.8 - CVE-2026-31446
In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in update_super_work when racing with umoun…
highCVSSv3 7.8 - CVE-2026-31441
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix memory leak when a wq is reset idxd_wq_disable…
mediumCVSSv3 5.5 - CVE-2026-31431Actively exploited
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly r…
criticalCVSSv3 7.8 - CVE-2026-31428
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PA…
mediumCVSSv3 5.5 - CVE-2026-31427
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in pr…
mediumCVSSv3 5.5 - CVE-2026-31424
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: restrict xt_check_match/xt_check_target extensi…
mediumCVSSv3 5.5 - CVE-2026-31423
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() m2sm() conver…
mediumCVSSv3 5.5 - CVE-2026-31422
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flow: fix NULL pointer dereference on shared blocks…
mediumCVSSv3 5.5 - CVE-2026-31421
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_fw: fix NULL pointer dereference on shared blocks Th…
mediumCVSSv3 5.5 - CVE-2026-31418
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: drop logically empty buckets in mtype_del mtype_d…
mediumCVSSv3 5.5 - CVE-2026-31417
In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix overflow when accumulating packets Add a check to ensu…
highCVSSv3 7.5 - CVE-2026-31416
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: account for netlink header size This is a…
mediumCVSSv3 5.5 - CVE-2026-31415
In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid overflows in ip6_datagram_send_ctl() Yiming Qian report…
mediumCVSSv3 5.5 - CVE-2026-31414
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->help…
criticalCVSSv3 9.8 - CVE-2026-31411
In the Linux kernel, the following vulnerability has been resolved: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() R…
mediumCVSSv3 5.5 - CVE-2026-31403
In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd…
highCVSSv3 7.8 - CVE-2026-31402
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 re…
criticalCVSSv3 9.8 - CVE-2026-31396
In the Linux kernel, the following vulnerability has been resolved: net: macb: fix use-after-free access to PTP clock PTP clock is regi…
highCVSSv3 7.8 - CVE-2026-31391
In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - Fix OOM ->tfm_count leak If memory allocati…
mediumCVSSv3 5.5 - CVE-2026-31389
In the Linux kernel, the following vulnerability has been resolved: spi: fix use-after-free on controller registration failure Make sur…
highCVSSv3 7.8 - CVE-2026-27135
A flaw was found in nghttp2.
highCVSSv3 7.5 - CVE-2026-23475
In the Linux kernel, the following vulnerability has been resolved: spi: fix statistics allocation The controller per-cpu statistics is…
mediumCVSSv3 5.5 - CVE-2026-23474
In the Linux kernel, the following vulnerability has been resolved: mtd: Avoid boot crash in RedBoot partition table parser Given CONFI…
mediumCVSSv3 5.5 - CVE-2026-23463
In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: fix race condition in qman_destroy_fq When QMAN_FQ…
mediumCVSSv3 4.7 - CVE-2026-23458
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()…
highCVSSv3 7.8 - CVE-2026-23457
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in si…
highCVSSv3 8.6 - CVE-2026-23456
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case…
highCVSSv3 8.2 - CVE-2026-23455
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()…
criticalCVSSv3 9.1 - CVE-2026-23454
In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in mana_hwc_destroy_channel() by reord…
highCVSSv3 7.0 - CVE-2026-23452
In the Linux kernel, the following vulnerability has been resolved: PM: runtime: Fix a race condition related to device removal The fol…
mediumCVSSv3 4.7 - CVE-2026-23450
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Sy…
criticalCVSSv3 9.8 - CVE-2026-23449
In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free in teql_master_xmit Whenever a TEQ…
highCVSSv3 7.8 - CVE-2026-23446
In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Do not perform PM inside suspend callback syzbot…
mediumCVSSv3 5.5 - CVE-2026-23439
In the Linux kernel, the following vulnerability has been resolved: udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IP…
mediumCVSSv3 5.5 - CVE-2026-23438
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: guard flow control update with global_tx_fc in buffer sw…
mediumCVSSv3 5.5 - CVE-2026-23434
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: serialize lock/unlock against other NAND operations n…
highCVSSv3 7.1 - CVE-2026-23422
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ h…
highCVSSv3 7.8 - CVE-2026-23414
In the Linux kernel, the following vulnerability has been resolved: tls: Purge async_hold in tls_decrypt_async_wait() The async_hold qu…
highCVSSv3 7.5 - CVE-2026-23399
In the Linux kernel, the following vulnerability has been resolved: nf_tables: nft_dynset: fix possible stateful expression memleak in e…
mediumCVSSv3 5.5 - CVE-2026-23398
In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_ta…
mediumCVSSv3 5.5 - CVE-2026-23397
In the Linux kernel, the following vulnerability has been resolved: nfnetlink_osf: validate individual option lengths in fingerprints n…
highCVSSv3 7.1 - CVE-2026-23392
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on er…
highCVSSv3 7.8 - CVE-2026-23391
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_CT: drop pending enqueued packets on template removal…
highCVSSv3 7.8 - CVE-2026-23381
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled When…
mediumCVSSv3 5.5 - CVE-2026-23379
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: fix divide by zero in the offload path Offloading E…
mediumCVSSv3 5.5 - CVE-2026-23378
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ife: Fix metalist update behavior Whenever an ife ac…
highCVSSv3 7.8 - CVE-2026-23370
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump plaintext password dat…
mediumCVSSv3 5.5 - CVE-2026-23368
In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy led_triggers during probe to avoid AB-BA dead…
mediumCVSSv3 5.5 - CVE-2026-23365
In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: validate USB endpoints The kalmia driver should v…
mediumCVSSv3 5.5 - CVE-2026-23359
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack-out-of-bounds write in devmap get_upper_ifindexes()…
highCVSSv3 7.8 - CVE-2026-23351
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Y…
highCVSSv3 7.8 - CVE-2026-23343
In the Linux kernel, the following vulnerability has been resolved: xdp: produce a warning when calculated tailroom is negative Many et…
highCVSSv3 7.8 - CVE-2026-23340
In the Linux kernel, the following vulnerability has been resolved: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockle…
highCVSSv3 7.8 - CVE-2026-23335
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() struct…
mediumCVSSv3 5.5 - CVE-2026-23321
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: in-kernel: always mark signal+subflow endp as used Syzka…
mediumCVSSv3 5.5 - CVE-2026-23319
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim The root ca…
highCVSSv3 7.8 - CVE-2026-23304
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() l3mdev_master_…
mediumCVSSv3 5.5 - CVE-2026-23300
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix panic when IPv4 route references loopback IPv6 nextho…
mediumCVSSv3 5.5 - CVE-2026-23293
In the Linux kernel, the following vulnerability has been resolved: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled When…
mediumCVSSv3 5.5 - CVE-2026-23290
In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: validate USB endpoints The pegasus driver should…
mediumCVSSv3 5.5 - CVE-2026-23287
In the Linux kernel, the following vulnerability has been resolved: irqchip/sifive-plic: Fix frozen interrupt due to affinity setting P…
mediumCVSSv3 5.5 - CVE-2026-23284
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of er…
mediumCVSSv3 5.5 - CVE-2026-23277
In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TE…
mediumCVSSv3 5.5 - CVE-2026-23274
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels ID…
highCVSSv3 7.8 - CVE-2026-23273
In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_common_newlink() err…
highCVSSv3 7.8 - CVE-2026-23271
In the Linux kernel, the following vulnerability has been resolved: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race…
highCVSSv3 7.8 - CVE-2026-23270
In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and sh…
highCVSSv3 7.8 - CVE-2026-23255
In the Linux kernel, the following vulnerability has been resolved: net: add proper RCU protection to /proc/net/ptype Yin Fengwei repor…
mediumCVSSv3 5.5 - CVE-2026-23245
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gate: snapshot parameters with RCU on replace The ga…
highCVSSv3 7.8 - CVE-2026-23243
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write…
highCVSSv3 7.8 - CVE-2026-23242
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix potential NULL pointer dereference in header processin…
highCVSSv3 7.5 - CVE-2026-23231
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf…
highCVSSv3 7.8 - CVE-2026-23204
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_poi…
highCVSSv3 7.1 - CVE-2026-23154
In the Linux kernel, the following vulnerability has been resolved: net: fix segmentation of forwarding fraglist GRO This patch enhance…
mediumCVSSv3 5.5 - CVE-2026-23113
In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop Currently…
mediumCVSSv3 5.5 - CVE-2026-23111
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall…
highCVSSv3 7.8 - CVE-2026-23110
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race ag…
mediumCVSSv3 4.7 - CVE-2026-23103
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Make the addrs_lock be per port Make the addrs_lock be per…
highCVSSv3 7.8 - CVE-2026-23100
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb_pmd_shared() Patch series "mm/hugetlb: fixe…
mediumCVSSv3 5.5 - CVE-2026-23095
In the Linux kernel, the following vulnerability has been resolved: gue: Fix skb memleak with inner IP protocol 0.
highCVSSv3 7.5 - CVE-2026-23087
In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()…
mediumCVSSv3 5.5 - CVE-2026-23086
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: cap TX credit to local buffer size The virtio transpo…
mediumCVSSv3 5.5 - CVE-2026-23084
In the Linux kernel, the following vulnerability has been resolved: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list Wh…
mediumCVSSv3 5.5 - CVE-2026-23083
In the Linux kernel, the following vulnerability has been resolved: fou: Don't allow 0 for FOU_ATTR_IPPROTO.
highCVSSv3 7.8 - CVE-2026-23060
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/…
mediumCVSSv3 5.5 - CVE-2026-23054
In the Linux kernel, the following vulnerability has been resolved: net: hv_netvsc: reject RSS hash key programming without RX indirecti…
—CVSSv3 0.0 - CVE-2026-23038
In the Linux kernel, the following vulnerability has been resolved: pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() In…
—CVSSv3 0.0 - CVE-2026-23026
In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() Fi…
mediumCVSSv3 5.5 - CVE-2026-23019
In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix NULL dereference on devlink_alloc() fail…
mediumCVSSv3 5.5 - CVE-2026-23011
In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_gre: make ipgre_header() robust Analog to commit db5b4e39c…
mediumCVSSv3 5.5 - CVE-2026-23010
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del().
highCVSSv3 7.8 - CVE-2026-23005
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1…
mediumCVSSv3 5.5 - CVE-2026-23003
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed c…
highCVSSv3 7.5 - CVE-2026-22994
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is…
mediumCVSSv3 5.5 - CVE-2026-22992
In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from mon_handle_auth_done() Curre…
highCVSSv3 7.5 - CVE-2026-22982
In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: Fix crash when adding interface under a lag Comm…
mediumCVSSv3 5.5 - CVE-2026-22980
In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace Writing to v4_end_grace can…
highCVSSv3 7.8 - CVE-2026-22979
In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in skb_segment_list for GRO packets When skb_s…
mediumCVSSv3 5.5 - CVE-2026-22977
In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv_errqueue skbuff…
mediumCVSSv3 5.5 - CVE-2025-71267
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST We f…
mediumCVSSv3 5.5 - CVE-2025-71266
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: check return value of indx_find to avoid infinite loop W…
mediumCVSSv3 5.5 - CVE-2025-71265
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent…
mediumCVSSv3 5.5 - CVE-2025-71221
In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() Add p…
highCVSSv3 7.8 - CVE-2025-71197
In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fix off-by-one buffer overflow in alarms_store The sysfs…
—CVSSv3 0.0 - CVE-2025-71191
In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_hdmac: fix device leak on of_dma_xlate() Make sure to…
mediumCVSSv3 5.5 - CVE-2025-71190
In the Linux kernel, the following vulnerability has been resolved: dmaengine: bcm-sba-raid: fix device leak on probe Make sure to drop…
mediumCVSSv3 5.5 - CVE-2025-71189
In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw: dmamux: fix OF node leak on route allocation failure…
mediumCVSSv3 5.5 - CVE-2025-71186
In the Linux kernel, the following vulnerability has been resolved: dmaengine: stm32: dmamux: fix device leak on route allocation Make…
mediumCVSSv3 5.5 - CVE-2025-71185
In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocat…
mediumCVSSv3 5.5 - CVE-2025-71163
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix device leaks on compat bind and unbind Make su…
mediumCVSSv3 5.5 - CVE-2025-71162
In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exis…
highCVSSv3 7.8 - CVE-2025-71161
In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two…
highCVSSv3 7.5 - CVE-2025-71131
In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt As soo…
highCVSSv3 7.5 - CVE-2025-71123
In the Linux kernel, the following vulnerability has been resolved: ext4: fix string copying in parse_apply_sb_mount_options() strscpy_…
highCVSSv3 7.8 - CVE-2025-71120
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gs…
highCVSSv3 7.5 - CVE-2025-71114
In the Linux kernel, the following vulnerability has been resolved: via_wdt: fix critical boot hang due to unnamed resource allocation…
mediumCVSSv3 5.5 - CVE-2025-71113
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc…
mediumCVSSv3 5.5 - CVE-2025-71112
In the Linux kernel, the following vulnerability has been resolved: net: hns3: add VLAN id validation before using Currently, the VLAN…
highCVSSv3 8.8 - CVE-2025-71104
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodi…
mediumCVSSv3 5.5 - CVE-2025-71098
In the Linux kernel, the following vulnerability has been resolved: ip6_gre: make ip6gre_header() robust Over the years, syzbot found m…
mediumCVSSv3 5.5 - CVE-2025-71097
In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix reference count leak when using error routes with nexthop…
mediumCVSSv3 5.5 - CVE-2025-71095
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix the crash issue for zero copy XDP_TX action There…
criticalCVSSv3 9.1 - CVE-2025-71088
In the Linux kernel, the following vulnerability has been resolved: mptcp: fallback earlier on simult connection Syzkaller reports a si…
mediumCVSSv3 5.5 - CVE-2025-71086
In the Linux kernel, the following vulnerability has been resolved: net: rose: fix invalid array index in rose_kill_by_device() rose_ki…
highCVSSv3 7.8 - CVE-2025-71085
In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr(…
highCVSSv3 7.5 - CVE-2025-71079
In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_…
mediumCVSSv3 5.5 - CVE-2025-71075
In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asd_pc…
highCVSSv3 7.8 - CVE-2025-71064
In the Linux kernel, the following vulnerability has been resolved: net: hns3: using the num_tqps in the vf driver to apply for resource…
—CVSSv3 0.0 - CVE-2025-68820
In the Linux kernel, the following vulnerability has been resolved: ext4: xattr: fix null pointer deref in ext4_raw_inode() If ext4_get…
—CVSSv3 0.0 - CVE-2025-68818
In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in…
highCVSSv3 8.8 - CVE-2025-68816
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, Validate format string parameters Add validati…
—CVSSv3 0.0 - CVE-2025-68814
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix filename leak in __io_openat_prep() __io_openat_prep…
—CVSSv3 0.0 - CVE-2025-68803
In the Linux kernel, the following vulnerability has been resolved: NFSD: NFSv4 file creation neglects setting ACL An NFSv4 client that…
highCVSSv3 8.0 - CVE-2025-68798
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: Check event before enable to avoid GPF On AMD machine…
—CVSSv3 0.0 - CVE-2025-68788
In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special…
—CVSSv3 0.0 - CVE-2025-68787
In the Linux kernel, the following vulnerability has been resolved: netrom: Fix memory leak in nr_sendmsg() syzbot reported a memory le…
—CVSSv3 0.0 - CVE-2025-68782
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Reset t_task_cdb pointer in error case If allocation…
highCVSSv3 7.5 - CVE-2025-68776
In the Linux kernel, the following vulnerability has been resolved: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() p…
—CVSSv3 0.0 - CVE-2025-68773
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode C…
—CVSSv3 0.0 - CVE-2025-68764
In the Linux kernel, the following vulnerability has been resolved: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync fla…
highCVSSv3 7.8 - CVE-2025-68742
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_effective_progs fail…
—CVSSv3 0.0 - CVE-2025-68725
In the Linux kernel, the following vulnerability has been resolved: bpf: Do not let BPF test infra emit invalid GSO types to stack Yinh…
mediumCVSSv3 5.5 - CVE-2025-68724
In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generat…
highCVSSv3 7.8 - CVE-2025-68371
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed after device removal…
—CVSSv3 0.0 - CVE-2025-68363
In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb->transport_header is set in bpf_skb_check_mtu The bp…
—CVSSv3 0.0 - CVE-2025-68349
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_i…
highCVSSv3 7.5 - CVE-2025-68337
In the Linux kernel, the following vulnerability has been resolved: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file sys…
highCVSSv3 7.5 - CVE-2025-68291
In the Linux kernel, the following vulnerability has been resolved: mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in…
—CVSSv3 0.0 - CVE-2025-68266
In the Linux kernel, the following vulnerability has been resolved: bfs: Reconstruct file type when loading from disk syzbot is reporti…
—CVSSv3 0.0 - CVE-2025-68265
In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin request_queue lifetime The namespaces can access th…
highCVSSv3 7.8 - CVE-2025-68264
In the Linux kernel, the following vulnerability has been resolved: ext4: refresh inline data size before write operations The cached e…
—CVSSv3 0.0 - CVE-2025-68261
In the Linux kernel, the following vulnerability has been resolved: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()…
highCVSSv3 7.5 - CVE-2025-68206
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: add seqadj extension for natted connections Sequ…
highCVSSv3 7.5 - CVE-2025-61985
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
lowCVSSv3 3.6 - CVE-2025-61984
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially lea…
lowCVSSv3 3.6 - CVE-2025-40300
In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerabi…
mediumCVSSv3 5.5 - CVE-2025-40261
In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ct…
criticalCVSSv3 9.8 - CVE-2025-40219
In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit…
—CVSSv3 0.0 - CVE-2025-40196
In the Linux kernel, the following vulnerability has been resolved: fs: quota: create dedicated workqueue for quota_release_work There…
—CVSSv3 0.0 - CVE-2025-40149
In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
highCVSSv3 7.8 - CVE-2025-40135
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use d…
highCVSSv3 8.1 - CVE-2025-40105
In the Linux kernel, the following vulnerability has been resolved: vfs: Don't leak disconnected dentries on umount When user calls ope…
highCVSSv3 7.8 - CVE-2025-40080
In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to ab…
—CVSSv3 0.0 - CVE-2025-40078
In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a k…
—CVSSv3 0.0 - CVE-2025-40070
In the Linux kernel, the following vulnerability has been resolved: pps: fix warning in pps_register_cdev when register device fail Sim…
—CVSSv3 0.0 - CVE-2025-40022
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit…
—CVSSv3 0.0 - CVE-2025-39980
In the Linux kernel, the following vulnerability has been resolved: nexthop: Forbid FDB status change while nexthop is in a group The k…
—CVSSv3 0.0 - CVE-2025-39978
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() Th…
highCVSSv3 7.8 - CVE-2025-39977
In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to t…
highCVSSv3 7.8 - CVE-2025-39964
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issui…
highCVSSv3 7.8 - CVE-2025-39955
In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
highCVSSv3 7.8 - CVE-2025-39953
In the Linux kernel, the following vulnerability has been resolved: cgroup: split cgroup_destroy_wq into 3 workqueues A hung task can o…
mediumCVSSv3 5.5 - CVE-2025-39931
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Set merge to zero early in af_alg_sendmsg If an er…
highCVSSv3 7.8 - CVE-2025-39871
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Remove improper idxd_free The call to idxd_free()…
highCVSSv3 7.8 - CVE-2025-39866
In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-af…
highCVSSv3 7.8 - CVE-2025-39845
In the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_map…
mediumCVSSv3 5.5 - CVE-2025-39827
In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current i…
highCVSSv3 8.8 - CVE-2025-39826
In the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in str…
highCVSSv3 8.8 - CVE-2025-39795
In the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow for chunk_sectors check in blk_stack_…
mediumCVSSv3 5.5 - CVE-2025-39782
In the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_…
mediumCVSSv3 5.5 - CVE-2025-39773
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When s…
mediumCVSSv3 5.5 - CVE-2025-39770
In the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_…
highCVSSv3 7.5 - CVE-2025-39764
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: remove refcounting in expectation dumpers Sam…
mediumCVSSv3 5.5 - CVE-2025-39756
In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX Whe…
mediumCVSSv3 5.5 - CVE-2025-39748
In the Linux kernel, the following vulnerability has been resolved: bpf: Forget ranges when refining tnum after JSET Syzbot reported a…
mediumCVSSv3 5.5 - CVE-2025-39721
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - flush misc workqueue during device shutdown Repeated…
mediumCVSSv3 5.5 - CVE-2025-39691
In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's is…
highCVSSv3 7.8 - CVE-2025-39681
In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper…
mediumCVSSv3 5.5 - CVE-2025-38736
In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initializat…
highCVSSv3 7.1 - CVE-2025-38732
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets…
mediumCVSSv3 5.5 - CVE-2025-38727
In the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_…
mediumCVSSv3 5.5 - CVE-2025-38725
In the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without s…
mediumCVSSv3 5.5 - CVE-2025-38721
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a re…
mediumCVSSv3 5.5 - CVE-2025-38704
In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access…
highCVSSv3 7.8 - CVE-2025-38681
In the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Me…
mediumCVSSv3 4.7 - CVE-2025-38614
In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances…
highCVSSv3 7.8 - CVE-2025-38591
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF…
mediumCVSSv3 5.5 - CVE-2025-38322
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fu…
mediumCVSSv3 5.5 - CVE-2025-38232
In the Linux kernel, the following vulnerability has been resolved: NFSD: fix race between nfsd registration and exports_proc As of now…
highCVSSv3 7.8 - CVE-2025-38201
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX…
highCVSSv3 7.8 - CVE-2025-38192
In the Linux kernel, the following vulnerability has been resolved: net: clear the dst when changing skb protocol A not-so-careful NAT4…
highCVSSv3 7.8 - CVE-2025-38162
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: prevent overflow in lookup table allocati…
highCVSSv3 7.8 - CVE-2025-38125
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring EST…
mediumCVSSv3 5.5 - CVE-2025-37980
In the Linux kernel, the following vulnerability has been resolved: block: fix resource leak in blk_register_queue() error path When re…
mediumCVSSv3 5.5 - CVE-2025-37972
In the Linux kernel, the following vulnerability has been resolved: Input: mtk-pmic-keys - fix possible null pointer dereference In mtk…
mediumCVSSv3 5.5 - CVE-2025-37964
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skip…
highCVSSv3 7.8 - CVE-2025-37959
In the Linux kernel, the following vulnerability has been resolved: bpf: Scrub packet on bpf_redirect_peer When bpf_redirect_peer is us…
criticalCVSSv3 9.4 - CVE-2025-37945
In the Linux kernel, the following vulnerability has been resolved: net: phy: allow MDIO bus PM ops to start/stop state machine for phyl…
mediumCVSSv3 5.5 - CVE-2025-37917
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx…
highCVSSv3 7.5 - CVE-2025-37909
In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Fix memleak issue when GSO enabled Always map the `sk…
mediumCVSSv3 5.5 - CVE-2025-37785
In the Linux kernel, the following vulnerability has been resolved: ext4: fix OOB read when checking dotdot dir Mounting a corrupted fi…
highCVSSv3 7.8 - CVE-2025-23143
In the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
mediumCVSSv3 5.5 - CVE-2025-23136
In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev Not all devices have an A…
mediumCVSSv3 5.5 - CVE-2025-22121
In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() There…
highCVSSv3 8.4 - CVE-2025-22111
In the Linux kernel, the following vulnerability has been resolved: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
mediumCVSSv3 5.5 - CVE-2025-22107
In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_…
highCVSSv3 7.1 - CVE-2025-22095
In the Linux kernel, the following vulnerability has been resolved: PCI: brcmstb: Fix error path after a call to regulator_bulk_get() I…
mediumCVSSv3 5.5 - CVE-2025-22090
In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range…
highCVSSv3 7.3 - CVE-2025-22083
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoin…
highCVSSv3 7.8 - CVE-2025-22060
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: Prevent parser TCAM memory corruption Protect the parse…
mediumCVSSv3 4.7 - CVE-2025-22056
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When…
highCVSSv3 7.8 - CVE-2025-22055
In the Linux kernel, the following vulnerability has been resolved: net: fix geneve_opt length integer overflow struct geneve_opt uses…
highCVSSv3 7.1 - CVE-2025-22015
In the Linux kernel, the following vulnerability has been resolved: mm/migrate: fix shmem xarray update during migration A shmem folio…
highCVSSv3 7.8 - CVE-2025-22005
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
mediumCVSSv3 5.5 - CVE-2025-21999
In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in proc_get_inode() Fix race between rmmod and /proc/…
highCVSSv3 7.8 - CVE-2025-21959
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple…
highCVSSv3 7.3 - CVE-2025-21938
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local…
highCVSSv3 7.5 - CVE-2025-21926
In the Linux kernel, the following vulnerability has been resolved: net: gso: fix ownership in __udp_gso_segment In __udp_gso_segment t…
highCVSSv3 7.8 - CVE-2025-21925
In the Linux kernel, the following vulnerability has been resolved: llc: do not use skb_get() before dev_queue_xmit() syzbot is able to…
mediumCVSSv3 5.5 - CVE-2025-21919
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list…
highCVSSv3 7.8 - CVE-2025-21913
In the Linux kernel, the following vulnerability has been resolved: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() Xen doesn'…
mediumCVSSv3 5.5 - CVE-2025-21887
In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link…
highCVSSv3 7.8 - CVE-2025-21875
In the Linux kernel, the following vulnerability has been resolved: mptcp: always handle address removal under msk socket lock Syzkalle…
highCVSSv3 7.8 - CVE-2025-21867
In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() KMSAN…
highCVSSv3 7.8 - CVE-2025-21864
In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the same time as we currently drop dst Xiumei…
highCVSSv3 7.8 - CVE-2025-21863
In the Linux kernel, the following vulnerability has been resolved: io_uring: prevent opcode speculation sqe->opcode is used for differ…
highCVSSv3 7.8 - CVE-2025-21861
In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: don't add folio to be freed to LRU in migrate_dev…
mediumCVSSv3 5.5 - CVE-2025-21853
In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freeze_mutex during mmap operation We use map->f…
mediumCVSSv3 5.5 - CVE-2025-21846
In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that…
mediumCVSSv3 5.5 - CVE-2025-21814
In the Linux kernel, the following vulnerability has been resolved: ptp: Ensure info->enable callback is always set The ioctl and sysfs…
mediumCVSSv3 5.5 - CVE-2025-21802
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix oops when unload drivers paralleling When unload hcl…
mediumCVSSv3 5.5 - CVE-2025-21796
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting…
criticalCVSSv3 9.8 - CVE-2025-21795
In the Linux kernel, the following vulnerability has been resolved: NFSD: fix hang in nfsd4_shutdown_callback If nfs4_client is in cour…
highCVSSv3 7.5 - CVE-2025-21780
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()…
highCVSSv3 7.8 - CVE-2025-21765
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU protection in ip6_default_advmss() ip6_default_advmss…
highCVSSv3 8.1 - CVE-2025-21764
In the Linux kernel, the following vulnerability has been resolved: ndisc: use RCU protection in ndisc_alloc_skb() ndisc_alloc_skb() ca…
highCVSSv3 7.8 - CVE-2025-21760
In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU protection in ndisc_send_skb() ndisc_send_skb() c…
highCVSSv3 8.1 - CVE-2025-21758
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU protection to mld_newpack() mld_newpack() can…
highCVSSv3 7.8 - CVE-2025-21745
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix class @block_class's subsystem refcount leakage blk…
mediumCVSSv3 5.5 - CVE-2025-21731
In the Linux kernel, the following vulnerability has been resolved: nbd: don't allow reconnect after disconnect Following process can c…
highCVSSv3 7.8 - CVE-2025-21718
In the Linux kernel, the following vulnerability has been resolved: net: rose: fix timer races against user threads Rose timers only ac…
highCVSSv3 7.8 - CVE-2025-21707
In the Linux kernel, the following vulnerability has been resolved: mptcp: consolidate suboption status MPTCP maintains the received su…
criticalCVSSv3 9.8 - CVE-2025-21706
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only set fullmesh for subflow endp With the in-kernel pa…
mediumCVSSv3 5.5 - CVE-2025-21705
In the Linux kernel, the following vulnerability has been resolved: mptcp: handle fastopen disconnect correctly Syzbot was able to trig…
mediumCVSSv3 5.5 - CVE-2025-21702
In the Linux kernel, the following vulnerability has been resolved: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 Expected b…
highCVSSv3 7.8 - CVE-2025-21682
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: always recalculate features after XDP clearing, fix null-…
highCVSSv3 7.3 - CVE-2025-21676
In the Linux kernel, the following vulnerability has been resolved: net: fec: handle page_pool_dev_alloc_pages error The fec_enet_updat…
highCVSSv3 7.5 - CVE-2025-21655
In the Linux kernel, the following vulnerability has been resolved: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU peri…
highCVSSv3 7.8 - CVE-2025-21648
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use I…
mediumCVSSv3 5.5 - CVE-2025-21645
In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually…
mediumCVSSv3 5.5 - CVE-2024-58086
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Stop active perfmon if it is being destroyed If the active…
highCVSSv3 7.8 - CVE-2024-58061
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prohibit deactivating all links In the internal API…
mediumCVSSv3 5.5 - CVE-2024-58058
In the Linux kernel, the following vulnerability has been resolved: ubifs: skip dumping tnc tree when zroot is null Clearing slab cache…
mediumCVSSv3 5.5 - CVE-2024-58056
In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Fix ida_free call while not allocated In the rpro…
mediumCVSSv3 5.5 - CVE-2024-58020
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Add NULL check in mt_input_configured devm_kasprin…
mediumCVSSv3 5.5 - CVE-2024-58016
In the Linux kernel, the following vulnerability has been resolved: safesetid: check size of policy writes syzbot attempts to write a b…
mediumCVSSv3 5.5 - CVE-2024-58011
In the Linux kernel, the following vulnerability has been resolved: platform/x86: int3472: Check for adev == NULL Not all devices have…
mediumCVSSv3 5.5 - CVE-2024-57979
In the Linux kernel, the following vulnerability has been resolved: pps: Fix a use-after-free On a board running ntpd and gpsd, I'm see…
highCVSSv3 7.8 - CVE-2024-57977
In the Linux kernel, the following vulnerability has been resolved: memcg: fix soft lockup in the OOM process A soft lockup issue was f…
mediumCVSSv3 5.5 - CVE-2024-57973
In the Linux kernel, the following vulnerability has been resolved: rdma/cxgb4: Prevent potential integer overflow on 32bit The "gl->to…
highCVSSv3 8.1 - CVE-2024-57924
In the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding fil…
mediumCVSSv3 5.5 - CVE-2024-57917
In the Linux kernel, the following vulnerability has been resolved: topology: Keep the cpumask unchanged when printing cpumap During fu…
highCVSSv3 7.8 - CVE-2024-56719
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO DMA API usage causing oops Commit 66600fac7a98…
criticalCVSSv3 10.0 - CVE-2024-56703
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix soft lockups in fib6_select_path under high next hop churn…
highCVSSv3 7.5 - CVE-2024-56631
In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Fix slab-use-after-free read in sg_release() Fix a use-af…
highCVSSv3 7.8 - CVE-2024-54458
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: bsg: Set bsg_queue to NULL after removal Currently, this…
highCVSSv3 7.8 - CVE-2024-53170
In the Linux kernel, the following vulnerability has been resolved: block: fix uaf for flush rq while iterating tags blk_mq_clear_flush…
highCVSSv3 7.8 - CVE-2024-53124
In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk->sk_forward_alloc Syzkaller reported…
highCVSSv3 7.5 - CVE-2024-50298
In the Linux kernel, the following vulnerability has been resolved: net: enetc: allocate vf_state during PF probes In the previous impl…
mediumCVSSv3 5.5 - CVE-2024-50164
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overloading of MEM_UNINIT's meaning Lonial reported an iss…
highCVSSv3 7.8 - CVE-2024-50063
In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between progs attached to different hooks bp…
highCVSSv3 7.8 - CVE-2024-50014
In the Linux kernel, the following vulnerability has been resolved: ext4: fix access to uninitialised lock in fc replay path The follow…
mediumCVSSv3 5.5 - CVE-2024-49998
In the Linux kernel, the following vulnerability has been resolved: net: dsa: improve shutdown sequence Alexander Sverdlin presents 2 p…
mediumCVSSv3 4.7 - CVE-2024-49994
In the Linux kernel, the following vulnerability has been resolved: block: fix integer overflow in BLKSECDISCARD I independently redisc…
mediumCVSSv3 5.5 - CVE-2024-49968
In the Linux kernel, the following vulnerability has been resolved: ext4: filesystems without casefold feature cannot be mounted with si…
mediumCVSSv3 5.5 - CVE-2024-47809
In the Linux kernel, the following vulnerability has been resolved: dlm: fix possible lkb_resource null dereference This patch fixes a…
mediumCVSSv3 5.5 - CVE-2024-47736
In the Linux kernel, the following vulnerability has been resolved: erofs: handle overlapped pclusters out of crafted images properly s…
mediumCVSSv3 5.5 - CVE-2024-46786
In the Linux kernel, the following vulnerability has been resolved: fscache: delete fscache_cookie_lru_timer when fscache exits to avoid…
highCVSSv3 7.8 - CVE-2024-42079
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix NULL pointer dereference in gfs2_log_flush In gfs2_jindex…
mediumCVSSv3 5.5 - CVE-2024-36927
In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix uninit-value access in __ip_make_skb() KMSAN reported uni…
mediumCVSSv3 4.7 - CVE-2024-36903
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix potential uninit-value access in __ip6_make_skb() As it w…
mediumCVSSv3 5.5 - CVE-2024-28956
Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may all…
mediumCVSSv3 5.6 - CVE-2024-27056
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: ensure offloading TID queue exists The resume c…
highCVSSv3 7.8 - CVE-2024-26783
In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index…
mediumCVSSv3 5.5 - CVE-2023-53292
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_non…
mediumCVSSv3 5.5 - CVE-2023-52927
In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Cu…
highCVSSv3 7.8 - CVE-2023-51384
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied.
mediumCVSSv3 5.5 - CVE-2023-28531
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints.
criticalCVSSv3 9.8 - CVE-2021-41617
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplem…
highCVSSv3 7.0