VYPR

apk package

chainguard/linux-gcp-6.18-bootc

pkg:apk/chainguard/linux-gcp-6.18-bootc

Vulnerabilities (101)

  • CVE-2026-64256MedJul 25, 2026
    affected < 6.18.44-r0fixed 6.18.44-r0

    In the Linux kernel, the following vulnerability has been resolved: xfs: don't wrap around quota ids in dqiterate LOLLM noticed that q_id is an unsigned 32-bit variable. If it happens to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot for ID_MAX, then thi

  • CVE-2026-64207MedJul 20, 2026
    affected < 6.18.44-r0fixed 6.18.44-r0

    In the Linux kernel, the following vulnerability has been resolved: net/sched: dualpi2: fix GSO backlog accounting When DualPI2 splits a GSO skb into N segments, it propagates N additional packets to its parent before returning NET_XMIT_SUCCESS. The parent then accounts for the

  • CVE-2026-64206HigJul 20, 2026
    affected < 6.18.44-r0fixed 6.18.44-r0

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock l2cap_conn_del() takes conn->lock and then calls cancel_work_sync() for pending_rx_work. process_pending_rx() takes the same mutex, so teardown

  • CVE-2026-64205MedJul 20, 2026
    affected < 6.18.44-r0fixed 6.18.44-r0

    In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A severe livelock and subsequent Hung Task panic were observed in the i2c-i801 driver during concurrent Fuzzing. The crash is caused by an uncondit

  • CVE-2026-64192MedJul 20, 2026
    affected < 6.18.44-r0fixed 6.18.44-r0

    In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized When CONFIG_BPF_LSM=y is set, BPF inode storage maps (BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However, if the BPF LS

  • CVE-2026-64189HigJul 20, 2026
    affected < 6.18.44-r0fixed 6.18.44-r0

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the a

  • CVE-2026-64187MedJul 20, 2026
    affected < 6.18.44-r0fixed 6.18.44-r0

    In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transaction is a bare transaction header (len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans() adds an item but no

  • CVE-2026-64117HigJul 19, 2026
    affected < 0fixed 0

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() r

  • CVE-2026-53402HigJul 19, 2026
    affected < 6.18.44-r0fixed 6.18.44-r0

    In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() When fbcon_do_set_font() fails (e.g., due to a memory allocation failure inside vc_resize() under heavy memory pressure), it jumps to the `

  • CVE-2026-53401HigJul 19, 2026
    affected < 0fixed 0

    In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfb_mmap omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that can lead to use-after-free: The fb_mmap() entry point holds mm_lock but not lock (fb_info->

  • CVE-2026-53399CriJul 19, 2026
    affected < 6.18.44-r0fixed 6.18.44-r0

    In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layo

  • CVE-2026-53366HigJul 16, 2026
    affected < 6.18.39-r0fixed 6.18.39-r0

    In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen

  • CVE-2026-53362HigKEVJul 4, 2026
    affected < 6.18.39-r0fixed 6.18.39-r0

    In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen

  • CVE-2026-53361HigJul 4, 2026
    affected < 6.18.39-r0fixed 6.18.39-r0

    In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2

  • CVE-2026-53359HigJul 4, 2026
    affected < 6.18.39-r0fixed 6.18.39-r0

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and comp

  • CVE-2026-53313MedJun 26, 2026
    affected < 6.18.38-r2fixed 6.18.38-r2

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths In dc_dmub_srv_log_diagnostic_data() and dc_dmub_srv_enable_dpia_trace(). Both functions check: if (!dc_dmub_srv || !dc_dmub_srv->dmub) an

  • CVE-2026-53308MedJun 26, 2026
    affected < 6.18.38-r2fixed 6.18.38-r2

    In the Linux kernel, the following vulnerability has been resolved: power: supply: max77705: Free allocated workqueue and fix removal order Use devm interface for allocating workqueue to fix two bugs at the same time: 1. Driver leaks the memory on remove(), because the workque

  • CVE-2026-53292MedJun 26, 2026
    affected < 6.18.38-r2fixed 6.18.38-r2

    In the Linux kernel, the following vulnerability has been resolved: net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind syzbot reported a kernel BUG triggered from pn_socket_sendmsg() via pn_socket_autobind(): kernel BUG at net/phonet/socket.c:213! RIP: 001

  • CVE-2026-53285MedJun 26, 2026
    affected < 6.18.38-r2fixed 6.18.38-r2

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED [Why] dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with DC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_ST

  • CVE-2026-53260CriJun 25, 2026
    affected < 6.18.44-r0fixed 6.18.44-r0

    In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_dr

Page 2 of 6