chainguard/linux-qemu-6.18-bootc-boot-installed

Vulnerabilities (303)

• CVE-2026-53168MedJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: fuse: reject fuse_notify() pagecache ops on directories The operations FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE allow the FUSE daemon to actively write/read pagecache contents. For directories with FOPEN_CAC

• CVE-2026-53167MedJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios FUSE_NOTIFY_RETRIEVE must be limited to uptodate folios; !uptodate folios can contain uninitialized data. Since FUSE_NOTIFY_RETRIEVE is intended to only retur

• CVE-2026-53166Jun 25, 2026
  affected < 6.18.36-r3fixed 6.18.36-r3

  Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

• CVE-2026-53164MedJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Do not try to iommu_map a 0 length region in swiotlb iommu_dma_iova_link_swiotlb() processes a mapping that is unaligned in three parts, the head, middle and trailer. If the middle is empty because t

• CVE-2026-53163MedJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued syzbot triggered the following splat in remove_waiter() via FUTEX_CMP_REQUEUE_PI: KASAN: null-ptr-deref in range [0x0000000000000a88-0x000000

• CVE-2026-53162HigJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: memcg: use round-robin victim selection in refill_stock Harry Yoo reported that get_random_u32_below() is not safe to call in the nmi context and memcg charge draining can happen in nmi context. More specifica

• CVE-2026-53161HigJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is a race between fastrpc_device_release() and the workqueue that processes DSP responses. When the user closes the file descriptor,

• CVE-2026-53160HigJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free race in fastrpc_map_create fastrpc_map_lookup returns a raw pointer after releasing fl->lock. The caller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero) on

• CVE-2026-53159HigJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix DMA address corruption due to find_vma misuse fastrpc_get_args() uses find_vma() to look up the VMA for a user-provided pointer and compute a DMA address offset. When the address falls in a g

• CVE-2026-53158MedJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix NULL pointer dereference in rpmsg callback A NULL pointer dereference was observed on Hawi at boot when the DSP sends a glink message before fastrpc_rpmsg_probe() has completed initialization

• CVE-2026-53157HigJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from the per-net device list with list_del_rcu(), but frees it immediately. RCU readers walking the same li

• CVE-2026-53156HigJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: nvmem: core: fix use-after-free bugs in error paths Fix several instances of error paths in which we call __nvmem_device_put() - which may end up freeing the underlying memory and other resources - and then kee

• CVE-2026-53154MedJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: restore reservation on error in hugetlb folio copy paths Two sites in mm/hugetlb.c allocate a hugetlb folio via alloc_hugetlb_folio() (consuming a VMA reservation) and then call copy_user_large_foli

• CVE-2026-53153HigJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on reparent memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists into the parent. Th

• CVE-2026-53152MedJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: mmc: dw_mmc-rockchip: Add missing private data for very old controllers The really old controllers (rk2928, rk3066, rk3188) do not support UHS speeds at all, and thus never handled phase data. For that reason

• CVE-2026-53151CriJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the

• CVE-2026-53150MedJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject zero-length property entries in validator tb_property_entry_valid() accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but caus

• CVE-2026-53149HigJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does not check that content_offset + content_len fits within block_len for the root directory case. When rootdir->length equals

• CVE-2026-53148HigJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated

• CVE-2026-53147HigJun 25, 2026
  affected < 6.18.38-r0fixed 6.18.38-r0

  In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for