linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-74733 | — | >= 6.10.0, < 7.1.9 | 7.1.9 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or write) must hold the | ||
| CVE-2026-74732 | — | < 6.12.104 | 6.12.104 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for tg ops in dce110_set_avmute Some older DCE timing generators do not implement is_tg_enabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NUL | ||
| CVE-2026-74731 | — | >= 7.1.0, < 7.1.9 | 7.1.9 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scx_link_sched() links the sched into the hierarchy, e.g. when the parent is already being disabled, a | ||
| CVE-2026-74730 | — | >= 3.10.0, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the r | ||
| CVE-2026-74729 | — | >= 4.19.0, < 7.1.9 | 7.1.9 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read put_fifo_with_discard() acts as both producer and consumer on the kfifo: it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from | ||
| CVE-2026-74728 | — | >= 6.9.0, < 6.18.45 | 6.18.45 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL b_addr in xfs_buf_free When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with bp->b_addr still NULL. The code falls through to the folio_put path which calls virt_to_folio(NULL) | ||
| CVE-2026-74727 | — | >= 6.16.0, < 6.18.45 | 6.18.45 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from by_id ovpn_nl_peer_set_doit() resolves the target peer via ovpn_peer_get_by_id() before taking ovpn->lock. In the window between the lookup (which only takes a r | ||
| CVE-2026-74726 | — | >= 2.6.24, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it | ||
| CVE-2026-74725 | — | >= 4.4.0, < 6.12.104 | 6.12.104 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: enic: fix tx_hang_reset use-after-free on device removal enic_remove() cancels the reset and change_mtu_work items but does not cancel tx_hang_reset. A TX timeout that fires while the device is being removed ca | ||
| CVE-2026-74724 | — | >= 2.6.12, < 6.1.183 | 6.1.183 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-b | ||
| CVE-2026-74723 | — | >= 2.6.38, < 7.1.9 | 7.1.9 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers [BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds | ||
| CVE-2026-74722 | — | >= 5.18.0, < 6.1.183 | 6.1.183 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak in btrfs_do_encoded_write() Local fuzzing of 6.12.94 has found the following memory leak: Unreferenced object 0xffff888018050a80 (size 64): comm "syz.0.17", pid 10297, jiffies 42949536 | ||
| CVE-2026-74721 | — | >= 6.16.0, < 7.1.9 | 7.1.9 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages() Two error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma) before returning an error code to the caller. This is incorrect: amdxd | ||
| CVE-2026-74720 | — | >= 4.16.0, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only sele | ||
| CVE-2026-74719 | — | >= 5.8.0, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in smc_llc_event_handler() stores an incoming qentry into the | ||
| CVE-2026-74718 | — | >= 6.3.0, < 6.6.152 | 6.6.152 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlink_nl_reload_doit() calls devlink_netns_get(), which returns a net with a held reference. When the requested namespace differs from the current one and t | ||
| CVE-2026-74717 | — | >= 5.3.0, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, return NULL on create error Tracer creation can fail by returning either NULL or ERR_PTR. The return value is stored without a check on the device, and users treat ERR_PTR and NULL the same | ||
| CVE-2026-74716 | — | >= 6.16.0, < 7.1.9 | 7.1.9 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages() In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears VM_PFNMAP. If an unprivileged userspace process mmaps a non-imported | ||
| CVE-2026-74715 | — | >= 6.0.0, < 7.1.9 | 7.1.9 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read opts->netns_id sepa | ||
| CVE-2026-74714 | — | >= 5.15.0, < 6.1.183 | 6.1.183 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto the ehash chain, drops the bucket lock, and only afterwards sets rsk_refcnt |
- CVE-2026-74733Aug 22, 2026affected >= 6.10.0, < 7.1.9fixed 7.1.9
In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or write) must hold the
- CVE-2026-74732Aug 22, 2026affected < 6.12.104fixed 6.12.104
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check for tg ops in dce110_set_avmute Some older DCE timing generators do not implement is_tg_enabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NUL
- CVE-2026-74731Aug 22, 2026affected >= 7.1.0, < 7.1.9fixed 7.1.9
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scx_link_sched() links the sched into the hierarchy, e.g. when the parent is already being disabled, a
- CVE-2026-74730Aug 22, 2026affected >= 3.10.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREE_STATEID operation gets delayed for whatever reason. Fix this by bumping the r
- CVE-2026-74729Aug 22, 2026affected >= 4.19.0, < 7.1.9fixed 7.1.9
In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read put_fifo_with_discard() acts as both producer and consumer on the kfifo: it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from
- CVE-2026-74728Aug 22, 2026affected >= 6.9.0, < 6.18.45fixed 6.18.45
In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL b_addr in xfs_buf_free When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with bp->b_addr still NULL. The code falls through to the folio_put path which calls virt_to_folio(NULL)
- CVE-2026-74727Aug 22, 2026affected >= 6.16.0, < 6.18.45fixed 6.18.45
In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from by_id ovpn_nl_peer_set_doit() resolves the target peer via ovpn_peer_get_by_id() before taking ovpn->lock. In the window between the lookup (which only takes a r
- CVE-2026-74726Aug 22, 2026affected >= 2.6.24, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing the promiscuity it
- CVE-2026-74725Aug 22, 2026affected >= 4.4.0, < 6.12.104fixed 6.12.104
In the Linux kernel, the following vulnerability has been resolved: enic: fix tx_hang_reset use-after-free on device removal enic_remove() cancels the reset and change_mtu_work items but does not cancel tx_hang_reset. A TX timeout that fires while the device is being removed ca
- CVE-2026-74724Aug 22, 2026affected >= 2.6.12, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-b
- CVE-2026-74723Aug 22, 2026affected >= 2.6.38, < 7.1.9fixed 7.1.9
In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers [BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds
- CVE-2026-74722Aug 22, 2026affected >= 5.18.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak in btrfs_do_encoded_write() Local fuzzing of 6.12.94 has found the following memory leak: Unreferenced object 0xffff888018050a80 (size 64): comm "syz.0.17", pid 10297, jiffies 42949536
- CVE-2026-74721Aug 22, 2026affected >= 6.16.0, < 7.1.9fixed 7.1.9
In the Linux kernel, the following vulnerability has been resolved: accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages() Two error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma) before returning an error code to the caller. This is incorrect: amdxd
- CVE-2026-74720Aug 22, 2026affected >= 4.16.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only sele
- CVE-2026-74719Aug 22, 2026affected >= 5.8.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in smc_llc_event_handler() stores an incoming qentry into the
- CVE-2026-74718Aug 22, 2026affected >= 6.3.0, < 6.6.152fixed 6.6.152
In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlink_nl_reload_doit() calls devlink_netns_get(), which returns a net with a held reference. When the requested namespace differs from the current one and t
- CVE-2026-74717Aug 22, 2026affected >= 5.3.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, return NULL on create error Tracer creation can fail by returning either NULL or ERR_PTR. The return value is stored without a check on the device, and users treat ERR_PTR and NULL the same
- CVE-2026-74716Aug 22, 2026affected >= 6.16.0, < 7.1.9fixed 7.1.9
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages() In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears VM_PFNMAP. If an unprivileged userspace process mmaps a non-imported
- CVE-2026-74715Aug 22, 2026affected >= 6.0.0, < 7.1.9fixed 7.1.9
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read opts->netns_id sepa
- CVE-2026-74714Aug 22, 2026affected >= 5.15.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto the ehash chain, drops the bucket lock, and only afterwards sets rsk_refcnt
Page 1 of 702