linux package
kernel
pkg:linux/kernel
Vulnerabilities (1,755)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-23175 | Hig | 7.0 | >= 6.17.0, < 6.18.10 | 6.18.10 | Feb 14, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: cpsw: Execute ndo_set_rx_mode callback in a work queue Commit 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for IPV6_ADD_MEMBERSHIP and M | |
| CVE-2026-23174 | — | >= 6.17.0, < 6.18.10 | 6.18.10 | Feb 14, 2026 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: handle changing device dma map requirements The initial state of dma_needs_unmap may be false, but change to true while mapping the data iterator. Enabling swiotlb is one such case that can change the | ||
| CVE-2025-71224 | — | >= 3.19.0, < 5.10.250 | 5.10.250 | Feb 14, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: ocb: skip rx_no_sta when interface is not joined ieee80211_ocb_rx_no_sta() assumes a valid channel context, which is only present after JOIN_OCB. RX may run before JOIN_OCB is executed, in whic | ||
| CVE-2026-23059 | — | >= 6.6.0, < 6.6.122 | 6.6.122 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Sanitize payload size to prevent member overflow In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the frame_size reported by firmware is used to calculate the copy length into item->io | ||
| CVE-2026-23058 | — | >= 2.6.32, < 5.10.249 | 5.10.249 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In ems_usb_open(), the UR | ||
| CVE-2026-23057 | — | >= 6.7.0, < 6.12.68 | 6.12.68 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Coalesce only linear skb vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb (with a spare tail room) is followed by a small skb (length limited by GOOD_COPY_LEN = 128), an | ||
| CVE-2026-23056 | — | >= 5.7.0, < 5.10.249 | 5.10.249 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: uacce: implement mremap in uacce_vm_ops to return -EPERM The current uacce_vm_ops does not support the mremap operation of vm_operations_struct. Implement .mremap to return -EPERM to remind users. The reason w | ||
| CVE-2026-23055 | — | >= 6.12.0, < 6.12.67 | 6.12.67 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: i2c: riic: Move suspend handling to NOIRQ phase Commit 53326135d0e0 ("i2c: riic: Add suspend/resume support") added suspend support for the Renesas I2C driver and following this change on RZ/G3E the following W | ||
| CVE-2026-23054 | — | >= 4.11.0, < 6.1.162 | 6.1.162 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: hv_netvsc: reject RSS hash key programming without RX indirection table RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndis_filter_device_add() do | ||
| CVE-2026-23053 | — | >= 6.3.0, < 6.6.130 | 6.6.130 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a deadlock involving nfs_release_folio() Wang Zhaolong reports a deadlock involving NFSv4.1 state recovery waiting on kthreadd, which is attempting to reclaim memory by calling nfs_release_folio(). The | ||
| CVE-2026-23052 | — | >= 6.15.0, < 6.18.7 | 6.18.7 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Do not over-allocate ftrace memory The pg_remaining calculation in ftrace_process_locs() assumes that ENTRIES_PER_PAGE multiplied by 2^order equals the actual capacity of the allocated page group. Howev | ||
| CVE-2026-23051 | — | >= 6.14.0, < 6.18.7 | 6.18.7 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix drm panic null pointer when driver not support atomic When driver not support atomic, fb using plane->fb rather than plane->state->fb. (cherry picked from commit 2f2a72de673513247cd6fae14e53f6c | ||
| CVE-2026-23050 | — | >= 4.10.0, < 6.6.130 | 6.6.130 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix a deadlock when returning a delegation during open() Ben Coddington reports seeing a hang in the following stack trace: 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415 1 [ffffd0b50e177548] sch | ||
| CVE-2026-23049 | — | >= 4.19.0, < 5.10.249 | 5.10.249 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel The connector type for the DataImage SCF0700C48GGU18 panel is missing and devm_drm_panel_bridge_add() requires connector type to be set. | ||
| CVE-2025-71199 | — | >= 4.19.0, < 5.10.249 | 5.10.249 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver at91_adc_interrupt can call at91_adc_touch_data_handler function to start the work by schedule_work(&st->touch_st.workq). If we re | ||
| CVE-2025-71198 | — | >= 5.5.0, < 6.6.122 | 6.6.122 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection The st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL event_spec field, indicating support for IIO events. However, | ||
| CVE-2025-71197 | — | >= 5.8.0, < 5.10.249 | 5.10.249 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fix off-by-one buffer overflow in alarms_store The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not acc | ||
| CVE-2025-71196 | — | >= 4.17.0, < 5.10.249 | 5.10.249 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: phy: stm32-usphyc: Fix off by one in probe() The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one elemen | ||
| CVE-2025-71195 | — | >= 6.3.0, < 6.6.122 | 6.6.122 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx: xdma: Fix regmap max_register The max_register field is assigned the size of the register memory region instead of the offset of the last register. The result is that reading from the regmap | ||
| CVE-2025-71194 | — | >= 3.11.0, < 5.10.249 | 5.10.249 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type When wait_current_trans() is called during start_transaction(), it currently waits for a blocked transaction without considering wheth |
- affected >= 6.17.0, < 6.18.10fixed 6.18.10
In the Linux kernel, the following vulnerability has been resolved: net: cpsw: Execute ndo_set_rx_mode callback in a work queue Commit 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for IPV6_ADD_MEMBERSHIP and M
- CVE-2026-23174Feb 14, 2026affected >= 6.17.0, < 6.18.10fixed 6.18.10
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: handle changing device dma map requirements The initial state of dma_needs_unmap may be false, but change to true while mapping the data iterator. Enabling swiotlb is one such case that can change the
- CVE-2025-71224Feb 14, 2026affected >= 3.19.0, < 5.10.250fixed 5.10.250
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: ocb: skip rx_no_sta when interface is not joined ieee80211_ocb_rx_no_sta() assumes a valid channel context, which is only present after JOIN_OCB. RX may run before JOIN_OCB is executed, in whic
- CVE-2026-23059Feb 4, 2026affected >= 6.6.0, < 6.6.122fixed 6.6.122
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Sanitize payload size to prevent member overflow In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the frame_size reported by firmware is used to calculate the copy length into item->io
- CVE-2026-23058Feb 4, 2026affected >= 2.6.32, < 5.10.249fixed 5.10.249
In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In ems_usb_open(), the UR
- CVE-2026-23057Feb 4, 2026affected >= 6.7.0, < 6.12.68fixed 6.12.68
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Coalesce only linear skb vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb (with a spare tail room) is followed by a small skb (length limited by GOOD_COPY_LEN = 128), an
- CVE-2026-23056Feb 4, 2026affected >= 5.7.0, < 5.10.249fixed 5.10.249
In the Linux kernel, the following vulnerability has been resolved: uacce: implement mremap in uacce_vm_ops to return -EPERM The current uacce_vm_ops does not support the mremap operation of vm_operations_struct. Implement .mremap to return -EPERM to remind users. The reason w
- CVE-2026-23055Feb 4, 2026affected >= 6.12.0, < 6.12.67fixed 6.12.67
In the Linux kernel, the following vulnerability has been resolved: i2c: riic: Move suspend handling to NOIRQ phase Commit 53326135d0e0 ("i2c: riic: Add suspend/resume support") added suspend support for the Renesas I2C driver and following this change on RZ/G3E the following W
- CVE-2026-23054Feb 4, 2026affected >= 4.11.0, < 6.1.162fixed 6.1.162
In the Linux kernel, the following vulnerability has been resolved: net: hv_netvsc: reject RSS hash key programming without RX indirection table RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndis_filter_device_add() do
- CVE-2026-23053Feb 4, 2026affected >= 6.3.0, < 6.6.130fixed 6.6.130
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a deadlock involving nfs_release_folio() Wang Zhaolong reports a deadlock involving NFSv4.1 state recovery waiting on kthreadd, which is attempting to reclaim memory by calling nfs_release_folio(). The
- CVE-2026-23052Feb 4, 2026affected >= 6.15.0, < 6.18.7fixed 6.18.7
In the Linux kernel, the following vulnerability has been resolved: ftrace: Do not over-allocate ftrace memory The pg_remaining calculation in ftrace_process_locs() assumes that ENTRIES_PER_PAGE multiplied by 2^order equals the actual capacity of the allocated page group. Howev
- CVE-2026-23051Feb 4, 2026affected >= 6.14.0, < 6.18.7fixed 6.18.7
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix drm panic null pointer when driver not support atomic When driver not support atomic, fb using plane->fb rather than plane->state->fb. (cherry picked from commit 2f2a72de673513247cd6fae14e53f6c
- CVE-2026-23050Feb 4, 2026affected >= 4.10.0, < 6.6.130fixed 6.6.130
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix a deadlock when returning a delegation during open() Ben Coddington reports seeing a hang in the following stack trace: 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415 1 [ffffd0b50e177548] sch
- CVE-2026-23049Feb 4, 2026affected >= 4.19.0, < 5.10.249fixed 5.10.249
In the Linux kernel, the following vulnerability has been resolved: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel The connector type for the DataImage SCF0700C48GGU18 panel is missing and devm_drm_panel_bridge_add() requires connector type to be set.
- CVE-2025-71199Feb 4, 2026affected >= 4.19.0, < 5.10.249fixed 5.10.249
In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver at91_adc_interrupt can call at91_adc_touch_data_handler function to start the work by schedule_work(&st->touch_st.workq). If we re
- CVE-2025-71198Feb 4, 2026affected >= 5.5.0, < 6.6.122fixed 6.6.122
In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection The st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL event_spec field, indicating support for IIO events. However,
- CVE-2025-71197Feb 4, 2026affected >= 5.8.0, < 5.10.249fixed 5.10.249
In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fix off-by-one buffer overflow in alarms_store The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not acc
- CVE-2025-71196Feb 4, 2026affected >= 4.17.0, < 5.10.249fixed 5.10.249
In the Linux kernel, the following vulnerability has been resolved: phy: stm32-usphyc: Fix off by one in probe() The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one elemen
- CVE-2025-71195Feb 4, 2026affected >= 6.3.0, < 6.6.122fixed 6.6.122
In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx: xdma: Fix regmap max_register The max_register field is assigned the size of the register memory region instead of the offset of the last register. The result is that reading from the regmap
- CVE-2025-71194Feb 4, 2026affected >= 3.11.0, < 5.10.249fixed 5.10.249
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type When wait_current_trans() is called during start_transaction(), it currently waits for a blocked transaction without considering wheth
Page 10 of 88