kernel

Vulnerabilities (14,254)

• CVE-2026-64114HigJul 19, 2026
  affected >= 2.6.12, < 5.10.258fixed 5.10.258

  In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 raw_send_hdrinc() validates that the caller-supplied IPv4 header fits within the message length: iphlen = iph->ihl * 4; err = -EINVAL; if (iphlen >

• CVE-2026-64113CriJul 19, 2026
  affected >= 3.19.0, < 5.10.258fixed 5.10.258

  In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to t

• CVE-2026-64112HigJul 19, 2026
  affected >= 4.12.0, < 6.12.92fixed 6.12.92

  In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lock_dwork draining on unmap Given how rbd_lock_add_request() and rbd_img_exclusive_lock() are written, lock_dwork may be (re)queued more than it's actually needed: for example in case

• CVE-2026-64111HigJul 19, 2026
  affected >= 6.8.0, < 6.12.92fixed 6.12.92

  In the Linux kernel, the following vulnerability has been resolved: lsm: hold cred_guard_mutex for lsm_set_self_attr() Just as proc_pid_attr_write() already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptr

• CVE-2026-64110MedJul 19, 2026
  affected >= 6.16.0, < 6.18.34fixed 6.18.34

  In the Linux kernel, the following vulnerability has been resolved: igc: fix potential skb leak in igc_fpe_xmit_smd_frame() When igc_fpe_init_tx_descriptor() fails, no one takes care of an allocated skb, leaking it. [1] Use dev_kfree_skb_any() on failure. Tested on an I226 ada

• CVE-2026-64109HigJul 19, 2026
  affected >= 4.2.0, < 6.6.143fixed 6.6.143

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without holding any lock that prevents SKBs on that queue from being dequeued and

• CVE-2026-64108HigJul 19, 2026
  affected < 6.1.175fixed 6.1.175

  In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), cifs file only holds the dentry ref_cnt, the cifs file close work(cfile->deferred)

• CVE-2026-64107MedJul 19, 2026
  affected >= 6.19.0, < 7.0.11fixed 7.0.11

  In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put() In the pcm512x chipset driver, pcm512x_overclock_xxx_put() is defined as a general mixer kcontrol instead of a DAPM kcontrol, so st

• CVE-2026-64106CriJul 19, 2026
  affected >= 4.12.0, < 6.1.175fixed 6.1.175

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live M

• CVE-2026-64105MedJul 19, 2026
  affected >= 6.10.0, < 6.12.92fixed 6.12.92

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free private_irqs when init fails after allocation Companion to commit 250f25367b58 ("KVM: arm64: Tear down vGIC on failed vCPU creation"), which added the missing kvm_vgic_vcpu_destroy() call

• CVE-2026-64104HigJul 19, 2026
  affected >= 6.14.0, < 6.18.34fixed 6.18.34

  In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unknown state When set_memory_{encrypted,decrypted}() fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state

• CVE-2026-64103HigJul 19, 2026
  affected >= 3.0.0, < 5.10.258fixed 5.10.258

  In the Linux kernel, the following vulnerability has been resolved: scsi: isci: Fix use-after-free in device removal path The ISCI completion tasklet is initialized in isci_host_alloc() (drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy interrupt handlers (

• CVE-2026-64102CriJul 19, 2026
  affected >= 5.3.0, < 5.10.258fixed 5.10.258

  In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller

• CVE-2026-64101MedJul 19, 2026
  affected >= 6.15.0, < 6.18.34fixed 6.18.34

  In the Linux kernel, the following vulnerability has been resolved: fwctl: pds: Validate RPC input size before parsing The fwctl core allocates the device-specific RPC input buffer with fwctl_rpc.in_len and passes that buffer to the driver callback. pdsfc_fw_rpc() casts the bu

• CVE-2026-64100MedJul 19, 2026
  affected >= 6.17.0, < 6.18.34fixed 6.18.34

  In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix shrinker deadlock With PROVE_LOCKING on an Snapdragon X1 and VM reclaim pressure, we see: ====================================================== WARNING: possible circular locking dependency

• CVE-2026-64099HigJul 19, 2026
  affected >= 6.8.0, < 6.12.93fixed 6.12.93

  In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and performance query arrays after v3d_job_cleanup(), which drops the job's

• CVE-2026-64098HigJul 19, 2026
  affected >= 5.7.0, < 6.1.175fixed 6.1.175

  In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and ignore its re

• CVE-2026-64097HigJul 19, 2026
  affected >= 4.15.0, < 6.1.175fixed 6.1.175

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO pin LUT table size before iterating [Why&How] The GPIO pin table parsers in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() derive an element count from the VBIOS table_he

• CVE-2026-64096HigJul 19, 2026
  affected >= 3.15.0, < 5.10.258fixed 5.10.258

  In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: fix use-after-free in orig_node RCU release batadv_mcast_purge_orig() removes entries from RCU-protected hlists but does not wait for an RCU grace period before returning. Concurrent RCU read

• CVE-2026-64095HigJul 19, 2026
  affected >= 3.5.0, < 5.10.259fixed 5.10.259

  In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.num_requests The bla.num_requests is increased when no request_sent was in progress. And it is decremented in various places (announcement was received, backbone i