linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,254)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-64074 | Hig | 7.8 | >= 6.15.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap statmount_mnt_idmap() writes one mapping with seq_printf() and then manually advances seq->count to include the NUL separator. If seq_printf() | |
| CVE-2026-64073 | Hig | 7.8 | >= 5.16.0, < 6.1.175 | 6.1.175 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via run_irq_workd(), so irq_work_sync() uses rcuwait() to wait for BUSY==0. After irq_w | |
| CVE-2026-64072 | — | >= 6.18.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: nvme: fix bio leak on mapping failure The local bio is always NULL, so we'd leak the bio if the integrity mapping failed. Just get it directly from the request. | ||
| CVE-2026-64071 | — | >= 6.13.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix use-after-free in nvme_free_host_mem() nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous() but never clears the pointer afterward. This leads to a use-after-free if nvme_free_hos | ||
| CVE-2026-64070 | — | >= 6.6.0, < 7.0.11 | 7.0.11 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: powerpc/hv-gpci: fix preempt count leak in sysfs show paths Four sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb) (which calls preempt_disable()) but only call the matching put_cpu_var() on the | ||
| CVE-2026-64069 | Cri | 9.8 | >= 6.14.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read subrequests When the preparation of a new subrequest for a read fails, if the subrequest has already been added to the stream->subrequests list, it can't simply | |
| CVE-2026-64068 | Cri | 9.8 | >= 6.10.0, < 7.0.11 | 7.0.11 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs Fix netfs_retry_read_subrequests() and netfs_retry_write_stream() to take the appropriate lock when adding extra subrequests into stream->subrequests. | |
| CVE-2026-64067 | Cri | 9.8 | >= 6.10.0, < 7.0.11 | 7.0.11 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing barriers when accessing stream->subrequests locklessly The list of subrequests attached to stream->subrequests is accessed without locks by netfs_collect_read_results() and netfs_collect_writ | |
| CVE-2026-64066 | Cri | 9.8 | >= 6.12.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure Fix netfs_read_to_pagecache() so that it pauses the generation of new subrequests if an already-issued subrequest fails. | |
| CVE-2026-64065 | — | >= 6.12.0, < 6.12.92 | 6.12.92 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call The multiple runs of generic/013 test-case is capable to reproduce a kernel BUG at mm/filemap.c:1504 with probability of 30%. while true; do sud | ||
| CVE-2026-64064 | — | >= 6.8.0, < 6.12.92 | 6.12.92 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfs_folio struct | ||
| CVE-2026-64063 | — | >= 6.12.0, < 6.12.92 | 6.12.92 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix streaming write being overwritten In order to avoid reading whilst writing, netfslib will allow "streaming writes" in which dirty data is stored directly into folios without reading them first. Such | ||
| CVE-2026-64062 | — | >= 6.10.0, < 6.12.92 | 6.12.92 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential deadlock in write-through mode Fix netfs_advance_writethrough() to always unlock the supplied folio and to mark it dirty if it isn't yet written to the end. Unfortunately, it can't be mark | ||
| CVE-2026-64061 | Cri | 9.8 | >= 6.12.0, < 6.12.92 | 6.12.92 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfs_read_gaps() Fix netfs_read_gaps() to release the sink page it uses after waiting for the request to complete. The way the sink page is used is that an ITER_BVEC-clas | |
| CVE-2026-64060 | — | >= 5.18.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix leak of request in netfs_write_begin() error handling Fix netfs_write_begin() to not leak our ref on the request in the event that we get an error from netfs_wait_for_read(). | ||
| CVE-2026-64059 | — | >= 6.12.0, < 6.12.92 | 6.12.92 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio->private handling in netfs_perform_write() Under some circumstances, netfs_perform_write() doesn't correctly manipulate folio->private between NULL, NETFS_FOLIO_COPY_TO_CACHE, pointing to a gro | ||
| CVE-2026-64058 | Hig | 7.8 | >= 6.12.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_read_folio() to wait on writeback Fix netfs_read_folio() to wait for an ongoing writeback to complete so that it can trust the dirty flag and whatever is attached to folio->private (folio->priv | |
| CVE-2026-64057 | Hig | 7.8 | >= 6.14.0, < 7.0.11 | 7.0.11 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix the locking used by afs_get_link() The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems: (1) It doesn't do any locking around afs_read_sin | |
| CVE-2026-64056 | Cri | 9.8 | >= 4.16.0, < 5.10.258 | 5.10.258 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmac_rx() is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on | |
| CVE-2026-64055 | Cri | 9.8 | >= 4.16.0, < 5.10.258 | 5.10.258 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry over frag counter The gmac_rx() NAPI poll function assembles packets in an SKB from a ring buffer. If the ring buffer gets completely emptied during a poll cycle, we exit gmac_rx( |
- affected >= 6.15.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap statmount_mnt_idmap() writes one mapping with seq_printf() and then manually advances seq->count to include the NUL separator. If seq_printf()
- affected >= 5.16.0, < 6.1.175fixed 6.1.175
In the Linux kernel, the following vulnerability has been resolved: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via run_irq_workd(), so irq_work_sync() uses rcuwait() to wait for BUSY==0. After irq_w
- CVE-2026-64072Jul 19, 2026affected >= 6.18.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: nvme: fix bio leak on mapping failure The local bio is always NULL, so we'd leak the bio if the integrity mapping failed. Just get it directly from the request.
- CVE-2026-64071Jul 19, 2026affected >= 6.13.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix use-after-free in nvme_free_host_mem() nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous() but never clears the pointer afterward. This leads to a use-after-free if nvme_free_hos
- CVE-2026-64070Jul 19, 2026affected >= 6.6.0, < 7.0.11fixed 7.0.11
In the Linux kernel, the following vulnerability has been resolved: powerpc/hv-gpci: fix preempt count leak in sysfs show paths Four sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb) (which calls preempt_disable()) but only call the matching put_cpu_var() on the
- affected >= 6.14.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read subrequests When the preparation of a new subrequest for a read fails, if the subrequest has already been added to the stream->subrequests list, it can't simply
- affected >= 6.10.0, < 7.0.11fixed 7.0.11
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs Fix netfs_retry_read_subrequests() and netfs_retry_write_stream() to take the appropriate lock when adding extra subrequests into stream->subrequests.
- affected >= 6.10.0, < 7.0.11fixed 7.0.11
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing barriers when accessing stream->subrequests locklessly The list of subrequests attached to stream->subrequests is accessed without locks by netfs_collect_read_results() and netfs_collect_writ
- affected >= 6.12.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_read_to_pagecache() to pause on subreq failure Fix netfs_read_to_pagecache() so that it pauses the generation of new subrequests if an already-issued subrequest fails.
- CVE-2026-64065Jul 19, 2026affected >= 6.12.0, < 6.12.92fixed 6.12.92
In the Linux kernel, the following vulnerability has been resolved: netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call The multiple runs of generic/013 test-case is capable to reproduce a kernel BUG at mm/filemap.c:1504 with probability of 30%. while true; do sud
- CVE-2026-64064Jul 19, 2026affected >= 6.8.0, < 6.12.92fixed 6.12.92
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfs_folio struct
- CVE-2026-64063Jul 19, 2026affected >= 6.12.0, < 6.12.92fixed 6.12.92
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix streaming write being overwritten In order to avoid reading whilst writing, netfslib will allow "streaming writes" in which dirty data is stored directly into folios without reading them first. Such
- CVE-2026-64062Jul 19, 2026affected >= 6.10.0, < 6.12.92fixed 6.12.92
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential deadlock in write-through mode Fix netfs_advance_writethrough() to always unlock the supplied folio and to mark it dirty if it isn't yet written to the end. Unfortunately, it can't be mark
- affected >= 6.12.0, < 6.12.92fixed 6.12.92
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfs_read_gaps() Fix netfs_read_gaps() to release the sink page it uses after waiting for the request to complete. The way the sink page is used is that an ITER_BVEC-clas
- CVE-2026-64060Jul 19, 2026affected >= 5.18.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix leak of request in netfs_write_begin() error handling Fix netfs_write_begin() to not leak our ref on the request in the event that we get an error from netfs_wait_for_read().
- CVE-2026-64059Jul 19, 2026affected >= 6.12.0, < 6.12.92fixed 6.12.92
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio->private handling in netfs_perform_write() Under some circumstances, netfs_perform_write() doesn't correctly manipulate folio->private between NULL, NETFS_FOLIO_COPY_TO_CACHE, pointing to a gro
- affected >= 6.12.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_read_folio() to wait on writeback Fix netfs_read_folio() to wait for an ongoing writeback to complete so that it can trust the dirty flag and whatever is attached to folio->private (folio->priv
- affected >= 6.14.0, < 7.0.11fixed 7.0.11
In the Linux kernel, the following vulnerability has been resolved: afs: Fix the locking used by afs_get_link() The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems: (1) It doesn't do any locking around afs_read_sin
- affected >= 4.16.0, < 5.10.258fixed 5.10.258
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmac_rx() is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on
- affected >= 4.16.0, < 5.10.258fixed 5.10.258
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry over frag counter The gmac_rx() NAPI poll function assembles packets in an SKB from a ring buffer. If the ring buffer gets completely emptied during a poll cycle, we exit gmac_rx(
Page 107 of 713