linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,254)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-64034 | Cri | 9.3 | >= 5.13.0, < 5.15.209 | 5.15.209 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-rea | |
| CVE-2026-64033 | Cri | 9.8 | < 5.15.209 | 5.15.209 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initi | |
| CVE-2026-64032 | Hig | 7.8 | < 5.15.209 | 5.15.209 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on ea | |
| CVE-2026-64031 | Hig | 7.8 | >= 6.15.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race for unaligned extents After unaligned compressed extents were introduced, the following race could occur: [Thread 1] [Thread 2] (z_erofs_fill_bio | |
| CVE-2026-64030 | Hig | 8.8 | >= 6.15.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15. sdata->lin | |
| CVE-2026-64029 | Hig | 7.8 | >= 6.5.0, < 6.6.142 | 6.6.142 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_ump_client_open() an | |
| CVE-2026-64028 | — | >= 6.6.141, < 6.6.142 | 6.6.142 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from hist_field_name() on truncation hist_field_name() returns "" everywhere except the fully-qualified VAR_REF/EXPR case, where snprintf() truncation returns NULL early and bypasses | ||
| CVE-2026-64027 | Hig | 7.8 | >= 6.13.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking (again) Recent commit changed the semantics from NOT_VALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. There's still a rac | |
| CVE-2026-64026 | Hig | 7.8 | >= 5.3.0, < 6.6.143 | 6.6.143 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by | |
| CVE-2026-64025 | Cri | 9.8 | >= 5.10.0, < 6.6.142 | 6.6.142 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflic | |
| CVE-2026-64024 | Cri | 9.4 | >= 6.10.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_ | |
| CVE-2026-64023 | Hig | 7.8 | >= 6.16.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: fix a potential use-after-free On error we free aggr->lookups->dev_id before removing the entry from the lookup table. If a concurrent thread calls gpiod_find() before we remove the entry, it | |
| CVE-2026-64022 | — | >= 6.16.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: remove the software node when deactivating the aggregator The dynamic software node we create for the aggregator platform device when using configfs is leaked when the device is deactivated. D | ||
| CVE-2026-64021 | — | >= 6.13.0, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix exec_queue leak on width check in stream open In xe_oa_stream_open_ioctl(), when param.exec_q->width > 1 the function returns -EOPNOTSUPP directly, skipping the existing err_exec_q cleanup path. | ||
| CVE-2026-64020 | Hig | 7.5 | >= 6.17.0, < 7.0.11 | 7.0.11 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma_vecs leak on p2p memory We don't unmap P2P memory, so we don't need to track it. The dma_vec allocation was getting leaked on the completion. | |
| CVE-2026-64019 | — | >= 6.17.0, < 7.0.11 | 7.0.11 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can | ||
| CVE-2026-64018 | Cri | 9.3 | >= 5.13.0, < 5.15.209 | 5.15.209 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memor | |
| CVE-2026-64017 | Hig | 7.8 | >= 6.7.0, < 6.12.104 | 6.12.104 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freei | |
| CVE-2026-64016 | Cri | 9.8 | >= 6.18.33, < 6.18.34 | 6.18.34 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes the same ksmbd_file into the session volatile-id table. If smb2_open() then takes | |
| CVE-2026-64015 | Hig | 7.8 | >= 3.13.0, < 6.1.175 | 6.1.175 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while the assoc_array_gc() |
- affected >= 5.13.0, < 5.15.209fixed 5.15.209
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-rea
- affected < 5.15.209fixed 5.15.209
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initi
- affected < 5.15.209fixed 5.15.209
In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on ea
- affected >= 6.15.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race for unaligned extents After unaligned compressed extents were introduced, the following race could occur: [Thread 1] [Thread 2] (z_erofs_fill_bio
- affected >= 6.15.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15. sdata->lin
- affected >= 6.5.0, < 6.6.142fixed 6.6.142
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_ump_client_open() an
- CVE-2026-64028Jul 19, 2026affected >= 6.6.141, < 6.6.142fixed 6.6.142
In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from hist_field_name() on truncation hist_field_name() returns "" everywhere except the fully-qualified VAR_REF/EXPR case, where snprintf() truncation returns NULL early and bypasses
- affected >= 6.13.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking (again) Recent commit changed the semantics from NOT_VALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. There's still a rac
- affected >= 5.3.0, < 6.6.143fixed 6.6.143
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by
- affected >= 5.10.0, < 6.6.142fixed 6.6.142
In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflic
- affected >= 6.10.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_
- affected >= 6.16.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: fix a potential use-after-free On error we free aggr->lookups->dev_id before removing the entry from the lookup table. If a concurrent thread calls gpiod_find() before we remove the entry, it
- CVE-2026-64022Jul 19, 2026affected >= 6.16.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: remove the software node when deactivating the aggregator The dynamic software node we create for the aggregator platform device when using configfs is leaked when the device is deactivated. D
- CVE-2026-64021Jul 19, 2026affected >= 6.13.0, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix exec_queue leak on width check in stream open In xe_oa_stream_open_ioctl(), when param.exec_q->width > 1 the function returns -EOPNOTSUPP directly, skipping the existing err_exec_q cleanup path.
- affected >= 6.17.0, < 7.0.11fixed 7.0.11
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma_vecs leak on p2p memory We don't unmap P2P memory, so we don't need to track it. The dma_vec allocation was getting leaked on the completion.
- CVE-2026-64019Jul 19, 2026affected >= 6.17.0, < 7.0.11fixed 7.0.11
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can
- affected >= 5.13.0, < 5.15.209fixed 5.15.209
In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memor
- affected >= 6.7.0, < 6.12.104fixed 6.12.104
In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freei
- affected >= 6.18.33, < 6.18.34fixed 6.18.34
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes the same ksmbd_file into the session volatile-id table. If smb2_open() then takes
- affected >= 3.13.0, < 6.1.175fixed 6.1.175
In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while the assoc_array_gc()
Page 109 of 713