linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,255)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-63955 | Hig | 7.5 | >= 6.19.0, < 7.0.12 | 7.0.12 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: do not trigger BUG() on BH disabled context __get_vm_area_node() currently triggers a BUG() if in_interrupt() returns true. However, in_interrupt() also reports true when BH are disabled. The brid | |
| CVE-2026-63954 | Hig | 7.8 | >= 2.6.12, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: hpfs: fix a crash if hpfs_map_dnode_bitmap fails If hpfs_map_dnode_bitmap fails, the code would call hpfs_brelse4 on uninitialized quad buffer head, causing a crash. | |
| CVE-2026-63953 | — | >= 6.19.0, < 7.0.12 | 7.0.12 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page When migrate_vma_insert_huge_pmd_page() jumps to unlock_abort due to a PMD check failure, the pgtable allocated earlier via pte_alloc_one( | ||
| CVE-2026-63952 | Hig | 8.4 | >= 6.3.0, < 6.6.143 | 6.6.143 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEAL_WRITE When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writab | |
| CVE-2026-63951 | Hig | 7.8 | >= 6.19.0, < 7.0.12 | 7.0.12 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_writeback_endio A crash was observed in zram_writeback_endio due to a NULL pointer dereference in wake_up. The root cause is a race condition between the bio completion handler | |
| CVE-2026-63950 | Hig | 7.8 | >= 6.15.0, < 6.18.35 | 6.18.35 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Initialize nr_pages to 1 at the start of each loop iteration, like folio_referenced_one() does. Without this, nr_pages computed by a previous | |
| CVE-2026-63949 | — | >= 5.16.0, < 6.1.176 | 6.1.176 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: auxdisplay: line-display: fix OOB read on zero-length message_store() linedisp_display() unconditionally reads msg[count - 1] before checking whether count is zero, so a write of zero bytes to the message sysfs | ||
| CVE-2026-63948 | — | < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn __set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold() before scheduling the delayed work. The normal path in l2cap_chan_time | ||
| CVE-2026-63947 | Hig | 8.8 | >= 2.6.12, < 5.15.210 | 5.15.210 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidp_input_report() hidp_input_report() reads keyboard and mouse payload data from an skb without first verifying that skb->len contains enough data. hidp_recv_int | |
| CVE-2026-63946 | Hig | 8.8 | >= 6.0.0, < 6.1.176 | 6.1.176 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk, with no reference held. A concurrent iso_sock_kill() can free sk in that window | |
| CVE-2026-63945 | Hig | 7.8 | >= 6.0.0, < 6.1.176 | 6.1.176 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk). iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the soc | |
| CVE-2026-63944 | Hig | 8.8 | >= 6.4.0, < 6.6.143 | 6.6.143 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from a | |
| CVE-2026-63943 | — | < 6.6.143 | 6.6.143 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: Input: xpad - fix out-of-bounds access for Share button xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Sin | ||
| CVE-2026-63942 | Hig | 7.8 | >= 4.2.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: parport: Fix race between port and client registration The parport subsystem registers port devices before they are fully initialised, resulting in a race condition where client drivers such as lp can attach to | |
| CVE-2026-63941 | Hig | 8.8 | >= 6.11.0, < 7.0.12 | 7.0.12 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor ZCR_EL2 can be updated by a VHE guest hypervisor either using ZCR_EL2 (which traps) or ZCR_EL1 (which does not trap). KVM handles both in differe | |
| CVE-2026-63940 | Cri | 9.3 | >= 5.11.0, < 6.12.95 | 6.12.95 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about under | |
| CVE-2026-63939 | Cri | 9.3 | >= 6.11.0, < 6.12.93 | 6.12.93 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to | |
| CVE-2026-63938 | Cri | 9.3 | >= 6.11.0, < 6.12.93 | 6.12.93 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change (PSC) requests, validate the PSC buffer against the effective size of the scratch area, which could be | |
| CVE-2026-63937 | Hig | 8.8 | >= 6.11.0, < 6.12.93 | 6.12.93 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Use READ_ONCE() when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bothe | |
| CVE-2026-63936 | — | >= 6.11.0, < 6.12.93 | 6.12.93 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358_read_imp In mt6358_read_imp(), the variable val_v is passed to regmap_read() but the return value is not checked. If the read fails, val_v remains uninitia |
- affected >= 6.19.0, < 7.0.12fixed 7.0.12
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: do not trigger BUG() on BH disabled context __get_vm_area_node() currently triggers a BUG() if in_interrupt() returns true. However, in_interrupt() also reports true when BH are disabled. The brid
- affected >= 2.6.12, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: hpfs: fix a crash if hpfs_map_dnode_bitmap fails If hpfs_map_dnode_bitmap fails, the code would call hpfs_brelse4 on uninitialized quad buffer head, causing a crash.
- CVE-2026-63953Jul 19, 2026affected >= 6.19.0, < 7.0.12fixed 7.0.12
In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page When migrate_vma_insert_huge_pmd_page() jumps to unlock_abort due to a PMD check failure, the pgtable allocated earlier via pte_alloc_one(
- affected >= 6.3.0, < 6.6.143fixed 6.6.143
In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEAL_WRITE When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writab
- affected >= 6.19.0, < 7.0.12fixed 7.0.12
In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_writeback_endio A crash was observed in zram_writeback_endio due to a NULL pointer dereference in wake_up. The root cause is a race condition between the bio completion handler
- affected >= 6.15.0, < 6.18.35fixed 6.18.35
In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Initialize nr_pages to 1 at the start of each loop iteration, like folio_referenced_one() does. Without this, nr_pages computed by a previous
- CVE-2026-63949Jul 19, 2026affected >= 5.16.0, < 6.1.176fixed 6.1.176
In the Linux kernel, the following vulnerability has been resolved: auxdisplay: line-display: fix OOB read on zero-length message_store() linedisp_display() unconditionally reads msg[count - 1] before checking whether count is zero, so a write of zero bytes to the message sysfs
- CVE-2026-63948Jul 19, 2026affected < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn __set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold() before scheduling the delayed work. The normal path in l2cap_chan_time
- affected >= 2.6.12, < 5.15.210fixed 5.15.210
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidp_input_report() hidp_input_report() reads keyboard and mouse payload data from an skb without first verifying that skb->len contains enough data. hidp_recv_int
- affected >= 6.0.0, < 6.1.176fixed 6.1.176
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock before using sk, with no reference held. A concurrent iso_sock_kill() can free sk in that window
- affected >= 6.0.0, < 6.1.176fixed 6.1.176
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk). iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the soc
- affected >= 6.4.0, < 6.6.143fixed 6.6.143
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from a
- CVE-2026-63943Jul 19, 2026affected < 6.6.143fixed 6.6.143
In the Linux kernel, the following vulnerability has been resolved: Input: xpad - fix out-of-bounds access for Share button xpadone_process_packet() receives len directly from urb->actual_length and uses it to index the share-button byte at data[len - 18] or data[len - 26]. Sin
- affected >= 4.2.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: parport: Fix race between port and client registration The parport subsystem registers port devices before they are fully initialised, resulting in a race condition where client drivers such as lp can attach to
- affected >= 6.11.0, < 7.0.12fixed 7.0.12
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor ZCR_EL2 can be updated by a VHE guest hypervisor either using ZCR_EL2 (which traps) or ZCR_EL1 (which does not trap). KVM handles both in differe
- affected >= 5.11.0, < 6.12.95fixed 6.12.95
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about under
- affected >= 6.11.0, < 6.12.93fixed 6.12.93
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to
- affected >= 6.11.0, < 6.12.93fixed 6.12.93
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change (PSC) requests, validate the PSC buffer against the effective size of the scratch area, which could be
- affected >= 6.11.0, < 6.12.93fixed 6.12.93
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer Use READ_ONCE() when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bothe
- CVE-2026-63936Jul 19, 2026affected >= 6.11.0, < 6.12.93fixed 6.12.93
In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358_read_imp In mt6358_read_imp(), the variable val_v is passed to regmap_read() but the return value is not checked. If the read fails, val_v remains uninitia
Page 113 of 713