linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,255)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-63935 | — | >= 7.0.0, < 7.0.12 | 7.0.12 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: nxp-sar-adc: fix division by zero in write_raw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero or a negative value to the sampling_frequency s | ||
| CVE-2026-63934 | — | >= 3.9.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: gyro: itg3200: fix i2c read into the wrong stack location itg3200_read_all_channels() takes `__be16 *buf' as a parameter and fills the i2c_msg destination as `(char *)&buf'. Since `buf' is the parameter (a | ||
| CVE-2026-63933 | — | >= 2.6.35, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16260: fix division by zero in write_raw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero to the sampling_frequency sysfs attribute trigge | ||
| CVE-2026-63932 | — | >= 6.16.0, < 6.18.35 | 6.18.35 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19b_receive_buf() appends each serdev chunk into the fixed MHZ19B_CMD_SIZE receive buffer and advances buf_idx by len without checking that the chunk fi | ||
| CVE-2026-63931 | — | >= 5.9.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: fix division by zero in write_raw Add a zero check for val2 before using it as a divisor when setting the sampling frequency. A user writing a zero fractional part to the sampling_frequenc | ||
| CVE-2026-63930 | Hig | 7.8 | >= 4.16.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_b | |
| CVE-2026-63929 | — | >= 6.11.0, < 6.12.93 | 6.12.93 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() iio_buffer_enqueue_dmabuf() allocates a struct iio_dma_fence (104 bytes, kmalloc-128) via kmalloc_obj()+dma_fence_init(), which sets the initial kr | ||
| CVE-2026-63928 | — | >= 2.6.12, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicio | ||
| CVE-2026-63927 | Hig | 7.8 | >= 3.10.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to dereference "urb" after calling usb_hcd_giveback_urb() so save the urb->status ahead of time. | |
| CVE-2026-63926 | Hig | 8.4 | >= 4.20.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. T | |
| CVE-2026-63925 | Hig | 8.1 | >= 5.7.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_halves.lower is also in the upper half, pn | |
| CVE-2026-63924 | Cri | 9.8 | >= 2.6.12, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up. | |
| CVE-2026-63923 | Hig | 8.8 | >= 6.13.0, < 6.18.42 | 6.18.42 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY r | |
| CVE-2026-63922 | Cri | 9.8 | >= 2.6.19, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move th | |
| CVE-2026-63921 | Hig | 8.8 | >= 3.15.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) for the collision l | |
| CVE-2026-63920 | Hig | 7.1 | >= 2.6.12, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting the on-wire hdrlen | |
| CVE-2026-63919 | Hig | 8.8 | >= 5.6.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must stay valid until t | |
| CVE-2026-63918 | Hig | 7.8 | >= 6.12.0, < 6.12.93 | 6.12.93 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname A reader in l2tp_session_get_by_ifname() can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plai | |
| CVE-2026-63917 | Hig | 8.8 | >= 3.15.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6 | |
| CVE-2026-63916 | Hig | 8.8 | >= 3.18.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacom_hid_set_device_mode() wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE usage is always located in the first field (field[0]) of the feature report. Howe |
- CVE-2026-63935Jul 19, 2026affected >= 7.0.0, < 7.0.12fixed 7.0.12
In the Linux kernel, the following vulnerability has been resolved: iio: adc: nxp-sar-adc: fix division by zero in write_raw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero or a negative value to the sampling_frequency s
- CVE-2026-63934Jul 19, 2026affected >= 3.9.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: itg3200: fix i2c read into the wrong stack location itg3200_read_all_channels() takes `__be16 *buf' as a parameter and fills the i2c_msg destination as `(char *)&buf'. Since `buf' is the parameter (a
- CVE-2026-63933Jul 19, 2026affected >= 2.6.35, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16260: fix division by zero in write_raw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero to the sampling_frequency sysfs attribute trigge
- CVE-2026-63932Jul 19, 2026affected >= 6.16.0, < 6.18.35fixed 6.18.35
In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19b_receive_buf() appends each serdev chunk into the fixed MHZ19B_CMD_SIZE receive buffer and advances buf_idx by len without checking that the chunk fi
- CVE-2026-63931Jul 19, 2026affected >= 5.9.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: fix division by zero in write_raw Add a zero check for val2 before using it as a divisor when setting the sampling frequency. A user writing a zero fractional part to the sampling_frequenc
- affected >= 4.16.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_b
- CVE-2026-63929Jul 19, 2026affected >= 6.11.0, < 6.12.93fixed 6.12.93
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() iio_buffer_enqueue_dmabuf() allocates a struct iio_dma_fence (104 bytes, kmalloc-128) via kmalloc_obj()+dma_fence_init(), which sets the initial kr
- CVE-2026-63928Jul 19, 2026affected >= 2.6.12, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicio
- affected >= 3.10.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to dereference "urb" after calling usb_hcd_giveback_urb() so save the urb->status ahead of time.
- affected >= 4.20.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. T
- affected >= 5.7.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_halves.lower is also in the upper half, pn
- affected >= 2.6.12, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up.
- affected >= 6.13.0, < 6.18.42fixed 6.18.42
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY r
- affected >= 2.6.19, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move th
- affected >= 3.15.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) for the collision l
- affected >= 2.6.12, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting the on-wire hdrlen
- affected >= 5.6.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must stay valid until t
- affected >= 6.12.0, < 6.12.93fixed 6.12.93
In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname A reader in l2tp_session_get_by_ifname() can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plai
- affected >= 3.15.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6
- affected >= 3.18.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacom_hid_set_device_mode() wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE usage is always located in the first field (field[0]) of the feature report. Howe
Page 114 of 713