linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,255)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-63915 | Hig | 8.8 | >= 3.5.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfc_hci_recv_from_llc() and nci_hci_data_received_cb() read packet->header from skb->data at function entry without first checking that the buffer hol | |
| CVE-2026-63914 | Hig | 7.3 | >= 2.6.21, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate() in net/key/af_key.c both hardcode &init_net for the multicast that announces a successful | |
| CVE-2026-63913 | Hig | 8.2 | >= 2.6.15, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an | |
| CVE-2026-63912 | Cri | 9.8 | < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate curre | |
| CVE-2026-63911 | Hig | 7.8 | >= 6.14.0, < 6.18.35 | 6.18.35 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: reset runtime state when cloning SAs iptfs_clone_state() clones the IPTFS mode data with kmemdup(). This copies runtime objects which must not be shared with the original SA, including the embedded | |
| CVE-2026-63910 | Hig | 7.8 | >= 7.0.0, < 7.0.12 | 7.0.12 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dma_buf_fd() tracepoint Once FD_ADD() returns, the fd is live in the file descriptor table and a thread sharing that table can close() it before DMA_BUF_TRACE() runs. The close drops the las | |
| CVE-2026-63909 | Hig | 8.1 | >= 6.6.140, < 6.6.143 | 6.6.143 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check: if (offsetof(struct | |
| CVE-2026-63908 | — | >= 3.17.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem When a configuration file provides an object size that is larger than the driver's known mxt_obj_size(object), the driver intends to discard the e | ||
| CVE-2026-63907 | — | >= 6.19.0, < 7.0.12 | 7.0.12 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory uio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in probe(), but then calls kfree(udev) both on the probe() error path (label o | ||
| CVE-2026-63906 | Hig | 8.4 | < 6.1.176 | 6.1.176 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430_probe() In omap2430_probe(), of_node_put(np) is called prematurely before the last access to np, leading to a use-after-free if the node's reference count dro | |
| CVE-2026-63905 | — | >= 4.7.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudc_remove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudc_remove(). The original thread stalled on Shuah Khan's request | ||
| CVE-2026-63904 | — | >= 4.6.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actual_length for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the paylo | ||
| CVE-2026-63903 | — | >= 2.6.12, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkin_sa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer len | ||
| CVE-2026-63902 | — | >= 2.6.26, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypress_m8: validate interrupt packet headers cypress_read_int_callback() parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header | ||
| CVE-2026-63901 | — | >= 2.6.12, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix memory corruption with small endpoints Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesses or slab corruption should a malicious device re | ||
| CVE-2026-63900 | — | >= 2.6.23, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data. | ||
| CVE-2026-63899 | — | >= 3.14.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device re | ||
| CVE-2026-63898 | — | >= 2.6.12, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: mct_u232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make | ||
| CVE-2026-63897 | — | >= 2.6.12, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data (and leaking it to user | ||
| CVE-2026-63896 | — | >= 6.3.0, < 6.6.143 | 6.6.143 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling The WebUSB GET_URL handler in composite_setup() narrows landing_page_length to fit the host-supplied wLength using landing_page_length |
- affected >= 3.5.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfc_hci_recv_from_llc() and nci_hci_data_received_cb() read packet->header from skb->data at function entry without first checking that the buffer hol
- affected >= 2.6.21, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate() in net/key/af_key.c both hardcode &init_net for the multicast that announces a successful
- affected >= 2.6.15, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an
- affected < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate curre
- affected >= 6.14.0, < 6.18.35fixed 6.18.35
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: reset runtime state when cloning SAs iptfs_clone_state() clones the IPTFS mode data with kmemdup(). This copies runtime objects which must not be shared with the original SA, including the embedded
- affected >= 7.0.0, < 7.0.12fixed 7.0.12
In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dma_buf_fd() tracepoint Once FD_ADD() returns, the fd is live in the file descriptor table and a thread sharing that table can close() it before DMA_BUF_TRACE() runs. The close drops the las
- affected >= 6.6.140, < 6.6.143fixed 6.6.143
In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check: if (offsetof(struct
- CVE-2026-63908Jul 19, 2026affected >= 3.17.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem When a configuration file provides an object size that is larger than the driver's known mxt_obj_size(object), the driver intends to discard the e
- CVE-2026-63907Jul 19, 2026affected >= 6.19.0, < 7.0.12fixed 7.0.12
In the Linux kernel, the following vulnerability has been resolved: uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory uio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in probe(), but then calls kfree(udev) both on the probe() error path (label o
- affected < 6.1.176fixed 6.1.176
In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430_probe() In omap2430_probe(), of_node_put(np) is called prematurely before the last access to np, leading to a use-after-free if the node's reference count dro
- CVE-2026-63905Jul 19, 2026affected >= 4.7.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudc_remove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudc_remove(). The original thread stalled on Shuah Khan's request
- CVE-2026-63904Jul 19, 2026affected >= 4.6.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actual_length for interrupt-IN notifications USBTMC devices can use an optional interrupt endpoint for notification messages. These typically contain two-byte headers indicating the paylo
- CVE-2026-63903Jul 19, 2026affected >= 2.6.12, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: USB: serial: belkin_sa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR fields at offsets 2 and 3. The interrupt-in buffer len
- CVE-2026-63902Jul 19, 2026affected >= 2.6.26, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: USB: serial: cypress_m8: validate interrupt packet headers cypress_read_int_callback() parses the interrupt-in buffer according to the selected Cypress packet format. Format 1 has a two-byte status/count header
- CVE-2026-63901Jul 19, 2026affected >= 2.6.12, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: USB: serial: digi_acceleport: fix memory corruption with small endpoints Add the missing bulk-out buffer size sanity checks to avoid out-of-bounds memory accesses or slab corruption should a malicious device re
- CVE-2026-63900Jul 19, 2026affected >= 2.6.23, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan: fix missing indat transfer sanity check Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data.
- CVE-2026-63899Jul 19, 2026affected >= 3.14.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device re
- CVE-2026-63898Jul 19, 2026affected >= 2.6.12, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mct_u232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make
- CVE-2026-63897Jul 19, 2026affected >= 2.6.12, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mct_u232: fix missing interrupt-in transfer sanity check Add the missing sanity check on the size of interrupt-in transfers to avoid parsing stale or uninitialised slab data (and leaking it to user
- CVE-2026-63896Jul 19, 2026affected >= 6.3.0, < 6.6.143fixed 6.6.143
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling The WebUSB GET_URL handler in composite_setup() narrows landing_page_length to fit the host-supplied wLength using landing_page_length
Page 115 of 713