linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,255)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-63895 | — | >= 2.6.35, < 5.15.210 | 5.15.210 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: copy only received bytes on short ep0 read ffs_ep0_read() allocates its control-OUT data buffer with kmalloc() (not kzalloc) at the Length value from the Setup packet, then copies that full l | ||
| CVE-2026-63894 | Hig | 7.8 | >= 6.9.0, < 6.12.93 | 6.12.93 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: serialize DMABUF cancel against request completion ffs_epfile_dmabuf_io_complete() calls usb_ep_free_request() on the completed request but leaves priv->req, the back-pointer that ffs_dmabuf_ | |
| CVE-2026-63893 | Hig | 8.1 | >= 4.15.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() entry->value is u32 and entry->length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, le | |
| CVE-2026-63892 | — | >= 4.15.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow On the non-root path, __tb_property_parse_dir() takes dir_len from entry->length (u16 widened to size_t). Two distinct OOB conditions follo | ||
| CVE-2026-63891 | — | >= 4.15.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A cra | ||
| CVE-2026-63890 | — | >= 2.6.30, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker drivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the descriptor cursor by an attacker-supplied fip_dlen without ever requiri | ||
| CVE-2026-63889 | Hig | 8.1 | >= 5.11.0, < 5.15.210 | 5.15.210 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the ge | |
| CVE-2026-63888 | Cri | 9.8 | >= 3.1.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target | |
| CVE-2026-63887 | Cri | 9.8 | >= 3.1.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer alloc | |
| CVE-2026-63886 | Cri | 9.8 | >= 6.0.0, < 6.1.176 | 6.1.176 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passes chap_r directly t | |
| CVE-2026-63885 | Hig | 8.8 | >= 6.18.32, < 6.18.35 | 6.18.35 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). | |
| CVE-2026-63884 | Hig | 7.8 | >= 5.17.0, < 6.1.176 | 6.1.176 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right pointer. | |
| CVE-2026-63883 | Hig | 7.3 | >= 6.3.0, < 6.6.143 | 6.6.143 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ When uart_flush_buffer() runs before the DMA completion IRQ is delivered, the following race can occur (all steps serialized by uart | |
| CVE-2026-63882 | — | >= 5.14.0, < 6.1.176 | 6.1.176 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL pointer bug in svm_range_set_attr The process_info could be NULL if user doesn't call kfd_ioctl_acquire_vm before calling kfd_ioctl_svm. (cherry picked from commit 83a26c812e0529eb040d31a7 | ||
| CVE-2026-63881 | Hig | 7.8 | >= 6.5.0, < 6.6.143 | 6.6.143 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger get_queue_ids() computes array_size = num_queues * sizeof(uint32_t), which could overflow on 32-bit size_t build. using array_size() instead, | |
| CVE-2026-63880 | — | >= 6.18.0, < 6.18.35 | 6.18.35 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO The AMDGPU_GEM_OP_GET_MAPPING_INFO branch of amdgpu_gem_op_ioctl() holds three cleanup-tracked resources before calling kvcalloc(): the drm_ | ||
| CVE-2026-63879 | Hig | 7.8 | >= 6.2.0, < 7.0.12 | 7.0.12 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_hmm_range_get_pages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized retur | |
| CVE-2026-63878 | — | >= 6.18.0, < 6.18.35 | 6.18.35 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO kvcalloc(args->num_entries, sizeof(*vm_entries), GFP_KERNEL) at amdgpu_gem.c:1050 uses the user-supplied num_entries directly without any upper bounds ch | ||
| CVE-2026-63877 | — | >= 6.5.0, < 6.6.143 | 6.6.143 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: serial: dz: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to colour frame buffer device 160x64 tgafb: SFB+ detected, rev=0x02 | ||
| CVE-2026-63876 | — | >= 6.5.0, < 6.6.143 | 6.6.143 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: serial: zs: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to mono frame buffer device 160x64 fb0: PMAG-AA frame buffer device a |
- CVE-2026-63895Jul 19, 2026affected >= 2.6.35, < 5.15.210fixed 5.15.210
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: copy only received bytes on short ep0 read ffs_ep0_read() allocates its control-OUT data buffer with kmalloc() (not kzalloc) at the Length value from the Setup packet, then copies that full l
- affected >= 6.9.0, < 6.12.93fixed 6.12.93
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: serialize DMABUF cancel against request completion ffs_epfile_dmabuf_io_complete() calls usb_ep_free_request() on the completed request but leaves priv->req, the back-pointer that ffs_dmabuf_
- affected >= 4.15.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() entry->value is u32 and entry->length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, le
- CVE-2026-63892Jul 19, 2026affected >= 4.15.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow On the non-root path, __tb_property_parse_dir() takes dir_len from entry->length (u16 widened to size_t). Two distinct OOB conditions follo
- CVE-2026-63891Jul 19, 2026affected >= 4.15.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() A DIRECTORY entry's value field is used as the dir_offset for a recursive call into __tb_property_parse_dir() with no depth counter. A cra
- CVE-2026-63890Jul 19, 2026affected >= 2.6.30, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker drivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the descriptor cursor by an attacker-supplied fip_dlen without ever requiri
- affected >= 5.11.0, < 5.15.210fixed 5.15.210
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the ge
- affected >= 3.1.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target
- affected >= 3.1.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer alloc
- affected >= 6.0.0, < 6.1.176fixed 6.1.176
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passes chap_r directly t
- affected >= 6.18.32, < 6.18.35fixed 6.18.35
In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock).
- affected >= 5.17.0, < 6.1.176fixed 6.1.176
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right pointer.
- affected >= 6.3.0, < 6.6.143fixed 6.6.143
In the Linux kernel, the following vulnerability has been resolved: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ When uart_flush_buffer() runs before the DMA completion IRQ is delivered, the following race can occur (all steps serialized by uart
- CVE-2026-63882Jul 19, 2026affected >= 5.14.0, < 6.1.176fixed 6.1.176
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL pointer bug in svm_range_set_attr The process_info could be NULL if user doesn't call kfd_ioctl_acquire_vm before calling kfd_ioctl_svm. (cherry picked from commit 83a26c812e0529eb040d31a7
- affected >= 6.5.0, < 6.6.143fixed 6.6.143
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger get_queue_ids() computes array_size = num_queues * sizeof(uint32_t), which could overflow on 32-bit size_t build. using array_size() instead,
- CVE-2026-63880Jul 19, 2026affected >= 6.18.0, < 6.18.35fixed 6.18.35
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO The AMDGPU_GEM_OP_GET_MAPPING_INFO branch of amdgpu_gem_op_ioctl() holds three cleanup-tracked resources before calling kvcalloc(): the drm_
- affected >= 6.2.0, < 7.0.12fixed 7.0.12
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_hmm_range_get_pages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized retur
- CVE-2026-63878Jul 19, 2026affected >= 6.18.0, < 6.18.35fixed 6.18.35
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO kvcalloc(args->num_entries, sizeof(*vm_entries), GFP_KERNEL) at amdgpu_gem.c:1050 uses the user-supplied num_entries directly without any upper bounds ch
- CVE-2026-63877Jul 19, 2026affected >= 6.5.0, < 6.6.143fixed 6.6.143
In the Linux kernel, the following vulnerability has been resolved: serial: dz: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to colour frame buffer device 160x64 tgafb: SFB+ detected, rev=0x02
- CVE-2026-63876Jul 19, 2026affected >= 6.5.0, < 6.6.143fixed 6.6.143
In the Linux kernel, the following vulnerability has been resolved: serial: zs: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to mono frame buffer device 160x64 fb0: PMAG-AA frame buffer device a
Page 116 of 713