linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,255)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-63875 | Hig | 7.8 | < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When huge_pmd_unshare() is called to unshare a PMD table, the tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true but the aarch64 tlb_flush() | |
| CVE-2026-63874 | Hig | 7.8 | >= 6.15.0, < 6.18.36 | 6.18.36 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: mctp: usb: fix race between urb completion and rx_retry cancellation It's possible that sequencing between setting ->stopped and cancelling the rx_retry work (in ndo_stop) could leave us with an urb queued | |
| CVE-2026-63873 | — | >= 6.16.0, < 6.18.36 | 6.18.36 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() aie2_populate_range() jumps back to the again label without calling mmput(mm), leaking a reference to the mm_struct. Add the missing mmput() | ||
| CVE-2026-63872 | — | >= 4.11.0, < 7.0.13 | 7.0.13 | Jul 19, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||
| CVE-2026-63871 | — | >= 6.2.0, < 6.12.94 | 6.12.94 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls iso_connect_bis(), iso_connect_cis(), iso_listen_bis(), and iso_conn_big_sync() call hci_get_route() using iso_pi(sk)->dst, iso_pi(sk)->src, | ||
| CVE-2026-63870 | Hig | 7.8 | >= 4.0.0, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit() on a 6LoWPAN interfac | |
| CVE-2026-63869 | Hig | 7.6 | >= 6.7.0, < 6.12.94 | 6.12.94 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value directl | |
| CVE-2026-63868 | — | >= 2.6.27, < 5.10.259 | 5.10.259 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeof(*ga) - ga->len; ga->len is the on-wire attri | ||
| CVE-2026-63867 | Hig | 8.2 | >= 5.11.0, < 5.15.210 | 5.15.210 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to comp | |
| CVE-2026-63866 | Hig | 8.8 | >= 6.15.0, < 6.18.33 | 6.18.33 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link() Clear WCID pointer removing the sta link in mt7996_mac_sta_deinit_link routine. | |
| CVE-2026-63865 | Hig | 8.8 | >= 5.11.0, < 5.15.209 | 5.15.209 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, so neither | |
| CVE-2026-63864 | Hig | 8.4 | >= 6.19.0, < 7.0.10 | 7.0.10 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visit_tailcall_insn Commit e40f5a6bf88a ("bpf: correct stack liveness for tail calls") added visit_tailcall_insn() but did not check its return value. | |
| CVE-2026-63863 | Hig | 8.8 | >= 7.0.0, < 7.0.10 | 7.0.10 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm() There is a unbalanced lock/unlock to gpusvm notifier lock: [ 931.045868] ===================================== [ 931.046509] WARNING: bad unlock balan | |
| CVE-2026-63862 | — | >= 5.13.0, < 6.1.175 | 6.1.175 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtk_pcie_setup_irq(), the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly retur | ||
| CVE-2026-63861 | — | >= 5.19.0, < 6.1.175 | 6.1.175 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback mtk_snand_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add | ||
| CVE-2026-63860 | Hig | 8.4 | >= 3.16.0, < 5.10.258 | 5.10.258 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLA_NUL_STRING These attributes are evaluated as c-string (passed to strcmp), but NLA_STRING doesn't check for the presence of a \0 terminator. Either this needs to switch to nla_strcmp() and | |
| CVE-2026-63859 | — | >= 6.11.0, < 6.18.33 | 6.18.33 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() Similar to airoha_qdma_cleanup_rx_queue(), reset DMA TX descriptors in airoha_qdma_cleanup_tx_queue routine. Moreover, reset TX_DMA_IDX to TX_CPU_ | ||
| CVE-2026-63858 | Hig | 7.8 | >= 5.19.0, < 7.0.10 | 7.0.10 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFT_HOOK_REMOVE, but add a new transaction object to track deletion of hooks wit | |
| CVE-2026-63857 | Cri | 9.8 | >= 6.11.0, < 6.18.33 | 6.18.33 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_s | |
| CVE-2026-63856 | Hig | 7.8 | >= 5.3.0, < 6.6.141 | 6.6.141 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. (cherry picked from commit e2b5499fca |
- affected < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When huge_pmd_unshare() is called to unshare a PMD table, the tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true but the aarch64 tlb_flush()
- affected >= 6.15.0, < 6.18.36fixed 6.18.36
In the Linux kernel, the following vulnerability has been resolved: net: mctp: usb: fix race between urb completion and rx_retry cancellation It's possible that sequencing between setting ->stopped and cancelling the rx_retry work (in ndo_stop) could leave us with an urb queued
- CVE-2026-63873Jul 19, 2026affected >= 6.16.0, < 6.18.36fixed 6.18.36
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() aie2_populate_range() jumps back to the again label without calling mmput(mm), leaking a reference to the mm_struct. Add the missing mmput()
- CVE-2026-63872Jul 19, 2026affected >= 4.11.0, < 7.0.13fixed 7.0.13
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- CVE-2026-63871Jul 19, 2026affected >= 6.2.0, < 6.12.94fixed 6.12.94
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls iso_connect_bis(), iso_connect_cis(), iso_listen_bis(), and iso_conn_big_sync() call hci_get_route() using iso_pi(sk)->dst, iso_pi(sk)->src,
- affected >= 4.0.0, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit() on a 6LoWPAN interfac
- affected >= 6.7.0, < 6.12.94fixed 6.12.94
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value directl
- CVE-2026-63868Jul 19, 2026affected >= 2.6.27, < 5.10.259fixed 5.10.259
In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeof(*ga) - ga->len; ga->len is the on-wire attri
- affected >= 5.11.0, < 5.15.210fixed 5.15.210
In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_wnd The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to comp
- affected >= 6.15.0, < 6.18.33fixed 6.18.33
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link() Clear WCID pointer removing the sta link in mt7996_mac_sta_deinit_link routine.
- affected >= 5.11.0, < 5.15.209fixed 5.15.209
In the Linux kernel, the following vulnerability has been resolved: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, so neither
- affected >= 6.19.0, < 7.0.10fixed 7.0.10
In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visit_tailcall_insn Commit e40f5a6bf88a ("bpf: correct stack liveness for tail calls") added visit_tailcall_insn() but did not check its return value.
- affected >= 7.0.0, < 7.0.10fixed 7.0.10
In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm() There is a unbalanced lock/unlock to gpusvm notifier lock: [ 931.045868] ===================================== [ 931.046509] WARNING: bad unlock balan
- CVE-2026-63862Jul 19, 2026affected >= 5.13.0, < 6.1.175fixed 6.1.175
In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtk_pcie_setup_irq(), the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly retur
- CVE-2026-63861Jul 19, 2026affected >= 5.19.0, < 6.1.175fixed 6.1.175
In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback mtk_snand_probe() registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add
- affected >= 3.16.0, < 5.10.258fixed 5.10.258
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLA_NUL_STRING These attributes are evaluated as c-string (passed to strcmp), but NLA_STRING doesn't check for the presence of a \0 terminator. Either this needs to switch to nla_strcmp() and
- CVE-2026-63859Jul 19, 2026affected >= 6.11.0, < 6.18.33fixed 6.18.33
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() Similar to airoha_qdma_cleanup_rx_queue(), reset DMA TX descriptors in airoha_qdma_cleanup_tx_queue routine. Moreover, reset TX_DMA_IDX to TX_CPU_
- affected >= 5.19.0, < 7.0.10fixed 7.0.10
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFT_HOOK_REMOVE, but add a new transaction object to track deletion of hooks wit
- affected >= 6.11.0, < 6.18.33fixed 6.18.33
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_s
- affected >= 5.3.0, < 6.6.141fixed 6.6.141
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. (cherry picked from commit e2b5499fca
Page 117 of 713