linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,255)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-63835 | — | >= 5.4.0, < 5.10.260 | 5.10.260 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: prevent OGM aggregation on disabled hardif When an interface gets disabled, the worker is correctly disabled by batadv_hardif_disable_interface() -> ... -> batadv_v_ogm_iface_disable(). In this p | ||
| CVE-2026-63834 | — | >= 4.8.0, < 5.10.260 | 5.10.260 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: restrict number of unacked list entries When the unacked_list is unbound, an attacker could send messages with small lengths and appropriated seqno + gaps to force the receiver to allocate | ||
| CVE-2026-63833 | Hig | 7.1 | >= 5.15.0, < 5.15.211 | 5.15.211 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_per | |
| CVE-2026-63832 | Hig | 8.8 | >= 6.14.0, < 6.18.38 | 6.18.38 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76_sta_add Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list. Found dev->sta_poll_list corruption wh | |
| CVE-2026-63831 | Hig | 8.8 | >= 3.16.0, < 5.10.260 | 5.10.260 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skb_cow_data() before in-place crypto llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(), llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform in-place cryptographic transfor | |
| CVE-2026-63830 | Cri | 9.4 | >= 4.20.0, < 5.10.261 | 5.10.261 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writa | |
| CVE-2026-63829 | Hig | 8.8 | >= 3.16.0, < 5.10.261 | 5.10.261 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created i | |
| CVE-2026-63828 | Hig | 8.4 | >= 3.6.0, < 5.10.261 | 5.10.261 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_socket_sendmsg() on | |
| CVE-2026-63827 | Hig | 7.8 | < 5.10.261 | 5.10.261 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on str | |
| CVE-2026-63826 | — | >= 2.6.12, < 6.6.144 | 6.6.144 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: fbdev: fix use-after-free in store_modes() store_modes() replaces a framebuffer's modelist with modes from userspace. On success it frees the old modelist with fb_destroy_modelist(). Two fields still point into | ||
| CVE-2026-63825 | Cri | 9.8 | >= 2.6.31, < 6.18.38 | 6.18.38 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: gcov: use atomic counter updates to fix concurrent access crashes GCC's GCOV instrumentation can merge global branch counters with loop induction variables as an optimization. In inflate_fast(), the inner copy | |
| CVE-2026-63824 | Hig | 7.8 | >= 4.20.0, < 5.10.260 | 5.10.260 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctl_pkey_params_get_2() The length for the internal output buffer is calculated incorrectly, which can result overflow when a too small buffer is provided. Fix the bug by allocating in | |
| CVE-2026-63823 | Hig | 7.8 | >= 2.6.16, < 5.10.260 | 5.10.260 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for helper | |
| CVE-2026-63822 | — | >= 5.6.0, < 5.10.260 | 5.10.260 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix warning when unbinding If there is an error during some initialization related to firmware, the buffers dp->tx_ring[i].tx_status are released. However this is released again when the device is | ||
| CVE-2026-63821 | — | >= 6.2.0, < 6.6.144 | 6.6.144 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtw_usb_write_port() fails to submit a USB Request Block (URB) (e.g., due to device disconnect or ENOMEM), the completion callback is never executed | ||
| CVE-2026-63820 | — | >= 7.0.0, < 7.1.3 | 7.1.3 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix missing read bio submission on large folio error f2fs_read_data_large_folio() can keep a read bio across multiple readahead folios. If a later folio hits an error before any of its blocks are added t | ||
| CVE-2026-63819 | Hig | 7.8 | >= 3.8.0, < 6.18.39 | 6.18.39 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() kernel BUG at fs/f2fs/file.c:845! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT( | |
| CVE-2026-63818 | Hig | 8.4 | >= 3.8.0, < 5.10.261 | 5.10.261 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode entry count f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_P | |
| CVE-2026-63817 | Hig | 7.8 | >= 5.14.0, < 5.15.212 | 5.15.212 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: f2fs: validate compress cache inode only when enabled F2FS_COMPRESS_INO() uses NM_I(sbi)->max_nid as the synthetic inode number for the compressed page cache inode. That inode only exists when the compress_cach | |
| CVE-2026-63816 | Hig | 7.8 | >= 5.19.0, < 6.6.145 | 6.6.145 | Jul 19, 2026 | In the Linux kernel, the following vulnerability has been resolved: f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink - f2fs_gc - gc_data_segment - ra_data_block(cow_inode) - mapping = F2FS_I(inode)->atomic_i |
- CVE-2026-63835Jul 19, 2026affected >= 5.4.0, < 5.10.260fixed 5.10.260
In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: prevent OGM aggregation on disabled hardif When an interface gets disabled, the worker is correctly disabled by batadv_hardif_disable_interface() -> ... -> batadv_v_ogm_iface_disable(). In this p
- CVE-2026-63834Jul 19, 2026affected >= 4.8.0, < 5.10.260fixed 5.10.260
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: restrict number of unacked list entries When the unacked_list is unbound, an attacker could send messages with small lengths and appropriated seqno + gaps to force the receiver to allocate
- affected >= 5.15.0, < 5.15.211fixed 5.15.211
In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_per
- affected >= 6.14.0, < 6.18.38fixed 6.18.38
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76_sta_add Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list. Found dev->sta_poll_list corruption wh
- affected >= 3.16.0, < 5.10.260fixed 5.10.260
In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skb_cow_data() before in-place crypto llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(), llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform in-place cryptographic transfor
- affected >= 4.20.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writa
- affected >= 3.16.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created i
- affected >= 3.6.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_socket_sendmsg() on
- affected < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on str
- CVE-2026-63826Jul 19, 2026affected >= 2.6.12, < 6.6.144fixed 6.6.144
In the Linux kernel, the following vulnerability has been resolved: fbdev: fix use-after-free in store_modes() store_modes() replaces a framebuffer's modelist with modes from userspace. On success it frees the old modelist with fb_destroy_modelist(). Two fields still point into
- affected >= 2.6.31, < 6.18.38fixed 6.18.38
In the Linux kernel, the following vulnerability has been resolved: gcov: use atomic counter updates to fix concurrent access crashes GCC's GCOV instrumentation can merge global branch counters with loop induction variables as an optimization. In inflate_fast(), the inner copy
- affected >= 4.20.0, < 5.10.260fixed 5.10.260
In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctl_pkey_params_get_2() The length for the internal output buffer is calculated incorrectly, which can result overflow when a too small buffer is provided. Fix the bug by allocating in
- affected >= 2.6.16, < 5.10.260fixed 5.10.260
In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for helper
- CVE-2026-63822Jul 19, 2026affected >= 5.6.0, < 5.10.260fixed 5.10.260
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix warning when unbinding If there is an error during some initialization related to firmware, the buffers dp->tx_ring[i].tx_status are released. However this is released again when the device is
- CVE-2026-63821Jul 19, 2026affected >= 6.2.0, < 6.6.144fixed 6.6.144
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtw_usb_write_port() fails to submit a USB Request Block (URB) (e.g., due to device disconnect or ENOMEM), the completion callback is never executed
- CVE-2026-63820Jul 19, 2026affected >= 7.0.0, < 7.1.3fixed 7.1.3
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix missing read bio submission on large folio error f2fs_read_data_large_folio() can keep a read bio across multiple readahead folios. If a later folio hits an error before any of its blocks are added t
- affected >= 3.8.0, < 6.18.39fixed 6.18.39
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() kernel BUG at fs/f2fs/file.c:845! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(
- affected >= 3.8.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode entry count f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_P
- affected >= 5.14.0, < 5.15.212fixed 5.15.212
In the Linux kernel, the following vulnerability has been resolved: f2fs: validate compress cache inode only when enabled F2FS_COMPRESS_INO() uses NM_I(sbi)->max_nid as the synthetic inode number for the compressed page cache inode. That inode only exists when the compress_cach
- affected >= 5.19.0, < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink - f2fs_gc - gc_data_segment - ra_data_block(cow_inode) - mapping = F2FS_I(inode)->atomic_i
Page 119 of 713