linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-74513 | Hig | 7.8 | >= 6.10.0, < 6.18.44 | 6.18.44 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister dibs_lo_attach_dmb(), dibs_lo_detach_dmb() and dibs_lo_unregister_dmb() look up the dmb_node under dmb_ht_lock, drop the lock and only t | |
| CVE-2026-74512 | Hig | 7.8 | >= 4.3.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in audit_del_rule() `audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()` before unlinking the rule from RCU-visible filter lists and waiting for a grace p | |
| CVE-2026-74511 | — | < 6.6.151 | 6.6.151 | Aug 15, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||
| CVE-2026-74510 | Hig | 7.8 | >= 2.6.39, < 6.1.184 | 6.1.184 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending. The lookup return | |
| CVE-2026-74509 | Hig | 8.8 | >= 5.17.0, < 6.1.184 | 6.1.184 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix advertising data UAFs hci_find_adv_instance() returns an adv_info pointer that is valid only while hdev->lock is held. The advertising command-sync paths perform instance lookups witho | |
| CVE-2026-74508 | Hig | 8.8 | >= 2.6.12, < 5.10.266 | 5.10.266 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP | |
| CVE-2026-74507 | Hig | 7.1 | >= 2.6.39, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can re | |
| CVE-2026-74506 | Hig | 7.8 | >= 5.8.0, < 6.18.44 | 6.18.44 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix UAF when sending a message In afs_make_call(), there's a race with async call reception and destruction. If a call is dispatched that doesn't have call->write_iter set (used to specify the data conten | |
| CVE-2026-74505 | — | >= 2.6.39, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Fix UAF at error handling during probe Although 6fire driver had a few fixes for dealing with the early error handling during the probe phase, it forgot a pending URB before freeing the resources, | ||
| CVE-2026-74504 | — | >= 6.12.0, < 6.12.103 | 6.12.103 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initialize_timer() A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set the backing snd_timer's hardware resolution to an arbitrary 64-bit value via SNDRV_ | ||
| CVE-2026-74503 | Hig | 7.8 | < 6.12.103 | 6.12.103 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes snd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD and returns early when the flag is already set, but the flag is never clea | |
| CVE-2026-74502 | — | >= 6.5.0, < 6.6.151 | 6.6.151 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of out_cvts on rawmidi error snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with kfree() but le | ||
| CVE-2026-74501 | — | >= 6.5.0, < 6.6.151 | 6.6.151 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in ump_to_endpoint() create_midi2_ump() registers a card-owned snd_ump_endpoint and stores a back-pointer to its per-interface snd_usb_midi2_ump object in ump->private_data, | ||
| CVE-2026-74500 | — | >= 6.12.0, < 6.12.103 | 6.12.103 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status snd_rme_digiface_read_status() reads a four-word status block from the device into an uninitialised on-stack __le32 buf[4] and, whenever the vendor co | ||
| CVE-2026-74499 | — | >= 2.6.35, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() snd_usbmidi_akai_output() computes its fill-loop bound buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1; as a signed int, so a small device-adve | ||
| CVE-2026-74498 | — | >= 3.5.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set When a USB audio endpoint requests full packet transfers via the fill_max descriptor flag, data_ep_set_params() promotes ep->curpacksize | ||
| CVE-2026-74497 | Hig | 8.4 | >= 3.8.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's stride and stores the result directly in out_packet->packet_size[i]. If a | |
| CVE-2026-74496 | Hig | 7.8 | >= 3.18.0, < 7.1.8 | 7.1.8 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in fou_create() fou_create() publishes struct fou through sk_user_data before adding the new FOU port to the per-netns list. If fou_add_to_port_list() fails, the error path frees fou wh | |
| CVE-2026-74495 | Cri | 9.8 | >= 2.6.33, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: igbvf: Fix leak in TX DMA error cleanup If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Because count is incremented before each frag mappi | |
| CVE-2026-74494 | — | >= 5.15.0, < 5.15.217 | 5.15.217 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSION_SETUP. While the connection is in KSMBD_SESS_NEED_SETU |
- affected >= 6.10.0, < 6.18.44fixed 6.18.44
In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister dibs_lo_attach_dmb(), dibs_lo_detach_dmb() and dibs_lo_unregister_dmb() look up the dmb_node under dmb_ht_lock, drop the lock and only t
- affected >= 4.3.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in audit_del_rule() `audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()` before unlinking the rule from RCU-visible filter lists and waiting for a grace p
- CVE-2026-74511Aug 15, 2026affected < 6.6.151fixed 6.6.151
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- affected >= 2.6.39, < 6.1.184fixed 6.1.184
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending. The lookup return
- affected >= 5.17.0, < 6.1.184fixed 6.1.184
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix advertising data UAFs hci_find_adv_instance() returns an adv_info pointer that is valid only while hdev->lock is held. The advertising command-sync paths perform instance lookups witho
- affected >= 2.6.12, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP
- affected >= 2.6.39, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can re
- affected >= 5.8.0, < 6.18.44fixed 6.18.44
In the Linux kernel, the following vulnerability has been resolved: afs: Fix UAF when sending a message In afs_make_call(), there's a race with async call reception and destruction. If a call is dispatched that doesn't have call->write_iter set (used to specify the data conten
- CVE-2026-74505Aug 15, 2026affected >= 2.6.39, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Fix UAF at error handling during probe Although 6fire driver had a few fixes for dealing with the early error handling during the probe phase, it forgot a pending URB before freeing the resources,
- CVE-2026-74504Aug 15, 2026affected >= 6.12.0, < 6.12.103fixed 6.12.103
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initialize_timer() A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set the backing snd_timer's hardware resolution to an arbitrary 64-bit value via SNDRV_
- affected < 6.12.103fixed 6.12.103
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes snd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD and returns early when the flag is already set, but the flag is never clea
- CVE-2026-74502Aug 15, 2026affected >= 6.5.0, < 6.6.151fixed 6.6.151
In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of out_cvts on rawmidi error snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with kfree() but le
- CVE-2026-74501Aug 15, 2026affected >= 6.5.0, < 6.6.151fixed 6.6.151
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in ump_to_endpoint() create_midi2_ump() registers a card-owned snd_ump_endpoint and stores a back-pointer to its per-interface snd_usb_midi2_ump object in ump->private_data,
- CVE-2026-74500Aug 15, 2026affected >= 6.12.0, < 6.12.103fixed 6.12.103
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status snd_rme_digiface_read_status() reads a four-word status block from the device into an uninitialised on-stack __le32 buf[4] and, whenever the vendor co
- CVE-2026-74499Aug 15, 2026affected >= 2.6.35, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() snd_usbmidi_akai_output() computes its fill-loop bound buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1; as a signed int, so a small device-adve
- CVE-2026-74498Aug 15, 2026affected >= 3.5.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set When a USB audio endpoint requests full packet transfers via the fill_max descriptor flag, data_ep_set_params() promotes ep->curpacksize
- affected >= 3.8.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's stride and stores the result directly in out_packet->packet_size[i]. If a
- affected >= 3.18.0, < 7.1.8fixed 7.1.8
In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in fou_create() fou_create() publishes struct fou through sk_user_data before adding the new FOU port to the per-netns list. If fou_add_to_port_list() fails, the error path frees fou wh
- affected >= 2.6.33, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: igbvf: Fix leak in TX DMA error cleanup If an error is encountered while mapping TX buffers, the driver should unmap any buffers already mapped for that skb. Because count is incremented before each frag mappi
- CVE-2026-74494Aug 15, 2026affected >= 5.15.0, < 5.15.217fixed 5.15.217
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSION_SETUP. While the connection is in KSMBD_SESS_NEED_SETU
Page 12 of 702