linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-74493 | Cri | 9.8 | >= 5.5.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket use-after-free during link group termination __smc_lgr_terminate() drops conns_lock after finding a connection in lgr->conns_all, but before taking a reference on its socket. The connection | |
| CVE-2026-74492 | Hig | 8.4 | >= 5.6.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtype_resize() copies comment pointers with memcpy(), not the comment objects themselves. During the window after an entry has been copied but | |
| CVE-2026-74491 | — | >= 6.13.0, < 6.18.44 | 6.18.44 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in of_pci_range_parser_one() The bus matching rework made of_match_bus() return NULL for nodes with ranges/dma-ranges but no local #address-cells. parser_init() stored that | ||
| CVE-2026-74490 | Hig | 8.8 | >= 5.0.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipc_sk_dump(). Most queue-dump callsites already serialize that walk under the socket lock or sk->sk_lock.s | |
| CVE-2026-74489 | Hig | 8.8 | >= 7.1.0, < 7.1.8 | 7.1.8 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tid_tx use-after-free on BA session stop ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() through ieee80211_remove_tid_tx(), and then reads tid_tx->ndp after dropping sta->lock: ieee8 | |
| CVE-2026-74488 | Hig | 8.8 | >= 4.5.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with ieee80211_amsdu_to_8023s() and walks the resulting subframes. For each subframe it p | |
| CVE-2026-74487 | — | >= 4.8.0, < 5.10.266 | 5.10.266 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: restore write access when removing an entry Registering an entry with the MISC_FMT_OPEN_FILE flag opens the interpreter via open_exec() which denies write access to it for as long as the entry exis | ||
| CVE-2026-74486 | — | >= 6.14.0, < 6.18.44 | 6.18.44 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: use exe_file_deny_write_access() for the interpreter clone For MISC_FMT_OPEN_FILE entries load_misc_binary() clones the registered interpreter file and denies write access to the clone via plain de | ||
| CVE-2026-74485 | Hig | 7.1 | >= 2.6.12, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: reject a flag character as the field delimiter The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a trunca | |
| CVE-2026-74484 | — | >= 6.7.0, < 6.12.103 | 6.12.103 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand on | ||
| CVE-2026-74483 | — | >= 6.7.0, < 6.12.105 | 6.12.105 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't leak the user namespace when the mount fails bm_get_tree() takes a reference to the user namespace and hands it to get_tree_keyed() as the sget key. sget_fc() moves that reference into sb->s_ | ||
| CVE-2026-74482 | Hig | 7.8 | >= 4.8.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios __folio_split() keeps dereferencing the mapping after the split: shmem_uncharge(mapping->host) and remap_page() while the folios are still | |
| CVE-2026-74481 | Hig | 7.8 | >= 5.7.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm/page_reporting: use system_freezable_wq to fix UAF during suspend During PM freeze (e.g. S3 suspend or S4 hibernation), device drivers like virtio_balloon reset their underlying virtio devices and delete th | |
| CVE-2026-74480 | Cri | 9.8 | >= 4.11.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advan | |
| CVE-2026-74479 | Hig | 7.8 | >= 2.6.22, < 5.10.266 | 5.10.266 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgen_change_name() replaces pkt_dev->entry while holding t->if_lock. pktgen_remove_device() removes the same entry before _rem_dev_from_if_list() takes that lock. T | |
| CVE-2026-74478 | Cri | 9.8 | >= 4.17.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kf | |
| CVE-2026-74477 | — | >= 6.13.0, < 6.18.44 | 6.18.44 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobe_expire() Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone() path: BUG: kernel NULL pointer derefere | ||
| CVE-2026-74476 | Cri | 9.1 | >= 5.18.0, < 6.1.184 | 6.1.184 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do | |
| CVE-2026-74475 | Cri | 10.0 | >= 3.8.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: vxlan: use neigh_ha_snapshot() in route_shortcircuit() The neighbour hardware address n->ha can be updated asynchronously by the neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without holdi | |
| CVE-2026-74474 | Cri | 9.8 | >= 3.8.0, < 6.6.153 | 6.6.153 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer heade |
- affected >= 5.5.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket use-after-free during link group termination __smc_lgr_terminate() drops conns_lock after finding a connection in lgr->conns_all, but before taking a reference on its socket. The connection
- affected >= 5.6.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtype_resize() copies comment pointers with memcpy(), not the comment objects themselves. During the window after an entry has been copied but
- CVE-2026-74491Aug 15, 2026affected >= 6.13.0, < 6.18.44fixed 6.18.44
In the Linux kernel, the following vulnerability has been resolved: of/address: Fix NULL bus dereference in of_pci_range_parser_one() The bus matching rework made of_match_bus() return NULL for nodes with ranges/dma-ranges but no local #address-cells. parser_init() stored that
- affected >= 5.0.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipc_sk_dump(). Most queue-dump callsites already serialize that walk under the socket lock or sk->sk_lock.s
- affected >= 7.1.0, < 7.1.8fixed 7.1.8
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tid_tx use-after-free on BA session stop ieee80211_stop_tx_ba_cb() hands tid_tx to kfree_rcu() through ieee80211_remove_tid_tx(), and then reads tid_tx->ndp after dropping sta->lock: ieee8
- affected >= 4.5.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with ieee80211_amsdu_to_8023s() and walks the resulting subframes. For each subframe it p
- CVE-2026-74487Aug 15, 2026affected >= 4.8.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: restore write access when removing an entry Registering an entry with the MISC_FMT_OPEN_FILE flag opens the interpreter via open_exec() which denies write access to it for as long as the entry exis
- CVE-2026-74486Aug 15, 2026affected >= 6.14.0, < 6.18.44fixed 6.18.44
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: use exe_file_deny_write_access() for the interpreter clone For MISC_FMT_OPEN_FILE entries load_misc_binary() clones the registered interpreter file and denies write access to the clone via plain de
- affected >= 2.6.12, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: reject a flag character as the field delimiter The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a trunca
- CVE-2026-74484Aug 15, 2026affected >= 6.7.0, < 6.12.103fixed 6.12.103
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand on
- CVE-2026-74483Aug 15, 2026affected >= 6.7.0, < 6.12.105fixed 6.12.105
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't leak the user namespace when the mount fails bm_get_tree() takes a reference to the user namespace and hands it to get_tree_keyed() as the sget key. sget_fc() moves that reference into sb->s_
- affected >= 4.8.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios __folio_split() keeps dereferencing the mapping after the split: shmem_uncharge(mapping->host) and remap_page() while the folios are still
- affected >= 5.7.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: mm/page_reporting: use system_freezable_wq to fix UAF during suspend During PM freeze (e.g. S3 suspend or S4 hibernation), device drivers like virtio_balloon reset their underlying virtio devices and delete th
- affected >= 4.11.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, continuing the loop advan
- affected >= 2.6.22, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgen_change_name() replaces pkt_dev->entry while holding t->if_lock. pktgen_remove_device() removes the same entry before _rem_dev_from_if_list() takes that lock. T
- affected >= 4.17.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vector_mmsg_rx() When vector_mmsg_rx() discards a packet whose overlay header fails verify_header(), it frees the skb and continues the loop: if (header_check < 0) { dev_kf
- CVE-2026-74477Aug 15, 2026affected >= 6.13.0, < 6.18.44fixed 6.18.44
In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobe_expire() Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone() path: BUG: kernel NULL pointer derefere
- affected >= 5.18.0, < 6.1.184fixed 6.1.184
In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do
- affected >= 3.8.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: vxlan: use neigh_ha_snapshot() in route_shortcircuit() The neighbour hardware address n->ha can be updated asynchronously by the neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without holdi
- affected >= 3.8.0, < 6.6.153fixed 6.6.153
In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer heade
Page 13 of 702