linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-74453 | Hig | 7.8 | >= 4.13.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without eve | |
| CVE-2026-74452 | Hig | 7.8 | >= 6.10.0, < 6.12.103 | 6.12.103 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthor_fw_load_section_entry(), the data size to copy is calculated without validating it against the allocated section_size: section->data.siz | |
| CVE-2026-74451 | Hig | 7.8 | >= 6.10.0, < 6.12.103 | 6.12.103 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes iface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as | |
| CVE-2026-74450 | Hig | 7.8 | >= 4.9.0, < 6.1.184 | 6.1.184 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs path then copies from that pointer. A concurrent pp_tabl | |
| CVE-2026-74449 | Hig | 7.8 | >= 6.11.0, < 7.1.8 | 7.1.8 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport If a plane reaches calculate_mcache_setting with a zero-area viewport, calculate_mcache_setting exits early with num_mcaches == 0 | |
| CVE-2026-74448 | — | < 6.6.151 | 6.6.151 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix QID bit leak in pqm_create_queue() When MES is enabled and amdgpu_amdkfd_alloc_kernel_mem() fails during the first queue creation for a process, pqm_create_queue() returns early via 'return retv | ||
| CVE-2026-74447 | Hig | 7.8 | < 6.12.103 | 6.12.103 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment eop_ring_buffer_size in struct queue_properties is a u32. In kfd_queue_acquire_buffers() the expected EOP buffer size is computed as ALIGN(eop | |
| CVE-2026-74446 | Hig | 7.8 | >= 5.18.0, < 6.1.183 | 6.1.183 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold event_mutex while checkpointing CRIU events kfd_criu_checkpoint_events() counts the entries in p->event_idr via kfd_get_num_events(), allocates an array sized to that count, and then walks the | |
| CVE-2026-74445 | — | >= 4.20.0, < 6.6.151 | 6.6.151 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DX_BIND_QUERY without a DX context vmw_cmd_dx_bind_query() unconditionally dereferences sw_context->dx_ctx_node->ctx. Userspace can trigger a NULL pointer dereference from any render-node fd | ||
| CVE-2026-74444 | Hig | 7.8 | >= 2.6.33, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); where header->size is u32 and is taken straight from the | |
| CVE-2026-74443 | Hig | 8.8 | >= 2.6.33, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large | |
| CVE-2026-74442 | — | >= 6.10.0, < 6.12.103 | 6.12.103 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Two paths through vmw_vkms_init() can leave vmw->crc_workq NULL while still leaving the rest of the driver in a state that calls vmw_vkms_cleanup() | ||
| CVE-2026-74441 | — | >= 5.16.0, < 6.1.184 | 6.1.184 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix race condition and ordering in port unregistration A synchronization issue exists during port unregistration where pending partner work items can race against workqueue destruction, leadin | ||
| CVE-2026-74440 | Hig | 7.8 | >= 6.8.0, < 6.12.103 | 6.12.103 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xe_exec_ioctl() only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of | |
| CVE-2026-74439 | Cri | 9.3 | >= 6.9.0, < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry device_pasid_table_teardown() zeroes the 128-bit scalable-mode context entry with context_clear_entry() while the Present bit is sti | |
| CVE-2026-74438 | Hig | 7.8 | >= 4.14.0, < 5.15.212 | 5.15.212 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rng_alg Remove sun4i_ss_rng, as it is insecure and unused: - It has multiple vulnerabilities. sun4i_ss_prng_seed() is missing locking and has a buffer overflow. | |
| CVE-2026-74437 | — | >= 6.16.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work If a UVC camera has an asynchronous control, uvc_status_stop may be called from async_ctrl.work: uvc_ctrl_status_event_work() | ||
| CVE-2026-74436 | Cri | 9.8 | >= 4.9.0, < 5.10.266 | 5.10.266 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpc_kernel_charge_accept() reads rx->backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc_service_preallo | |
| CVE-2026-74435 | Hig | 7.5 | < 6.6.145 | 6.6.145 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the rxrpc_call.rx_dec_buffer is unallocated and assumes that upon successful return that rx_dec_buffer | |
| CVE-2026-74434 | Cri | 9.8 | >= 6.16.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq and, if a response is needed, moves it onto the pending_oobq tree. However, only t |
- affected >= 4.13.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without eve
- affected >= 6.10.0, < 6.12.103fixed 6.12.103
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthor_fw_load_section_entry(), the data size to copy is calculated without validating it against the allocated section_size: section->data.siz
- affected >= 6.10.0, < 6.12.103fixed 6.12.103
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes iface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as
- affected >= 4.9.0, < 6.1.184fixed 6.1.184
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix pptable use-after-free amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table after dropping adev->pm.mutex. The sysfs path then copies from that pointer. A concurrent pp_tabl
- affected >= 6.11.0, < 7.1.8fixed 7.1.8
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport If a plane reaches calculate_mcache_setting with a zero-area viewport, calculate_mcache_setting exits early with num_mcaches == 0
- CVE-2026-74448Aug 15, 2026affected < 6.6.151fixed 6.6.151
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix QID bit leak in pqm_create_queue() When MES is enabled and amdgpu_amdkfd_alloc_kernel_mem() fails during the first queue creation for a process, pqm_create_queue() returns early via 'return retv
- affected < 6.12.103fixed 6.12.103
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment eop_ring_buffer_size in struct queue_properties is a u32. In kfd_queue_acquire_buffers() the expected EOP buffer size is computed as ALIGN(eop
- affected >= 5.18.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold event_mutex while checkpointing CRIU events kfd_criu_checkpoint_events() counts the entries in p->event_idr via kfd_get_num_events(), allocates an array sized to that count, and then walks the
- CVE-2026-74445Aug 15, 2026affected >= 4.20.0, < 6.6.151fixed 6.6.151
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DX_BIND_QUERY without a DX context vmw_cmd_dx_bind_query() unconditionally dereferences sw_context->dx_ctx_node->ctx. Userspace can trigger a NULL pointer dereference from any render-node fd
- affected >= 2.6.33, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); where header->size is u32 and is taken straight from the
- affected >= 2.6.33, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large
- CVE-2026-74442Aug 15, 2026affected >= 6.10.0, < 6.12.103fixed 6.12.103
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure Two paths through vmw_vkms_init() can leave vmw->crc_workq NULL while still leaving the rest of the driver in a state that calls vmw_vkms_cleanup()
- CVE-2026-74441Aug 15, 2026affected >= 5.16.0, < 6.1.184fixed 6.1.184
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix race condition and ordering in port unregistration A synchronization issue exists during port unregistration where pending partner work items can race against workqueue destruction, leadin
- affected >= 6.8.0, < 6.12.103fixed 6.12.103
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xe_exec_ioctl() only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of
- affected >= 6.9.0, < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry device_pasid_table_teardown() zeroes the 128-bit scalable-mode context entry with context_clear_entry() while the Present bit is sti
- affected >= 4.14.0, < 5.15.212fixed 5.15.212
In the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rng_alg Remove sun4i_ss_rng, as it is insecure and unused: - It has multiple vulnerabilities. sun4i_ss_prng_seed() is missing locking and has a buffer overflow.
- CVE-2026-74437Aug 15, 2026affected >= 6.16.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work If a UVC camera has an asynchronous control, uvc_status_stop may be called from async_ctrl.work: uvc_ctrl_status_event_work()
- affected >= 4.9.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpc_kernel_charge_accept() reads rx->backlog without any socket/backlog synchronization and passes that raw pointer into rxrpc_service_preallo
- affected < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the rxrpc_call.rx_dec_buffer is unallocated and assumes that upon successful return that rx_dec_buffer
- affected >= 6.16.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Don't move a peeked OOB message onto the pending queue rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq and, if a response is needed, moves it onto the pending_oobq tree. However, only t
Page 15 of 702