linux package
kernel
pkg:linux/kernel
Vulnerabilities (1,755)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-68792 | — | >= 6.10.0, < 6.12.66 | 6.12.66 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: tpm2-sessions: Fix out of range indexing in name_size 'name_size' does not have any range checks, and it just directly indexes with TPM_ALG_ID, which could lead into memory corruption at worst. Address the iss | ||
| CVE-2025-68791 | — | >= 6.14.0, < 6.18.3 | 6.18.3 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: fuse: missing copy_finish in fuse-over-io-uring argument copies Fix a possible reference count leak of payload pages during fuse argument copies. [Joanne: simplified error cleanup] | ||
| CVE-2025-68790 | — | >= 6.18.0, < 6.18.3 | 6.18.3 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix double unregister of HCA_PORTS component Clear hca_devcom_comp in device's private data after unregistering it in LAG teardown. Otherwise a slightly lagging second pass through mlx5_unload_one() m | ||
| CVE-2025-68788 | — | >= 2.6.36, < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow t | ||
| CVE-2025-68787 | — | >= 2.6.12, < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: netrom: Fix memory leak in nr_sendmsg() syzbot reported a memory leak [1]. When function sock_alloc_send_skb() return NULL in nr_output(), the original skb is not freed, which was allocated in nr_sendmsg(). Fi | ||
| CVE-2025-68786 | — | >= 5.15.0, < 6.1.160 | 6.1.160 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: skip lock-range check on equal size to avoid size==0 underflow When size equals the current i_size (including 0), the code used to call check_lock_range(filp, i_size, size - 1, WRITE), which computes `si | ||
| CVE-2025-68785 | — | >= 4.15.0, < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix middle attribute validation in push_nsh() action The push_nsh() action structure looks like this: OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...)) The outermost OVS | ||
| CVE-2025-68784 | — | >= 6.10.0, < 6.12.64 | 6.12.64 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix a UAF problem in xattr repair The xchk_setup_xattr_buf function can allocate a new value buffer, which means that any reference to ab->value before the call could become a dangling pointer. Fix this b | ||
| CVE-2025-68783 | — | >= 4.11.0, < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices get_meter_levels_from_urb() parses the 64-byte meter packets sent by the device and fills the per-channel arrays meter_level[], comp_level[] and master_le | ||
| CVE-2025-68782 | — | >= 5.8.0, < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: Reset t_task_cdb pointer in error case If allocation of cmd->t_task_cdb fails, it remains NULL but is later dereferenced in the 'err' path. In case of error, reset NULL t_task_cdb value to point | ||
| CVE-2025-68781 | — | >= 3.0.0, < 6.1.160 | 6.1.160 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal The delayed work item otg_event is initialized in fsl_otg_conf() and scheduled under two conditions: 1. When a host controller binds t | ||
| CVE-2025-68780 | — | >= 4.0.0, < 5.15.198 | 5.15.198 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: sched/deadline: only set free_cpus for online runqueues Commit 16b269436b72 ("sched/deadline: Modify cpudl::free_cpus to reflect rd->online") introduced the cpudl_set/clear_freecpu functions to allow the cpu_dl | ||
| CVE-2025-68779 | — | >= 6.18.0, < 6.18.3 | 6.18.3 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid unregistering PSP twice PSP is unregistered twice in: _mlx5e_remove -> mlx5e_psp_unregister mlx5e_nic_cleanup -> mlx5e_psp_unregister This leads to a refcount underflow in some conditions: --- | ||
| CVE-2025-68778 | — | >= 4.8.0, < 6.1.160 | 6.1.160 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from one parent directory to another parent directory in t | ||
| CVE-2025-68777 | — | >= 3.11.0, < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: Input: ti_am335x_tsc - fix off-by-one error in wire_order validation The current validation 'wire_order[i] > ARRAY_SIZE(config_pins)' allows wire_order[i] to equal ARRAY_SIZE(config_pins), which causes out-of-b | ||
| CVE-2025-68776 | — | >= 3.17.0, < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() prp_get_untagged_frame() calls __pskb_copy() to create frame->skb_std but doesn't check if the allocation failed. If __pskb_copy() returns NULL, | ||
| CVE-2025-68775 | — | >= 6.4.0, < 6.6.120 | 6.6.120 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a handshake request is cancelled it is removed from the handshake_net->hn_requests list, but it is still present in the handshake_rhashtbl until | ||
| CVE-2025-68774 | — | >= 2.6.12, < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create When sync() and link() are called concurrently, both threads may enter hfs_bnode_find() without finding the node in the hash table and proceed to creat | ||
| CVE-2025-68773 | — | < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") failed to make sure that the size is really even before | ||
| CVE-2025-68772 | — | >= 5.6.0, < 6.1.160 | 6.1.160 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating compression context during writeback Bai, Shuangpeng <sjb7183@psu.edu> reported a bug as below: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 11441 Comm: syz.0.46 N |
- CVE-2025-68792Jan 13, 2026affected >= 6.10.0, < 6.12.66fixed 6.12.66
In the Linux kernel, the following vulnerability has been resolved: tpm2-sessions: Fix out of range indexing in name_size 'name_size' does not have any range checks, and it just directly indexes with TPM_ALG_ID, which could lead into memory corruption at worst. Address the iss
- CVE-2025-68791Jan 13, 2026affected >= 6.14.0, < 6.18.3fixed 6.18.3
In the Linux kernel, the following vulnerability has been resolved: fuse: missing copy_finish in fuse-over-io-uring argument copies Fix a possible reference count leak of payload pages during fuse argument copies. [Joanne: simplified error cleanup]
- CVE-2025-68790Jan 13, 2026affected >= 6.18.0, < 6.18.3fixed 6.18.3
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix double unregister of HCA_PORTS component Clear hca_devcom_comp in device's private data after unregistering it in LAG teardown. Otherwise a slightly lagging second pass through mlx5_unload_one() m
- CVE-2025-68788Jan 13, 2026affected >= 2.6.36, < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users with no read access to a file to subscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow t
- CVE-2025-68787Jan 13, 2026affected >= 2.6.12, < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: netrom: Fix memory leak in nr_sendmsg() syzbot reported a memory leak [1]. When function sock_alloc_send_skb() return NULL in nr_output(), the original skb is not freed, which was allocated in nr_sendmsg(). Fi
- CVE-2025-68786Jan 13, 2026affected >= 5.15.0, < 6.1.160fixed 6.1.160
In the Linux kernel, the following vulnerability has been resolved: ksmbd: skip lock-range check on equal size to avoid size==0 underflow When size equals the current i_size (including 0), the code used to call check_lock_range(filp, i_size, size - 1, WRITE), which computes `si
- CVE-2025-68785Jan 13, 2026affected >= 4.15.0, < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix middle attribute validation in push_nsh() action The push_nsh() action structure looks like this: OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...)) The outermost OVS
- CVE-2025-68784Jan 13, 2026affected >= 6.10.0, < 6.12.64fixed 6.12.64
In the Linux kernel, the following vulnerability has been resolved: xfs: fix a UAF problem in xattr repair The xchk_setup_xattr_buf function can allocate a new value buffer, which means that any reference to ab->value before the call could become a dangling pointer. Fix this b
- CVE-2025-68783Jan 13, 2026affected >= 4.11.0, < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-mixer: us16x08: validate meter packet indices get_meter_levels_from_urb() parses the 64-byte meter packets sent by the device and fills the per-channel arrays meter_level[], comp_level[] and master_le
- CVE-2025-68782Jan 13, 2026affected >= 5.8.0, < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Reset t_task_cdb pointer in error case If allocation of cmd->t_task_cdb fails, it remains NULL but is later dereferenced in the 'err' path. In case of error, reset NULL t_task_cdb value to point
- CVE-2025-68781Jan 13, 2026affected >= 3.0.0, < 6.1.160fixed 6.1.160
In the Linux kernel, the following vulnerability has been resolved: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal The delayed work item otg_event is initialized in fsl_otg_conf() and scheduled under two conditions: 1. When a host controller binds t
- CVE-2025-68780Jan 13, 2026affected >= 4.0.0, < 5.15.198fixed 5.15.198
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: only set free_cpus for online runqueues Commit 16b269436b72 ("sched/deadline: Modify cpudl::free_cpus to reflect rd->online") introduced the cpudl_set/clear_freecpu functions to allow the cpu_dl
- CVE-2025-68779Jan 13, 2026affected >= 6.18.0, < 6.18.3fixed 6.18.3
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid unregistering PSP twice PSP is unregistered twice in: _mlx5e_remove -> mlx5e_psp_unregister mlx5e_nic_cleanup -> mlx5e_psp_unregister This leads to a refcount underflow in some conditions: ---
- CVE-2025-68778Jan 13, 2026affected >= 4.8.0, < 6.1.160fixed 6.1.160
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from one parent directory to another parent directory in t
- CVE-2025-68777Jan 13, 2026affected >= 3.11.0, < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: Input: ti_am335x_tsc - fix off-by-one error in wire_order validation The current validation 'wire_order[i] > ARRAY_SIZE(config_pins)' allows wire_order[i] to equal ARRAY_SIZE(config_pins), which causes out-of-b
- CVE-2025-68776Jan 13, 2026affected >= 3.17.0, < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() prp_get_untagged_frame() calls __pskb_copy() to create frame->skb_std but doesn't check if the allocation failed. If __pskb_copy() returns NULL,
- CVE-2025-68775Jan 13, 2026affected >= 6.4.0, < 6.6.120fixed 6.6.120
In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a handshake request is cancelled it is removed from the handshake_net->hn_requests list, but it is still present in the handshake_rhashtbl until
- CVE-2025-68774Jan 13, 2026affected >= 2.6.12, < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create When sync() and link() are called concurrently, both threads may enter hfs_bnode_find() without finding the node in the hash table and proceed to creat
- CVE-2025-68773Jan 13, 2026affected < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") failed to make sure that the size is really even before
- CVE-2025-68772Jan 13, 2026affected >= 5.6.0, < 6.1.160fixed 6.1.160
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating compression context during writeback Bai, Shuangpeng <sjb7183@psu.edu> reported a bug as below: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 11441 Comm: syz.0.46 N
Page 18 of 88