linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-74373 | — | >= 6.6.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix bio accounting for split md cloned bios Use md_cloned_bio() to control bio accounting instead of relying on r1bio_existed in raid1 or the io_accounting flag in raid10. The previous logic d | ||
| CVE-2026-74372 | — | >= 6.13.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path In raid1_write_request(), each per-mirror loop iteration begins by incrementing rdev->nr_pending. If a REQ_ATOMIC write encounters a badblock within | ||
| CVE-2026-74371 | Hig | 7.8 | >= 6.17.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat BPF_PROG_QUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpf_attr' structure (e.g. 40 bytes | |
| CVE-2026-74370 | — | >= 6.19.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luo_session_retrieve() Extend the scope of the rwsem_read lock in luo_session_retrieve() to overlap with the acquisition of the session mutex. This prevents a concurrent thread fr | ||
| CVE-2026-74369 | — | >= 7.1.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish() In luo_file_unpreserve_files() and luo_file_finish(), reorder module_put() and xa_erase() to ensure the file handler module remains pin | ||
| CVE-2026-74368 | — | >= 6.15.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() In ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to ath12k_dp_rx_check_nwifi_hdr_len_valid() may return false when the NWIFI header len | ||
| CVE-2026-74367 | Hig | 7.8 | >= 6.13.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdev_create error paths ath12k_mac_vdev_create() has three error path issues that leave arvif in an inconsistent state: 1. When ath12k_wmi_vdev_create() fails, the | |
| CVE-2026-74366 | — | >= 6.14.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in change_sta_links for unready link _ieee80211_set_active_links() calls _ieee80211_link_use_channel() for each newly-added link and WARN_ON_ONCE()s if it fails. The call uses assig | ||
| CVE-2026-74365 | Hig | 7.3 | < 6.1.178 | 6.1.178 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to | |
| CVE-2026-74364 | Hig | 7.1 | >= 6.18.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map (created with excl_prog_hash) is bound to a single program by hash: check_map_prog_compatibility() refuses to load any program whose diges | |
| CVE-2026-74363 | Hig | 7.8 | < 5.15.212 | 5.15.212 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") moved inode cleanup from ->free_inode() into ->destr | |
| CVE-2026-74362 | — | >= 6.5.0, < 6.6.145 | 6.6.145 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ext2: fix ignored return value of generic_write_sync() Fix ext2_dio_write_iter() to propagate the error returned by generic_write_sync() instead of silently discarding it, which could cause write(2) to return s | ||
| CVE-2026-74361 | Cri | 9.8 | >= 6.16.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used > instead of >=, incorrectly accepting fdp_idx when it equals n (i.e. NUMFDPC + 1). | |
| CVE-2026-74360 | — | >= 6.18.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps for bpf_map_elem iterators Exclusive maps (aka excl_prog_hash) are meant to be reachable only from the single program whose hash matches. This is enforced by check_map_prog_compatibil | ||
| CVE-2026-74359 | Hig | 7.8 | >= 2.6.16, < 5.15.212 | 5.15.212 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: configfs_lookup(): don't leave ->s_dentry dangling on failure Normally ->s_dentry is cleared when dentry it's pointing to becomes negative (on eviction, realistically). However, that only happens if dentry get | |
| CVE-2026-74358 | — | >= 6.16.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix fast commit wait/wake bit mapping on 64-bit On 64-bit, ext4 dynamic inode states live in the upper half of i_flags, and ext4_test_inode_state() applies the corresponding +32 offset. The fast-commit w | ||
| CVE-2026-74357 | Hig | 7.8 | >= 7.1.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump The ring content dump in amdgpu_coredump() uses two separate loops over adev->rings[]: the first counts rings with unsignalled fences to siz | |
| CVE-2026-74356 | Hig | 7.4 | >= 5.18.0, < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhost_get_avail_idx for a non empty ring vhost_get_avail_idx is supposed to report whether it has updated vq->avail_idx. Instead, it returns whether all entries have been consumed, which is usually t | |
| CVE-2026-74355 | Hig | 8.2 | >= 6.15.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info->node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the device_rbtree_insert() call is skipped. If a subsequen | |
| CVE-2026-74354 | Hig | 7.8 | >= 6.9.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf: Take mmap_lock in zap_pages() zap_vma_range() requires the owning mm's mmap_lock to be held. Taking mmap_read_lock under arena->lock would AB-BA against arena_vm_close() and arena_map_mmap(), both of whic |
- CVE-2026-74373Aug 15, 2026affected >= 6.6.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix bio accounting for split md cloned bios Use md_cloned_bio() to control bio accounting instead of relying on r1bio_existed in raid1 or the io_accounting flag in raid10. The previous logic d
- CVE-2026-74372Aug 15, 2026affected >= 6.13.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path In raid1_write_request(), each per-mirror loop iteration begins by incrementing rdev->nr_pending. If a REQ_ATOMIC write encounters a badblock within
- affected >= 6.17.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat BPF_PROG_QUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpf_attr' structure (e.g. 40 bytes
- CVE-2026-74370Aug 15, 2026affected >= 6.19.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luo_session_retrieve() Extend the scope of the rwsem_read lock in luo_session_retrieve() to overlap with the acquisition of the session mutex. This prevents a concurrent thread fr
- CVE-2026-74369Aug 15, 2026affected >= 7.1.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish() In luo_file_unpreserve_files() and luo_file_finish(), reorder module_put() and xa_erase() to ensure the file handler module remains pin
- CVE-2026-74368Aug 15, 2026affected >= 6.15.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() In ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to ath12k_dp_rx_check_nwifi_hdr_len_valid() may return false when the NWIFI header len
- affected >= 6.13.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdev_create error paths ath12k_mac_vdev_create() has three error path issues that leave arvif in an inconsistent state: 1. When ath12k_wmi_vdev_create() fails, the
- CVE-2026-74366Aug 15, 2026affected >= 6.14.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in change_sta_links for unready link _ieee80211_set_active_links() calls _ieee80211_link_use_channel() for each newly-added link and WARN_ON_ONCE()s if it fails. The call uses assig
- affected < 6.1.178fixed 6.1.178
In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to
- affected >= 6.18.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map (created with excl_prog_hash) is bound to a single program by hash: check_map_prog_compatibility() refuses to load any program whose diges
- affected < 5.15.212fixed 5.15.212
In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 ("bpf: Avoid RCU context warning when unpinning htab with internal structs") moved inode cleanup from ->free_inode() into ->destr
- CVE-2026-74362Aug 15, 2026affected >= 6.5.0, < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: ext2: fix ignored return value of generic_write_sync() Fix ext2_dio_write_iter() to propagate the error returned by generic_write_sync() instead of silently discarding it, which could cause write(2) to return s
- affected >= 6.16.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used > instead of >=, incorrectly accepting fdp_idx when it equals n (i.e. NUMFDPC + 1).
- CVE-2026-74360Aug 15, 2026affected >= 6.18.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps for bpf_map_elem iterators Exclusive maps (aka excl_prog_hash) are meant to be reachable only from the single program whose hash matches. This is enforced by check_map_prog_compatibil
- affected >= 2.6.16, < 5.15.212fixed 5.15.212
In the Linux kernel, the following vulnerability has been resolved: configfs_lookup(): don't leave ->s_dentry dangling on failure Normally ->s_dentry is cleared when dentry it's pointing to becomes negative (on eviction, realistically). However, that only happens if dentry get
- CVE-2026-74358Aug 15, 2026affected >= 6.16.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: ext4: fix fast commit wait/wake bit mapping on 64-bit On 64-bit, ext4 dynamic inode states live in the upper half of i_flags, and ext4_test_inode_state() applies the corresponding +32 offset. The fast-commit w
- affected >= 7.1.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump The ring content dump in amdgpu_coredump() uses two separate loops over adev->rings[]: the first counts rings with unsignalled fences to siz
- affected >= 5.18.0, < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhost_get_avail_idx for a non empty ring vhost_get_avail_idx is supposed to report whether it has updated vq->avail_idx. Instead, it returns whether all entries have been consumed, which is usually t
- affected >= 6.15.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe error path The info->node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the device_rbtree_insert() call is skipped. If a subsequen
- affected >= 6.9.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: bpf: Take mmap_lock in zap_pages() zap_vma_range() requires the owning mm's mmap_lock to be held. Taking mmap_read_lock under arena->lock would AB-BA against arena_vm_close() and arena_map_mmap(), both of whic
Page 19 of 702