linux package
kernel
pkg:linux/kernel
Vulnerabilities (1,755)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-71085 | — | >= 4.8.0, < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of t | ||
| CVE-2025-71084 | — | < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix leaking the multicast GID table reference If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will prevent the work from running which also pr | ||
| CVE-2025-71083 | — | >= 4.14.0, < 5.15.198 | 5.15.198 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Avoid NULL pointer deref for evicted BOs It is possible for a BO to exist that is not currently associated with a resource, e.g. because it has been evicted. When devcoredump tries to read the content | ||
| CVE-2025-71082 | — | >= 3.7.0, < 5.15.198 | 5.15.198 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This | ||
| CVE-2025-71081 | — | >= 4.15.0, < 5.15.198 | 5.15.198 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: sai: fix OF node leak on probe The reference taken to the sync provider OF node when probing the platform device is currently only dropped if the set_sync() callback fails during DAI probe. Make s | ||
| CVE-2025-71080 | — | >= 6.12.0, < 6.12.64 | 6.12.64 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the current task can be preempted. Another task running on the same CPU may then execute | ||
| CVE-2025-71079 | — | < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write A deadlock can occur between nfc_unregister_device() and rfkill_fop_write() due to lock ordering inversion between device_lock and rfkil | ||
| CVE-2025-71078 | — | >= 4.20.0, < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/slb: Fix SLB multihit issue during SLB preload On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer. This preload cache i | ||
| CVE-2025-71077 | — | >= 5.1.0, < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: tpm: Cap the number of PCR banks tpm2_get_pcr_allocation() does not cap any upper limit for the number of banks. Cap the limit to eight banks so that out of bounds values coming from external I/O cause on only | ||
| CVE-2025-71076 | — | < 6.12.64 | 6.12.64 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Limit num_syncs to prevent oversized allocations The OA open parameters did not validate num_syncs, allowing userspace to pass arbitrarily large values, potentially leading to excessive allocations. | ||
| CVE-2025-71075 | — | >= 2.6.19, < 5.10.248 | 5.10.248 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulne | ||
| CVE-2025-71073 | — | >= 2.6.12, < 6.12.64 | 6.12.64 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: Input: lkkbd - disable pending work before freeing device lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work handler lkkbd_reinit() dereferences the lkkbd structure and its serio/input_dev fie | ||
| CVE-2025-71072 | — | >= 6.6.0, < 6.12.64 | 6.12.64 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: shmem: fix recovery on rename failures maple_tree insertions can fail if we are seriously short on memory; simple_offset_rename() does not recover well if it runs into that. The same goes for simple_offset_rena | ||
| CVE-2025-71071 | — | < 6.1.160 | 6.1.160 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potentially lead to a use | ||
| CVE-2025-68766 | — | >= 5.16.0, < 6.1.160 | 6.1.160 | Jan 5, 2026 | In the Linux kernel, the following vulnerability has been resolved: irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() If irq_domain_translate_twocell() sets "hwirq" to >= MCHP_EIC_NIRQ (2) then it results in an out of bounds access. The code checks for invalid values | ||
| CVE-2025-68765 | — | >= 5.7.0, < 5.15.198 | 5.15.198 | Jan 5, 2026 | In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() In mt7615_mcu_wtbl_sta_add(), an skb sskb is allocated. If the subsequent call to mt76_connac_mcu_alloc_wtbl_req() fails, the function returns an error | ||
| CVE-2025-68764 | — | >= 5.6.0, < 5.10.248 | 5.10.248 | Jan 5, 2026 | In the Linux kernel, the following vulnerability has been resolved: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags When a filesystem is being automounted, it needs to preserve the user-set superblock mount options, such as the "ro" flag. | ||
| CVE-2025-68763 | — | >= 6.5.0, < 6.6.120 | 6.6.120 | Jan 5, 2026 | In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Correctly handle return of sg_nents_for_len The return value of sg_nents_for_len was assigned to an unsigned long in starfive_hash_digest, causing negative error codes to be converted to larg | ||
| CVE-2025-68762 | — | >= 6.15.0, < 6.17.13 | 6.17.13 | Jan 5, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: netpoll: initialize work queue before error checks Prevent a kernel warning when netconsole setup fails on devices with IFF_DISABLE_NETPOLL flag. The warning (at kernel/workqueue.c:4242 in __flush_work) oc | ||
| CVE-2025-68761 | — | >= 6.18.0, < 6.18.2 | 6.18.2 | Jan 5, 2026 | In the Linux kernel, the following vulnerability has been resolved: hfs: fix potential use after free in hfs_correct_next_unused_CNID() This code calls hfs_bnode_put(node) which drops the refcount and then dreferences "node" on the next line. It's only safe to use "node" when |
- CVE-2025-71085Jan 13, 2026affected >= 4.8.0, < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of t
- CVE-2025-71084Jan 13, 2026affected < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix leaking the multicast GID table reference If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will prevent the work from running which also pr
- CVE-2025-71083Jan 13, 2026affected >= 4.14.0, < 5.15.198fixed 5.15.198
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Avoid NULL pointer deref for evicted BOs It is possible for a BO to exist that is not currently associated with a resource, e.g. because it has been evicted. When devcoredump tries to read the content
- CVE-2025-71082Jan 13, 2026affected >= 3.7.0, < 5.15.198fixed 5.15.198
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This
- CVE-2025-71081Jan 13, 2026affected >= 4.15.0, < 5.15.198fixed 5.15.198
In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: sai: fix OF node leak on probe The reference taken to the sync provider OF node when probing the platform device is currently only dropped if the set_sync() callback fails during DAI probe. Make s
- CVE-2025-71080Jan 13, 2026affected >= 6.12.0, < 6.12.64fixed 6.12.64
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the current task can be preempted. Another task running on the same CPU may then execute
- CVE-2025-71079Jan 13, 2026affected < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write A deadlock can occur between nfc_unregister_device() and rfkill_fop_write() due to lock ordering inversion between device_lock and rfkil
- CVE-2025-71078Jan 13, 2026affected >= 4.20.0, < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/slb: Fix SLB multihit issue during SLB preload On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer. This preload cache i
- CVE-2025-71077Jan 13, 2026affected >= 5.1.0, < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: tpm: Cap the number of PCR banks tpm2_get_pcr_allocation() does not cap any upper limit for the number of banks. Cap the limit to eight banks so that out of bounds values coming from external I/O cause on only
- CVE-2025-71076Jan 13, 2026affected < 6.12.64fixed 6.12.64
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Limit num_syncs to prevent oversized allocations The OA open parameters did not validate num_syncs, allowing userspace to pass arbitrarily large values, potentially leading to excessive allocations.
- CVE-2025-71075Jan 13, 2026affected >= 2.6.19, < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulne
- CVE-2025-71073Jan 13, 2026affected >= 2.6.12, < 6.12.64fixed 6.12.64
In the Linux kernel, the following vulnerability has been resolved: Input: lkkbd - disable pending work before freeing device lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work handler lkkbd_reinit() dereferences the lkkbd structure and its serio/input_dev fie
- CVE-2025-71072Jan 13, 2026affected >= 6.6.0, < 6.12.64fixed 6.12.64
In the Linux kernel, the following vulnerability has been resolved: shmem: fix recovery on rename failures maple_tree insertions can fail if we are seriously short on memory; simple_offset_rename() does not recover well if it runs into that. The same goes for simple_offset_rena
- CVE-2025-71071Jan 13, 2026affected < 6.1.160fixed 6.1.160
In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potentially lead to a use
- CVE-2025-68766Jan 5, 2026affected >= 5.16.0, < 6.1.160fixed 6.1.160
In the Linux kernel, the following vulnerability has been resolved: irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() If irq_domain_translate_twocell() sets "hwirq" to >= MCHP_EIC_NIRQ (2) then it results in an out of bounds access. The code checks for invalid values
- CVE-2025-68765Jan 5, 2026affected >= 5.7.0, < 5.15.198fixed 5.15.198
In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() In mt7615_mcu_wtbl_sta_add(), an skb sskb is allocated. If the subsequent call to mt76_connac_mcu_alloc_wtbl_req() fails, the function returns an error
- CVE-2025-68764Jan 5, 2026affected >= 5.6.0, < 5.10.248fixed 5.10.248
In the Linux kernel, the following vulnerability has been resolved: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags When a filesystem is being automounted, it needs to preserve the user-set superblock mount options, such as the "ro" flag.
- CVE-2025-68763Jan 5, 2026affected >= 6.5.0, < 6.6.120fixed 6.6.120
In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Correctly handle return of sg_nents_for_len The return value of sg_nents_for_len was assigned to an unsigned long in starfive_hash_digest, causing negative error codes to be converted to larg
- CVE-2025-68762Jan 5, 2026affected >= 6.15.0, < 6.17.13fixed 6.17.13
In the Linux kernel, the following vulnerability has been resolved: net: netpoll: initialize work queue before error checks Prevent a kernel warning when netconsole setup fails on devices with IFF_DISABLE_NETPOLL flag. The warning (at kernel/workqueue.c:4242 in __flush_work) oc
- CVE-2025-68761Jan 5, 2026affected >= 6.18.0, < 6.18.2fixed 6.18.2
In the Linux kernel, the following vulnerability has been resolved: hfs: fix potential use after free in hfs_correct_next_unused_CNID() This code calls hfs_bnode_put(node) which drops the refcount and then dreferences "node" on the next line. It's only safe to use "node" when
Page 20 of 88