linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-72481 | — | >= 4.7.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2c_smbus_read_i2c | ||
| CVE-2026-72480 | Hig | 7.8 | >= 5.17.0, < 6.1.178 | 6.1.178 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling ams_event_to_channel() may return a pointer past the end of dev->channels when no matching scan_index is found. This can lead to invalid | |
| CVE-2026-72479 | — | >= 4.7.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: handle I2C read error(s) in mma8452_read() Currently, If i2c_smbus_read_i2c_block_data() fails but mma8452_set_runtime_pm_state() succeeds, mma8452_read() returns 0. As a result, the calle | ||
| CVE-2026-72478 | Hig | 8.4 | < 6.1.178 | 6.1.178 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to run_get_highest_vcn() run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile Upd | |
| CVE-2026-72477 | Cri | 9.8 | >= 6.17.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: call _ntfs_bad_inode() when failing to rename It is safe to call _ntfs_bad_inode on live inodes since: commit 519b078998ce ("fs/ntfs3: Exclude call make_bad_inode for live nodes.") The WARN_ON was | |
| CVE-2026-72476 | Hig | 7.8 | >= 2.6.30, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dma_release_channel(), check chan->device->privatecnt after call dma_chan_put(). However, dma_chan_put() call dma_device_put() which could release the last reference of | |
| CVE-2026-72475 | — | >= 6.11.0, < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc Use axi_dmac_free_desc() to free fully the descriptor at fail path when call axi_dmac_alloc_desc() in axi_dmac_prep_peripheral_dma_vec(). | ||
| CVE-2026-72474 | — | >= 6.8.0, < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor For architectures like Microblaze or arm64 (where this IP is used), DMA_DIRECT_REMAP is set which means that dma_alloc_coherent() might remap (and | ||
| CVE-2026-72473 | Cri | 9.8 | >= 5.3.0, < 6.1.178 | 6.1.178 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rl_kref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake its RPC task, and it gated when an rpcrdma_req cou | |
| CVE-2026-72472 | Cri | 9.8 | >= 4.0.0, < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi->rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flc_lock while iterating over | |
| CVE-2026-72471 | Hig | 7.1 | >= 7.0.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent potential lcn remains uninitialized The target VCN being sought was not found within runs[0], causing run_lookup() to return false. This causes run_lookup_entry() to return false, which in tur | |
| CVE-2026-72470 | Hig | 7.8 | >= 5.15.0, < 6.6.145 | 6.6.145 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log->one_page_buf when adopting on-disk page size log_replay() allocates log->one_page_buf using the page size that was chosen from the host PAGE_SIZE: log->one_page_buf = kmalloc(log->page_s | |
| CVE-2026-72469 | Hig | 8.8 | >= 5.8.0, < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE rpcrdma_cm_event_handler() falls through to the disconnected: label on RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no matching get when the event arr | |
| CVE-2026-72468 | — | >= 6.11.0, < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize re_id before removal registration rpcrdma_create_id() registers ep->re_rn with the rpcrdma ib_client before returning the new rdma_cm_id to rpcrdma_ep_create(). However rpcrdma_ep_create() | ||
| CVE-2026-72467 | — | >= 5.16.0, < 6.1.178 | 6.1.178 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwr_wp_create() during connect frwr_wp_create() creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a n | ||
| CVE-2026-72466 | Cri | 9.8 | >= 4.14.0, < 5.15.212 | 5.15.212 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdma_is_bcall() decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply | |
| CVE-2026-72465 | Hig | 7.5 | >= 7.1.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The out_norqst exit in rpcrdma_reply_handler() branches away before the credit clamp, so a reply that matches no pending request reaches out_post carrying | |
| CVE-2026-72464 | Hig | 7.5 | >= 5.5.0, < 6.1.178 | 6.1.178 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdma_wc_receive() decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdma_reply_handler(). Th | |
| CVE-2026-72463 | Cri | 9.8 | >= 7.0.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device refere | |
| CVE-2026-72462 | Hig | 8.8 | >= 6.17.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peer_path is used The holding a reference to the peer_sk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows |
- CVE-2026-72481Aug 15, 2026affected >= 4.7.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2c_smbus_read_i2c
- affected >= 5.17.0, < 6.1.178fixed 6.1.178
In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling ams_event_to_channel() may return a pointer past the end of dev->channels when no matching scan_index is found. This can lead to invalid
- CVE-2026-72479Aug 15, 2026affected >= 4.7.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: handle I2C read error(s) in mma8452_read() Currently, If i2c_smbus_read_i2c_block_data() fails but mma8452_set_runtime_pm_state() succeeds, mma8452_read() returns 0. As a result, the calle
- affected < 6.1.178fixed 6.1.178
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to run_get_highest_vcn() run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile Upd
- affected >= 6.17.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: call _ntfs_bad_inode() when failing to rename It is safe to call _ntfs_bad_inode on live inodes since: commit 519b078998ce ("fs/ntfs3: Exclude call make_bad_inode for live nodes.") The WARN_ON was
- affected >= 2.6.30, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dma_release_channel(), check chan->device->privatecnt after call dma_chan_put(). However, dma_chan_put() call dma_device_put() which could release the last reference of
- CVE-2026-72475Aug 15, 2026affected >= 6.11.0, < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc Use axi_dmac_free_desc() to free fully the descriptor at fail path when call axi_dmac_alloc_desc() in axi_dmac_prep_peripheral_dma_vec().
- CVE-2026-72474Aug 15, 2026affected >= 6.8.0, < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor For architectures like Microblaze or arm64 (where this IP is used), DMA_DIRECT_REMAP is set which means that dma_alloc_coherent() might remap (and
- affected >= 5.3.0, < 6.1.178fixed 6.1.178
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rl_kref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake its RPC task, and it gated when an rpcrdma_req cou
- affected >= 4.0.0, < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi->rwsem to protect traversal of the file lock list Lingfeng identified a bug and suggested two solutions, but both appear to have issues. Generally, we cannot release flc_lock while iterating over
- affected >= 7.0.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent potential lcn remains uninitialized The target VCN being sought was not found within runs[0], causing run_lookup() to return false. This causes run_lookup_entry() to return false, which in tur
- affected >= 5.15.0, < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log->one_page_buf when adopting on-disk page size log_replay() allocates log->one_page_buf using the page size that was chosen from the host PAGE_SIZE: log->one_page_buf = kmalloc(log->page_s
- affected >= 5.8.0, < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE rpcrdma_cm_event_handler() falls through to the disconnected: label on RDMA_CM_EVENT_ADDR_CHANGE and calls rpcrdma_ep_put() with no matching get when the event arr
- CVE-2026-72468Aug 15, 2026affected >= 6.11.0, < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize re_id before removal registration rpcrdma_create_id() registers ep->re_rn with the rpcrdma ib_client before returning the new rdma_cm_id to rpcrdma_ep_create(). However rpcrdma_ep_create()
- CVE-2026-72467Aug 15, 2026affected >= 5.16.0, < 6.1.178fixed 6.1.178
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwr_wp_create() during connect frwr_wp_create() creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a n
- affected >= 4.14.0, < 5.15.212fixed 5.15.212
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdma_is_bcall() decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply
- affected >= 7.1.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The out_norqst exit in rpcrdma_reply_handler() branches away before the credit clamp, so a reply that matches no pending request reaches out_post carrying
- affected >= 5.5.0, < 6.1.178fixed 6.1.178
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdma_wc_receive() decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdma_reply_handler(). Th
- affected >= 7.0.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device refere
- affected >= 6.17.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peer_path is used The holding a reference to the peer_sk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows
Page 26 of 702