linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-72461 | Hig | 7.8 | >= 6.17.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the sk_ctx Currently update_sk_ctx() transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller condit | |
| CVE-2026-72460 | Hig | 7.1 | >= 4.13.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before no_new_privs test aa_change_profile() builds a replacement label with fn_label_build_in_scope() before the no_new_privs subset check. The build helper can fail and return NULL | |
| CVE-2026-72459 | Hig | 7.8 | >= 4.13.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: apparmor: aa_label_alloc use aa_label_free on alloc failure aa_label_alloc() allocates a secid before allocating or taking the label proxy. If the later proxy step fails, the error path only freed the label mem | |
| CVE-2026-72458 | — | >= 6.17.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unpack_pdb pdb->dfa could be NULL if unpack_dfa fails, causing a NULL pointer dereference. | ||
| CVE-2026-72457 | — | >= 6.17.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fail policy unpack on accept2 allocation failure unpack_pdb() may need to allocate a missing ACCEPT2 table for older policy data. If that allocation failed, it set an error message but jumped to the s | ||
| CVE-2026-72456 | — | >= 7.0.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: apparmor: release exe file resources on path failure get_current_exe_path() takes both an exe_file reference and a path reference before resolving the path name. If aa_path_name() failed, it returned immediatel | ||
| CVE-2026-72455 | Hig | 7.1 | < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to audit_log_untrustedstring() Commit 4a134723f9f1 ("apparmor: move check for aa_null file to cover all cases") intrdouced a small bug, where path_name() may pass a po | |
| CVE-2026-72454 | Hig | 7.8 | >= 5.11.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() i3c_hci_addr_to_dev() walks bus->devs.i3c, which is protected by bus.lock (rwsem). However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot ta | |
| CVE-2026-72453 | — | >= 6.19.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cache_ops->populate callback, and if cache operations include an exit callback, | ||
| CVE-2026-72452 | Hig | 7.8 | < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intel_crtc_put_color_blobs() drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intel_crtc_pr | |
| CVE-2026-72451 | Cri | 9.8 | < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrm_state_lock. Thus it's possible for someone else to kill the | |
| CVE-2026-72450 | Hig | 7.8 | < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when | |
| CVE-2026-72449 | Hig | 7.8 | >= 5.18.0, < 6.1.178 | 6.1.178 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm The cleanup tail of kfd_criu_resume_svm() walks svms->criu_svm_metadata_list and kfree()s each struct criu_svm_metadata without removing it from the li | |
| CVE-2026-72448 | — | >= 5.10.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown The send-queue timestamp ring is allocated with qmem_alloc() when timestamping is used, but otx2_free_sq_res() never freed sq->timestamps, leaking that | ||
| CVE-2026-72447 | — | >= 4.7.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctp_diag SCTP_DIAG endpoint dumping was traversing endpoint address lists without holding lock_sock(), while those lists could change concurrently via socket op | ||
| CVE-2026-72446 | Hig | 7.8 | >= 6.16.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handle_uaudio_stream_req() resolves an interface index with info_idx_from_ifnum(), which returns -EINVAL when no interface matches. The enab | |
| CVE-2026-72445 | — | >= 6.16.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: clear opened when stream enable fails On enable, subs->opened is set before the service_interval is validated; an invalid interval jumps to the response label without clearing it, so the | ||
| CVE-2026-72444 | Hig | 7.8 | >= 4.2.0, < 6.1.178 | 6.1.178 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: flow_dissector: check device type before reading ETH_ADDRS __skb_flow_dissect() unconditionally reads 12 bytes from eth_hdr(skb) when FLOW_DISSECTOR_KEY_ETH_ADDRS is requested. This assumes the skb has a valid | |
| CVE-2026-72443 | — | >= 6.5.0, < 6.6.145 | 6.6.145 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during snd_usb_midi_v2_create(). A later setup failure can still jump to snd_usb_midi_v2_free(), which currently free | ||
| CVE-2026-72442 | Cri | 9.8 | >= 7.0.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nf_flow_ip6_tunnel_proto() to use pskb_may_pull() instead of skb_header_pointer() to ensure the outer IPv6 header is in the skb headroom, which |
- affected >= 6.17.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the sk_ctx Currently update_sk_ctx() transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller condit
- affected >= 4.13.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before no_new_privs test aa_change_profile() builds a replacement label with fn_label_build_in_scope() before the no_new_privs subset check. The build helper can fail and return NULL
- affected >= 4.13.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: apparmor: aa_label_alloc use aa_label_free on alloc failure aa_label_alloc() allocates a secid before allocating or taking the label proxy. If the later proxy step fails, the error path only freed the label mem
- CVE-2026-72458Aug 15, 2026affected >= 6.17.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix NULL pointer dereference in unpack_pdb pdb->dfa could be NULL if unpack_dfa fails, causing a NULL pointer dereference.
- CVE-2026-72457Aug 15, 2026affected >= 6.17.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: apparmor: fail policy unpack on accept2 allocation failure unpack_pdb() may need to allocate a missing ACCEPT2 table for older policy data. If that allocation failed, it set an error message but jumped to the s
- CVE-2026-72456Aug 15, 2026affected >= 7.0.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: apparmor: release exe file resources on path failure get_current_exe_path() takes both an exe_file reference and a path reference before resolving the path name. If aa_path_name() failed, it returned immediatel
- affected < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to audit_log_untrustedstring() Commit 4a134723f9f1 ("apparmor: move check for aa_null file to cover all cases") intrdouced a small bug, where path_name() may pass a po
- affected >= 5.11.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() i3c_hci_addr_to_dev() walks bus->devs.i3c, which is protected by bus.lock (rwsem). However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot ta
- CVE-2026-72453Aug 15, 2026affected >= 6.19.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: regcache: Do not overwrite error code when finalizing cache after error During regcache initialization, if an error occurs in the cache_ops->populate callback, and if cache operations include an exit callback,
- affected < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intel_crtc_put_color_blobs() drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intel_crtc_pr
- affected < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrm_state_lock. Thus it's possible for someone else to kill the
- affected < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: xfrm: validate selector family and prefixlen during match syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when
- affected >= 5.18.0, < 6.1.178fixed 6.1.178
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm The cleanup tail of kfd_criu_resume_svm() walks svms->criu_svm_metadata_list and kfree()s each struct criu_svm_metadata without removing it from the li
- CVE-2026-72448Aug 15, 2026affected >= 5.10.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown The send-queue timestamp ring is allocated with qmem_alloc() when timestamping is used, but otx2_free_sq_res() never freed sq->timestamps, leaking that
- CVE-2026-72447Aug 15, 2026affected >= 4.7.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctp_diag SCTP_DIAG endpoint dumping was traversing endpoint address lists without holding lock_sock(), while those lists could change concurrently via socket op
- affected >= 6.16.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handle_uaudio_stream_req() resolves an interface index with info_idx_from_ifnum(), which returns -EINVAL when no interface matches. The enab
- CVE-2026-72445Aug 15, 2026affected >= 6.16.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: clear opened when stream enable fails On enable, subs->opened is set before the service_interval is validated; an invalid interval jumps to the response label without clearing it, so the
- affected >= 4.2.0, < 6.1.178fixed 6.1.178
In the Linux kernel, the following vulnerability has been resolved: flow_dissector: check device type before reading ETH_ADDRS __skb_flow_dissect() unconditionally reads 12 bytes from eth_hdr(skb) when FLOW_DISSECTOR_KEY_ETH_ADDRS is requested. This assumes the skb has a valid
- CVE-2026-72443Aug 15, 2026affected >= 6.5.0, < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during snd_usb_midi_v2_create(). A later setup failure can still jump to snd_usb_midi_v2_free(), which currently free
- affected >= 7.0.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nf_flow_ip6_tunnel_proto() to use pskb_may_pull() instead of skb_header_pointer() to ensure the outer IPv6 header is in the skb headroom, which
Page 27 of 702