VYPR

linux package

kernel

pkg:linux/kernel

Vulnerabilities (14,027)

  • CVE-2026-74693Aug 22, 2026
    affected >= 5.10.0, < 5.10.265fixed 5.10.265

    In the Linux kernel, the following vulnerability has been resolved: net: prestera: validate firmware header length prestera_fw_hdr_parse() reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct prestera_fw_head

  • CVE-2026-74692Aug 22, 2026
    affected >= 5.1.0, < 5.15.216fixed 5.15.216

    In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smc_listen_out() and listener close smc_listen_out() reads lsmc->sk.sk_state without the listener lock, then acquires lock_sock_nested() only after the check passes. This opens

  • CVE-2026-74691Aug 22, 2026
    affected >= 4.15.0, < 5.15.216fixed 5.15.216

    In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Tear down DMA paths before stopping the rings tbnet_tear_down() stops both rings and frees their frame buffers before calling tb_xdomain_disable_paths(). tb_ring_stop() zeroes the ring's desc

  • CVE-2026-74690Aug 22, 2026
    affected >= 4.19.0, < 6.18.45fixed 6.18.45

    In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ism_dev_exit() A ism interrupt handler can be active in parallel with ism_dev_exit(), accessing freed data structures. No new interrupts will be generated after unregist

  • CVE-2026-74689Aug 22, 2026
    affected >= 2.6.12, < 6.1.183fixed 6.1.183

    In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() vcc_setsockopt() contained an ineffective optlen check: if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname)) return -EINVAL; If

  • CVE-2026-74688Aug 22, 2026
    affected >= 3.1.0, < 5.10.265fixed 5.10.265

    In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctp_make_heartbeat_ack() caches the destination transport in chunk->transport without taking a reference. When src_out_of_asoc_ok is enabled, the HEAR

  • CVE-2026-74687Aug 22, 2026
    affected >= 3.14.0, < 6.18.45fixed 6.18.45

    In the Linux kernel, the following vulnerability has been resolved: watchdog: at91sam9_wdt: prevent timer rearm during teardown at91_ping() rearms the watchdog timer from its callback. timer_delete() neither waits for a running callback nor prevents it from rearming the timer,

  • CVE-2026-74686Aug 22, 2026
    affected >= 6.19.0, < 7.1.9fixed 7.1.9

    In the Linux kernel, the following vulnerability has been resolved: rqspinlock: Reset tail when preserving queue on deadlock Currently, the destruction of the waiter queue is suppressed for rqspinlock in cases where a deadlock is detected. Deadlock checks happen relatively freq

  • CVE-2026-74685Aug 22, 2026
    affected >= 6.9.0, < 6.12.104fixed 6.12.104

    In the Linux kernel, the following vulnerability has been resolved: hwmon: (ltc4282) Clamp negative current limits When a negative value is passed to ltc4282_write_curr(), the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282_write_curr() { /* ne

  • CVE-2026-74684Aug 22, 2026
    affected >= 5.12.0, < 6.18.45fixed 6.18.45

    In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() The commit 4f61f133f354 ("net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null") fixed a crash in tap

  • CVE-2026-74683Aug 22, 2026
    affected < 5.10.265fixed 5.10.265

    In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() an

  • CVE-2026-74682Aug 22, 2026
    affected >= 3.5.0, < 5.10.265fixed 5.10.265

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs data_ep_set_params() sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u->packets = urb_packs; u->buffer_size = maxsi

  • CVE-2026-74681Aug 22, 2026
    affected >= 6.18.0, < 6.18.45fixed 6.18.45

    In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg ibuf_len is the bulk IN (receive) buffer size, but the EMSGSIZE check in usbio_bulk_msg() compares it against txbuf_len — the bulk OUT endpoint siz

  • CVE-2026-74680Aug 22, 2026
    affected >= 2.6.13, < 5.10.265fixed 5.10.265

    In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() If cxacru_cm() encounters an error while submitting or waiting for snd_urb, it aborts and returns the error without killing the already submitted

  • CVE-2026-74679Aug 22, 2026
    affected >= 3.17.0, < 5.10.265fixed 5.10.265

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Use unsigned int for ndp_index The variable ndp_index is declared as a signed integer, but it stores the return value of get_ncm(), which is unsigned. A malicious host can supply a large of

  • CVE-2026-74678Aug 22, 2026
    affected >= 5.17.0, < 6.1.183fixed 6.1.183

    In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() When the interface has NETIF_F_SG enabled and skb_linearize() fails in ax88179_tx_fixup(), the function returns NULL without freeing the skb. usbnet_s

  • CVE-2026-74677Aug 22, 2026
    affected >= 4.15.0, < 6.12.104fixed 6.12.104

    In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrier_work UAF on disconnect ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero URB status: else schedule_delayed_work(&dev->carrier_work, 0); Nothing ties tha

  • CVE-2026-74676Aug 22, 2026
    affected < 5.10.265fixed 5.10.265

    In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vt_k_ioctl() enforce, allowing a process to change meta mode

  • CVE-2026-74675Aug 22, 2026
    affected < 5.10.265fixed 5.10.265

    In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get kbd_keycode() reads vc->port.tty without acquiring a tty reference, racing against con_shutdown() which clears port.tty under a different lock. U

  • CVE-2026-74674Aug 22, 2026
    affected >= 7.0.0, < 7.1.9fixed 7.1.9

    In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zap_pte_range reclaims a page table, it does: pte_free_tlb(tlb, pmd_pgtable(pmdval), addr); and this is unconditionally wrong: if this cod

Page 3 of 702