linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-72341 | — | >= 5.17.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv->channel_stats[] mlx5e_channel_stats_alloc() publishes a new entry to priv->channel_stats[] and then increments priv->stats_nch as a publication token, but neither store | ||
| CVE-2026-72340 | Hig | 7.8 | >= 6.2.0, < 6.6.145 | 6.6.145 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by | |
| CVE-2026-72339 | Cri | 9.8 | >= 4.18.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build_skb failure qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(). When it returns NULL under memory pressure, | |
| CVE-2026-72338 | Hig | 7.8 | >= 4.11.0, < 6.6.145 | 6.6.145 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flow_rule buffer and filling it. [email protected] report | |
| CVE-2026-72337 | — | >= 3.19.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpan_enable_set() allocates a temporary work item and schedules do_enable_set() on system_wq, then returns to debugfs. The debugfs active operation has ended at | ||
| CVE-2026-72336 | — | >= 3.17.0, < 6.6.145 | 6.6.145 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control get_l2cap_conn() looks up an LE hci_conn under hdev protection, but then drops that protection before reading hcon->l2cap_data and before lowpan_contro | ||
| CVE-2026-72335 | Hig | 7.8 | >= 5.12.0, < 6.1.178 | 6.1.178 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci_add_adv_monitor() publishes a new adv_monitor in hdev->adv_monitors_idr before the powered MSFT setup step. The MSFT offload add path can then fail eithe | |
| CVE-2026-72334 | Hig | 8.8 | >= 6.0.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISO_END/CONT handling Core specification (Part C vol 4 sec 5.4.5) does not exclude empty ISO_CONT, ISO_END packets. We currently reject them if they are last. If controller sends | |
| CVE-2026-72333 | — | < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding TX ident") changed ident allocation to use an IDA, releasing idents in l2 | ||
| CVE-2026-72332 | — | >= 6.19.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo() amdxdna_hwctx_sync_debug_bo() invokes the hardware hwctx_sync_debug_bo() callback while holding xdna->dev_lock. The callback may call amdxdna_ | ||
| CVE-2026-72331 | Hig | 7.8 | >= 6.16.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix VMA access race aie2_populate_range() and amdxdna_umap_release() access a saved VMA pointer that may have already been freed, leading to a potential use-after-free. Remove the VMA accesses f | |
| CVE-2026-72330 | Hig | 7.5 | >= 6.6.0, < 6.6.145 | 6.6.145 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tls_sw_read_sock() A peer may send a zero-length TLS application_data record; TLS 1.3 explicitly permits these as a traffic-analysis countermeasure (RFC 8446, Section 5.1) | |
| CVE-2026-72329 | Cri | 9.3 | >= 4.10.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pci_dev LUT The PF SR-IOV enable path caches VF pci_dev pointers in dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those entries do not own a reference, because the i | |
| CVE-2026-72328 | Hig | 7.8 | >= 6.16.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdna_umap lifetime race amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove() before removing the object from abo->mem.umap_list. If aie2_populate_range() runs | |
| CVE-2026-72327 | — | >= 6.8.0, < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or st | ||
| CVE-2026-72326 | — | >= 4.19.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effe | ||
| CVE-2026-72325 | — | >= 5.19.0, < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path Branch Sampling (BRS) and Last Branch Record (LBR) are mutually exclusive hardware features, and users of both are tracked via cpuc->lbr_users. Wh | ||
| CVE-2026-72324 | — | >= 4.9.0, < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: free generic chips on unbind irq_alloc_domain_generic_chips() allocates generic chip data that must be freed via irq_domain_remove_generic_chips(). The devres action mvebu_gpio_remove_irq_domain() | ||
| CVE-2026-72323 | Cri | 9.8 | >= 2.6.12, < 6.6.145 | 6.6.145 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() A race condition exists between device teardown (inetdev_destroy) and incoming IGMP query processing (igmp_rcv), leading to a Use-After-Free in the IGMP ti | |
| CVE-2026-72322 | Cri | 9.8 | >= 2.6.12, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruct |
- CVE-2026-72341Aug 15, 2026affected >= 5.17.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv->channel_stats[] mlx5e_channel_stats_alloc() publishes a new entry to priv->channel_stats[] and then increments priv->stats_nch as a publication token, but neither store
- affected >= 6.2.0, < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: fix races on the shared Super VCAP block The VCAP instances on a chip are not independent, yet they are locked independently. On sparx5 and lan969x the IS0 and IS2 instances are backed by
- affected >= 4.18.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build_skb failure qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a NULL return from qede_build_skb(). When it returns NULL under memory pressure,
- affected >= 4.11.0, < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flow_rule buffer and filling it. [email protected] report
- CVE-2026-72337Aug 15, 2026affected >= 3.19.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpan_enable_set() allocates a temporary work item and schedules do_enable_set() on system_wq, then returns to debugfs. The debugfs active operation has ended at
- CVE-2026-72336Aug 15, 2026affected >= 3.17.0, < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control get_l2cap_conn() looks up an LE hci_conn under hdev protection, but then drops that protection before reading hcon->l2cap_data and before lowpan_contro
- affected >= 5.12.0, < 6.1.178fixed 6.1.178
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci_add_adv_monitor() publishes a new adv_monitor in hdev->adv_monitors_idr before the powered MSFT setup step. The MSFT offload add path can then fail eithe
- affected >= 6.0.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISO_END/CONT handling Core specification (Part C vol 4 sec 5.4.5) does not exclude empty ISO_CONT, ISO_END packets. We currently reject them if they are last. If controller sends
- CVE-2026-72333Aug 15, 2026affected < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding TX ident") changed ident allocation to use an IDA, releasing idents in l2
- CVE-2026-72332Aug 15, 2026affected >= 6.19.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo() amdxdna_hwctx_sync_debug_bo() invokes the hardware hwctx_sync_debug_bo() callback while holding xdna->dev_lock. The callback may call amdxdna_
- affected >= 6.16.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix VMA access race aie2_populate_range() and amdxdna_umap_release() access a saved VMA pointer that may have already been freed, leading to a potential use-after-free. Remove the VMA accesses f
- affected >= 6.6.0, < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tls_sw_read_sock() A peer may send a zero-length TLS application_data record; TLS 1.3 explicitly permits these as a traffic-analysis countermeasure (RFC 8446, Section 5.1)
- affected >= 4.10.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pci_dev LUT The PF SR-IOV enable path caches VF pci_dev pointers in dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those entries do not own a reference, because the i
- affected >= 6.16.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential amdxdna_umap lifetime race amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove() before removing the object from abo->mem.umap_list. If aie2_populate_range() runs
- CVE-2026-72327Aug 15, 2026affected >= 6.8.0, < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or st
- CVE-2026-72326Aug 15, 2026affected >= 4.19.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effe
- CVE-2026-72325Aug 15, 2026affected >= 5.19.0, < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path Branch Sampling (BRS) and Last Branch Record (LBR) are mutually exclusive hardware features, and users of both are tracked via cpuc->lbr_users. Wh
- CVE-2026-72324Aug 15, 2026affected >= 4.9.0, < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: free generic chips on unbind irq_alloc_domain_generic_chips() allocates generic chip data that must be freed via irq_domain_remove_generic_chips(). The devres action mvebu_gpio_remove_irq_domain()
- affected >= 2.6.12, < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() A race condition exists between device teardown (inetdev_destroy) and incoming IGMP query processing (igmp_rcv), leading to a Use-After-Free in the IGMP ti
- affected >= 2.6.12, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruct
Page 33 of 702