kernel

Vulnerabilities (14,027)

• CVE-2026-74673Aug 22, 2026
  affected < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdev_pass_values() In evdev_pass_values(), the input_event structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized

• CVE-2026-74672Aug 22, 2026
  affected >= 4.16.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into two broad categories

• CVE-2026-74671Aug 22, 2026
  affected >= 3.13.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattr_verify() The digest-length check in xattr_verify() mixes int and size_t: if (xattr_len - sizeof(xattr_value->type) - hash_start >= iint->ima_hash->length) sizeof() yie

• CVE-2026-74670Aug 22, 2026
  affected >= 6.2.0, < 6.6.152fixed 6.6.152

  In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs->enable

• CVE-2026-74669Aug 22, 2026
  affected >= 3.7.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt stil

• CVE-2026-74668Aug 22, 2026
  affected >= 2.6.31, < 6.6.152fixed 6.6.152

  In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in TX_RING send path tpacket_snd() reads dev->hard_header_len independently for skb allocation and header construction in tpacket_fill_skb(). Concurrent netdevice reconfig

• CVE-2026-74667Aug 22, 2026
  affected >= 5.1.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packet_parse_headers() resets the MAC header only for a SOCK_RAW frame whose socket did not bind a protocol. A protocol-bound SOCK_RAW socket,

• CVE-2026-74666Aug 22, 2026
  affected >= 4.2.0, < 6.6.152fixed 6.6.152

  In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packet_set_ring() updates the RX ring state under sk_receive_queue.lock, but used to publish the tpacket receive mode through po->prot_hook.func a

• CVE-2026-74665Aug 22, 2026
  affected >= 6.9.0, < 6.12.104fixed 6.12.104

  In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdp_buff. If an XDP program adjusts the fragment area, bpf_prog_run_generic_xdp() copies

• CVE-2026-74664Aug 22, 2026
  affected >= 4.0.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovs_flow_cmd_new() preallocates the optional reply skb before it takes ovs_mutex and before it knows which existing flow will be updated. That is

• CVE-2026-74663Aug 22, 2026
  affected >= 2.6.12, < 6.1.183fixed 6.1.183

  In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-g

• CVE-2026-74662Aug 22, 2026
  affected >= 4.17.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the

• CVE-2026-74661Aug 22, 2026
  affected >= 6.3.0, < 6.6.152fixed 6.6.152

  In the Linux kernel, the following vulnerability has been resolved: mac802154: fix netdev use-after-free in beacon worker mac802154_beacon_worker() reads local->beacon_req under RCU and derives the sub-interface from the request, but then drops the RCU read lock and continues t

• CVE-2026-74660Aug 22, 2026
  affected >= 4.12.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ebt_nflog: pin the NFLOG backend nf_log_unregister() runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebt_n

• CVE-2026-74659Aug 22, 2026
  affected >= 5.14.0, < 5.15.216fixed 5.15.216

  In the Linux kernel, the following vulnerability has been resolved: net: bridge: mrp: fix uninitialised bytes on the wire br_mrp_alloc_test_skb() builds MRP test frames on an skb from dev_alloc_skb(), which does not clear the linear data area. On the MRA ring-role branch the s

• CVE-2026-74658Aug 22, 2026
  affected >= 5.5.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: futex: Prevent robust futex exit race some more A robust futex unlock stores 0 over the whole futex value - wiping FUTEX_WAITERS - and wakes a single waiter. That wakeup is a one-shot notification: the protocol

• CVE-2026-74657Aug 22, 2026
  affected >= 5.2.0, < 5.15.216fixed 5.15.216

  In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops fib_nlmsg_size() still estimates nexthop space as if every gateway is encoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which

• CVE-2026-74656Aug 22, 2026
  affected >= 4.19.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fib_nhc_update_mtu() fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcu_dereferen

• CVE-2026-74655Aug 22, 2026
  affected >= 6.3.0, < 6.12.104fixed 6.12.104

  In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uart_ops does not pro

• CVE-2026-74654Aug 22, 2026
  affected >= 3.19.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dma: Clear stale RX state on shutdown serial8250_release_dma() terminates RX DMA and releases the channel, but leaves rx_running set. If the port is closed while an RX transfer is active, the stal