linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-72060 | — | >= 6.16.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssg_ndo_get_stats64() unconditionally calls emac_get_stat_by_name() with FW PA stat names regardless of whether the PA stats block is present on the hardware. | ||
| CVE-2026-72059 | — | >= 5.19.0, < 6.1.178 | 6.1.178 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xx_cldma_late_init() creates md_ctrl->gpd_dmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees t | ||
| CVE-2026-72058 | — | >= 5.14.0, < 5.15.217 | 5.15.217 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: ixp4xx_hss: fix duplicate HDLC netdev allocation ixp4xx_hss_probe() allocates two HDLC netdevs. The first one is stored in ndev, initialized, and registered with register_hdlc_device(). The second one is s | ||
| CVE-2026-72057 | Hig | 8.2 | < 5.15.217 | 5.15.217 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb across defragmentation tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases the | |
| CVE-2026-72056 | — | >= 5.6.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: ena: clean up XDP TX queues when regular TX setup fails create_queues_with_size_backoff() creates XDP TX queues before setting up the regular TX path. If the subsequent allocation or creation of regular TX | ||
| CVE-2026-72055 | Hig | 8.8 | >= 3.15.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink vti6_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in o | |
| CVE-2026-72054 | Hig | 8.8 | >= 3.15.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink vti_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or | |
| CVE-2026-72053 | Hig | 8.8 | >= 3.12.0, < 5.10.266 | 5.10.266 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAP_NET_ADMIN in the device netns for changelink ipip_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or m | |
| CVE-2026-72052 | Hig | 8.8 | >= 5.5.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ onc | |
| CVE-2026-72051 | Hig | 8.8 | >= 3.12.0, < 5.10.266 | 5.10.266 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink ip6_tnl_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is create | |
| CVE-2026-72050 | — | >= 6.9.0, < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Free BPID bitmap on setup failure nix_setup_bpids() allocates bp->bpids with rvu_alloc_bitmap(), which uses a plain kcalloc(). If any of the following devm_kcalloc() allocations for the BPID mappi | ||
| CVE-2026-72049 | Hig | 7.1 | >= 3.16.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV, LLSEC_LIST_DEVKEY, LLSEC | |
| CVE-2026-72048 | — | >= 4.12.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix cas_ctl leak on spi_async failure ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC) and relies entirely on the SPI completion callback ca8210_spi_transfer_complete() t | ||
| CVE-2026-72047 | — | >= 4.12.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as | ||
| CVE-2026-72046 | Cri | 9.8 | >= 6.9.0, < 6.12.101 | 6.12.101 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor header_buf_addr at post time and reads the split header back at completion time. Both th | |
| CVE-2026-72045 | Hig | 8.8 | >= 5.14.0, < 5.15.217 | 5.15.217 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base | |
| CVE-2026-72043 | Hig | 7.1 | >= 5.19.0, < 6.1.178 | 6.1.178 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() When hardware page table walker (PTW) is enabled on LoongArch, the CPU may set _PAGE_DIRTY directly in the page table entry during a write TLB | |
| CVE-2026-72042 | Hig | 7.8 | >= 6.18.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the receive message, and ipmi_free_recv_msg() drops it again. If event delivery fails af | |
| CVE-2026-72041 | Cri | 9.8 | >= 5.6.0, < 5.10.266 | 5.10.266 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: espintcp: use sk_msg_free_partial to fix partial send sk_msg_free_partial() ensures consistency of the skmsg at every iteration, without having to manually handle uncharges and offsets. This simplifies the code | |
| CVE-2026-72040 | — | < 6.1.184 | 6.1.184 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ipmi: fix refcount leak in i_ipmi_request() When a caller provides a `supplied_recv` message to i_ipmi_request(), the function increments the user's `nr_msgs` reference count. If an error occurs later, the out_ |
- CVE-2026-72060Aug 15, 2026affected >= 6.16.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssg_ndo_get_stats64() unconditionally calls emac_get_stat_by_name() with FW PA stat names regardless of whether the PA stats block is present on the hardware.
- CVE-2026-72059Aug 15, 2026affected >= 5.19.0, < 6.1.178fixed 6.1.178
In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xx_cldma_late_init() creates md_ctrl->gpd_dmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees t
- CVE-2026-72058Aug 15, 2026affected >= 5.14.0, < 5.15.217fixed 5.15.217
In the Linux kernel, the following vulnerability has been resolved: net: ixp4xx_hss: fix duplicate HDLC netdev allocation ixp4xx_hss_probe() allocates two HDLC netdevs. The first one is stored in ndev, initialized, and registered with register_hdlc_device(). The second one is s
- affected < 5.15.217fixed 5.15.217
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb across defragmentation tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases the
- CVE-2026-72056Aug 15, 2026affected >= 5.6.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: net: ena: clean up XDP TX queues when regular TX setup fails create_queues_with_size_backoff() creates XDP TX queues before setting up the regular TX path. If the subsequent allocation or creation of regular TX
- affected >= 3.15.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink vti6_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in o
- affected >= 3.15.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink vti_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or
- affected >= 3.12.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAP_NET_ADMIN in the device netns for changelink ipip_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or m
- affected >= 5.5.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ onc
- affected >= 3.12.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink ip6_tnl_changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is create
- CVE-2026-72050Aug 15, 2026affected >= 6.9.0, < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Free BPID bitmap on setup failure nix_setup_bpids() allocates bp->bpids with rvu_alloc_bitmap(), which uses a plain kcalloc(). If any of the following devm_kcalloc() allocations for the BPID mappi
- affected >= 3.16.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV, LLSEC_LIST_DEVKEY, LLSEC
- CVE-2026-72048Aug 15, 2026affected >= 4.12.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix cas_ctl leak on spi_async failure ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC) and relies entirely on the SPI completion callback ca8210_spi_transfer_complete() t
- CVE-2026-72047Aug 15, 2026affected >= 4.12.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as
- affected >= 6.9.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor header_buf_addr at post time and reads the split header back at completion time. Both th
- affected >= 5.14.0, < 5.15.217fixed 5.15.217
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base
- affected >= 5.19.0, < 6.1.178fixed 6.1.178
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() When hardware page table walker (PTW) is enabled on LoongArch, the CPU may set _PAGE_DIRTY directly in the page table entry during a write TLB
- affected >= 6.18.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the receive message, and ipmi_free_recv_msg() drops it again. If event delivery fails af
- affected >= 5.6.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: espintcp: use sk_msg_free_partial to fix partial send sk_msg_free_partial() ensures consistency of the skmsg at every iteration, without having to manually handle uncharges and offsets. This simplifies the code
- CVE-2026-72040Aug 15, 2026affected < 6.1.184fixed 6.1.184
In the Linux kernel, the following vulnerability has been resolved: ipmi: fix refcount leak in i_ipmi_request() When a caller provides a `supplied_recv` message to i_ipmi_request(), the function increments the user's `nr_msgs` reference count. If an error occurs later, the out_
Page 47 of 702