linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-72019 | Hig | 7.3 | >= 4.6.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsec_encrypt() macsec_encrypt() reads the Ethernet header via eth_hdr(skb) (skb->head + skb->mac_header) to memmove() the 12 source/destination MAC bytes forward and | |
| CVE-2026-72018 | Hig | 7.8 | >= 6.10.0, < 6.12.97 | 6.12.97 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in move_data() The loopback move_data() performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardwar | |
| CVE-2026-72017 | — | >= 2.6.20, < 6.1.184 | 6.1.184 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue->tx_skb which gets freed without remorse nor | ||
| CVE-2026-72016 | — | >= 6.15.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable() On arm64, when booting with `maxcpus` greater than the number of present CPUs (e.g., QEMU -smp cpus=4,maxcpus=8), some CPUs are marked as 'present' bu | ||
| CVE-2026-72015 | — | >= 4.19.0, < 5.10.266 | 5.10.266 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list A pseudo-locked group's RMID is freed when it is created. On unmount rmdir_all_sub() unconditionally frees all RMID of all groups, resultin | ||
| CVE-2026-72014 | Cri | 9.8 | >= 2.6.33, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the | |
| CVE-2026-72013 | — | < 5.15.212 | 5.15.212 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machine_kexec_prepare() A NULL pointer dereference issue is noticed in riscv's machine_kexec_prepare(), where image->segment[i].buf might be NULL and copied unchecked. | ||
| CVE-2026-72012 | Hig | 7.8 | >= 5.17.0, < 6.1.184 | 6.1.184 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Call synchronize_rcu() when unregistering This ensures that any RCU readers traversing the instance list have finished, before releasing the reference on the tracer that the instance points to. | |
| CVE-2026-72011 | — | >= 6.14.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: s390/diag: Add missing array_index_nospec() call to memtop_get_page_count() 'level' is user space controlled and used to read from an array. Add the missing array_index_nospec() call to prevent speculative exec | ||
| CVE-2026-72010 | — | >= 3.17.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed Creating a child cpuset where cpuset.mems is never set leads to a div/0 when a VMA mempolicy with MPOL_F_RELATIVE_NODES rebinds in response | ||
| CVE-2026-72009 | Hig | 7.8 | >= 6.1.0, < 6.18.42 | 6.18.42 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI The MIPI DSI and CSI domains share control bits for clock and reset, which can lead to incorrect behavior if one domain disables the shared res | |
| CVE-2026-72008 | — | >= 6.19.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HW_VOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECT_CTL domains, but only | ||
| CVE-2026-72007 | — | >= 6.1.0, < 6.6.145 | 6.6.145 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx: Fix i.MX8MP VC8000E power up sequence Per errata[1]: ERR050531: VPU_NOC power down handshake may hang during VC8000E/VPUMIX power up/down cycling. Description: VC8000E reset de-assertion edge and | ||
| CVE-2026-72006 | — | >= 6.17.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5_st_idx_data on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints (e.g. churning RDMA MRs) leak one struct mlx5_st_idx_data per cycle; kmemlea | ||
| CVE-2026-72005 | Hig | 7.8 | >= 2.6.39, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for all probe failures. However, drv_data allocation and workqueue allocation can | |
| CVE-2026-72004 | — | >= 4.20.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211_register_hw() If kmemdup() fails while copying supported band structures, the error path jumps to fail_rate. This skips rate_control_deinitialize() and leaks the ini | ||
| CVE-2026-72003 | Hig | 8.8 | >= 6.16.0, < 6.18.40 | 6.18.40 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: | |
| CVE-2026-68479 | Hig | 7.8 | >= 4.2.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make th | |
| CVE-2026-68478 | — | >= 3.12.0, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: memstick: ms_block: reject a card that reports too many blocks msb_ftl_initialize() computes the zone count from the card block count with no bound: msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE; .. | ||
| CVE-2026-68477 | Cri | 9.8 | >= 2.6.28, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provid |
- affected >= 4.6.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsec_encrypt() macsec_encrypt() reads the Ethernet header via eth_hdr(skb) (skb->head + skb->mac_header) to memmove() the 12 source/destination MAC bytes forward and
- affected >= 6.10.0, < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in move_data() The loopback move_data() performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardwar
- CVE-2026-72017Aug 15, 2026affected >= 2.6.20, < 6.1.184fixed 6.1.184
In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue->tx_skb which gets freed without remorse nor
- CVE-2026-72016Aug 15, 2026affected >= 6.15.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable() On arm64, when booting with `maxcpus` greater than the number of present CPUs (e.g., QEMU -smp cpus=4,maxcpus=8), some CPUs are marked as 'present' bu
- CVE-2026-72015Aug 15, 2026affected >= 4.19.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list A pseudo-locked group's RMID is freed when it is created. On unmount rmdir_all_sub() unconditionally frees all RMID of all groups, resultin
- affected >= 2.6.33, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the
- CVE-2026-72013Aug 15, 2026affected < 5.15.212fixed 5.15.212
In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machine_kexec_prepare() A NULL pointer dereference issue is noticed in riscv's machine_kexec_prepare(), where image->segment[i].buf might be NULL and copied unchecked.
- affected >= 5.17.0, < 6.1.184fixed 6.1.184
In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Call synchronize_rcu() when unregistering This ensures that any RCU readers traversing the instance list have finished, before releasing the reference on the tracer that the instance points to.
- CVE-2026-72011Aug 15, 2026affected >= 6.14.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: s390/diag: Add missing array_index_nospec() call to memtop_get_page_count() 'level' is user space controlled and used to read from an array. Add the missing array_index_nospec() call to prevent speculative exec
- CVE-2026-72010Aug 15, 2026affected >= 3.17.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed Creating a child cpuset where cpuset.mems is never set leads to a div/0 when a VMA mempolicy with MPOL_F_RELATIVE_NODES rebinds in response
- affected >= 6.1.0, < 6.18.42fixed 6.18.42
In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI The MIPI DSI and CSI domains share control bits for clock and reset, which can lead to incorrect behavior if one domain disables the shared res
- CVE-2026-72008Aug 15, 2026affected >= 6.19.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HW_VOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECT_CTL domains, but only
- CVE-2026-72007Aug 15, 2026affected >= 6.1.0, < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx: Fix i.MX8MP VC8000E power up sequence Per errata[1]: ERR050531: VPU_NOC power down handshake may hang during VC8000E/VPUMIX power up/down cycling. Description: VC8000E reset de-assertion edge and
- CVE-2026-72006Aug 15, 2026affected >= 6.17.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5_st_idx_data on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints (e.g. churning RDMA MRs) leak one struct mlx5_st_idx_data per cycle; kmemlea
- affected >= 2.6.39, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for all probe failures. However, drv_data allocation and workqueue allocation can
- CVE-2026-72004Aug 15, 2026affected >= 4.20.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211_register_hw() If kmemdup() fails while copying supported band structures, the error path jumps to fail_rate. This skips rate_control_deinitialize() and leaks the ini
- affected >= 6.16.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header offset subtracted:
- affected >= 4.2.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make th
- CVE-2026-68478Aug 15, 2026affected >= 3.12.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: memstick: ms_block: reject a card that reports too many blocks msb_ftl_initialize() computes the zone count from the card block count with no bound: msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE; ..
- affected >= 2.6.28, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provid
Page 49 of 702