kernel

Vulnerabilities (14,027)

• CVE-2026-74653Aug 22, 2026
  affected < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART (PORT_LPC3220) can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UART_IIR_RX_TIMEOUT (0x0c) b

• CVE-2026-74652Aug 22, 2026
  affected >= 6.14.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ firs

• CVE-2026-74651Aug 22, 2026
  affected >= 4.12.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() rtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-

• CVE-2026-74650Aug 22, 2026
  affected >= 4.12.0, < 5.15.216fixed 5.15.216

  In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMM_param_handler() WMM_param_handler() copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, caus

• CVE-2026-74649Aug 22, 2026
  affected >= 4.12.0, < 5.15.216fixed 5.15.216

  In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixe

• CVE-2026-74648Aug 22, 2026
  affected >= 4.12.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 hea

• CVE-2026-74647Aug 22, 2026
  affected >= 5.5.0, < 6.6.152fixed 6.6.152

  In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Remove buffer from list prior to unmap operation fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can creat

• CVE-2026-74646Aug 22, 2026
  affected >= 6.2.0, < 6.6.152fixed 6.6.152

  In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, wait_for_completion_interruptible() returns -ERESTARTSYS and fastrpc_internal_invoke() moves every

• CVE-2026-74645Aug 22, 2026
  affected >= 7.0.0, < 7.1.9fixed 7.1.9

  In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru_sort: error out for >10000 active_mem_bp damos_quota_score() can trigger division by zero if the target value is zero. DAMON_LRU_SORT lets users set the target value for the hot memory scheme via

• CVE-2026-74644Aug 22, 2026
  affected >= 6.17.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: putback folios on invalid migrate nid damon_pa_migrate() and damos_va_migrate() isolate folios into a local list and then call damon_migrate_pages(). When target_nid is invalid (including

• CVE-2026-74643Aug 22, 2026
  affected >= 6.17.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damos_quota_score()". DAMON_SAMPLE_MTIER and DAMON_LRU_SORT allow the user to trigger divisi

• CVE-2026-74642Aug 22, 2026
  affected >= 6.6.151, < 6.6.152fixed 6.6.152

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in ump_to_endpoint() caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed

• CVE-2026-74641Aug 22, 2026
  affected >= 2.6.12, < 5.15.216fixed 5.15.216

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf->pgoff << PAGE_SHIFT; vaddr = (char *)(...

• CVE-2026-74640Aug 22, 2026
  affected >= 6.14.0, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcp_meter_ctl_get() fcp_ioctl_set_meter_map() bounds the user-supplied Level Meter map size by the driver's own limit of 255 if (map.map_size < 1 || map.map_size > 255 || map.

• CVE-2026-74639Aug 22, 2026
  affected >= 6.18.39, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission capture_urb_complete() resubmits each capture URB without anchoring it: usb_get_urb(urb); ret = usb_submit_urb(urb, GFP_ATOMIC); Anchoring is a proper

• CVE-2026-74638Aug 22, 2026
  affected < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues (BIN, RENDER, TFU and CSD) but has only a single, global reset. A timeout on any one queue therefore has to stop

• CVE-2026-74637Aug 22, 2026
  affected >= 2.6.35, < 6.18.45fixed 6.18.45

  In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perf_group_detach() handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton event

• CVE-2026-74636Aug 22, 2026
  affected < 5.15.216fixed 5.15.216

  In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between update_event_fields and, event_define_fields The following sequence may leads race between event_define_fields() and update_event_fields(): CPU0 (loads module A)

• CVE-2026-74635Aug 22, 2026
  affected < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_cursor() bit_cursor() fetches the glyph under the cursor with c = scr_readw(vc_pos); src = vc_font.data + ((c & charmask) * w * height); where charmask is 0x1f

• CVE-2026-74634Aug 22, 2026
  affected >= 6.8.0, < 6.12.104fixed 6.12.104

  In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ring_buffer_subbuf_order_set() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of us