linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-68456 | — | >= 2.6.16, < 5.10.261 | 5.10.261 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() ueagle-atm uses the asynchronous request_firmware_nowait() in .probe(), but does not wait for its completion, not even in .disconnect(); so, if | ||
| CVE-2026-68455 | — | >= 6.19.0, < 7.1.5 | 7.1.5 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVE_FD is only applicable to outgoing sessions. RETRIEVE_FD and FINISH are only va | ||
| CVE-2026-68454 | Hig | 8.8 | >= 6.0.0, < 6.1.178 | 6.1.178 | Aug 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix handling of AIF enable without AISB When a guest seeks to register IRQs without a summary bit specified, ensure that the associated GAITE then stores 0 for the guest AISB location instead of | |
| CVE-2026-68453 | Hig | 7.1 | >= 5.4.0, < 6.18.44 | 6.18.44 | Aug 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Add validation of both the actual key buffer size and token length fields in all the cca_check_sec*token() functions. Additionally check in cca_gencipherk | |
| CVE-2026-68452 | Hig | 7.8 | >= 5.4.0, < 5.10.265 | 5.10.265 | Aug 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early i | |
| CVE-2026-68451 | Hig | 7.8 | >= 5.10.0, < 5.10.265 | 5.10.265 | Aug 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests cca_ecc2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if | |
| CVE-2026-68450 | — | >= 5.13.0, < 5.15.216 | 5.15.216 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: btrfs: free mapping node on duplicate reloc root insert __add_reloc_root() allocates a mapping_node before inserting it into rc->reloc_root_tree. If rb_simple_insert() finds an existing entry, it returns the e | ||
| CVE-2026-68449 | — | >= 2.6.36, < 5.10.265 | 5.10.265 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning The hand-rolled bit-scanning loop in the NCQ completion path has an infinite loop bug. When tag_mask has only high bits set (e.g. 0x800 | ||
| CVE-2026-68448 | — | >= 5.3.0, < 6.18.42 | 6.18.42 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_range() f_op to dec | ||
| CVE-2026-68447 | Hig | 7.1 | >= 5.18.0, < 7.1.6 | 7.1.6 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without bounding it to the allocated BO region. If the | |
| CVE-2026-68446 | Hig | 7.8 | >= 5.7.0, < 5.10.265 | 5.10.265 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmw_surface_metadata::array_size This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM) is available. | |
| CVE-2026-68445 | Hig | 7.8 | >= 4.5.0, < 6.6.148 | 6.6.148 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4_gem_object_mmap() rejects a writable mapping of a validated shader BO, but leaves VM_MAYWRITE set. Userspace can map the BO read-only and then tur | |
| CVE-2026-68444 | — | >= 5.14.0, < 5.15.216 | 5.15.216 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a caller passes NULL, uuid_parse() -> __uuid_pars | ||
| CVE-2026-68443 | — | >= 6.8.0, < 6.12.101 | 6.12.101 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately fo | ||
| CVE-2026-68442 | Hig | 7.8 | >= 6.8.0, < 6.12.101 | 6.12.101 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps When btrfs_drop_extent_map_range() splits an extent map, the new split maps inherit the original map's flags through a local 'flags' variable. Com | |
| CVE-2026-68441 | — | >= 4.4.0, < 7.1.6 | 7.1.6 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an act_bpf action), the re | ||
| CVE-2026-68440 | Hig | 7.8 | >= 6.19.0, < 7.1.6 | 7.1.6 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: txgbe: fix heap overflow when reading module EEPROM txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into the caller buffer, which ethtool allocates with exactly 'length' bytes. A non-4-a | |
| CVE-2026-68439 | — | >= 6.7.0, < 6.12.101 | 6.12.101 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() mt76_connac_get_he_phy_cap routine can theoretically return NULL so check cap pointer before dereferencing it. | ||
| CVE-2026-68438 | — | >= 7.1.0, < 7.1.6 | 7.1.6 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: smp: Make CSD lock acquisition atomic for debug mode Commit b0473dcd4b1d ("smp: Improve smp_call_function_single() CSD-lock diagnostics") changed smp_call_function_single() so that, when CSD lock debugging is e | ||
| CVE-2026-68437 | — | >= 6.8.0, < 6.12.101 | 6.12.101 | Aug 12, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fit paired fragment job in the correct CCCB For geometry jobs with a paired fragment job, at the moment, the DRM scheduler's prepare_job() callback: - checks for internal (driver) dependencies |
- CVE-2026-68456Aug 15, 2026affected >= 2.6.16, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() ueagle-atm uses the asynchronous request_firmware_nowait() in .probe(), but does not wait for its completion, not even in .disconnect(); so, if
- CVE-2026-68455Aug 15, 2026affected >= 6.19.0, < 7.1.5fixed 7.1.5
In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVE_FD is only applicable to outgoing sessions. RETRIEVE_FD and FINISH are only va
- affected >= 6.0.0, < 6.1.178fixed 6.1.178
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix handling of AIF enable without AISB When a guest seeks to register IRQs without a summary bit specified, ensure that the associated GAITE then stores 0 for the guest AISB location instead of
- affected >= 5.4.0, < 6.18.44fixed 6.18.44
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Add validation of both the actual key buffer size and token length fields in all the cca_check_sec*token() functions. Additionally check in cca_gencipherk
- affected >= 5.4.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early i
- affected >= 5.10.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests cca_ecc2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if
- CVE-2026-68450Aug 12, 2026affected >= 5.13.0, < 5.15.216fixed 5.15.216
In the Linux kernel, the following vulnerability has been resolved: btrfs: free mapping node on duplicate reloc root insert __add_reloc_root() allocates a mapping_node before inserting it into rc->reloc_root_tree. If rb_simple_insert() finds an existing entry, it returns the e
- CVE-2026-68449Aug 12, 2026affected >= 2.6.36, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning The hand-rolled bit-scanning loop in the NCQ completion path has an infinite loop bug. When tag_mask has only high bits set (e.g. 0x800
- CVE-2026-68448Aug 12, 2026affected >= 5.3.0, < 6.18.42fixed 6.18.42
In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_range() f_op to dec
- affected >= 5.18.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without bounding it to the allocated BO region. If the
- affected >= 5.7.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmw_surface_metadata::array_size This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM) is available.
- affected >= 4.5.0, < 6.6.148fixed 6.6.148
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4_gem_object_mmap() rejects a writable mapping of a validated shader BO, but leaves VM_MAYWRITE set. Userspace can map the BO read-only and then tur
- CVE-2026-68444Aug 12, 2026affected >= 5.14.0, < 5.15.216fixed 5.15.216
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a caller passes NULL, uuid_parse() -> __uuid_pars
- CVE-2026-68443Aug 12, 2026affected >= 6.8.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately fo
- affected >= 6.8.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps When btrfs_drop_extent_map_range() splits an extent map, the new split maps inherit the original map's flags through a local 'flags' variable. Com
- CVE-2026-68441Aug 12, 2026affected >= 4.4.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an act_bpf action), the re
- affected >= 6.19.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: net: txgbe: fix heap overflow when reading module EEPROM txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into the caller buffer, which ethtool allocates with exactly 'length' bytes. A non-4-a
- CVE-2026-68439Aug 12, 2026affected >= 6.7.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() mt76_connac_get_he_phy_cap routine can theoretically return NULL so check cap pointer before dereferencing it.
- CVE-2026-68438Aug 12, 2026affected >= 7.1.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: smp: Make CSD lock acquisition atomic for debug mode Commit b0473dcd4b1d ("smp: Improve smp_call_function_single() CSD-lock diagnostics") changed smp_call_function_single() so that, when CSD lock debugging is e
- CVE-2026-68437Aug 12, 2026affected >= 6.8.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fit paired fragment job in the correct CCCB For geometry jobs with a paired fragment job, at the moment, the DRM scheduler's prepare_job() callback: - checks for internal (driver) dependencies
Page 51 of 702