linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-68416 | — | >= 6.6.0, < 6.6.148 | 6.6.148 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARN_ON in add_mtd_device() error paths When device_register() or mtd_nvmem_add() fails inside add_mtd_device() for a partition, the error handling triggers mtd_release() via put_device | ||
| CVE-2026-68415 | Hig | 7.8 | >= 6.14.0, < 6.18.42 | 6.18.42 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrm_state_gc_task can run long after a failed IPTFS state setup. In the reproduced case, __xfrm_init_state() cached x->mode_cbs, IPTFS setup returned -ENOMEM | |
| CVE-2026-68414 | Hig | 7.5 | >= 3.0.0, < 5.15.216 | 5.15.216 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211_sched_scan_results() can queue rdev->sched_scan_res_wk from a driver result notification while a scheduled scan request is present. The work | |
| CVE-2026-68413 | — | >= 2.6.14, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() The memory allocated in the ipw2100_alloc_device() function is not freed in some of the error paths in ipw2100_pci_init_one(). Fix that by conv | ||
| CVE-2026-68412 | — | >= 2.6.30, < 6.18.42 | 6.18.42 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() If the test against IEEE80211_MAX_SSID_LEN fails, then 'creq' leaks. Use the existing error handling path to fix it. | ||
| CVE-2026-68411 | — | >= 5.7.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: clamp virtio RX length before skb_put hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend repor | ||
| CVE-2026-68410 | — | >= 3.13.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helper_firmware_cb() helper_firmware_cb() neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download | ||
| CVE-2026-68409 | Hig | 8.8 | >= 6.0.0, < 6.18.42 | 6.18.42 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: sta_info_free_link(&alloc->inf | |
| CVE-2026-68408 | — | < 6.12.101 | 6.12.101 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock When a netlink socket that owns a PMSR session is closed, cfg80211_release_pmsr() clears the request's nl_portid and queues pmsr_free_wk to cal | ||
| CVE-2026-68407 | — | < 6.1.183 | 6.1.183 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211_parse_beacon() rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon | ||
| CVE-2026-68406 | — | >= 5.0.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate PMSR FTM preamble range PMSR FTM request parsing accepts preamble values outside the enumerated nl80211 preamble range. Reject out-of-range values before using them in the parser capab | ||
| CVE-2026-68405 | — | >= 3.9.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock ieee80211_do_stop() removes AP_VLAN packets from the parent AP ps->bc_buf while holding ps->bc_buf.lock with IRQs disabled. It then calls ieee80211_free | ||
| CVE-2026-68404 | Hig | 7.8 | >= 4.11.0, < 7.1.6 | 7.1.6 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a connection, the no | |
| CVE-2026-68403 | — | >= 4.1.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before allocating the ordered workqueue. If that allocation fails, the function jumps t | ||
| CVE-2026-68402 | Hig | 7.1 | >= 5.2.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211_is_element_inherited() reads the first data octet of the candidate element (id = elem->data[0]) to look it up in an extension non-inh | |
| CVE-2026-68401 | Hig | 7.8 | >= 6.4.0, < 6.18.42 | 6.18.42 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() Sashiko (locally) reports multiple out-of-bound issues in ffa_setup_and_transmit: 1) Writing ep_mem_access->reserved can write out of bound | |
| CVE-2026-68400 | Hig | 7.8 | >= 6.7.0, < 6.18.42 | 6.18.42 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's `ep_mem_offset` to calculate the start of the endpoint memory access array and to comply with the FF-A spec inste | |
| CVE-2026-68399 | Hig | 7.8 | >= 5.2.0, < 7.1.6 | 7.1.6 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage before bailouts that access it"), sk_clone() performs an initial shallow copy of the socket field - | |
| CVE-2026-68398 | Hig | 7.8 | >= 4.15.0, < 5.15.216 | 5.15.216 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path: l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv() -> ppp_input | |
| CVE-2026-68397 | Hig | 8.8 | >= 3.2.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucv_hs_rcv() afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*( |
- CVE-2026-68416Aug 10, 2026affected >= 6.6.0, < 6.6.148fixed 6.6.148
In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARN_ON in add_mtd_device() error paths When device_register() or mtd_nvmem_add() fails inside add_mtd_device() for a partition, the error handling triggers mtd_release() via put_device
- affected >= 6.14.0, < 6.18.42fixed 6.18.42
In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrm_state_gc_task can run long after a failed IPTFS state setup. In the reproduced case, __xfrm_init_state() cached x->mode_cbs, IPTFS setup returned -ENOMEM
- affected >= 3.0.0, < 5.15.216fixed 5.15.216
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211_sched_scan_results() can queue rdev->sched_scan_res_wk from a driver result notification while a scheduled scan request is present. The work
- CVE-2026-68413Aug 10, 2026affected >= 2.6.14, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() The memory allocated in the ipw2100_alloc_device() function is not freed in some of the error paths in ipw2100_pci_init_one(). Fix that by conv
- CVE-2026-68412Aug 10, 2026affected >= 2.6.30, < 6.18.42fixed 6.18.42
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() If the test against IEEE80211_MAX_SSID_LEN fails, then 'creq' leaks. Use the existing error handling path to fix it.
- CVE-2026-68411Aug 10, 2026affected >= 5.7.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: clamp virtio RX length before skb_put hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend repor
- CVE-2026-68410Aug 10, 2026affected >= 3.13.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helper_firmware_cb() helper_firmware_cb() neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download
- affected >= 6.0.0, < 6.18.42fixed 6.18.42
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: sta_info_free_link(&alloc->inf
- CVE-2026-68408Aug 10, 2026affected < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock When a netlink socket that owns a PMSR session is closed, cfg80211_release_pmsr() clears the request's nl_portid and queues pmsr_free_wk to cal
- CVE-2026-68407Aug 10, 2026affected < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211_parse_beacon() rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon
- CVE-2026-68406Aug 10, 2026affected >= 5.0.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate PMSR FTM preamble range PMSR FTM request parsing accepts preamble values outside the enumerated nl80211 preamble range. Reject out-of-range values before using them in the parser capab
- CVE-2026-68405Aug 10, 2026affected >= 3.9.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock ieee80211_do_stop() removes AP_VLAN packets from the parent AP ps->bc_buf while holding ps->bc_buf.lock with IRQs disabled. It then calls ieee80211_free
- affected >= 4.11.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a connection, the no
- CVE-2026-68403Aug 10, 2026affected >= 4.1.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before allocating the ordered workqueue. If that allocation fails, the function jumps t
- affected >= 5.2.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211_is_element_inherited() reads the first data octet of the candidate element (id = elem->data[0]) to look it up in an extension non-inh
- affected >= 6.4.0, < 6.18.42fixed 6.18.42
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() Sashiko (locally) reports multiple out-of-bound issues in ffa_setup_and_transmit: 1) Writing ep_mem_access->reserved can write out of bound
- affected >= 6.7.0, < 6.18.42fixed 6.18.42
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's `ep_mem_offset` to calculate the start of the endpoint memory access array and to comply with the FF-A spec inste
- affected >= 5.2.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage before bailouts that access it"), sk_clone() performs an initial shallow copy of the socket field -
- affected >= 4.15.0, < 5.15.216fixed 5.15.216
In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path: l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv() -> ppp_input
- affected >= 3.2.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucv_hs_rcv() afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*(
Page 53 of 702