linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-68376 | Hig | 8.1 | >= 2.6.24, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_hmacs array size in struct sctp_cookie The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed | |
| CVE-2026-68375 | — | >= 6.10.0, < 7.1.6 | 7.1.6 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle partially initialized auxiliary devices bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. After auxiliary_device_init() suc | ||
| CVE-2026-68374 | Hig | 7.8 | >= 6.9.0, < 6.12.101 | 6.12.101 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: core: sysfs: add lock to bos_descriptors_read() Add a lock to the function bos_descriptors_read(). This function accesses udev->bos, which could be simultaneously freed in usb_reset_and_verify_device(), a | |
| CVE-2026-68373 | Hig | 8.1 | >= 2.6.30, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before subtracting the fixed management-body off | |
| CVE-2026-68372 | — | >= 6.7.0, < 6.12.101 | 6.12.101 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: core: port: Deattach Type-C connector on component unbind connector_unbind() is the mirror of connector_bind(), but it is missing the symmetric call to typec_deattach() that connector_bind() makes via: | ||
| CVE-2026-68371 | Hig | 8.4 | < 6.1.184 | 6.1.184 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed of_node in probe omap2430_probe() stores pdev->dev.of_node in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it. Th | |
| CVE-2026-68370 | Hig | 7.8 | >= 2.6.12, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback dummy_hcd embeds a single shared usb_request (dum->fifo_req) that the "emulated single-request FIFO" fast-path in dummy_queue() reuses for small IN | |
| CVE-2026-68369 | — | >= 4.1.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: printer: fix infinite loop in printer_read() printer_read() uses the same variable for the requested copy size and the number of bytes actually copied to user space. copy_to_user() returns the numb | ||
| CVE-2026-68368 | — | >= 5.9.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length against frame_max but does not verify that the datagram fits within th | ||
| CVE-2026-68367 | — | >= 3.5.0, < 5.10.266 | 5.10.266 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: synchronize delayed set_alt with teardown The f_tcm set_alt() path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses | ||
| CVE-2026-68366 | — | >= 3.10.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer uvc_send_response() builds the UVC control response from a user-supplied struct uvc_request_data: req->length = min_t(unsigned int, uvc->eve | ||
| CVE-2026-68365 | — | >= 2.6.12, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edge_interrupt_callback() adds the 16-bit value to txCredits without checking | ||
| CVE-2026-68364 | — | >= 7.1.0, < 7.1.6 | 7.1.6 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix ISM dc_lock deadlock during suspend [Why] System hang observed during suspend/resume while video is playing. amdgpu_dm_ism_disable() is called under dc_lock and waits for ISM delayed work v | ||
| CVE-2026-68363 | — | >= 4.4.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_dev as the completi | ||
| CVE-2026-68362 | — | >= 6.1.0, < 6.1.183 | 6.1.183 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set unconditionally even when ath11k_core_qmi_firmware_ready() fails. This leav | ||
| CVE-2026-68361 | — | >= 5.11.0, < 5.15.216 | 5.15.216 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the exe | ||
| CVE-2026-68360 | — | >= 5.9.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following | ||
| CVE-2026-68359 | — | >= 5.17.0, < 6.1.183 | 6.1.183 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following | ||
| CVE-2026-68358 | — | >= 6.9.0, < 6.12.101 | 6.12.101 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following | ||
| CVE-2026-68357 | — | >= 4.9.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to `default_gov`. If |
- affected >= 2.6.24, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_hmacs array size in struct sctp_cookie The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed
- CVE-2026-68375Aug 10, 2026affected >= 6.10.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle partially initialized auxiliary devices bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. After auxiliary_device_init() suc
- affected >= 6.9.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: usb: core: sysfs: add lock to bos_descriptors_read() Add a lock to the function bos_descriptors_read(). This function accesses udev->bos, which could be simultaneously freed in usb_reset_and_verify_device(), a
- affected >= 2.6.30, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() at76_guess_freq() checks only that the received frame is at least a bare 802.11 header (24 bytes) before subtracting the fixed management-body off
- CVE-2026-68372Aug 10, 2026affected >= 6.7.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: usb: core: port: Deattach Type-C connector on component unbind connector_unbind() is the mirror of connector_bind(), but it is missing the symmetric call to typec_deattach() that connector_bind() makes via:
- affected < 6.1.184fixed 6.1.184
In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed of_node in probe omap2430_probe() stores pdev->dev.of_node in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it. Th
- affected >= 2.6.12, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback dummy_hcd embeds a single shared usb_request (dum->fifo_req) that the "emulated single-request FIFO" fast-path in dummy_queue() reuses for small IN
- CVE-2026-68369Aug 10, 2026affected >= 4.1.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: printer: fix infinite loop in printer_read() printer_read() uses the same variable for the requested copy size and the number of bytes actually copied to user space. copy_to_user() returns the numb
- CVE-2026-68368Aug 10, 2026affected >= 5.9.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length against frame_max but does not verify that the datagram fits within th
- CVE-2026-68367Aug 10, 2026affected >= 3.5.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: synchronize delayed set_alt with teardown The f_tcm set_alt() path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses
- CVE-2026-68366Aug 10, 2026affected >= 3.10.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer uvc_send_response() builds the UVC control response from a user-supplied struct uvc_request_data: req->length = min_t(unsigned int, uvc->eve
- CVE-2026-68365Aug 10, 2026affected >= 2.6.12, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edge_interrupt_callback() adds the 16-bit value to txCredits without checking
- CVE-2026-68364Aug 10, 2026affected >= 7.1.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix ISM dc_lock deadlock during suspend [Why] System hang observed during suspend/resume while video is playing. amdgpu_dm_ism_disable() is called under dc_lock and waits for ISM delayed work v
- CVE-2026-68363Aug 10, 2026affected >= 4.4.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_dev as the completi
- CVE-2026-68362Aug 10, 2026affected >= 6.1.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set unconditionally even when ath11k_core_qmi_firmware_ready() fails. This leav
- CVE-2026-68361Aug 10, 2026affected >= 5.11.0, < 5.15.216fixed 5.15.216
In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the exe
- CVE-2026-68360Aug 10, 2026affected >= 5.9.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following
- CVE-2026-68359Aug 10, 2026affected >= 5.17.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following
- CVE-2026-68358Aug 10, 2026affected >= 6.9.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following
- CVE-2026-68357Aug 10, 2026affected >= 4.9.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to `default_gov`. If
Page 55 of 702