linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-74633 | — | >= 6.14.0, < 6.18.45 | 6.18.45 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL event_mod->match when foo has not been loaded. If a later write tries to r | ||
| CVE-2026-74632 | — | >= 5.13.0, < 6.12.104 | 6.12.104 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix huge_zero_pfn race Patch series "mm/huge_memory: fix huge_zero_pfn race", v2. There is a subtle race in the reference-counted huge_zero_folio implementation. The fast path atomic logic fai | ||
| CVE-2026-74631 | — | >= 4.18.0, < 6.1.183 | 6.1.183 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc_rx_splice smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB pa | ||
| CVE-2026-74630 | — | >= 2.6.19, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6_dev_get() from resurrecting inet6_dev in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last refer | ||
| CVE-2026-74629 | — | >= 6.18.0, < 6.18.45 | 6.18.45 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmb_clientid_arr A dibs device interrupt handler can be active after dibs_dev_del() and may still access dmb_clientid_arr. (UAF) In case of a failure in dibs_dev_add() being called | ||
| CVE-2026-74628 | — | >= 2.6.12, < 6.18.45 | 6.18.45 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket and a cancel does not wai | ||
| CVE-2026-74627 | — | >= 6.16.0, < 6.18.45 | 6.18.45 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: devmem: prevent net-iov / page mixing We should either have net_iov or page backed frags in a single skb, otherwise it blows up down the stack. Don't allow mixing in zerocopy_fill_skb_from_devmem(). | ||
| CVE-2026-74626 | — | >= 3.9.0, < 7.1.9 | 7.1.9 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_netdev: Preserve RX queue depth on allocation failure ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted | ||
| CVE-2026-74625 | — | >= 5.3.0, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nf_ct_ | ||
| CVE-2026-74624 | — | >= 6.1.0, < 6.6.152 | 6.6.152 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock is still held. When invalid logging is routed to nfnetlink_log and conntra | ||
| CVE-2026-74623 | — | >= 4.11.0, < 6.1.183 | 6.1.183 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free stranded TX buffers on ring deinit aq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean() call, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and stops at hw_hea | ||
| CVE-2026-74622 | — | >= 5.2.0, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aq_ring_rx_deinit() only walks [sw_head, sw_tail), the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer k | ||
| CVE-2026-74621 | — | < 6.6.152 | 6.6.152 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix sk_buff leak when the header checks reject a packet tcf_ct_handle_fragments() runs its header sanity checks before handing anything to the defragmentation engine: if (family == NFPROTO_ | ||
| CVE-2026-74620 | — | >= 5.3.0, < 5.15.216 | 5.15.216 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gact, act_police: range check the fallback control action tcf_action_check_ctrlact() range checks the primary control action: if (!opcode) ret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0; TC_A | ||
| CVE-2026-74619 | — | >= 6.5.0, < 6.6.152 | 6.6.152 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. Nothing ties the task that calls f | ||
| CVE-2026-74618 | — | >= 6.7.0, < 6.12.104 | 6.12.104 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't warn when the mount is completed from another user namespace fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. Nothing ties the task that | ||
| CVE-2026-74617 | — | >= 6.18.0, < 6.18.45 | 6.18.45 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs->lock in dibs_dev_alloc() dibs->lock is initialised by dibs_dev_add(), but a dibs device can already take interrupts before that call: ism_probe() runs ism_dev_init(), and hence request_ir | ||
| CVE-2026-74616 | — | >= 5.14.0, < 5.15.216 | 5.15.216 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal | ||
| CVE-2026-74615 | — | >= 5.0.0, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlan_changelink() arms vxlan->age_timer whenever the requested ageing interval differs from the configured one: if (conf.age_interval != vxlan->cfg | ||
| CVE-2026-74614 | — | < 5.15.216 | 5.15.216 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement |
- CVE-2026-74633Aug 22, 2026affected >= 6.14.0, < 6.18.45fixed 6.18.45
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL event_mod->match when foo has not been loaded. If a later write tries to r
- CVE-2026-74632Aug 22, 2026affected >= 5.13.0, < 6.12.104fixed 6.12.104
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix huge_zero_pfn race Patch series "mm/huge_memory: fix huge_zero_pfn race", v2. There is a subtle race in the reference-counted huge_zero_folio implementation. The fast path atomic logic fai
- CVE-2026-74631Aug 22, 2026affected >= 4.18.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc_rx_splice smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB pa
- CVE-2026-74630Aug 22, 2026affected >= 2.6.19, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6_dev_get() from resurrecting inet6_dev in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last refer
- CVE-2026-74629Aug 22, 2026affected >= 6.18.0, < 6.18.45fixed 6.18.45
In the Linux kernel, the following vulnerability has been resolved: net/dibs: Correct freeing of dmb_clientid_arr A dibs device interrupt handler can be active after dibs_dev_del() and may still access dmb_clientid_arr. (UAF) In case of a failure in dibs_dev_add() being called
- CVE-2026-74628Aug 22, 2026affected >= 2.6.12, < 6.18.45fixed 6.18.45
In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket and a cancel does not wai
- CVE-2026-74627Aug 22, 2026affected >= 6.16.0, < 6.18.45fixed 6.18.45
In the Linux kernel, the following vulnerability has been resolved: net: devmem: prevent net-iov / page mixing We should either have net_iov or page backed frags in a single skb, otherwise it blows up down the stack. Don't allow mixing in zerocopy_fill_skb_from_devmem().
- CVE-2026-74626Aug 22, 2026affected >= 3.9.0, < 7.1.9fixed 7.1.9
In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_netdev: Preserve RX queue depth on allocation failure ntb_netdev_rx_handler() hands the received skb to the network stack before allocating its replacement. If the allocation fails, nothing is reposted
- CVE-2026-74625Aug 22, 2026affected >= 5.3.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nf_ct_
- CVE-2026-74624Aug 22, 2026affected >= 6.1.0, < 6.6.152fixed 6.6.152
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock is still held. When invalid logging is routed to nfnetlink_log and conntra
- CVE-2026-74623Aug 22, 2026affected >= 4.11.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free stranded TX buffers on ring deinit aq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean() call, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and stops at hw_hea
- CVE-2026-74622Aug 22, 2026affected >= 5.2.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aq_ring_rx_deinit() only walks [sw_head, sw_tail), the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer k
- CVE-2026-74621Aug 22, 2026affected < 6.6.152fixed 6.6.152
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix sk_buff leak when the header checks reject a packet tcf_ct_handle_fragments() runs its header sanity checks before handing anything to the defragmentation engine: if (family == NFPROTO_
- CVE-2026-74620Aug 22, 2026affected >= 5.3.0, < 5.15.216fixed 5.15.216
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_gact, act_police: range check the fallback control action tcf_action_check_ctrlact() range checks the primary control action: if (!opcode) ret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0; TC_A
- CVE-2026-74619Aug 22, 2026affected >= 6.5.0, < 6.6.152fixed 6.6.152
In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. Nothing ties the task that calls f
- CVE-2026-74618Aug 22, 2026affected >= 6.7.0, < 6.12.104fixed 6.12.104
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't warn when the mount is completed from another user namespace fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. Nothing ties the task that
- CVE-2026-74617Aug 22, 2026affected >= 6.18.0, < 6.18.45fixed 6.18.45
In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs->lock in dibs_dev_alloc() dibs->lock is initialised by dibs_dev_add(), but a dibs device can already take interrupts before that call: ism_probe() runs ism_dev_init(), and hence request_ir
- CVE-2026-74616Aug 22, 2026affected >= 5.14.0, < 5.15.216fixed 5.15.216
In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal
- CVE-2026-74615Aug 22, 2026affected >= 5.0.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlan_changelink() arms vxlan->age_timer whenever the requested ageing interval differs from the configured one: if (conf.age_interval != vxlan->cfg
- CVE-2026-74614Aug 22, 2026affected < 5.15.216fixed 5.15.216
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement
Page 6 of 702