linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,119)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-68368 | — | >= 5.9.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length against frame_max but does not verify that the datagram fits within th | ||
| CVE-2026-68367 | — | >= 3.5.0, < 5.10.266 | 5.10.266 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: synchronize delayed set_alt with teardown The f_tcm set_alt() path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses | ||
| CVE-2026-68366 | — | >= 3.10.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer uvc_send_response() builds the UVC control response from a user-supplied struct uvc_request_data: req->length = min_t(unsigned int, uvc->eve | ||
| CVE-2026-68365 | — | >= 2.6.12, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edge_interrupt_callback() adds the 16-bit value to txCredits without checking | ||
| CVE-2026-68364 | — | >= 7.1.0, < 7.1.6 | 7.1.6 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix ISM dc_lock deadlock during suspend [Why] System hang observed during suspend/resume while video is playing. amdgpu_dm_ism_disable() is called under dc_lock and waits for ISM delayed work v | ||
| CVE-2026-68363 | — | >= 4.4.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_dev as the completi | ||
| CVE-2026-68362 | — | >= 6.1.0, < 6.1.183 | 6.1.183 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set unconditionally even when ath11k_core_qmi_firmware_ready() fails. This leav | ||
| CVE-2026-68361 | — | >= 5.11.0, < 5.15.216 | 5.15.216 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the exe | ||
| CVE-2026-68360 | — | >= 5.9.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following | ||
| CVE-2026-68359 | — | >= 5.17.0, < 6.1.183 | 6.1.183 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following | ||
| CVE-2026-68358 | — | >= 6.9.0, < 6.12.101 | 6.12.101 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following | ||
| CVE-2026-68357 | — | >= 4.9.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to `default_gov`. If | ||
| CVE-2026-68356 | — | >= 6.13.0, < 6.18.42 | 6.18.42 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: watchdog: airoha: Prevent division by zero when clock frequency is zero clk_get_rate() can return 0 when the clock provider is not properly configured or the clock is unmanaged. The driver uses wdt_freq as a di | ||
| CVE-2026-68355 | — | >= 5.6.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing a buffer | ||
| CVE-2026-68354 | Hig | 8.8 | >= 2.6.31, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnet_frag_new() keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whet | |
| CVE-2026-68353 | Hig | 8.1 | >= 3.2.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler The firmware-controlled num_msg field (u8, 0-255) drives the loop in ath6kl_wmi_tx_complete_event_rx() without validation against the buff | |
| CVE-2026-68352 | Hig | 8.3 | >= 3.2.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against th | |
| CVE-2026-68351 | — | >= 2.6.37, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs the mismatch and calls carl9170_restart() | ||
| CVE-2026-68350 | — | >= 2.6.37, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid | ||
| CVE-2026-68349 | — | >= 2.6.37, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix buffer overflow in rx_stream failover path The failover continuation in carl9170_rx_stream() copies the full tlen from the second USB transfer instead of capping at rx_failover_missing bytes |
- CVE-2026-68368Aug 10, 2026affected >= 5.9.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() When unpacking host-supplied NTBs, ncm_unwrap_ntb() checks datagram length against frame_max but does not verify that the datagram fits within th
- CVE-2026-68367Aug 10, 2026affected >= 3.5.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: synchronize delayed set_alt with teardown The f_tcm set_alt() path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses
- CVE-2026-68366Aug 10, 2026affected >= 3.10.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer uvc_send_response() builds the UVC control response from a user-supplied struct uvc_request_data: req->length = min_t(unsigned int, uvc->eve
- CVE-2026-68365Aug 10, 2026affected >= 2.6.12, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edge_interrupt_callback() adds the 16-bit value to txCredits without checking
- CVE-2026-68364Aug 10, 2026affected >= 7.1.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix ISM dc_lock deadlock during suspend [Why] System hang observed during suspend/resume while video is playing. amdgpu_dm_ism_disable() is called under dc_lock and waits for ISM delayed work v
- CVE-2026-68363Aug 10, 2026affected >= 4.4.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_dev as the completi
- CVE-2026-68362Aug 10, 2026affected >= 6.1.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin In ATH11K_QMI_EVENT_FW_READY, ATH11K_FLAG_REGISTERED is set unconditionally even when ath11k_core_qmi_firmware_ready() fails. This leav
- CVE-2026-68361Aug 10, 2026affected >= 5.11.0, < 5.15.216fixed 5.15.216
In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following the exe
- CVE-2026-68360Aug 10, 2026affected >= 5.9.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following
- CVE-2026-68359Aug 10, 2026affected >= 5.17.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following
- CVE-2026-68358Aug 10, 2026affected >= 6.9.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the point immediately following
- CVE-2026-68357Aug 10, 2026affected >= 4.9.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to `default_gov`. If
- CVE-2026-68356Aug 10, 2026affected >= 6.13.0, < 6.18.42fixed 6.18.42
In the Linux kernel, the following vulnerability has been resolved: watchdog: airoha: Prevent division by zero when clock frequency is zero clk_get_rate() can return 0 when the clock provider is not properly configured or the clock is unmanaged. The driver uses wdt_freq as a di
- CVE-2026-68355Aug 10, 2026affected >= 5.6.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() When the first entry in msdu_details has a zero buffer address, the code accesses msdu_details[i - 1] with i == 0, causing a buffer
- affected >= 2.6.31, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnet_frag_new() keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whet
- affected >= 3.2.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler The firmware-controlled num_msg field (u8, 0-255) drives the loop in ath6kl_wmi_tx_complete_event_rx() without validation against the buff
- affected >= 3.2.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against th
- CVE-2026-68351Aug 10, 2026affected >= 2.6.37, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs the mismatch and calls carl9170_restart()
- CVE-2026-68350Aug 10, 2026affected >= 2.6.37, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid
- CVE-2026-68349Aug 10, 2026affected >= 2.6.37, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix buffer overflow in rx_stream failover path The failover continuation in carl9170_rx_stream() copies the full tlen from the second USB transfer instead of capping at rx_failover_missing bytes
Page 60 of 706