linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,119)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-68288 | — | >= 5.4.0, < 7.1.6 | 7.1.6 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code the NET_DM_ATTR_PAYLOAD attribute to avoid zeroing the packet payload before over | ||
| CVE-2026-68287 | Hig | 7.5 | >= 5.4.0, < 7.1.6 | 7.1.6 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix size calculations for 64-bit attributes net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use nla_put_u64_64bit() to append 64-bit attributes (NET_DM_ATTR_PC and NET_DM_ATTR_TIMES | |
| CVE-2026-68286 | — | >= 5.4.0, < 7.1.6 | 7.1.6 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drop_monitor: perform u64_stats updates under IRQ-disabled section In net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(), u64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() w | ||
| CVE-2026-68285 | — | >= 7.0.0, < 7.1.6 | 7.1.6 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix memory leak in bpf_jit_free() When bpf_int_jit_compile() is called for subprograms, it returns early during the first pass (!prog->is_func || extra_pass is false), keeping ctx->offset alive | ||
| CVE-2026-68284 | Hig | 7.8 | >= 4.20.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which drops and reacquires the socket lock. Its error path tries to decide whether msg_ | |
| CVE-2026-68283 | Hig | 8.8 | >= 6.19.0, < 7.1.6 | 7.1.6 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing trigger private data Commit 61d445af0a7c ("tracing: Add bulk garbage collection of freeing event_trigger_data") moved the kfree() of event_trigger_data to a kthread that runs | |
| CVE-2026-68282 | — | >= 6.15.0, < 6.18.42 | 6.18.42 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogix_dp: Add missing error check for platform_get_resource() Add missing error check for platform_get_resource() return value to prevent NULL pointer dereference when memory resource is not av | ||
| CVE-2026-68281 | — | >= 6.8.0, < 6.12.101 | 6.12.101 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Count paired job fence as dependency in prepare_job() The DRM scheduler's prepare_job() callback counts the remaining non-signaled native dependencies for a job, preventing job submission until | ||
| CVE-2026-68280 | — | >= 4.18.0, < 6.1.184 | 6.1.184 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() The deprecated UNIVERSAL_DEV_PM_OPS() macro uses the provided callbacks for both runtime PM and system sleep. This causes the DSI clocks to be dis | ||
| CVE-2026-68279 | — | >= 3.17.0, < 5.10.266 | 5.10.266 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw message and then unconditionally does: memcpy(bytes, &raw->msg[idx], | ||
| CVE-2026-68278 | — | >= 3.17.0, < 5.10.266 | 5.10.266 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunk_len underflo | ||
| CVE-2026-68277 | — | >= 3.17.0, < 5.10.266 | 5.10.266 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = (raw->msg[idx] << 8) | (raw->msg[idx+1]); and check bounds only after the fact. | ||
| CVE-2026-68276 | — | >= 6.12.0, < 6.12.103 | 6.12.103 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword (64 byte) IB but incorrectly fills (align_mask + 1) dwords. On GFX rings align_mask is 0xff, so the loop | ||
| CVE-2026-68275 | — | >= 6.18.0, < 6.18.42 | 6.18.42 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO The AMDGPU_GEM_OP_GET_MAPPING_INFO path of amdgpu_gem_op_ioctl() looks up the bo_va for the buffer object in the caller's VM via amdgpu_vm_bo_fin | ||
| CVE-2026-68274 | Hig | 7.8 | >= 6.13.0, < 6.18.44 | 6.18.44 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation for the steered register extarray uses only the geometry DSS mask (g_dss_mask) to determine the number of entries to allo | |
| CVE-2026-68273 | Hig | 7.8 | >= 6.1.0, < 6.12.103 | 6.12.103 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context init | |
| CVE-2026-68272 | — | >= 6.5.0, < 6.6.148 | 6.6.148 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in amdgpu_cs_pass1(), matching the gate already present for the IB, FENCE and BO_ | ||
| CVE-2026-68271 | — | >= 6.6.0, < 6.6.148 | 6.6.148 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() place their error cleanup labels in allocation order rather than reverse allocation order. | ||
| CVE-2026-68270 | — | >= 6.16.0, < 6.18.42 | 6.18.42 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Avoid possible truncation with calculating visible size Calculating the visible size of the system framebuffer can result in truncation of the result. The calculation uses 32-bit arithmetics, which c | ||
| CVE-2026-68269 | — | >= 5.16.0, < 6.1.183 | 6.1.183 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Add missing nospec on parallel submit slot Add missing Spectre mitigation for userspace controlled parallel submission slot. Discovered using AI-assisted static analysis confirmed by Intel Produc |
- CVE-2026-68288Aug 10, 2026affected >= 5.4.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code the NET_DM_ATTR_PAYLOAD attribute to avoid zeroing the packet payload before over
- affected >= 5.4.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix size calculations for 64-bit attributes net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use nla_put_u64_64bit() to append 64-bit attributes (NET_DM_ATTR_PC and NET_DM_ATTR_TIMES
- CVE-2026-68286Aug 10, 2026affected >= 5.4.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: drop_monitor: perform u64_stats updates under IRQ-disabled section In net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(), u64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() w
- CVE-2026-68285Aug 10, 2026affected >= 7.0.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix memory leak in bpf_jit_free() When bpf_int_jit_compile() is called for subprograms, it returns early during the first pass (!prog->is_func || extra_pass is false), keeping ctx->offset alive
- affected >= 4.20.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which drops and reacquires the socket lock. Its error path tries to decide whether msg_
- affected >= 6.19.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing trigger private data Commit 61d445af0a7c ("tracing: Add bulk garbage collection of freeing event_trigger_data") moved the kfree() of event_trigger_data to a kthread that runs
- CVE-2026-68282Aug 10, 2026affected >= 6.15.0, < 6.18.42fixed 6.18.42
In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogix_dp: Add missing error check for platform_get_resource() Add missing error check for platform_get_resource() return value to prevent NULL pointer dereference when memory resource is not av
- CVE-2026-68281Aug 10, 2026affected >= 6.8.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Count paired job fence as dependency in prepare_job() The DRM scheduler's prepare_job() callback counts the remaining non-signaled native dependencies for a job, preventing job submission until
- CVE-2026-68280Aug 10, 2026affected >= 4.18.0, < 6.1.184fixed 6.1.184
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() The deprecated UNIVERSAL_DEV_PM_OPS() macro uses the provided callbacks for both runtime PM and system sleep. This causes the DSI clocks to be dis
- CVE-2026-68279Aug 10, 2026affected >= 3.17.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw message and then unconditionally does: memcpy(bytes, &raw->msg[idx],
- CVE-2026-68278Aug 10, 2026affected >= 3.17.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunk_len underflo
- CVE-2026-68277Aug 10, 2026affected >= 3.17.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = (raw->msg[idx] << 8) | (raw->msg[idx+1]); and check bounds only after the fact.
- CVE-2026-68276Aug 10, 2026affected >= 6.12.0, < 6.12.103fixed 6.12.103
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword (64 byte) IB but incorrectly fills (align_mask + 1) dwords. On GFX rings align_mask is 0xff, so the loop
- CVE-2026-68275Aug 10, 2026affected >= 6.18.0, < 6.18.42fixed 6.18.42
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO The AMDGPU_GEM_OP_GET_MAPPING_INFO path of amdgpu_gem_op_ioctl() looks up the bo_va for the buffer object in the caller's VM via amdgpu_vm_bo_fin
- affected >= 6.13.0, < 6.18.44fixed 6.18.44
In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation for the steered register extarray uses only the geometry DSS mask (g_dss_mask) to determine the number of entries to allo
- affected >= 6.1.0, < 6.12.103fixed 6.12.103
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context init
- CVE-2026-68272Aug 10, 2026affected >= 6.5.0, < 6.6.148fixed 6.6.148
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in amdgpu_cs_pass1(), matching the gate already present for the IB, FENCE and BO_
- CVE-2026-68271Aug 10, 2026affected >= 6.6.0, < 6.6.148fixed 6.6.148
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() place their error cleanup labels in allocation order rather than reverse allocation order.
- CVE-2026-68270Aug 10, 2026affected >= 6.16.0, < 6.18.42fixed 6.18.42
In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Avoid possible truncation with calculating visible size Calculating the visible size of the system framebuffer can result in truncation of the result. The calculation uses 32-bit arithmetics, which c
- CVE-2026-68269Aug 10, 2026affected >= 5.16.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Add missing nospec on parallel submit slot Add missing Spectre mitigation for userspace controlled parallel submission slot. Discovered using AI-assisted static analysis confirmed by Intel Produc
Page 64 of 706