linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,119)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-68208 | — | >= 7.0.0, < 7.1.6 | 7.1.6 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice() In vip_probe_slice(), the error check for devm_kzalloc() incorrectly uses PTR_ERR_OR_ZERO() which returns 0 for NULL pointer. Return -E | ||
| CVE-2026-68207 | — | >= 5.5.0, < 6.1.183 | 6.1.183 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: unwind v4l2 device registration on probe error If the vpe_top resource is missing, vpe_probe() returns -ENODEV after v4l2_device_register() has succeeded. Probe failures do not call the driver's | ||
| CVE-2026-68206 | Hig | 7.8 | >= 5.14.0, < 6.1.183 | 6.1.183 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver- | |
| CVE-2026-68205 | — | >= 4.15.0, < 5.10.266 | 5.10.266 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() The v4l2 helper v4l2_async_register_subdev_sensor() calls v4l2_async_register_subdev(), which is a macro that expands to _ | ||
| CVE-2026-68204 | Hig | 7.8 | >= 3.18.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2_is_busy() when toggling caps The vivid_update_format_cap/out() functions must only be called if the capture/output queue are not busy. But for the controls that select the CROP/COMPO | |
| CVE-2026-68203 | — | >= 4.1.0, < 6.12.101 | 6.12.101 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vivid_init() When platform_device_register() fails in vivid_init(), the embedded struct device in vivid_pdev has already been initialized by device_initialize(), but the failur | ||
| CVE-2026-68202 | Hig | 7.8 | >= 2.6.12, < 5.10.266 | 5.10.266 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queue_delete() closes the queue timer, then frees it. snd_seq_timer_close() clears q->timer->timeri. snd_use_lock_sync() then drains borrowers, and snd | |
| CVE-2026-68201 | Hig | 7.8 | >= 6.12.0, < 6.12.101 | 6.12.101 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it snd_timer_close_locked() drains the closing instance's own in-flight callback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a m | |
| CVE-2026-68200 | Hig | 7.8 | >= 6.12.0, < 6.12.101 | 6.12.101 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two threads triggering the | |
| CVE-2026-68199 | Hig | 8.8 | >= 3.2.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not return. T | |
| CVE-2026-68198 | Hig | 8.8 | >= 3.2.0, < 5.10.266 | 5.10.266 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the struct | |
| CVE-2026-68197 | — | >= 3.16.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper mwifiex_tdls_add_ht_oper() gates its follow-the-AP-bandwidth path on bss_desc->bcn_ht_cap being present, but then dereferences a differe | ||
| CVE-2026-68196 | Hig | 8.3 | >= 4.2.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: validate assoc response length before subtracting header wilc_parse_assoc_resp_info() computes the trailing IE length as ies_len = buffer_len - sizeof(*res); without first checking that buffe | |
| CVE-2026-68195 | — | >= 5.8.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7615_rx_check() and mt7615_queue_rx_skb() dispatch it to mt7615_mac_tx_free() on every bus. mt7615_mac_tx | ||
| CVE-2026-68194 | — | >= 5.16.0, < 6.1.183 | 6.1.183 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7921_rx_check() and mt7921_queue_rx_skb() dispatch it to mt7921_mac_tx_free() on every bus. mt7921_mac_tx | ||
| CVE-2026-68193 | — | >= 6.7.0, < 6.12.101 | 6.12.101 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7925_rx_check() and mt7925_queue_rx_skb() dispatch it to mt7925_mac_tx_free() on every bus. mt7925_mac_tx | ||
| CVE-2026-68192 | Hig | 8.8 | >= 5.2.0, < 5.10.265 | 5.10.265 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make release_scratchbuffers idempotent brcmf_pcie_release_scratchbuffers() frees the shared.scratch and shared.ringupd DMA buffers with dma_free_coherent() but does not clear the pointers afterw | |
| CVE-2026-68191 | — | >= 7.0.0, < 7.1.6 | 7.1.6 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL pointer dereference in rhash table destroy When unbinding the ath12k driver, kernel NULL pointer dereferences occur in irq_work_sync() called from rhashtable_destroy(). Two hash tables a | ||
| CVE-2026-68190 | — | >= 4.12.0, < 5.15.216 | 5.15.216 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() rtw_get_wps_ie() iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading | ||
| CVE-2026-68189 | Hig | 7.8 | >= 5.17.0, < 6.1.183 | 6.1.183 | Aug 10, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Protect UUID list traversal The hci_sync conversion moved class-of-device and EIR generation from an HCI request built under hdev->lock to asynchronous command sync work. The worker holds h |
- CVE-2026-68208Aug 10, 2026affected >= 7.0.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice() In vip_probe_slice(), the error check for devm_kzalloc() incorrectly uses PTR_ERR_OR_ZERO() which returns 0 for NULL pointer. Return -E
- CVE-2026-68207Aug 10, 2026affected >= 5.5.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: unwind v4l2 device registration on probe error If the vpe_top resource is missing, vpe_probe() returns -ENODEV after v4l2_device_register() has succeeded. Probe failures do not call the driver's
- affected >= 5.14.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver-
- CVE-2026-68205Aug 10, 2026affected >= 4.15.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() The v4l2 helper v4l2_async_register_subdev_sensor() calls v4l2_async_register_subdev(), which is a macro that expands to _
- affected >= 3.18.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2_is_busy() when toggling caps The vivid_update_format_cap/out() functions must only be called if the capture/output queue are not busy. But for the controls that select the CROP/COMPO
- CVE-2026-68203Aug 10, 2026affected >= 4.1.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vivid_init() When platform_device_register() fails in vivid_init(), the embedded struct device in vivid_pdev has already been initialized by device_initialize(), but the failur
- affected >= 2.6.12, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queue_delete() closes the queue timer, then frees it. snd_seq_timer_close() clears q->timer->timeri. snd_use_lock_sync() then drains borrowers, and snd
- affected >= 6.12.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it snd_timer_close_locked() drains the closing instance's own in-flight callback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a m
- affected >= 6.12.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two threads triggering the
- affected >= 3.2.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggr_recv_addba_req_evt() logs a debug message when the firmware-supplied win_sz is outside [AGGR_WIN_SZ_MIN, AGGR_WIN_SZ_MAX] but does not return. T
- affected >= 3.2.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the struct
- CVE-2026-68197Aug 10, 2026affected >= 3.16.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper mwifiex_tdls_add_ht_oper() gates its follow-the-AP-bandwidth path on bss_desc->bcn_ht_cap being present, but then dereferences a differe
- affected >= 4.2.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: validate assoc response length before subtracting header wilc_parse_assoc_resp_info() computes the trailing IE length as ies_len = buffer_len - sizeof(*res); without first checking that buffe
- CVE-2026-68195Aug 10, 2026affected >= 5.8.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7615_rx_check() and mt7615_queue_rx_skb() dispatch it to mt7615_mac_tx_free() on every bus. mt7615_mac_tx
- CVE-2026-68194Aug 10, 2026affected >= 5.16.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7921_rx_check() and mt7921_queue_rx_skb() dispatch it to mt7921_mac_tx_free() on every bus. mt7921_mac_tx
- CVE-2026-68193Aug 10, 2026affected >= 6.7.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7925_rx_check() and mt7925_queue_rx_skb() dispatch it to mt7925_mac_tx_free() on every bus. mt7925_mac_tx
- affected >= 5.2.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make release_scratchbuffers idempotent brcmf_pcie_release_scratchbuffers() frees the shared.scratch and shared.ringupd DMA buffers with dma_free_coherent() but does not clear the pointers afterw
- CVE-2026-68191Aug 10, 2026affected >= 7.0.0, < 7.1.6fixed 7.1.6
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL pointer dereference in rhash table destroy When unbinding the ath12k driver, kernel NULL pointer dereferences occur in irq_work_sync() called from rhashtable_destroy(). Two hash tables a
- CVE-2026-68190Aug 10, 2026affected >= 4.12.0, < 5.15.216fixed 5.15.216
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() rtw_get_wps_ie() iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading
- affected >= 5.17.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Protect UUID list traversal The hci_sync conversion moved class-of-device and EIR generation from an HCI request built under hdev->lock to asynchronous command sync work. The worker holds h
Page 68 of 706