linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,119)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-64511 | — | >= 6.6.0, < 6.6.145 | 6.6.145 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler for the NF | ||
| CVE-2026-64510 | Hig | 7.0 | >= 4.6.0, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init() fails after adding the acpi_desc object to the acpi_descs list, that object is never removed from that list because the acpi_nfit_shutdow | |
| CVE-2026-64509 | — | >= 6.11.0, < 6.12.97 | 6.12.97 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build() still has fallible work after __blk_mq_alloc_disk(), but its error path only recovers the foreign queue data. That leaks the temporary gendisk and | ||
| CVE-2026-64508 | — | >= 5.18.0, < 6.1.183 | 6.1.183 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. Whe | ||
| CVE-2026-64507 | — | >= 5.18.0, < 6.1.183 | 6.1.183 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB | ||
| CVE-2026-64506 | — | >= 7.1.0, < 7.1.4 | 7.1.4 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certai | ||
| CVE-2026-64505 | — | >= 2.6.12, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndis_rm_hdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before | ||
| CVE-2026-64504 | — | >= 4.1.0, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count __bmc150_accel_fifo_flush() copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 buffer[BMC150_ACCEL_ | ||
| CVE-2026-64503 | — | >= 4.9.0, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync() but returns -EINVAL directly when a scale with a non-zero integer part | ||
| CVE-2026-64502 | Hig | 7.8 | >= 6.14.0, < 6.18.39 | 6.18.39 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices ad_sigma_delta_clear_pending_event() falls through to the status register read path for devices with has_registers = false and no rdy_g | |
| CVE-2026-64501 | Hig | 7.1 | >= 6.14.0, < 6.18.39 | 6.18.39 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix CS held asserted and state leaks In ad_sigma_delta_single_conversion(), set_mode(AD_SD_MODE_IDLE) and disable_one() were called from the out: block while keep_cs_asserted was still | |
| CVE-2026-64500 | — | >= 4.12.0, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its interrupt handler with devm_request_irq() b | ||
| CVE-2026-64499 | — | >= 6.11.0, < 6.12.96 | 6.12.96 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119_triggered_buffer_preenable() resumes the device with pm_runtime_resume_and_get() before starting a conversion. If i2c_smbus_write_byte() | ||
| CVE-2026-64498 | — | >= 7.1.0, < 7.1.4 | 7.1.4 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: free scan_mask on buffer release The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer: hw-consumer: remove redundant scan_mask flexible array"). Before that change, the | ||
| CVE-2026-64497 | — | >= 5.9.0, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELD_GET(). Create new macros for bit manipulation in combination with manual bit manipulation being repla | ||
| CVE-2026-64496 | Hig | 7.1 | >= 3.15.0, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race `iio_event_getfd()` creates the event file descriptor with `anon_inode_getfd()`, which allocates a new fd, creates the anonymous file and installs it in the process fd tabl | |
| CVE-2026-64495 | — | >= 3.18.0, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip: for (i = 0; i < ARRAY_ | ||
| CVE-2026-64494 | — | >= 5.8.0, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the lux value, but if gp2ap002_get_lux() fails, it returns directly. This skips the pm_runt | ||
| CVE-2026-64493 | — | >= 6.2.0, < 6.6.145 | 6.6.145 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mpl115: fix runtime PM leak on read error mpl115_read_raw() takes a runtime PM reference with pm_runtime_get_sync() before reading the processed pressure or raw temperature, but on the read error | ||
| CVE-2026-64492 | — | >= 6.13.0, < 6.18.39 | 6.18.39 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devm_iio_trigger_register tmp006_probe() allocates the DRDY trigger with devm_iio_trigger_alloc() but registers it with plain iio_trigger_register(). The driver has no .remove() ca |
- CVE-2026-64511Jul 25, 2026affected >= 6.6.0, < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler for the NF
- affected >= 4.6.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init() fails after adding the acpi_desc object to the acpi_descs list, that object is never removed from that list because the acpi_nfit_shutdow
- CVE-2026-64509Jul 25, 2026affected >= 6.11.0, < 6.12.97fixed 6.12.97
In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build() still has fallible work after __blk_mq_alloc_disk(), but its error path only recovers the foreign queue data. That leaks the temporary gendisk and
- CVE-2026-64508Jul 25, 2026affected >= 5.18.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. Whe
- CVE-2026-64507Jul 25, 2026affected >= 5.18.0, < 6.1.183fixed 6.1.183
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB
- CVE-2026-64506Jul 25, 2026affected >= 7.1.0, < 7.1.4fixed 7.1.4
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certai
- CVE-2026-64505Jul 25, 2026affected >= 2.6.12, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndis_rm_hdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before
- CVE-2026-64504Jul 25, 2026affected >= 4.1.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: clamp the device-reported FIFO frame count __bmc150_accel_fifo_flush() copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 buffer[BMC150_ACCEL_
- CVE-2026-64503Jul 25, 2026affected >= 4.9.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync() but returns -EINVAL directly when a scale with a non-zero integer part
- affected >= 6.14.0, < 6.18.39fixed 6.18.39
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices ad_sigma_delta_clear_pending_event() falls through to the status register read path for devices with has_registers = false and no rdy_g
- affected >= 6.14.0, < 6.18.39fixed 6.18.39
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix CS held asserted and state leaks In ad_sigma_delta_single_conversion(), set_mode(AD_SD_MODE_IDLE) and disable_one() were called from the out: block while keep_cs_asserted was still
- CVE-2026-64500Jul 25, 2026affected >= 4.12.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its interrupt handler with devm_request_irq() b
- CVE-2026-64499Jul 25, 2026affected >= 6.11.0, < 6.12.96fixed 6.12.96
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119_triggered_buffer_preenable() resumes the device with pm_runtime_resume_and_get() before starting a conversion. If i2c_smbus_write_byte()
- CVE-2026-64498Jul 25, 2026affected >= 7.1.0, < 7.1.4fixed 7.1.4
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: free scan_mask on buffer release The scan_mask lifetime changed in commit 9a2e1233d38c ("iio: buffer: hw-consumer: remove redundant scan_mask flexible array"). Before that change, the
- CVE-2026-64497Jul 25, 2026affected >= 5.9.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELD_GET(). Create new macros for bit manipulation in combination with manual bit manipulation being repla
- affected >= 3.15.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race `iio_event_getfd()` creates the event file descriptor with `anon_inode_getfd()`, which allocates a new fd, creates the anonymous file and installs it in the process fd tabl
- CVE-2026-64495Jul 25, 2026affected >= 3.18.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry matching the bw_bits value read from the chip: for (i = 0; i < ARRAY_
- CVE-2026-64494Jul 25, 2026affected >= 5.8.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the lux value, but if gp2ap002_get_lux() fails, it returns directly. This skips the pm_runt
- CVE-2026-64493Jul 25, 2026affected >= 6.2.0, < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mpl115: fix runtime PM leak on read error mpl115_read_raw() takes a runtime PM reference with pm_runtime_get_sync() before reading the processed pressure or raw temperature, but on the read error
- CVE-2026-64492Jul 25, 2026affected >= 6.13.0, < 6.18.39fixed 6.18.39
In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devm_iio_trigger_register tmp006_probe() allocates the DRDY trigger with devm_iio_trigger_alloc() but registers it with plain iio_trigger_register(). The driver has no .remove() ca
Page 79 of 706