linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,027)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-74593 | — | >= 6.18.0, < 6.18.46 | 6.18.46 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Take cgroup_lock() first in scx_cgroup_lock() scx_cgroup_lock() write-locks scx_cgroup_ops_rwsem and then takes cgroup_lock(), which can deadlock through kernfs: scx enable/disable cgroup | ||
| CVE-2026-74592 | — | < 6.12.104 | 6.12.104 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: ima: Instantiate file_truncate and path_truncate hooks Instantiate the file_truncate and path_truncate LSM hooks to reset the action cache flags (IMA_DONE_MASK) as soon as truncation is requested, so the file, | ||
| CVE-2026-74591 | — | >= 6.15.0, < 6.18.45 | 6.18.45 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm/filemap: __filemap_add_folio() restore index before retrying In __filemap_add_folio()'s split-a-conflict loop, xas_set_order() is applied repeatedly: each application modifies xas.xa_index, rounding it down | ||
| CVE-2026-74590 | — | >= 6.8.0, < 6.12.104 | 6.12.104 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however, provide any guara | ||
| CVE-2026-74589 | — | >= 4.20.0, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix sk_redir use-after-free in send verdict sk_psock_msg_verdict() takes a socket reference for psock->sk_redir. tcp_bpf_send_verdict() copies that pointer while holding the source socket lock, bu | ||
| CVE-2026-74588 | — | >= 2.6.12, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_ga | ||
| CVE-2026-74587 | — | >= 3.0.0, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctp_as | ||
| CVE-2026-74586 | — | >= 3.2.0, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer sctp_process_asconf_param() stores a newly added peer transport in asoc->new_transport. After all parameters in the ASCONF chunk have been processed, sctp_sf_do_as | ||
| CVE-2026-74585 | — | >= 3.17.0, < 5.10.265 | 5.10.265 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound the DROM dual link port number before indexing sw->ports tb_drom_parse_entry_port() validates the device-supplied header->index against sw->config.max_port_number before indexing sw->ports[], | ||
| CVE-2026-74584 | — | >= 4.11.0, < 5.10.260 | 5.10.260 | Aug 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: zero shared page before exposing to userspace bnxt_re_alloc_ucontext() allocates uctx->shpg via __get_free_page(GFP_KERNEL). The buddy allocator does not zero pages without __GFP_ZERO, so the page | ||
| CVE-2026-74583 | — | >= 3.18.0, < 5.10.265 | 5.10.265 | Aug 21, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The reader (route4_classify | ||
| CVE-2026-74582 | — | >= 4.17.0, < 6.6.152 | 6.6.152 | Aug 21, 2026 | In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concur | ||
| CVE-2026-74581 | — | < 5.10.265 | 5.10.265 | Aug 21, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacemen | ||
| CVE-2026-74580 | — | >= 4.11.0, < 5.10.265 | 5.10.265 | Aug 21, 2026 | In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cache hit, taking the h | ||
| CVE-2026-74579 | — | >= 5.10.0, < 5.10.265 | 5.10.265 | Aug 17, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: fix mask build for partial field offload nft_payload_offload_mask() builds the offload match mask for a payload expression that covers only part of a header field. For a partial IPv6 ad | ||
| CVE-2026-74578 | Hig | 7.1 | >= 4.14.0, < 5.10.261 | 5.10.261 | Aug 16, 2026 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_skcipher - force synchronous processing on trees without ctx->state The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx->iv directly into the skcipher request. After io_submit() th | |
| CVE-2026-74577 | — | >= 4.13.0, < 5.10.265 | 5.10.265 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtm_tos in mpls_getroute() mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed (alloc_skb | ||
| CVE-2026-74576 | Hig | 7.5 | >= 6.10.0, < 6.12.103 | 6.12.103 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b ("mm/slab: avoid allocating slabobj_ext array from its own slab") avoided recursive allocation of obj_exts from kmallo | |
| CVE-2026-74575 | Hig | 8.8 | >= 5.2.0, < 5.10.266 | 5.10.266 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tb_xdp_handle_request() runs on system_wq and queues xd->state_work via queue_delayed_work() in three request handlers: PROPERTIES_CHANGED_ | |
| CVE-2026-74574 | Hig | 7.8 | >= 6.4.0, < 6.6.151 | 6.6.151 | Aug 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() The failed_dev_add and failed_dev_name paths drop the file-device reference while wq->wq_lock is still held. If put_device(fdev) drops the las |
- CVE-2026-74593Aug 22, 2026affected >= 6.18.0, < 6.18.46fixed 6.18.46
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Take cgroup_lock() first in scx_cgroup_lock() scx_cgroup_lock() write-locks scx_cgroup_ops_rwsem and then takes cgroup_lock(), which can deadlock through kernfs: scx enable/disable cgroup
- CVE-2026-74592Aug 22, 2026affected < 6.12.104fixed 6.12.104
In the Linux kernel, the following vulnerability has been resolved: ima: Instantiate file_truncate and path_truncate hooks Instantiate the file_truncate and path_truncate LSM hooks to reset the action cache flags (IMA_DONE_MASK) as soon as truncation is requested, so the file,
- CVE-2026-74591Aug 22, 2026affected >= 6.15.0, < 6.18.45fixed 6.18.45
In the Linux kernel, the following vulnerability has been resolved: mm/filemap: __filemap_add_folio() restore index before retrying In __filemap_add_folio()'s split-a-conflict loop, xas_set_order() is applied repeatedly: each application modifies xas.xa_index, rounding it down
- CVE-2026-74590Aug 22, 2026affected >= 6.8.0, < 6.12.104fixed 6.12.104
In the Linux kernel, the following vulnerability has been resolved: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however, provide any guara
- CVE-2026-74589Aug 22, 2026affected >= 4.20.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix sk_redir use-after-free in send verdict sk_psock_msg_verdict() takes a socket reference for psock->sk_redir. tcp_bpf_send_verdict() copies that pointer while holding the source socket lock, bu
- CVE-2026-74588Aug 22, 2026affected >= 2.6.12, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_ga
- CVE-2026-74587Aug 22, 2026affected >= 3.0.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: sctp: fix use-after-free of cached ASCONF chunk addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctp_as
- CVE-2026-74586Aug 22, 2026affected >= 3.2.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer sctp_process_asconf_param() stores a newly added peer transport in asoc->new_transport. After all parameters in the ASCONF chunk have been processed, sctp_sf_do_as
- CVE-2026-74585Aug 22, 2026affected >= 3.17.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound the DROM dual link port number before indexing sw->ports tb_drom_parse_entry_port() validates the device-supplied header->index against sw->config.max_port_number before indexing sw->ports[],
- CVE-2026-74584Aug 22, 2026affected >= 4.11.0, < 5.10.260fixed 5.10.260
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: zero shared page before exposing to userspace bnxt_re_alloc_ucontext() allocates uctx->shpg via __get_free_page(GFP_KERNEL). The buddy allocator does not zero pages without __GFP_ZERO, so the page
- CVE-2026-74583Aug 21, 2026affected >= 3.18.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The reader (route4_classify
- CVE-2026-74582Aug 21, 2026affected >= 4.17.0, < 6.6.152fixed 6.6.152
In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_header_len in non-ring send paths packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb. Device reconfiguration can change this value concur
- CVE-2026-74581Aug 21, 2026affected < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacemen
- CVE-2026-74580Aug 21, 2026affected >= 4.11.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cache hit, taking the h
- CVE-2026-74579Aug 17, 2026affected >= 5.10.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: fix mask build for partial field offload nft_payload_offload_mask() builds the offload match mask for a payload expression that covers only part of a header field. For a partial IPv6 ad
- affected >= 4.14.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_skcipher - force synchronous processing on trees without ctx->state The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx->iv directly into the skcipher request. After io_submit() th
- CVE-2026-74577Aug 15, 2026affected >= 4.13.0, < 5.10.265fixed 5.10.265
In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtm_tos in mpls_getroute() mpls_getroute() builds the RTM_NEWROUTE reply to an RTM_GETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed (alloc_skb
- affected >= 6.10.0, < 6.12.103fixed 6.12.103
In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b ("mm/slab: avoid allocating slabobj_ext array from its own slab") avoided recursive allocation of obj_exts from kmallo
- affected >= 5.2.0, < 5.10.266fixed 5.10.266
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tb_xdp_handle_request() runs on system_wq and queues xd->state_work via queue_delayed_work() in three request handlers: PROPERTIES_CHANGED_
- affected >= 6.4.0, < 6.6.151fixed 6.6.151
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() The failed_dev_add and failed_dev_name paths drop the file-device reference while wq->wq_lock is still held. If put_device(fdev) drops the las
Page 8 of 702