kernel

Vulnerabilities (14,254)

• CVE-2026-64466Jul 25, 2026
  affected >= 6.18.0, < 6.18.39fixed 6.18.39

  In the Linux kernel, the following vulnerability has been resolved: rust_binder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. C

• CVE-2026-64465Jul 25, 2026
  affected >= 2.6.35, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhci_free_streams() When a USB device with active stream endpoints is disconnected, xhci_free_streams() is called from the hub_event workqueue to free the stream resour

• CVE-2026-64464Jul 25, 2026
  affected >= 6.16.0, < 6.18.39fixed 6.18.39

  In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhci_ring_to_sgtable() allocates a temporary pages array and uses it to build the returned sg_table with sg_alloc_table_from_pages(). The error paths free the pages

• CVE-2026-64463HigJul 25, 2026
  affected >= 5.8.0, < 6.6.145fixed 6.6.145

  In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres rt1711h_probe() registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the pro

• CVE-2026-64462Jul 25, 2026
  affected >= 5.9.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Fix resource leaks on probe failure The chained IRQ handler is set during probe, but is only removed during the driver remove(). If pci_host_probe() fails, the handler and INTx IRQ domain remain se

• CVE-2026-64461Jul 25, 2026
  affected >= 4.14.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port from pcie->ports and frees the port structure. However, the IRQ domains set

• CVE-2026-64460HigJul 25, 2026
  affected >= 6.17.0, < 6.18.39fixed 6.18.39

  In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register to decide how many VF BARs to restore (nbars) and which VF BAR each iteration addre

• CVE-2026-64459CriJul 25, 2026
  affected >= 6.18.0, < 6.18.39fixed 6.18.39

  In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcp_ao_destroy_sock Commit 51e547e8c89c ("tcp: Free TCP-AO/TCP-MD5 info/keys without RCU") removed the call_rcu() callback from tcp_ao_destroy_sock(), arguing that "the destruct

• CVE-2026-64458Jul 25, 2026
  affected >= 5.16.0, < 6.1.178fixed 6.1.178

  In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damon_hot_score() Fix three issues in damon_hot_score() that comes from wrong handling of extreme (zero or too high) monitoring intervals user setup. When the u

• CVE-2026-64457Jul 25, 2026
  affected >= 6.11.0, < 6.12.96fixed 6.12.96

  In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind triggers a NULL pointer dereference. The dmesg says:

• CVE-2026-64456HigJul 25, 2026
  affected >= 2.6.26, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi->data_idx (advance

• CVE-2026-64455Jul 25, 2026
  affected >= 4.1.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskey_release() The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a de

• CVE-2026-64454Jul 25, 2026
  affected < 5.15.212fixed 5.15.212

  In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls dwc3_disconnect_gadget(). For async callbacks that helper only uses plain

• CVE-2026-64453Jul 25, 2026
  affected >= 6.18.0, < 6.18.39fixed 6.18.39

  In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbio_disconnect() walks usbio->cli_list in reverse and uninitializes each auxiliary device. auxiliary_device_uninit() drops the device reference, and for

• CVE-2026-64452HigJul 25, 2026
  affected >= 4.1.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding lowpan_nhc_lock. If the descriptor has no uncompress callback, the error path drops th

• CVE-2026-64451Jul 25, 2026
  affected >= 6.19.0, < 7.1.4fixed 7.1.4

  In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in func_set_flag() func_set_flag() dereferences tr->current_trace_flags before verifying that the current tracer is actually the function tracer. When the active tracer has

• CVE-2026-64450CriJul 25, 2026
  affected >= 5.8.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its data area. tipc_get_gap_ack_blks() only verifies that the record's len field is s

• CVE-2026-64449HigJul 25, 2026
  affected >= 2.6.32, < 6.1.178fixed 6.1.178

  In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE ==

• CVE-2026-64448HigJul 25, 2026
  affected >= 3.6.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc[0] exemption to responses without data area smb2_check_message() has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes act

• CVE-2026-64447HigJul 25, 2026
  affected >= 6.17.0, < 6.18.39fixed 6.18.39

  In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7_isys_init() and ipu7_psys_init(), pdata is allocated and then passed to ipu7_bus_initialize_device(), which stores it in adev