kernel

Vulnerabilities (14,254)

• CVE-2026-64326Jul 25, 2026
  affected >= 6.6.0, < 6.6.145fixed 6.6.145

  In the Linux kernel, the following vulnerability has been resolved: block: skip sync_blockdev() on surprise removal in bdev_mark_dead() bdev_mark_dead()'s @surprise == true means the device is already gone. The filesystem callback fs_bdev_mark_dead() honours this and skips sync

• CVE-2026-64325Jul 25, 2026
  affected >= 6.14.0, < 7.1.4fixed 7.1.4

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a c

• CVE-2026-64324HigJul 25, 2026
  affected < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udf_free_blocks() checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A craf

• CVE-2026-64323HigJul 25, 2026
  affected >= 2.6.26, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udf_load_vat() takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size: ma

• CVE-2026-64322HigJul 25, 2026
  affected >= 3.5.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udf_load_sparable_map() accepts a sparing table when sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize is false, i.e

• CVE-2026-64321Jul 25, 2026
  affected >= 6.8.0, < 6.12.96fixed 6.12.96

  In the Linux kernel, the following vulnerability has been resolved: nvme: target: rdma: fix ndev refcount leak on queue connect nvmet_rdma_queue_connect() calls nvmet_rdma_find_get_device() which acquires a reference on the returned ndev via kref_get(). On the path where the ho

• CVE-2026-64320CriJul 25, 2026
  affected >= 4.8.0, < 6.12.96fixed 6.12.96

  In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_get_log_page() validates only the dword alignment of the host-supplied Log Page Offset (lpo). The 64-bit offset is then

• CVE-2026-64319CriJul 25, 2026
  affected >= 6.0.0, < 6.6.145fixed 6.6.145

  In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_reply() accesses the variable-length rval[] array using attacker-controlled hl (hash length) and dhvlen (DH value length) fie

• CVE-2026-64318HigJul 25, 2026
  affected >= 3.11.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the pp_count scan to the ppe array aix_partition() reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be1

• CVE-2026-64317HigJul 25, 2026
  affected >= 2.6.12, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record get_symlink_chunk() and the SL handling in parse_rock_ridge_inode_internal() walk the variable-length components of a Rock Ridge "SL" (symbolic link)

• CVE-2026-64316Jul 25, 2026
  affected >= 5.3.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use print_hex_dump_devel to guard key hex dumps Use print_hex_dump_devel() for dumping sensitive key material in *_setkey() and gen_split_key() to avoid leaking secrets at runtime when CONFIG_DYN

• CVE-2026-64315HigJul 25, 2026
  affected >= 4.20.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: crypto: caam - use print_hex_dump_devel to guard key hex dumps Use print_hex_dump_devel() for dumping sensitive key material in *_setkey() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG is enable

• CVE-2026-64314Jul 25, 2026
  affected >= 6.16.0, < 6.18.39fixed 6.18.39

  In the Linux kernel, the following vulnerability has been resolved: crypto: chacha20poly1305 - validate poly1305 template argument chachapoly_create() still accepts the compatibility poly1305 parameter in the template name, but it assumes the second template argument is always

• CVE-2026-64313HigJul 25, 2026
  affected >= 4.8.0, < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails when r01.m_high is saturated (0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows. The condition (r01.m_high < produ

• CVE-2026-64312HigJul 25, 2026
  affected < 5.10.261fixed 5.10.261

  In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcrypt_aead_done() on the child AEAD request before trying to submit it through padata. If padata_do_parallel() returns -EBUSY, pcryp

• CVE-2026-64311HigJul 25, 2026
  affected >= 6.18.0, < 6.18.39fixed 6.18.39

  In the Linux kernel, the following vulnerability has been resolved: crypto: loongson - Remove broken and unused loongson-rng The loongson-rng rng_alg has several vulnerabilities, including not providing forward security, and a use-after-free bug due to the use of wait_for_compl

• CVE-2026-64310Jul 25, 2026
  affected < 6.12.96fixed 6.12.96

  In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev ioctls (e

• CVE-2026-64309Jul 25, 2026
  affected < 6.12.96fixed 6.12.96

  In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev io

• CVE-2026-64308Jul 25, 2026
  affected < 6.12.96fixed 6.12.96

  In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev

• CVE-2026-64307Jul 25, 2026
  affected < 6.12.97fixed 6.12.97

  In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) Sashiko notes: > if SEV initialization fails and KVM is actively running normal VMs, could a > userspace process trigger this code path via /dev/sev io