linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,254)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-64306 | — | >= 4.1.0, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTR_DRBG drbg_ctr_generate() sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it. | ||
| CVE-2026-64305 | — | >= 3.17.0, < 6.12.96 | 6.12.96 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - protect service table iterations with service_lock The service_table list is protected by service_lock when entries are added or removed (in adf_service_add() and adf_service_remove()), but severa | ||
| CVE-2026-64304 | Hig | 7.8 | >= 4.8.0, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() allocates half-size D | |
| CVE-2026-64303 | Cri | 9.8 | >= 5.2.0, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengine_prep_slave_sg() fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since | |
| CVE-2026-64302 | — | < 6.18.39 | 6.18.39 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix freeing of PMD-sized vmemmap pages Commit bf9e4e30f353 ("x86/mm: use pagetable_free()"), switched from freeing non-boot page tables through __free_pages() to pagetable_free(). However, the function | ||
| CVE-2026-64301 | — | >= 5.11.0, < 5.15.212 | 5.15.212 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() scmi_regulator_probe() calls of_find_node_by_name() which takes a reference on the returned device node. On the error path where process_scmi | ||
| CVE-2026-64300 | Hig | 7.8 | >= 6.14.0, < 6.18.39 | 6.18.39 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via perf_mmap_to_page() while holding only event->mmap_mutex. Those fields are serialized by rb->aux_m | |
| CVE-2026-64299 | Hig | 7.1 | >= 4.10.0, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions (filter_pred_string(), filter_pred_strloc() and filter_pred_strrell | |
| CVE-2026-64298 | Hig | 7.1 | >= 2.6.24, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMO | |
| CVE-2026-64297 | Med | 5.5 | >= 5.17.0, < 6.1.178 | 6.1.178 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of module_extend_max_pages() module_extend_max_pages() calls kvrealloc() internally and returns -ENOMEM on allocation failure. The return value is never checked. If the i | |
| CVE-2026-64296 | Hig | 7.8 | >= 5.7.0, < 5.10.261 | 5.10.261 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfat_find_dir_entry() In exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulate | |
| CVE-2026-64295 | Med | 5.5 | >= 6.15.0, < 6.18.39 | 6.18.39 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access The page_ext iteration API does not validate if the PFN still belongs to a valid section while advancing the iterator. When dyn | |
| CVE-2026-64294 | Med | 5.5 | >= 5.12.0, < 5.15.217 | 5.15.217 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks (for side-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done against | |
| CVE-2026-64293 | Hig | 7.8 | >= 6.15.0, < 6.18.39 | 6.18.39 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read The bound-check in iommufd_veventq_fops_read() for the normal vEVENT path uses sizeof(hdr) where the surrounding code uses sizeof(*hdr): if (!v | |
| CVE-2026-64292 | Med | 5.5 | >= 6.15.0, < 6.18.40 | 6.18.40 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation happens inside the spinlock. Given its depth is decided by the user space, this leaves a vulnerability, where userspace can | |
| CVE-2026-64291 | Med | 5.5 | >= 6.15.0, < 6.18.39 | 6.18.39 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX. This leaves a vulnerability where userspace can allocate excessively | |
| CVE-2026-64290 | Med | 5.5 | >= 6.11.0, < 6.12.101 | 6.12.101 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fault_fops_read() On a copy_to_user() failure inside the inner list_for_each_entry, only the inner loop breaks; the outer while re-fetches the just-restored fault g | |
| CVE-2026-64289 | Med | 5.5 | >= 6.8.0, < 6.12.96 | 6.12.96 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entry_num and entry_len iommufd_hwpt_invalidate() takes a user-controlled entry_num and entry_len, each bounded only by U32_MAX. An entry_len beyond the kernel's | |
| CVE-2026-64288 | Med | 5.5 | >= 6.16.0, < 6.18.39 | 6.18.39 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet (no pseudo-TLB allocated). | |
| CVE-2026-64287 | Hig | 8.2 | >= 6.2.0, < 6.6.145 | 6.6.145 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use used_lrs as their loo |
- CVE-2026-64306Jul 25, 2026affected >= 4.1.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTR_DRBG drbg_ctr_generate() sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it.
- CVE-2026-64305Jul 25, 2026affected >= 3.17.0, < 6.12.96fixed 6.12.96
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - protect service table iterations with service_lock The service_table list is protected by service_lock when entries are added or removed (in adf_service_add() and adf_service_remove()), but severa
- affected >= 4.8.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() allocates half-size D
- affected >= 5.2.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengine_prep_slave_sg() fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since
- CVE-2026-64302Jul 25, 2026affected < 6.18.39fixed 6.18.39
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix freeing of PMD-sized vmemmap pages Commit bf9e4e30f353 ("x86/mm: use pagetable_free()"), switched from freeing non-boot page tables through __free_pages() to pagetable_free(). However, the function
- CVE-2026-64301Jul 25, 2026affected >= 5.11.0, < 5.15.212fixed 5.15.212
In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() scmi_regulator_probe() calls of_find_node_by_name() which takes a reference on the returned device node. On the error path where process_scmi
- affected >= 6.14.0, < 6.18.39fixed 6.18.39
In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via perf_mmap_to_page() while holding only event->mmap_mutex. Those fields are serialized by rb->aux_m
- affected >= 4.10.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions (filter_pred_string(), filter_pred_strloc() and filter_pred_strrell
- affected >= 2.6.24, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMO
- affected >= 5.17.0, < 6.1.178fixed 6.1.178
In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of module_extend_max_pages() module_extend_max_pages() calls kvrealloc() internally and returns -ENOMEM on allocation failure. The return value is never checked. If the i
- affected >= 5.7.0, < 5.10.261fixed 5.10.261
In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfat_find_dir_entry() In exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulate
- affected >= 6.15.0, < 6.18.39fixed 6.18.39
In the Linux kernel, the following vulnerability has been resolved: mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access The page_ext iteration API does not validate if the PFN still belongs to a valid section while advancing the iterator. When dyn
- affected >= 5.12.0, < 5.15.217fixed 5.15.217
In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks (for side-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done against
- affected >= 6.15.0, < 6.18.39fixed 6.18.39
In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read The bound-check in iommufd_veventq_fops_read() for the normal vEVENT path uses sizeof(hdr) where the surrounding code uses sizeof(*hdr): if (!v
- affected >= 6.15.0, < 6.18.40fixed 6.18.40
In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation happens inside the spinlock. Given its depth is decided by the user space, this leaves a vulnerability, where userspace can
- affected >= 6.15.0, < 6.18.39fixed 6.18.39
In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX. This leaves a vulnerability where userspace can allocate excessively
- affected >= 6.11.0, < 6.12.101fixed 6.12.101
In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fault_fops_read() On a copy_to_user() failure inside the inner list_for_each_entry, only the inner loop breaks; the outer while re-fetches the just-restored fault g
- affected >= 6.8.0, < 6.12.96fixed 6.12.96
In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entry_num and entry_len iommufd_hwpt_invalidate() takes a user-controlled entry_num and entry_len, each bounded only by U32_MAX. An entry_len beyond the kernel's
- affected >= 6.16.0, < 6.18.39fixed 6.18.39
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet (no pseudo-TLB allocated).
- affected >= 6.2.0, < 6.6.145fixed 6.6.145
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use used_lrs as their loo
Page 96 of 713