kernel

Vulnerabilities (14,254)

• CVE-2026-64245HigJul 24, 2026
  affected >= 6.4.0, < 6.6.144fixed 6.6.144

  In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fb_find_mode() If mode_option is NULL, it is assigned from mode_option_buf: if (!mode_option) { fb_get_options(NULL, &mode_option_buf); mode_option = mode_option_

• CVE-2026-64244MedJul 24, 2026
  affected >= 6.6.0, < 6.6.144fixed 6.6.144

  In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem->altmap after successful device registration If __add_memory_block() fails at xa_store() (under memory pressure for example), device_unregister() is called, which eventually trigger

• CVE-2026-64243HigJul 24, 2026
  affected >= 5.11.0, < 5.15.210fixed 5.15.210

  In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix enum control bounds check simple_mux_control_put() rejects values greater than e->items, but enum control values are zero based. For the two-entry mux used by this driver, valid va

• CVE-2026-64242HigJul 24, 2026
  affected >= 5.10.0, < 5.10.259fixed 5.10.259

  In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usb_initialize_gadget() installs gadget_release() as the release callback for the embedded gadget device. The struct net2280 instance is therefore rele

• CVE-2026-64241MedJul 24, 2026
  affected >= 5.15.0, < 6.12.96fixed 6.12.96

  In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and resource leaks in the driver's remove path and error handling: 1. Debounce clock reference leak: The debounce clock (bank->d

• CVE-2026-64240MedJul 24, 2026
  affected >= 6.6.140, < 6.6.143fixed 6.6.143

  In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup packet Commit eac69475b01f ("media: rc: igorplugusb: heed coherency rules") changed the control request storage from an embedded struct to an allocated pointer

• CVE-2026-64239HigJul 24, 2026
  affected >= 6.2.0, < 6.6.143fixed 6.6.143

  In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() DAMON sysfs maintains the DAMOS tried region directory objects via a linked list. When the user requests refresh of the directories, DAMON sysfs

• CVE-2026-64238MedJul 24, 2026
  affected >= 7.0.0, < 7.0.12fixed 7.0.12

  In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix deadlock on shared proxy's parent removal Commit 710abda58055 ("gpio: shared: call gpio_chip::of_xlate() if set") used the mutex embedded in struct gpio_shared_entry to protect the offset fiel

• CVE-2026-64237HigJul 24, 2026
  affected >= 4.0.0, < 5.10.259fixed 5.10.259

  In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - validate firmware size before use Ensure that the firmware file is large enough to contain the expected number of pages and the signature (which resides at the end of the firmware blob) before

• CVE-2026-64236MedJul 24, 2026
  affected >= 6.14.0, < 6.18.35fixed 6.18.35

  In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix division by zero on missing clock-frequency When the 'clock-frequency' property is missing from the device tree, the driver falls back to DAVINCI_I2C_DEFAULT_BUS_FREQ. However, this macro was

• CVE-2026-64235HigJul 24, 2026
  affected >= 6.9.0, < 6.12.93fixed 6.12.93

  In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIG_CALL_DEPTH_TRACKING enabled on an x86 retbleed-affected platform (eg: Skylake), with retbleed=stuff, registering a dynamic ftrac

• CVE-2026-64234MedJul 24, 2026
  affected >= 2.6.38, < 5.10.259fixed 5.10.259

  In the Linux kernel, the following vulnerability has been resolved: tty: serial: pch_uart: add check for dma_alloc_coherent() Add a check for dma_alloc_coherent() failure to prevent a potential NULL pointer dereference in dma_handle_rx(). Properly release DMA channels and the P

• CVE-2026-64233MedJul 24, 2026
  affected >= 6.3.0, < 6.6.143fixed 6.6.143

  In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind uvc_function_bind() walks &opts->extension_units twice without holding opts->lock: - directly, for the iExtension string-descriptor fixu

• CVE-2026-64232CriJul 24, 2026
  affected >= 6.12.0, < 6.12.92fixed 6.12.92

  In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_segments in blk_insert_cloned_request blk_insert_cloned_request() already recomputes nr_phys_segments against the bottom queue, because "the queue settings related to segment count

• CVE-2026-64231MedJul 24, 2026
  affected >= 5.14.0, < 6.1.175fixed 6.1.175

  In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by io_offset. Later this adjusted address might be used for memory dumping. However the s

• CVE-2026-64230MedJul 24, 2026
  affected >= 6.14.0, < 6.18.34fixed 6.18.34

  In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irq_data.rdev not being assigned Commit 64a6b577490c ("regulator: tps65219: Remove debugging helper function") removed the tps65219_get_rdev_by_name() helper along with the irq_data.rde

• CVE-2026-64229MedJul 24, 2026
  affected >= 6.15.0, < 6.18.35fixed 6.18.35

  In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disable broadcast TLB flush when PCID is disabled Booting with "nopcid" clears X86_FEATURE_PCID and keeps CR4.PCIDE from being set to one. On AMD CPUs that support INVLPGB, broadcast TLB flushing remain

• CVE-2026-64228MedJul 24, 2026
  affected >= 6.16.0, < 6.18.34fixed 6.18.34

  In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev->drv can become NULL while the phy_device is still attached to its net_device, namely after the PHY driver is unbound via sysfs: echo <mdi

• CVE-2026-64227MedJul 24, 2026
  affected >= 6.7.0, < 6.12.97fixed 6.12.97

  In the Linux kernel, the following vulnerability has been resolved: ACPI: driver: Check ACPI_COMPANION() against NULL during probe Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of device_match_driver_override(), pl

• CVE-2026-64226HigJul 24, 2026
  affected >= 6.12.0, < 6.12.92fixed 6.12.92

  In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error() dereferences p->comm and p->pid. If the iterator's reference is th