Search for packages
| purl | pkg:deb/debian/linux@6.1.4-1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-128r-zru4-jyf1 | kernel: ipv4: ip_gre: make ipgre_header() robust |
CVE-2026-23011
|
| VCID-129n-rzn7-4bcb | kernel: s390/dasd: fix error recovery leading to data corruption on ESE devices |
CVE-2024-45026
|
| VCID-12aq-ujux-eqas | kernel: net: mdio: fix unbalanced fwnode reference count in mdio_device_release() |
CVE-2022-48961
|
| VCID-12gb-pxkp-dyhh | kernel: Linux kernel: mlx5 firmware tracer vulnerable to arbitrary memory access or denial of service via malformed format strings |
CVE-2025-68816
|
| VCID-139c-g3zn-83dp | kernel: RDMA/rtrs-srv: Avoid null pointer deref during path establishment |
CVE-2024-50062
|
| VCID-13b9-m28b-hfb9 | kernel: bpf: Check validity of link->type in bpf_link_show_fdinfo() |
CVE-2024-53099
|
| VCID-13bw-5cxf-kkcq | kernel: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type |
CVE-2025-71194
|
| VCID-13ha-2ceu-hyhs | kernel: net: phy: dp83869: fix memory corruption when enabling fiber |
CVE-2024-50188
|
| VCID-142k-7wgv-pfh6 | In the Linux kernel, the following vulnerability has been resolved: wifi: radiotap: reject radiotap with unknown bits The radiotap parser is currently only used with the radiotap namespace (not with vendor namespaces), but if the undefined field 18 is used, the alignment/size is unknown as well. In this case, iterator->_next_ns_data isn't initialized (it's only set for skipping vendor namespaces), and syzbot points out that we later compare against this uninitialized value. Fix this by moving the rejection of unknown radiotap fields down to after the in-namespace lookup, so it will really use iterator->_next_ns_data only for vendor namespaces, even in case undefined fields are present. |
CVE-2026-23367
|
| VCID-1471-btm1-1qcg | kernel: nfsd: Initialize ssc before laundromat_work to prevent NULL dereference |
CVE-2025-38231
|
| VCID-14ey-bdy6-5qe9 | In the Linux kernel, the following vulnerability has been resolved: ext4: validate p_idx bounds in ext4_ext_correct_indexes ext4_ext_correct_indexes() walks up the extent tree correcting index entries when the first extent in a leaf is modified. Before accessing path[k].p_idx->ei_block, there is no validation that p_idx falls within the valid range of index entries for that level. If the on-disk extent header contains a corrupted or crafted eh_entries value, p_idx can point past the end of the allocated buffer, causing a slab-out-of-bounds read. Fix this by validating path[k].p_idx against EXT_LAST_INDEX() at both access sites: before the while loop and inside it. Return -EFSCORRUPTED if the index pointer is out of range, consistent with how other bounds violations are handled in the ext4 extent tree code. |
CVE-2026-31449
|
| VCID-14hp-mh7a-ayef | kernel: sch_htb: make htb_qlen_notify() idempotent |
CVE-2025-37932
|
| VCID-15du-xfr9-qbft | kernel: selinux: ignore unknown extended permissions |
CVE-2024-57931
|
| VCID-15hy-7u3s-7yfq | kernel: drm/amd/display: Fix slab-use-after-free on hdcp_work |
CVE-2025-21968
|
| VCID-16bv-9gad-pkat | kernel: wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work |
CVE-2025-39863
|
| VCID-16es-2z99-a3hu |
CVE-2026-31405
|
|
| VCID-16g4-1euq-g7g8 | kernel: kcsan: Turn report_filterlist_lock into a raw_spinlock |
CVE-2024-56610
|
| VCID-16j4-wgks-dyfe | kernel: PCI: cadence: Check for the existence of cdns_pcie::ops before using it |
CVE-2025-68176
|
| VCID-179u-b611-z7hc | In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential mismatch between the memory reserved for statistics and the amount of memory written. gem_get_sset_count() correctly computes the number of stats based on the active queues, whereas gem_get_ethtool_stats() indiscriminately copies data using the maximum number of queues, and in the case the number of active queues is less than MACB_MAX_QUEUES, this results in a OOB write as observed in the KASAN splat. ================================================================== BUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78 [macb] Write of size 760 at addr ffff80008080b000 by task ethtool/1027 CPU: [...] Tainted: [E]=UNSIGNED_MODULE Hardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025 Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x80/0xf8 print_report+0x384/0x5e0 kasan_report+0xa0/0xf0 kasan_check_range+0xe8/0x190 __asan_memcpy+0x54/0x98 gem_get_ethtool_stats+0x54/0x78 [macb 926c13f3af83b0c6fe64badb21ec87d5e93fcf65] dev_ethtool+0x1220/0x38c0 dev_ioctl+0x4ac/0xca8 sock_do_ioctl+0x170/0x1d8 sock_ioctl+0x484/0x5d8 __arm64_sys_ioctl+0x12c/0x1b8 invoke_syscall+0xd4/0x258 el0_svc_common.constprop.0+0xb4/0x240 do_el0_svc+0x48/0x68 el0_svc+0x40/0xf8 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1b0/0x1b8 The buggy address belongs to a 1-page vmalloc region starting at 0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff00000a333000 pfn:0xa333 flags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff) raw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ================================================================== Fix it by making sure the copied size only considers the active number of queues. |
CVE-2026-31494
|
| VCID-17j1-c3fv-wyej | kernel: net_sched: Flush gso_skb list too during ->change() |
CVE-2025-37992
|
| VCID-17jc-frw3-v3ep | kernel: media: venus: protect against spurious interrupts during probe |
CVE-2025-39709
|
| VCID-17tu-a4wu-b3hv | kernel: blktrace: fix __this_cpu_read/write in preemptible context |
CVE-2026-23374
|
| VCID-17wc-s5p9-3qf8 | kernel: net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. |
CVE-2025-23143
|
| VCID-18fj-d6s1-2bch | kernel: block: Fix page refcounts for unaligned buffers in __bio_release_pages() |
CVE-2024-35826
|
| VCID-18mv-aj8j-2qg2 | kernel: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback |
CVE-2022-49398
|
| VCID-18wu-uw8m-myc2 | kernel: iio: light: as73211: Ensure buffer holes are zeroed |
CVE-2025-39687
|
| VCID-197k-nnxp-nqcx | kernel: cifs: use-after-free in cifs_demultiplex_thread() |
CVE-2023-52572
|
| VCID-19rb-87p4-hybx | kernel: nilfs2: fix potential oob read in nilfs_btree_check_delete() |
CVE-2024-47757
|
| VCID-1a3x-wcx3-j3gf | kernel: ipvs: fix ipv4 null-ptr-deref in route error path |
CVE-2025-68813
|
| VCID-1adp-h2dm-7kex | kernel: apparmor: fix unprivileged local user can do privileged policy management |
CVE-2026-23268
|
| VCID-1agu-skkf-fqf7 | kernel: mtd: rawnand: fix double free in atmel_pmecc_create_user() |
CVE-2024-56766
|
| VCID-1ajk-6gxr-efgp | kernel: gfs2: No more self recovery |
CVE-2025-38659
|
| VCID-1aq7-pxcr-tqgj | kernel: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK |
CVE-2024-57901
|
| VCID-1b3w-huk2-rbdu | kernel: net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup |
CVE-2026-23256
|
| VCID-1brz-b2qw-pbhy | kernel: comedi: aio_iiro_16: Fix bit shift out of bounds |
CVE-2025-38529
|
| VCID-1buh-fk6e-r7h1 | kernel: NFSD: fix hang in nfsd4_shutdown_callback |
CVE-2025-21795
|
| VCID-1c14-gjcb-yfaa | kernel: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl |
CVE-2023-54202
|
| VCID-1c1t-vczd-yfa3 | kernel: f2fs: fix to don't dirty inode for readonly filesystem |
CVE-2024-42297
|
| VCID-1c4a-w8jv-cudd | kernel: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() |
CVE-2023-53401
|
| VCID-1c7u-qh8q-uqc3 | kernel: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup |
CVE-2023-53748
|
| VCID-1cac-quc3-2bcf | kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() |
CVE-2025-40139
|
| VCID-1dr9-d7qp-abbs | kernel: bcache: fix NULL pointer in cache_set_flush() |
CVE-2025-38263
|
| VCID-1dxt-yy4z-y7cs | kernel: can: ucan: Fix infinite loop from zero-length messages |
CVE-2026-23298
|
| VCID-1e2r-rme5-7kbv | kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts |
CVE-2024-57981
|
| VCID-1emq-m7qa-sbdx | kernel: PCI: mt7621: Add sentinel to quirks table |
CVE-2022-48952
|
| VCID-1es2-2yzp-6ufp | kernel: f2fs: fix to avoid out-of-boundary access in devs.path |
CVE-2025-38652
|
| VCID-1exk-p2an-x3b5 | kernel: soc: qcom: pdr: protect locator_addr with the main mutex |
CVE-2024-43849
|
| VCID-1fkb-y8ad-vqec | kernel: tcp: fix mptcp DSS corruption due to large pmtu xmit |
CVE-2024-50083
|
| VCID-1g4u-g1ms-bqew | kernel: hfsplus: Verify inode mode when loading from disk |
CVE-2025-68767
|
| VCID-1g53-791b-8fd7 | kernel: drm/amd/display: Validate function returns |
CVE-2024-46775
|
| VCID-1g77-qwuy-nkg8 |
CVE-2026-31416
|
|
| VCID-1gq3-szyf-rkgv | kernel: ipmi: ipmb: Add check devm_kasprintf() returned value |
CVE-2024-58051
|
| VCID-1h2t-hhzx-77e2 | kernel: smack: tcp: ipv4, fix incorrect labeling |
CVE-2024-47659
|
| VCID-1hcz-s9ye-7kbz | kernel: drm/msm: fix vram leak on bind errors |
CVE-2023-53562
|
| VCID-1hvg-tmga-nfhm | kernel: firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() |
CVE-2024-53068
|
| VCID-1hyt-yz2v-vyhk | kernel: s390/sclp: Prevent release of buffer in I/O |
CVE-2024-44969
|
| VCID-1jvn-mqky-83d5 | kernel: wifi: cfg80211: fix use-after-free in cmp_bss() |
CVE-2025-39864
|
| VCID-1kaf-f6tb-ckdm | kernel: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' |
CVE-2024-36478
|
| VCID-1kag-8p92-57dv | kernel: NFC: nci: Add bounds checking in nci_hci_create_pipe() |
CVE-2025-21735
|
| VCID-1kfb-qzjj-6fc8 | kernel: net: arc: fix the device for dma_map_single/dma_unmap_single |
CVE-2024-50295
|
| VCID-1kfs-hhte-wka8 | kernel: leds: class: Protect brightness_show() with led_cdev->led_access mutex |
CVE-2024-56587
|
| VCID-1kgs-19ue-wbe1 | In the Linux kernel, the following vulnerability has been resolved: mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations ieee80211_chan_bw_change() iterates all stations and accesses link->reserved.oper via sta->sdata->link[link_id]. For stations on AP_VLAN interfaces (e.g. 4addr WDS clients), sta->sdata points to the VLAN sdata, whose link never participates in chanctx reservations. This leaves link->reserved.oper zero-initialized with chan == NULL, causing a NULL pointer dereference in __ieee80211_sta_cap_rx_bw() when accessing chandef->chan->band during CSA. Resolve the VLAN sdata to its parent AP sdata using get_bss_sdata() before accessing link data. [also change sta->sdata in ARRAY_SIZE even if it doesn't matter] |
CVE-2026-31394
|
| VCID-1kuj-tvuz-37a4 | kernel: net/mlx5e: Fix cleanup null-ptr deref on encap lock |
CVE-2023-53105
|
| VCID-1kx2-fvd6-abcu | kernel: crypto: af_alg - Set merge to zero early in af_alg_sendmsg |
CVE-2025-39931
|
| VCID-1m9j-m8xz-zqav | kernel: smc: Fix use-after-free in tcp_write_timer_handler() |
CVE-2023-53781
|
| VCID-1ms6-xhda-rkc8 | kernel: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO |
CVE-2025-38696
|
| VCID-1n3b-rbnm-t7by | kernel: smb: client: fix potential UAF in cifs_stats_proc_write() |
CVE-2024-35868
|
| VCID-1n5v-auw6-wbcd |
CVE-2026-23420
|
|
| VCID-1n7k-a7ve-8qcr | kernel: smb: client: fix use-after-free of signing key |
CVE-2024-53179
|
| VCID-1nn1-pqbm-rkep | kernel: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() |
CVE-2024-56748
|
| VCID-1nqk-1gvy-rkf7 | kernel: inet: inet_defrag: prevent sk release while still in use |
CVE-2024-26921
|
| VCID-1pre-7cqx-4yee | kernel: drm/amd/display: Initialize denominators' default to 1 |
CVE-2024-49899
|
| VCID-1pt7-8yue-c3gk | kernel: tls: race between async notify and socket close |
CVE-2024-26583
|
| VCID-1qk3-mmau-z7bz | kernel: cifs: Fix buffer overflow when parsing NFS reparse points |
CVE-2024-49996
|
| VCID-1r31-9qt8-j7e4 | kernel: usb: gadget: f_fs: Fix epfile null pointer access after ep enable |
CVE-2025-40315
|
| VCID-1r9m-mwej-xyhb | kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump |
CVE-2024-27017
|
| VCID-1rd4-nsvv-6bfy | kernel: btrfs: don't check PageError in __extent_writepage |
CVE-2023-53429
|
| VCID-1rhh-zrug-1ueq | kernel: KVM: VMX: Prevent RSB underflow before vmenter |
CVE-2022-49610
|
| VCID-1ru9-b9h4-1kbr | kernel: can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB |
CVE-2025-39873
|
| VCID-1rx1-313v-rqaz | kernel: can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak |
CVE-2026-23075
|
| VCID-1s26-havx-dkey | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads past the valid data in the skb. The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path. |
CVE-2026-31512
|
| VCID-1s71-efrq-nfep | kernel: net: ipv6: fix field-spanning memcpy warning in AH output |
CVE-2025-40363
|
| VCID-1s77-djzb-xffp |
CVE-2026-31417
|
|
| VCID-1t1x-4v6d-akdz | kernel: OOB Access in smb2_dump_detail |
CVE-2023-6610
|
| VCID-1t8x-8jm7-2qch | kernel: vfio/pci: fix memory leak during D3hot to D0 transition |
CVE-2022-49219
|
| VCID-1tap-mh5d-3ybj | kernel: ALSA: usx2y: Use snd_card_free_when_closed() at disconnection |
CVE-2024-56533
|
| VCID-1tb8-t91c-63bp | x86: Native Branch History Injection |
CVE-2024-2201
XSA-456 |
| VCID-1typ-gy3x-g7h6 | kernel: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly |
CVE-2025-71096
|
| VCID-1tz8-g3j6-zyds | kernel: ACPI: video: Fix use-after-free in acpi_video_switch_brightness() |
CVE-2025-40211
|
| VCID-1u7s-ayax-x3fs | kernel: iwlwifi: Add missing check for alloc_ordered_workqueue |
CVE-2025-38602
|
| VCID-1utw-6bxm-bfff | kernel: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE |
CVE-2024-45025
|
| VCID-1uzt-j9kh-4yc7 | kernel: f2fs: fix return value of f2fs_convert_inline_inode() |
CVE-2024-42296
|
| VCID-1vbv-5m6c-wfac | kernel: nilfs2: fix possible int overflows in nilfs_fiemap() |
CVE-2025-21736
|
| VCID-1w2e-4m6v-mben | kernel: drm/qxl: Add check for drm_cvt_mode |
CVE-2024-43829
|
| VCID-1wg5-fdus-vfeb | kernel: can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs |
CVE-2025-68307
|
| VCID-1x2r-t2gj-akgf | kernel: netfilter: nft_objref: validate objref and objrefmap expressions |
CVE-2025-40206
|
| VCID-1xxk-rdqj-akdr | kernel: ext4: fix off-by-one errors in fast-commit block filling |
CVE-2022-50428
|
| VCID-1y3u-3dxg-jugk | kernel: Null pointer dereference in some Intel(R) Graphics Drivers |
CVE-2020-12364
|
| VCID-1y7x-beaw-6bdy | kernel: regulator: core: Use different devices for resource allocation and DT lookup |
CVE-2022-50616
|
| VCID-1yb7-hxdh-ybdm | kernel: dm cache: free background tracker's queued work in btracker_destroy |
CVE-2023-53765
|
| VCID-1ygk-whua-gbcq | kernel: ALSA: usb-audio: Use correct version for UAC3 header validation |
CVE-2026-23318
|
| VCID-1yk6-qsuw-bbf8 | kernel: net/mlx5: Update error handler for UCTX and UMEM |
CVE-2021-47212
|
| VCID-1z5b-831k-c7aq | kernel: block: fix potential invalid pointer dereference in blk_add_partition |
CVE-2024-47705
|
| VCID-1z95-hqym-fbcc | kernel: tee: fix NULL pointer dereference in tee_shm_put |
CVE-2025-39865
|
| VCID-1zwy-1ej1-kfft | kernel: net: gso: fix ownership in __udp_gso_segment |
CVE-2025-21926
|
| VCID-211b-3gjm-r7fh | kernel: Linux kernel (JFS): Data corruption, information disclosure, and system unavailability via invalid inode mode. |
CVE-2025-40312
|
| VCID-21bh-d6n2-r3du | kernel: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] |
CVE-2024-46815
|
| VCID-21fx-6crx-ske2 | kernel: drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer |
CVE-2024-49918
|
| VCID-21jy-g45u-c7gp | kernel: sched/deadline: Fix warning in migrate_enable for boosted tasks |
CVE-2024-56583
|
| VCID-229w-jxk9-ykc1 | kernel: ad7780: fix division by zero in ad7780_write_raw() |
CVE-2024-56567
|
| VCID-22cz-87jj-83d4 | kernel: drm/dp: Fix OOB read when handling Post Cursor2 register |
CVE-2022-49218
|
| VCID-22rd-8dbu-bbc1 | kernel: arcnet: Add NULL check in com20020pci_probe() |
CVE-2025-22054
|
| VCID-22zw-13pm-fkct | kernel: scsi: pm80xx: Set phy->enable_completion only when we wait for it |
CVE-2024-47666
|
| VCID-23sv-mm7x-f3gq | kernel: leds: trigger: Unregister sysfs attributes before calling deactivate() |
CVE-2024-43830
|
| VCID-23xy-za5d-zqf7 | kernel: xfrm: validate new SA's prefixlen using SA family when sel.family is unset |
CVE-2024-50142
|
| VCID-249q-v6wt-e7d3 | kernel: media: rkisp1: Fix IRQ disable race issue |
CVE-2023-52589
|
| VCID-24dm-m1bk-t7fv | In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: fix race condition in qman_destroy_fq When QMAN_FQ_FLAG_DYNAMIC_FQID is set, there's a race condition between fq_table[fq->idx] state and freeing/allocating from the pool and WARN_ON(fq_table[fq->idx]) in qman_create_fq() gets triggered. Indeed, we can have: Thread A Thread B qman_destroy_fq() qman_create_fq() qman_release_fqid() qman_shutdown_fq() gen_pool_free() -- At this point, the fqid is available again -- qman_alloc_fqid() -- so, we can get the just-freed fqid in thread B -- fq->fqid = fqid; fq->idx = fqid * 2; WARN_ON(fq_table[fq->idx]); fq_table[fq->idx] = fq; fq_table[fq->idx] = NULL; And adding some logs between qman_release_fqid() and fq_table[fq->idx] = NULL makes the WARN_ON() trigger a lot more. To prevent that, ensure that fq_table[fq->idx] is set to NULL before gen_pool_free() is called by using smp_wmb(). |
CVE-2026-23463
|
| VCID-24gw-73zd-3khc | kernel: ipv6: mcast: extend RCU protection in igmp6_send() |
CVE-2025-21759
|
| VCID-25ja-vd4z-3ffc | kernel: wifi: ath10k: shutdown driver when hardware is unreliable |
CVE-2025-39746
|
| VCID-25nt-fa4m-97fm | kernel: binfmt_misc: restore write access before closing files opened by open_exec() |
CVE-2025-68239
|
| VCID-26p9-kfem-6yar | kernel: pptp: ensure minimal skb length in pptp_xmit() |
CVE-2025-38574
|
| VCID-27tf-w55m-97gh | kernel: net_sched: sch_sfq: don't allow 1 packet limit |
CVE-2024-57996
|
| VCID-27vm-nwxr-zuec | kernel: io_uring/sqpoll: work around a potential audit memory leak |
CVE-2024-41001
|
| VCID-285d-yzd9-sfhk | kernel: usb: typec: ucsi: Fix null pointer dereference in trace |
CVE-2024-46719
|
| VCID-28m6-tuyv-uqev | kernel: drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw |
CVE-2024-49917
|
| VCID-28pj-ffw2-f3e2 | kernel: drm/panfrost: Job should reference MMU not file_priv |
CVE-2022-49359
|
| VCID-2a93-u261-kkeg | kernel: drm/i915/selftests: fix subtraction overflow bug |
CVE-2022-49635
|
| VCID-2ahz-hvvc-n3cd | kernel: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo |
CVE-2025-37970
|
| VCID-2b83-3dx3-qydv | kernel: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() |
CVE-2024-40953
|
| VCID-2b9k-rn6z-7fhz | kernel: drm/amd/display: Avoid a NULL pointer dereference |
CVE-2025-39693
|
| VCID-2bay-kzph-yya3 | kernel: RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES |
CVE-2024-53094
|
| VCID-2bvr-9es2-87dt | kernel: drm/amd/display: Fix index out of bounds in degamma hardware format translation |
CVE-2024-49894
|
| VCID-2c9b-wvc2-b7h2 | kernel: scsi: qla2xxx: Fix for possible memory corruption |
CVE-2024-42288
|
| VCID-2cxv-ay17-4kh2 | kernel: Linux kernel: Denial of Service due to sleepable page allocation in KASAN |
CVE-2025-38029
|
| VCID-2czc-s79t-13fw | kernel: ext4: ignore xattrs past end |
CVE-2025-37738
|
| VCID-2d7w-2f5y-qfdz | kernel: exec: don't WARN for racy path_noexec check |
CVE-2024-50010
|
| VCID-2e99-ge3p-13eq | kernel: dm-raid: really frozen sync_thread during suspend |
CVE-2024-35794
|
| VCID-2e9y-367d-r7d3 | kernel: netfilter: xt_nfacct: don't assume acct name is null-terminated |
CVE-2025-38639
|
| VCID-2euh-sffk-tqgh | kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service |
CVE-2025-40269
|
| VCID-2fck-ppsa-7bbh | kernel: acct: perform last write from workqueue |
CVE-2025-21846
|
| VCID-2fjq-waru-kkc8 | kernel: usb: typec: ucsi: displayport: Fix deadlock |
CVE-2025-37967
|
| VCID-2g48-2tyb-4ugq | kernel: qed: Don't collect too many protection override GRC elements |
CVE-2025-39949
|
| VCID-2gjf-37qn-kydv | BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the HID over GATT Profile. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25177. |
CVE-2024-8805
|
| VCID-2gt4-7nbk-g7dj | kernel: drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules |
CVE-2024-43907
|
| VCID-2gxn-97ry-tfec | kernel: ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() |
CVE-2025-38249
|
| VCID-2hdc-hwf3-bqax | kernel: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() |
CVE-2025-40088
|
| VCID-2j8a-rjj4-83c9 | kernel: module: fix [e_shstrndx].sh_size=0 OOB access |
CVE-2022-49444
|
| VCID-2jt1-eh8c-4kbm | kernel: KVM: VMX: Do _all_ initialization before exposing /dev/kvm to userspace |
CVE-2022-49932
|
| VCID-2k4e-em5c-m3bv | kernel: sysfs: check visibility before changing group attribute ownership |
CVE-2025-40355
|
| VCID-2kk2-cj4m-6ucm | kernel: md: Don't ignore suspended array in md_check_recovery() |
CVE-2024-26758
|
| VCID-2ktk-z761-uyd7 | kernel: ALSA: scarlett2: Add missing error checks to *_ctl_get() |
CVE-2023-52680
|
| VCID-2kud-6ebm-dkb2 | kernel: arp: use RCU protection in arp_xmit() |
CVE-2025-21762
|
| VCID-2mam-3mfn-cfg8 | kernel: RDMA/hns: Fix deadlock on SRQ async events. |
CVE-2024-38591
|
| VCID-2nk9-4y34-vkba | kernel: dmaengine: ti: Add NULL check in udma_probe() |
CVE-2025-38138
|
| VCID-2nqc-u3ug-1fhg | kernel: ocfs2: uncache inode which has failed entering the group |
CVE-2024-53112
|
| VCID-2ph4-r6ek-3ybm | kernel: crypto: qat - add param check for DH |
CVE-2022-49564
|
| VCID-2prt-1t8q-bycy | kernel: media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread |
CVE-2024-57834
|
| VCID-2q6d-84eu-kyh4 | kernel: net: usb: rtl8150: fix memory leak on usb_submit_urb() failure |
CVE-2025-71154
|
| VCID-2qd3-2vy6-d3hu | kernel: ASoC: topology: Fix references to freed memory |
CVE-2024-41069
|
| VCID-2rgu-ys77-pfgq | kernel: ext4: fix potential out of bound read in ext4_fc_replay_scan() |
CVE-2022-50306
|
| VCID-2s5m-15wa-93d3 | kernel: USB: serial: io_edgeport: fix use after free in debug printk |
CVE-2024-50267
|
| VCID-2s7e-4bym-cbe1 | kernel: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() |
CVE-2025-40261
|
| VCID-2tb5-b941-bfck | kernel: Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF |
CVE-2025-40283
|
| VCID-2tkt-trv2-d7gf | kernel: Linux kernel: Denial of Service in ftrace due to race condition in trace_printk_seq |
CVE-2025-39813
|
| VCID-2vah-ytqz-c7cy | kernel: wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb |
CVE-2024-56609
|
| VCID-2vgf-2yqv-sfbd | kernel: btrfs: do not clean up repair bio if submit fails |
CVE-2022-49168
|
| VCID-2vqp-wpcw-pfbm | kernel: bpf: Prevent tailcall infinite loop caused by freplace |
CVE-2024-47794
|
| VCID-2vyh-bnqj-e7ea | kernel: staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser |
CVE-2025-68256
|
| VCID-2wa6-shcj-k3ff | kernel: netdevsim: prevent bad user input in nsim_dev_health_break_write() |
CVE-2024-56716
|
| VCID-2xhv-1gcg-y3cs | kernel: bpf: consider that tail calls invalidate packet pointers |
CVE-2024-58237
|
| VCID-2y25-ds8c-u7dh | kernel: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} |
CVE-2022-50233
|
| VCID-2ym4-7paw-zyg5 | kernel: usb: early: xhci-dbc: Fix a potential out-of-bound memory access |
CVE-2023-53840
|
| VCID-2yy2-gjs9-8uc6 | kernel: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() |
CVE-2024-57884
|
| VCID-311t-c3jg-tuc3 | kernel: usb: gadget: f_acm: Refactor bind path to use __free() |
CVE-2025-40094
|
| VCID-317b-2h1w-9ud1 | kernel: mptcp: pm: avoid possible UaF when selecting endp |
CVE-2024-44974
|
| VCID-31hs-1pwx-7uak | kernel: drm/amdkfd: debugfs hang_hws skip GPU with MES |
CVE-2025-37853
|
| VCID-3279-e33p-nkay | kernel: can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow |
CVE-2025-39986
|
| VCID-32fv-6t46-bfan | kernel: PCI: pnv_php: Clean up allocated IRQs on unplug |
CVE-2025-38624
|
| VCID-33re-7rh6-2bg4 | kernel: net: add proper RCU protection to /proc/net/ptype |
CVE-2026-23255
|
| VCID-341t-wy9a-p7fz | kernel: btrfs: do not free data reservation in fallback from inline due to -ENOSPC |
CVE-2025-71269
|
| VCID-35a3-rhpc-7fgv | kernel: block: Fix WARNING in _copy_from_iter |
CVE-2024-26844
|
| VCID-35pr-a5xg-4ugy | kernel: ipv6: prevent UAF in ip6_send_skb() |
CVE-2024-44987
|
| VCID-361h-4tp7-xff8 | kernel: Linux kernel: Denial of Service in ASoC Mediatek due to refcount leak |
CVE-2022-50392
|
| VCID-36e2-uj9a-6baj | kernel: tracing: Limit access to parser->buffer when trace_get_user failed |
CVE-2025-39683
|
| VCID-36tr-gx3y-sbf1 | kernel: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). |
CVE-2024-50154
|
| VCID-36xm-pbn4-2yfu | kernel: Linux kernel i40e: Resource exhaustion via unbounded VF filter requests |
CVE-2025-39968
|
| VCID-37dd-benh-dbdr | kernel: tpm: Clean up TPM space after command failure |
CVE-2024-49851
|
| VCID-38gu-4nx1-jfhy | kernel: wifi: ath11k: fix memory leak in WMI firmware stats |
CVE-2023-53602
|
| VCID-39fe-e7ya-kfe5 | kernel: memstick/mspro_block: fix handling of read-only devices |
CVE-2022-49178
|
| VCID-3a7k-7tcz-yfcw | kernel: openvswitch: Fix unsafe attribute parsing in output_userspace() |
CVE-2025-37998
|
| VCID-3a8a-ns8q-wbgy | kernel: drm/amd/display: Check null pointers before using them |
CVE-2024-49922
|
| VCID-3aa5-4rp5-g7h3 | kernel: Linux kernel: Memory Corruption and Kernel Crashes via IOMMU SVA coherency issue |
CVE-2025-71202
|
| VCID-3aek-a993-fyfj | kernel: exfat: fix the infinite loop in exfat_readdir() |
CVE-2024-57940
|
| VCID-3ans-72mm-sfh1 | In the Linux kernel, the following vulnerability has been resolved: spi: meson-spicc: Fix double-put in remove path meson_spicc_probe() registers the controller with devm_spi_register_controller(), so teardown already drops the controller reference via devm cleanup. Calling spi_controller_put() again in meson_spicc_remove() causes a double-put. |
CVE-2026-31489
|
| VCID-3auu-qywm-cyd2 | kernel: drm/amdgpu: Fix out-of-bounds write warning |
CVE-2024-46725
|
| VCID-3bdu-hpbb-4ycp | kernel: lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure |
CVE-2024-38543
|
| VCID-3bny-rs9y-3yag | kernel: smb: client: fix use-after-free in cifs_oplock_break |
CVE-2025-38527
|
| VCID-3bsr-htn1-ufea | kernel: most: usb: fix double free on late probe failure |
CVE-2025-68290
|
| VCID-3bw5-61q3-6kc8 | kernel: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" |
CVE-2025-68818
|
| VCID-3bwh-381p-6qbh | kernel: drm/amd/display: 'panel_cntl' could be null in 'dcn21_set_backlight_level()' |
CVE-2024-26662
|
| VCID-3cah-1nkn-5uga | kernel: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT |
CVE-2024-53057
|
| VCID-3cbu-frk2-vudb | kernel: net: hns3: using the num_tqps in the vf driver to apply for resources |
CVE-2025-71064
|
| VCID-3cuj-d6qv-u7bw | kernel: drm/amd/display: Assign normalized_pix_clk when color depth = 14 |
CVE-2025-21956
|
| VCID-3cwu-kg6p-yya7 | kernel: Bluetooth: L2CAP: Fix uaf in l2cap_connect |
CVE-2024-49950
|
| VCID-3d8r-1n1k-skff | kernel: io_uring: check for overflows in io_pin_pages |
CVE-2024-53187
|
| VCID-3dw8-cjmf-2fdp | kernel: PCI: keystone: Fix if-statement expression in ks_pcie_quirk() |
CVE-2024-47756
|
| VCID-3eb4-ca4c-5qf7 | kernel: bpf: Fix kmemleak warning for percpu hashmap |
CVE-2025-37807
|
| VCID-3fny-8r4k-buag | kernel: x86/bugs: Use code segment selector for VERW operand |
CVE-2024-50072
|
| VCID-3fpy-fq8u-r3gb | kernel: jfs: add check read-only before txBeginAnon() call |
CVE-2024-58095
|
| VCID-3fse-dyr7-akdw | kernel: parisc: Fix locking in pdc_iodc_print() firmware call |
CVE-2022-50518
|
| VCID-3fy9-44f1-rqc6 | kernel: x86/MCE: Always save CS register on AMD Zen IF Poison errors |
CVE-2023-53438
|
| VCID-3g8h-ez8d-f7c1 | kernel: drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' |
CVE-2024-56608
|
| VCID-3gbh-e8uh-vbgw | kernel: bonding: annotate data-races around slave->last_rx |
CVE-2026-23212
|
| VCID-3geu-x5r8-4yb8 | kernel: drm/amdgpu: Fix size validation for non-exclusive domains (v4) |
CVE-2022-50527
|
| VCID-3gtc-6ny2-ybe6 | kernel: sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III |
CVE-2025-40124
|
| VCID-3h5m-tgvt-73hm | kernel: wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() |
CVE-2025-68759
|
| VCID-3h7q-sen2-53ex | kernel: ext4: refresh inline data size before write operations |
CVE-2025-68264
|
| VCID-3hbn-g4qy-abea | kernel: soc: qcom: pdr: Fix the potential deadlock |
CVE-2025-22014
|
| VCID-3hmh-8t3k-97h8 | kernel: ksmbd race issue from smb2 close and logoff with multichannel |
CVE-2023-32256
|
| VCID-3hzg-4gzg-eqgm | kernel: ext4: fix string copying in parse_apply_sb_mount_options() |
CVE-2025-71123
|
| VCID-3hzp-1g57-k7d9 | kernel: staging: vchiq_arm: Avoid NULL ptr deref in vchiq_dump_platform_instances |
CVE-2022-49106
|
| VCID-3ja6-cm48-yyhp | kernel: drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() |
CVE-2024-56369
|
| VCID-3jmx-jfhk-yqh5 | kernel: usb: gadget: f_ncm: align net_device lifecycle with bind/unbind |
CVE-2026-23320
|
| VCID-3k5n-tbua-7bhb | kernel: net: liquidio: Initialize netdev pointer before queue setup |
CVE-2026-23258
|
| VCID-3km6-xsxg-4bcr |
CVE-2026-31426
|
|
| VCID-3m3c-4r85-qbaj | kernel: drm/hisilicon/hibmc: fix the hibmc loaded failed bug |
CVE-2025-39772
|
| VCID-3m7v-vaxb-1khb | kernel: net/smc: Transitional solution for clcsock race issue |
CVE-2022-48751
|
| VCID-3mnk-6n3d-v7ak | kernel: drm/amd/pm: fix a potential gpu_metrics_table memory leak |
CVE-2021-47658
|
| VCID-3mzb-7emm-zqbk | kernel: sched/core: Do not requeue task on CPU excluded from cpus_mask |
CVE-2022-50100
|
| VCID-3n93-2brh-vqaj | kernel: scsi: qla2xxx: Fix premature hw access after PCI error |
CVE-2022-49157
|
| VCID-3nnk-fzpk-j7cf | kernel: Input: cros_ec_keyb - fix an invalid memory access |
CVE-2025-40263
|
| VCID-3nnk-t6e8-sfa8 | kernel: media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish |
CVE-2023-53244
|
| VCID-3p2d-np1n-p3gv | kernel: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads |
CVE-2025-37833
|
| VCID-3phk-ne4y-2yfr | kernel: smb3: fix for slab out of bounds on mount to ksmbd |
CVE-2025-38728
|
| VCID-3pnr-vxcg-mqdr | kernel: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request |
CVE-2024-45828
|
| VCID-3pq7-cjsf-3fc9 | kernel: powerpc/memhotplug: Add add_pages override for PPC |
CVE-2022-49666
|
| VCID-3pqh-5kcf-q3cm | kernel: f2fs: fix to do sanity check on sit_bitmap_size |
CVE-2025-38218
|
| VCID-3pv5-s5r1-vkdg | Linux kernel: nfnetlink_osf: Linux kernel: Denial of Service in nfnetlink_osf via crafted network packets |
CVE-2026-23397
|
| VCID-3pye-vr45-xye5 | kernel: wifi: mac80211: ocb: skip rx_no_sta when interface is not joined |
CVE-2025-71224
|
| VCID-3q3d-9sza-v7bk | kernel: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT |
CVE-2026-23125
|
| VCID-3q3e-m1px-sfcc | kernel: ARM: rockchip: fix kernel hang during smp initialization |
CVE-2025-39752
|
| VCID-3r27-df68-nkh6 | kernel: tls: handle backlogging of crypto requests |
CVE-2024-26584
|
| VCID-3thc-wed7-1bhn | kernel: jfs: Regular file corruption check |
CVE-2025-38698
|
| VCID-3tj9-e9p3-kyc3 | kernel: usb: dwc3: host: Stop setting the ACPI companion |
CVE-2022-49306
|
| VCID-3tns-khmb-aqbn | In the Linux kernel, the following vulnerability has been resolved: xfs: avoid dereferencing log items after push callbacks After xfsaild_push_item() calls iop_push(), the log item may have been freed if the AIL lock was dropped during the push. Background inode reclaim or the dquot shrinker can free the log item while the AIL lock is not held, and the tracepoints in the switch statement dereference the log item after iop_push() returns. Fix this by capturing the log item type, flags, and LSN before calling xfsaild_push_item(), and introducing a new xfs_ail_push_class trace event class that takes these pre-captured values and the ailp pointer instead of the log item pointer. |
CVE-2026-31453
|
| VCID-3tx6-5j2a-pyh6 | kernel: Overlayfs in the Linux kernel and shiftfs not restoring original value on error leading to a refcount underflow |
CVE-2019-15794
|
| VCID-3uut-qcy8-wbdt | kernel: f2fs: compress: fix to cover normal cluster write with cp_rwsem |
CVE-2024-27034
|
| VCID-3uwu-5fws-kqbf | kernel: f2fs: use global inline_xattr_slab instead of per-sb slab cache |
CVE-2025-71105
|
| VCID-3vh9-c7m1-dubs | kernel: net/mlx5e: Prevent deadlock while disabling aRFS |
CVE-2024-27014
|
| VCID-3vzu-bb37-9ydc | kernel: sctp: Fix MAC comparison to be constant-time |
CVE-2025-40204
|
| VCID-3w2h-qpev-p7d2 | kernel: hfsplus: remove mutex_lock check in hfsplus_free_extents |
CVE-2025-38650
|
| VCID-3wec-9zyd-n7ay | kernel: Linux kernel kTLS: Denial of Service from uninitialized data transmission |
CVE-2025-38608
|
| VCID-3wu9-tstk-1ycc | kernel: fpga: manager: add owner module and take its refcount |
CVE-2024-37021
|
| VCID-3x6t-v16h-xfh4 | kernel: bpf: Fix a data-race around bpf_jit_limit. |
CVE-2022-49967
|
| VCID-3x89-ejxg-4qg6 | kernel: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() |
CVE-2025-22107
|
| VCID-3x8d-u8me-f7ge | kernel: net: 9p: fix refcount leak in p9_read_work() error handling |
CVE-2022-50114
|
| VCID-3yf8-k2fy-ckf4 | kernel: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry |
CVE-2024-46822
|
| VCID-3yg6-7zfv-gkaq | kernel: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket |
CVE-2024-53168
|
| VCID-3yy5-gnkd-kkhg | kernel: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT |
CVE-2025-38439
|
| VCID-3yy5-tvhs-bygv | kernel: Linux kernel: `iommu/amd`: Buffer overflow in `parse_ivrs_acpihid` |
CVE-2025-37927
|
| VCID-3yyd-b113-xybd | kernel: page_pool: avoid infinite loop to schedule delayed worker |
CVE-2025-37859
|
| VCID-3yzs-sjd2-53d7 | kernel: HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them |
CVE-2026-23382
|
| VCID-3z58-qk98-9fby | kernel: net/packet: fix a race in packet_set_ring() and packet_notifier() |
CVE-2025-38617
|
| VCID-41ur-7cwy-tyf1 | kernel: wifi: mt76: replace skb_put with skb_put_zero |
CVE-2024-42225
|
| VCID-42cm-szry-pqcj | kernel: btrfs: handle errors from btrfs_dec_ref() properly |
CVE-2024-46753
|
| VCID-42va-cqax-e7du | kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper() |
CVE-2024-43889
|
| VCID-42vv-ca62-nbay | kernel: ipv6: sr: Fix MAC comparison to be constant-time |
CVE-2025-39702
|
| VCID-441g-m795-kkfz | kernel: smb: client: fix potential UAF in is_valid_oplock_break() |
CVE-2024-35863
|
| VCID-44cz-8ud6-xubv | kernel: crypto: caam - Fix the pointer passed to caam_qi_shutdown() |
CVE-2024-56754
|
| VCID-45qm-naju-pycn | kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE |
CVE-2024-38564
|
| VCID-45vq-ugkk-1fa5 | kernel: Drivers: hv: vmbus: Don't dereference ACPI root object handle |
CVE-2023-53647
|
| VCID-46cw-muvz-kudc | kernel: cnic: Fix use-after-free bugs in cnic_delete_task |
CVE-2025-39945
|
| VCID-46e5-e2xf-6udw | kernel: ext2: Add sanity checks for group and filesystem size |
CVE-2022-50815
|
| VCID-46f4-ke11-53e3 | kernel: btrfs: do not start relocation until in progress drops are done |
CVE-2022-48901
|
| VCID-46ph-9mta-yqhy | kernel: drm/sched: Increment job count before swapping tail spsc queue |
CVE-2025-38515
|
| VCID-46zy-nb49-s7ge | kernel: sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK |
CVE-2022-49034
|
| VCID-4785-svcx-fqc3 | kernel: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock |
CVE-2025-38058
|
| VCID-47ch-yrmn-7yfu | kernel: HID: core: ensure the allocated report buffer can contain the reserved report ID |
CVE-2025-38495
|
| VCID-47cx-y8q8-cfcd | kernel: gso: fix udp gso fraglist segmentation after pull from frag_list |
CVE-2024-49978
|
| VCID-48av-kmwu-2ued | kernel: mt76: fix monitor mode crash with sdio driver |
CVE-2022-49112
|
| VCID-48g7-8qwz-rkg7 | kernel: hfs: fix slab-out-of-bounds in hfs_bnode_read() |
CVE-2025-38715
|
| VCID-49be-qf7v-jbhr | kernel: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower |
CVE-2024-50237
|
| VCID-49de-qwxr-wygg | kernel: media: atomisp: Add check for rgby_data memory allocation failure |
CVE-2024-56705
|
| VCID-49j4-4br3-cyab | kernel: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context |
CVE-2025-21767
|
| VCID-4a1v-kwks-e3ew | kernel: atm: Revert atm_account_tx() if copy_from_iter_full() fails |
CVE-2025-38190
|
| VCID-4ahh-jy24-4bax | kernel: rapidio: add check for rio_add_net() in rio_scan_alloc_net() |
CVE-2025-21935
|
| VCID-4b2d-sf8b-z7b2 | kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition |
CVE-2025-22056
|
| VCID-4bdu-79zv-pbbz | kernel: kobject_uevent: Fix OOB access within zap_modalias_env() |
CVE-2024-42292
|
| VCID-4by2-5ws3-dfb1 | kernel: pinctrl: ocelot: fix system hang on level based interrupts |
CVE-2024-50196
|
| VCID-4c5d-443x-ukc7 | kernel: net/sched: act_ct: fix ref leak when switching zones |
CVE-2022-49183
|
| VCID-4c8k-9yrr-uub9 | kernel: wifi: brcmfmac: Check the return value of of_property_read_string_index() |
CVE-2025-21750
|
| VCID-4cf1-avkf-hbdg | kernel: net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns() |
CVE-2025-21799
|
| VCID-4d15-g5v5-xbat | kernel: ocfs2: handle a symlink read error correctly |
CVE-2024-58001
|
| VCID-4d3d-kehn-fbdx | kernel: ASoC: amd: fix memory leak in acp3x pdm dma ops |
CVE-2026-23190
|
| VCID-4d5z-v3d2-2bb7 | kernel: netfilter: nf_reject: don't leak dst refcount for loopback packets |
CVE-2025-38732
|
| VCID-4d97-s9s9-ubbz | kernel: drm/meson: remove drm bridges at aggregate driver unbind time |
CVE-2022-50256
|
| VCID-4e1v-wjw2-uudw | kernel: safesetid: check size of policy writes |
CVE-2024-58016
|
| VCID-4e2j-gxau-gken | kernel: bonding: fix null pointer deref in bond_ipsec_offload_ok |
CVE-2024-44990
|
| VCID-4e3a-wpq4-vbcr | kernel: Julia Lawall reported this null pointer dereference, this should fix it. |
CVE-2024-36023
|
| VCID-4ebq-x7rk-4ya3 | kernel: wifi: wilc1000: avoid buffer overflow in WID string configuration |
CVE-2025-39952
|
| VCID-4ecp-rvas-hffw | kernel: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read |
CVE-2024-58069
|
| VCID-4edg-3cps-d3dd | kernel: block: don't call rq_qos_ops->done_bio if the bio isn't tracked |
CVE-2021-47412
|
| VCID-4eg6-1ts3-fqek | kernel: ext4: inline: fix len overflow in ext4_prepare_inline_data |
CVE-2025-38222
|
| VCID-4emc-x9jp-57d8 | kernel: atm: clip: Fix potential null-ptr-deref in to_atmarpd(). |
CVE-2025-38460
|
| VCID-4emz-c8nx-zqeb | kernel: afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server |
CVE-2021-47366
|
| VCID-4emz-g6xh-vbb4 | kernel: bpf: Avoid __bpf_prog_ret0_warn when jit fails |
CVE-2025-38280
|
| VCID-4f85-9h7n-kkby | kernel: wifi: cfg80211: regulatory: improve invalid hints checking |
CVE-2025-21910
|
| VCID-4fd5-y4mf-a7fj | kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup |
CVE-2024-39472
|
| VCID-4fhj-v5ut-eubv | kernel: mm/hugetlb: fix hugetlb_pmd_shared() |
CVE-2026-23100
|
| VCID-4g19-83u9-2udx | kernel: tracing: Fix bad hist from corrupting named_triggers list |
CVE-2025-21899
|
| VCID-4ghv-w1sg-77hu | kernel: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using |
CVE-2025-38369
|
| VCID-4gq7-1egy-p7a4 | kernel: vmwgfx: use-after-free in vmw_cmd_res_check |
CVE-2022-38457
|
| VCID-4hgp-r6cs-ayh2 | kernel: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() |
CVE-2024-56539
|
| VCID-4hxs-uzt2-x3b8 | kernel: f2fs: fix to do sanity check on ino and xnid |
CVE-2025-38347
|
| VCID-4j6j-3d7w-zfe6 | kernel: net_sched: red: fix a race in __red_change() |
CVE-2025-38108
|
| VCID-4ja6-dv1f-mydc | kernel: PCI: endpoint: Fix configfs group list head handling |
CVE-2025-39783
|
| VCID-4jg1-6d4h-tfaa | kernel: can: hi311x: hi3110_can_ist(): fix potential use-after-free |
CVE-2024-56651
|
| VCID-4jk2-7scp-7qf4 | kernel: vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() |
CVE-2024-49863
|
| VCID-4jvb-unxd-3qg3 |
CVE-2026-31423
|
|
| VCID-4k1b-g64y-43eg | kernel: smb: client: fix UAF in async decryption |
CVE-2024-50047
|
| VCID-4k1h-9cye-kyfu | kernel: io_uring: fix possible deadlock in io_register_iowq_max_workers() |
CVE-2024-41080
|
| VCID-4k7z-wxx8-jyg3 | kernel: Linux kernel VMCI: Denial of Service via GPF |
CVE-2023-53259
|
| VCID-4kbk-38g4-6kb7 | kernel: bpf, lsm: Add check for BPF LSM return value |
CVE-2024-47703
|
| VCID-4mqx-42ea-53c3 | kernel: f2fs: fix to bail out in get_new_segment() |
CVE-2025-38333
|
| VCID-4n9m-77qv-fuaa | kernel: iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection |
CVE-2025-71198
|
| VCID-4nak-rmgk-jybq | kernel: sctp: initialize more fields in sctp_v6_from_sk() |
CVE-2025-39812
|
| VCID-4nrq-2zch-8uct | kernel: riscv: stacktrace: Disable KASAN checks for non-current tasks |
CVE-2025-40358
|
| VCID-4p7y-3e4e-6yhd | kernel: media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() |
CVE-2025-39713
|
| VCID-4pfh-69kg-17bc | kernel: smb: client: Fix use-after-free in cifs_fill_dirent |
CVE-2025-38051
|
| VCID-4pg4-pb3c-hyfw | kernel: vsock/virtio: fix potential underflow in virtio_transport_get_credit() |
CVE-2026-23069
|
| VCID-4qed-1xmj-9qhy | kernel: net/mlx5: Add a timeout to acquire the command queue semaphore |
CVE-2024-38556
|
| VCID-4qpz-z2bs-buev | kernel: dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees |
CVE-2025-39923
|
| VCID-4qse-5w1w-sqec | kernel: bpf, sockmap: Several fixes to bpf_msg_pop_data |
CVE-2024-56720
|
| VCID-4qu7-j9q6-tfhy | kernel: usb: renesas_usbhs: Fix synchronous external abort on unbind |
CVE-2025-68327
|
| VCID-4qwu-fw8y-t7et | kernel: jfs: Fix null-ptr-deref in jfs_ioc_trim |
CVE-2025-38203
|
| VCID-4qx6-ysye-efhu | kernel: accel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release() |
CVE-2023-53353
|
| VCID-4r1c-et7a-13g9 | kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge |
CVE-2024-36000
|
| VCID-4r6h-9m42-53ad | kernel: udf: Avoid using corrupted block bitmap buffer |
CVE-2024-42306
|
| VCID-4s4m-bf1u-tyht | kernel: nvme-pci: fix race condition between reset and nvme_dev_disable() |
CVE-2024-50135
|
| VCID-4ssv-y86v-9ffc | kernel: USB: gadget: Fix use-after-free during usb config switch |
CVE-2022-50704
|
| VCID-4stn-nf2q-5fdd | kernel: drm/imx/tve: fix probe device leak |
CVE-2026-23170
|
| VCID-4sw1-a55s-vkc6 | kernel: dmaengine: dw-axi-dmac: ignore interrupt if no descriptor |
CVE-2022-50023
|
| VCID-4t4h-a2xy-h7bg | kernel: drm/amd/display: Add a dc_state NULL check in dc_state_release |
CVE-2024-26948
|
| VCID-4t9v-wb56-1ue5 | kernel: dmaengine: at_hdmac: fix device leak on of_dma_xlate() |
CVE-2025-71191
|
| VCID-4tq9-e1by-ybev | kernel: drm/amd/display: Add array index check for hdcp ddc access |
CVE-2024-46804
|
| VCID-4uds-n12w-aket | kernel: soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled |
CVE-2025-38487
|
| VCID-4uhk-w9vf-77bj | kernel: drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check |
CVE-2024-56778
|
| VCID-4uvy-ga5j-a7g3 | kernel: spi: lpspi: Avoid potential use-after-free in probe() |
CVE-2024-26866
|
| VCID-4vd2-y8nz-gqgm | kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion |
CVE-2022-0480
|
| VCID-4vm1-gy52-guav | kernel: ext4: fix off-by-one error in do_split |
CVE-2025-23150
|
| VCID-4vs9-vhrd-zfgn | kernel: jfs: add check read-only before truncation in jfs_truncate_nolock() |
CVE-2024-58094
|
| VCID-4why-73du-t3gx | kernel: scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() |
CVE-2023-53696
|
| VCID-4wqs-d1dp-sbcq | kernel: bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS |
CVE-2024-26589
|
| VCID-4wyy-uw7z-5be9 | kernel: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work |
CVE-2025-40003
|
| VCID-4xbz-d89x-hucp | kernel: net/xen-netback: prevent UAF in xenvif_flush_hash() |
CVE-2024-49936
|
| VCID-4xs3-r2ma-6kaz | kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds |
CVE-2025-38159
|
| VCID-4y19-hvww-dqcs | kernel: i40e: fix idx validation in i40e_validate_queue_map |
CVE-2025-39972
|
| VCID-4y9e-89wb-gbaz | kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check |
CVE-2026-23111
|
| VCID-4ywv-9sxh-q7gf | kernel: drm/vmwgfx: Fix Use-after-free in validation |
CVE-2025-40111
|
| VCID-4zpy-1e3e-7ygt | kernel: media: mediatek: vcodec: Handle invalid decoder vsi |
CVE-2024-43831
|
| VCID-5127-fgwu-27a3 | kernel: ALSA: us122l: Use snd_card_free_when_closed() at disconnection |
CVE-2024-56532
|
| VCID-51rd-4qg2-rkb4 | kernel: comedi: das16m1: Fix bit shift out of bounds |
CVE-2025-38483
|
| VCID-53uc-g9rh-tfhu | kernel: cpufreq: davinci: Fix clk use after free |
CVE-2023-53544
|
| VCID-54az-rths-hffs | kernel: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit |
CVE-2025-38685
|
| VCID-54hp-97my-h3e2 | kernel: Linux kernel: Denial of Service in Bluetooth HCI UART driver via null pointer dereference |
CVE-2026-23146
|
| VCID-54qr-x4vv-xfex | kernel: tty: n_gsm: fix deadlock and link starvation in outgoing data path |
CVE-2022-50116
|
| VCID-5574-kh48-93hy | kernel: platform/x86: dell_rbu: Fix list usage |
CVE-2025-38197
|
| VCID-557v-vh74-gkdx | kernel: crypto: hisilicon/qm - inject error before stopping queue |
CVE-2024-47730
|
| VCID-55bw-q6vb-bffn | kernel: atm: Fix NULL pointer dereference |
CVE-2025-22018
|
| VCID-55rr-9h4c-1ugn | kernel: scsi: pm80xx: Fix memory leak during rmmod |
CVE-2021-47193
|
| VCID-55w5-y7yj-syea | kernel: f2fs: fix to avoid UAF in f2fs_write_end_io() |
CVE-2026-23234
|
| VCID-566d-pv4z-23d6 | kernel: net: lantiq_xrx200: restore buffer if memory allocation failed |
CVE-2022-49997
|
| VCID-56h2-bdrq-3yeh | kernel: perf/aux: Fix AUX buffer serialization |
CVE-2024-46713
|
| VCID-56yw-17s7-tya5 | kernel: drm/amdkfd: Correct the migration DMA map direction |
CVE-2024-57897
|
| VCID-56z1-mjdt-87dn | kernel: f2fs: fix null-ptr-deref in f2fs_get_dnode_of_data |
CVE-2022-50009
|
| VCID-57ww-5dxf-y7e2 | kernel: vsock: Keep the binding until socket destruction |
CVE-2025-21756
|
| VCID-58z2-gusv-m3eg | kernel: bpf: Fix a segment issue when downgrading gso_size |
CVE-2024-42281
|
| VCID-5959-ckdh-dqd2 | kernel: dmaengine: qcom: bam_dma: fix runtime PM underflow |
CVE-2022-49650
|
| VCID-59yz-znzm-ufcv | kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too |
CVE-2025-37823
|
| VCID-5ahq-saw1-suf1 |
CVE-2026-31420
|
|
| VCID-5aq3-17g7-puh9 | kernel: usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend |
CVE-2024-26715
|
| VCID-5aqe-ry2y-1kcd | kernel: crypto: ecdh - explicitly zeroize private_key |
CVE-2024-42098
|
| VCID-5b4f-sket-kuge | kernel: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
CVE-2025-23132
|
| VCID-5bmj-8arh-9ufw | kernel: drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap |
CVE-2021-47200
|
| VCID-5bym-ak3k-8yg7 | kernel: Linux kernel: Denial of Service via excessive file descriptor table allocation |
CVE-2025-39756
|
| VCID-5c4j-urpd-v7fu | kernel: ipvs: fix uninit-value for saddr in do_output_route4 |
CVE-2025-37961
|
| VCID-5cfu-w12q-sfgm |
CVE-2026-23411
|
|
| VCID-5cs1-7b6w-wff4 | kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() |
CVE-2024-36924
|
| VCID-5das-f854-xke9 | kernel: sock_map: avoid race between sock_map_close and sk_psock_put |
CVE-2024-39500
|
| VCID-5e7d-w6w3-j3cv | kernel: net: bridge: mcast: wait for previous gc cycles when removing port |
CVE-2024-44934
|
| VCID-5ea3-gwak-sbf6 | kernel: btrfs: clean up our handling of refs == 0 in snapshot delete |
CVE-2024-46840
|
| VCID-5ed9-6yn1-t7f3 | kernel: pNFS: Fix uninited ptr deref in block/scsi layout |
CVE-2025-38691
|
| VCID-5eks-kg2z-5ye1 | In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug When trying to do a rather aggressive test of igt's "xe_module_load --r reload" with a full desktop environment and game running I noticed a few OOPSes when dereferencing freed pointers, related to framebuffers and property blobs after the compositor exits. Solve this by guarding the freeing in drm_file with drm_dev_enter/exit, and immediately put the references from struct drm_file objects during drm_dev_unplug(). Related warnings for framebuffers on the subtest: [ 739.713076] ------------[ cut here ]------------ WARN_ON(!list_empty(&dev->mode_config.fb_list)) [ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at drm_mode_config_cleanup+0x30b/0x320 [drm], CPU#12: xe_module_load/13145 .... [ 739.713328] Call Trace: [ 739.713330] <TASK> [ 739.713335] ? intel_pmdemand_destroy_state+0x11/0x20 [xe] [ 739.713574] ? intel_atomic_global_obj_cleanup+0xe4/0x1a0 [xe] [ 739.713794] intel_display_driver_remove_noirq+0x51/0xb0 [xe] [ 739.714041] xe_display_fini_early+0x33/0x50 [xe] [ 739.714284] devm_action_release+0xf/0x20 [ 739.714294] devres_release_all+0xad/0xf0 [ 739.714301] device_unbind_cleanup+0x12/0xa0 [ 739.714305] device_release_driver_internal+0x1b7/0x210 [ 739.714311] device_driver_detach+0x14/0x20 [ 739.714315] unbind_store+0xa6/0xb0 [ 739.714319] drv_attr_store+0x21/0x30 [ 739.714322] sysfs_kf_write+0x48/0x60 [ 739.714328] kernfs_fop_write_iter+0x16b/0x240 [ 739.714333] vfs_write+0x266/0x520 [ 739.714341] ksys_write+0x72/0xe0 [ 739.714345] __x64_sys_write+0x19/0x20 [ 739.714347] x64_sys_call+0xa15/0xa30 [ 739.714355] do_syscall_64+0xd8/0xab0 [ 739.714361] entry_SYSCALL_64_after_hwframe+0x4b/0x53 and [ 739.714459] ------------[ cut here ]------------ [ 739.714461] xe 0000:67:00.0: [drm] drm_WARN_ON(!list_empty(&fb->filp_head)) [ 739.714464] WARNING: drivers/gpu/drm/drm_framebuffer.c:833 at drm_framebuffer_free+0x6c/0x90 [drm], CPU#12: xe_module_load/13145 [ 739.714715] RIP: 0010:drm_framebuffer_free+0x7a/0x90 [drm] ... [ 739.714869] Call Trace: [ 739.714871] <TASK> [ 739.714876] drm_mode_config_cleanup+0x26a/0x320 [drm] [ 739.714998] ? __drm_printfn_seq_file+0x20/0x20 [drm] [ 739.715115] ? drm_mode_config_cleanup+0x207/0x320 [drm] [ 739.715235] intel_display_driver_remove_noirq+0x51/0xb0 [xe] [ 739.715576] xe_display_fini_early+0x33/0x50 [xe] [ 739.715821] devm_action_release+0xf/0x20 [ 739.715828] devres_release_all+0xad/0xf0 [ 739.715843] device_unbind_cleanup+0x12/0xa0 [ 739.715850] device_release_driver_internal+0x1b7/0x210 [ 739.715856] device_driver_detach+0x14/0x20 [ 739.715860] unbind_store+0xa6/0xb0 [ 739.715865] drv_attr_store+0x21/0x30 [ 739.715868] sysfs_kf_write+0x48/0x60 [ 739.715873] kernfs_fop_write_iter+0x16b/0x240 [ 739.715878] vfs_write+0x266/0x520 [ 739.715886] ksys_write+0x72/0xe0 [ 739.715890] __x64_sys_write+0x19/0x20 [ 739.715893] x64_sys_call+0xa15/0xa30 [ 739.715900] do_syscall_64+0xd8/0xab0 [ 739.715905] entry_SYSCALL_64_after_hwframe+0x4b/0x53 and then finally file close blows up: [ 743.186530] Oops: general protection fault, probably for non-canonical address 0xdead000000000122: 0000 [#1] SMP [ 743.186535] CPU: 3 UID: 1000 PID: 3453 Comm: kwin_wayland Tainted: G W 7.0.0-rc1-valkyria+ #110 PREEMPT_{RT,(lazy)} [ 743.186537] Tainted: [W]=WARN [ 743.186538] Hardware name: Gigabyte Technology Co., Ltd. X299 AORUS Gaming 3/X299 AORUS Gaming 3-CF, BIOS F8n 12/06/2021 [ 743.186539] RIP: 0010:drm_framebuffer_cleanup+0x55/0xc0 [drm] [ 743.186588] Code: d8 72 73 0f b6 42 05 ff c3 39 c3 72 e8 49 8d bd 50 07 00 00 31 f6 e8 3a 80 d3 e1 49 8b 44 24 10 49 8d 7c 24 08 49 8b 54 24 08 <48> 3b 38 0f 85 95 7f 02 00 48 3b 7a 08 0f 85 8b 7f 02 00 48 89 42 [ 743.186589] RSP: 0018:ffffc900085e3cf8 EFLAGS: 00 ---truncated--- |
CVE-2026-23471
|
| VCID-5fn8-uswp-7ffk | kernel: staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing |
CVE-2025-68255
|
| VCID-5fqv-jv6t-xbfb | kernel: ext4: aovid use-after-free in ext4_ext_insert_extent() |
CVE-2024-49883
|
| VCID-5fzg-3bmp-gkee | kernel: i40e: fix input validation logic for action_meta |
CVE-2025-39970
|
| VCID-5g2a-qj5r-uub4 | kernel: wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() |
CVE-2026-23336
|
| VCID-5g3u-eaqc-dbew | kernel: wifi: nl80211: reject cooked mode if it is set along with other flags |
CVE-2025-21909
|
| VCID-5gv4-c26w-gube | kernel: drm/amd/display: Fix null pointer deref in dcn20_resource.c |
CVE-2024-43899
|
| VCID-5gz4-1ysh-2qf7 | kernel: net: ena: Add validation for completion descriptors consistency |
CVE-2024-40999
|
| VCID-5hdv-pgsr-cfbm | kernel: bpf: Guard stack limits against 32bit overflow |
CVE-2023-52676
|
| VCID-5hpv-svx2-4bcz | kernel: net: fec: remove .ndo_poll_controller to avoid deadlocks |
CVE-2024-38553
|
| VCID-5hsp-5c26-bue1 | kernel: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet |
CVE-2024-56590
|
| VCID-5hve-2amk-wkgw | kernel: arm64: dts: qcom: sdm845-db845c: unreserved cont splash memory region leads to kernel panic |
CVE-2023-52561
|
| VCID-5hyx-u5pv-t7ev | kernel: net/smc: protect link down work from execute after lgr freed |
CVE-2024-56718
|
| VCID-5kdh-vgcu-kkf3 | In the Linux kernel, the following vulnerability has been resolved: af_key: validate families in pfkey_send_migrate() syzbot was able to trigger a crash in skb_put() [1] Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb. Validate families early, do not wait set_ipsecrequest(). [1] skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL> kernel BUG at net/core/skbuff.c:214 ! Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150 |
CVE-2026-31515
|
| VCID-5m1x-wksg-mbbz | kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow |
CVE-2024-27403
|
| VCID-5m4d-kd2d-f3ge | kernel: ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() |
CVE-2025-37758
|
| VCID-5m73-axnz-pban | kernel: ipvlan: ensure network headers are in skb linear part |
CVE-2025-21891
|
| VCID-5mxa-xpvq-dka1 | kernel: net_sched: qfq: Fix double list add in class with netem as child qdisc |
CVE-2025-37913
|
| VCID-5nak-sax2-m3fa | kernel: wifi: mwifiex: Initialize the chan_stats array to zero |
CVE-2025-39891
|
| VCID-5ndm-5e85-fbc7 | kernel: crypto: hisilicon/qm - increase the memory of local variables |
CVE-2022-50407
|
| VCID-5nx7-5az3-ckcz | kernel: closures: Change BUG_ON() to WARN_ON() |
CVE-2024-42252
|
| VCID-5pdd-jzp8-7qcz | kernel: PCI: Fix use-after-free in pci_bus_release_domain_nr() |
CVE-2023-53363
|
| VCID-5qjx-s9vp-4bbx | kernel: btrfs: fix crash on racing fsync and size-extending write into prealloc |
CVE-2024-37354
|
| VCID-5r96-czfc-hygr | kernel: clk: davinci: Add NULL check in davinci_lpsc_clk_register() |
CVE-2025-38635
|
| VCID-5rna-ncdw-1ycj | kernel: bonding: provide a net pointer to __skb_flow_dissect() |
CVE-2026-23119
|
| VCID-5sx4-erkf-qbb4 | kernel: drm/amdgpu: fix mc_data out-of-bounds read warning |
CVE-2024-46722
|
| VCID-5tyb-11p1-hqhx | kernel: apparmor: validate DFA start states are in bounds in unpack_pdb |
CVE-2026-23269
|
| VCID-5tyw-xkgy-cfgz | kernel: Linux kernel: Local privilege escalation or denial of service in usb: net: sierra driver |
CVE-2025-38474
|
| VCID-5u6h-uxd1-5qaf | kernel: Improper input validation in some Intel(R) Graphics Drivers |
CVE-2020-12363
|
| VCID-5u9j-rp2j-queg | kernel: net/mlx5: fs, lock FTE when checking if active |
CVE-2024-53121
|
| VCID-5vfe-6xqu-vyfy | kernel: ila: call nf_unregister_net_hooks() sooner |
CVE-2024-46782
|
| VCID-5vfj-aj15-cfe9 | kernel: Linux kernel: Denial of Service via integer overflow in s390/pkey memory allocation |
CVE-2025-38257
|
| VCID-5vp9-ejh8-bbcr | kernel: ceph: fix inode reference leakage in ceph_get_snapdir() |
CVE-2022-49109
|
| VCID-5vzs-ujfb-qubj | kernel: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak |
CVE-2025-40035
|
| VCID-5w4u-gzpx-tqan | kernel: Linux kernel: Denial of Service due to invalid queueing discipline (qdisc) parent class handling |
CVE-2025-38457
|
| VCID-5wdk-mrty-jbc2 | kernel: jfs: fix array-index-out-of-bounds in jfs_readdir |
CVE-2024-56596
|
| VCID-5wr6-yach-7fbf | kernel: crypto: stm32/cryp - call finalize with bh disabled |
CVE-2024-47658
|
| VCID-5xcb-e2am-s7en | kernel: f2fs: fix to avoid UAF in f2fs_sync_inode_meta() |
CVE-2025-38578
|
| VCID-5xm3-xwqf-ebce | kernel: Linux kernel: Local Denial of Service in network scheduler |
CVE-2025-38115
|
| VCID-5xpt-m65r-aben | kernel: static_call: Replace pointless WARN_ON() in static_call_module_notify() |
CVE-2024-49954
|
| VCID-5xru-rsjq-hqh3 | kernel: tun: Fix memory leak for detached NAPI queue |
CVE-2023-53685
|
| VCID-5xru-w7m9-6ydz | kernel: iio: adc: at91: call input_free_device() on allocated iio_dev |
CVE-2024-57904
|
| VCID-5xry-bk46-m7ae | kernel: most: usb: Fix use-after-free in hdm_disconnect |
CVE-2025-40223
|
| VCID-5xs2-ha7k-fub7 | kernel: net/sched: act_ct: fix wild memory access when clearing fragments |
CVE-2021-47014
|
| VCID-5xsd-59cv-vyc6 | kernel: soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() |
CVE-2025-38145
|
| VCID-5xud-fsmq-93cs | kernel: nvme: tcp: avoid race between queue_lock lock and destroy |
CVE-2024-53100
|
| VCID-5yd6-dvwf-8ygt | kernel: ocfs2: validate l_tree_depth to avoid out-of-bounds access |
CVE-2025-22079
|
| VCID-5yfh-nj3c-c3h7 | kernel: Integer overflow in Intel(R) Graphics Drivers |
CVE-2020-12362
|
| VCID-5ynw-da7q-d7fq | kernel: wifi: mac80211: fix potential key use-after-free |
CVE-2023-52530
|
| VCID-5yp2-meun-zbas | kernel: ax25: fix use-after-free bugs caused by ax25_ds_del_timer |
CVE-2024-35887
|
| VCID-5yxn-gf61-qkfg | kernel: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function |
CVE-2023-53039
|
| VCID-5z54-7skw-p7hm | kernel: smb: client: potential use-after-free in cifs_debug_files_proc_show() |
CVE-2024-26928
|
| VCID-5zkg-escv-gfa3 |
CVE-2026-23405
|
|
| VCID-5zpe-m7zd-jkdx | kernel: spufs: fix a leak on spufs_new_file() failure |
CVE-2025-22073
|
| VCID-5zuy-q1p8-hqex | kernel: coresight: Fix memory leak in acpi_buffer->pointer |
CVE-2023-53261
|
| VCID-61t7-s6qz-mfcf | kernel: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM |
CVE-2025-40289
|
| VCID-6233-92av-nfdg | kernel: iio: light: opt3001: fix deadlock due to concurrent flag access |
CVE-2025-37968
|
| VCID-62jz-qpdg-kyhe | kernel: NFS: Fix a race when updating an existing write |
CVE-2025-39697
|
| VCID-632y-x88e-zkav | kernel: drm/amd/display: Assign linear_pitch_alignment even for VM |
CVE-2024-46732
|
| VCID-63b1-m3wh-47d8 | kernel: net: ks8851: Fix deadlock with the SPI chip variant |
CVE-2024-41036
|
| VCID-63hp-7jta-2kaq | kernel: bpf: Fix bpf_sk_select_reuseport() memory leak |
CVE-2025-21683
|
| VCID-63mk-csq7-kqed | kernel: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). |
CVE-2025-22005
|
| VCID-63uy-k87j-67bw | kernel: ptp: Ensure info->enable callback is always set |
CVE-2025-21814
|
| VCID-64aj-2prh-vbc3 | kernel: hrtimers: Handle CPU state correctly on hotplug |
CVE-2024-57951
|
| VCID-64gw-2b6h-c7em | kernel: driver core: fix resource leak in device_add() |
CVE-2023-53594
|
| VCID-64kf-nxzw-vubp | kernel: Linux kernel: Use-after-free in teql queueing discipline can lead to privilege escalation |
CVE-2026-23074
|
| VCID-64nd-yud7-wqev | kernel: ndisc: use RCU protection in ndisc_alloc_skb() |
CVE-2025-21764
|
| VCID-651u-f45c-57de | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: clamp SCO altsetting table indices btusb_work() maps the number of active SCO links to USB alternate settings through a three-entry lookup table when CVSD traffic uses transparent voice settings. The lookup currently indexes alts[] with data->sco_num - 1 without first constraining sco_num to the number of available table entries. While the table only defines alternate settings for up to three SCO links, data->sco_num comes from hci_conn_num() and is used directly. Cap the lookup to the last table entry before indexing it so the driver keeps selecting the highest supported alternate setting without reading past alts[]. |
CVE-2026-31497
|
| VCID-657g-4e3s-qbbb | kernel: iomap: iomap: fix memory corruption when recording errors during writeback |
CVE-2022-50406
|
| VCID-65pm-vk43-c3eb | kernel: uacce: ensure safe queue release with state management |
CVE-2026-23063
|
| VCID-65vu-82v9-bbhv | kernel: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel |
CVE-2026-23049
|
| VCID-661m-4ype-83g4 | kernel: powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore |
CVE-2024-56701
|
| VCID-667u-9zch-uyhg | kernel: fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() |
CVE-2024-56746
|
| VCID-66c7-d5qq-1kgc | kernel: drm/amd/display: Ensure index calculation will not overflow |
CVE-2024-46726
|
| VCID-676c-3wrp-1ufr | kernel: RDMA/rxe: Fix incomplete state save in rxe_requester |
CVE-2023-53539
|
| VCID-67p9-yrq6-9kbz | kernel: jfs: fix slab-out-of-bounds read in ea_get() |
CVE-2025-39735
|
| VCID-67sz-s2q9-1kc2 | kernel: libceph: make free_choose_arg_map() resilient to partial allocation |
CVE-2026-22991
|
| VCID-67u4-sdzt-w7ep | kernel: i40e: Do not allow untrusted VF to remove administratively set MAC |
CVE-2024-26830
|
| VCID-67yy-vay5-jfh1 | kernel: netfilter: ipset: Hold module reference while requesting a module |
CVE-2024-56637
|
| VCID-686r-fvxa-vqhx | kernel: can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled |
CVE-2025-40107
|
| VCID-687u-nzmt-n7a6 | kernel: ila: serialize calls to nf_register_net_hooks() |
CVE-2024-57900
|
| VCID-68ag-35vk-eycb | kernel: net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null |
CVE-2022-50073
|
| VCID-68b6-mgvb-vfbj | kernel: w1: therm: Fix off-by-one buffer overflow in alarms_store |
CVE-2025-71197
|
| VCID-68sw-pe6f-5qbx | kernel: blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release() |
CVE-2021-47552
|
| VCID-68wx-sjuq-gbc1 | kernel: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion |
CVE-2024-49868
|
| VCID-698v-5cc6-mya8 | kernel: scsi: st: Fix array overflow in st_setup() |
CVE-2025-37857
|
| VCID-69m3-8198-jbb5 | kernel: mm: fix zswap writeback race condition |
CVE-2023-53178
|
| VCID-6a6r-5fwk-u3ax | kernel: Linux kernel: Use-After-Free vulnerability in PCM OSS layer due to race condition |
CVE-2025-38078
|
| VCID-6a92-c98x-uqfe | kernel: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT |
CVE-2022-49534
|
| VCID-6bqb-7yms-47be | kernel: sched: Fix yet more sched_fork() races |
CVE-2022-48944
|
| VCID-6bwt-an4d-23d8 | kernel: serial: protect uart_port_dtr_rts() in uart_shutdown() too |
CVE-2024-50058
|
| VCID-6c3x-q991-5uh7 | kernel: net: enetc: allocate vf_state during PF probes |
CVE-2024-50298
|
| VCID-6cda-zhpe-ebcb | kernel: ax25: Fix refcount imbalance on inbound connections |
CVE-2024-40910
|
| VCID-6cjn-bwy4-bbdq | kernel: btrfs: don't drop extent_map for free space inode on write error |
CVE-2024-26726
|
| VCID-6cqc-um2d-1kfk | kernel: wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() |
CVE-2026-23315
|
| VCID-6czf-s8z4-yqhn | kernel: btrfs: get rid of warning on transaction commit when using flushoncommit |
CVE-2022-48920
|
| VCID-6d51-ehhp-ufap | kernel: powerpc/eeh: Make EEH driver device hotplug safe |
CVE-2025-38576
|
| VCID-6dbf-16rj-bue4 | kernel: Linux kernel: Memory leak in gs_usb module can lead to denial of service via improper USB Request Block handling. |
CVE-2026-23031
|
| VCID-6dwv-ehs9-vbc1 | kernel: jfs: Fix array-index-out-of-bounds in diFree |
CVE-2024-43858
|
| VCID-6eg2-p26n-gya5 | kernel: ALSA: 6fire: Release resources at card release |
CVE-2024-53239
|
| VCID-6ejs-59g2-xkgg | kernel: drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities |
CVE-2025-39707
|
| VCID-6esd-16yh-5ken | kernel: nvmet-fc: avoid scheduling association deletion twice |
CVE-2025-40343
|
| VCID-6evp-22r4-27bq | kernel: net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices |
CVE-2025-38422
|
| VCID-6f63-djtc-pkcm | kernel: mm: krealloc: Fix MTE false alarm in __do_krealloc |
CVE-2024-53097
|
| VCID-6faj-ta9a-cyfn | kernel: sctp: avoid NULL dereference when chunk data buffer is missing |
CVE-2025-40240
|
| VCID-6fwr-v8rj-s3d3 | kernel: ocfs2: fix double free in user_cluster_connect() |
CVE-2025-40055
|
| VCID-6g6x-5hs8-cbcq | kernel: dev/parport: fix the array out-of-bounds risk |
CVE-2024-42301
|
| VCID-6gxd-146x-a7ab | kernel: drm/v3d: Add job to pending list if the reset was skipped |
CVE-2025-37951
|
| VCID-6hdv-aj36-jbar | kernel: hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create |
CVE-2025-68774
|
| VCID-6hf1-vsj3-a3h5 | kernel: drm/msm: Add error handling for krealloc in metadata setup |
CVE-2025-39747
|
| VCID-6hh8-5da7-2qcc | kernel: net/sched: Always pass notifications when child class becomes empty |
CVE-2025-38350
|
| VCID-6hur-ug1s-83am | In the Linux kernel, the following vulnerability has been resolved: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized): - uart_write_room() returns kfifo_avail() which can be > 0 - uart_write() checks xmit_buf and returns 0 if NULL This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write: while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits } For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs. Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write(). Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13 |
CVE-2026-23472
|
| VCID-6jje-r91t-sfhe | kernel: nvme-fc: use lock accessing port_state and rport state |
CVE-2025-40342
|
| VCID-6jzb-qp5p-47ex | kernel: wifi: ath11k: fix RCU stall while reaping monitor destination ring |
CVE-2024-58097
|
| VCID-6kr3-zexr-qfeq | kernel: x86/efistub: Call mixed mode boot services on the firmware's stack |
CVE-2024-35803
|
| VCID-6kyx-94dd-buas | kernel: Linux kernel: Denial of Service in ath11k wifi driver due to list node corruption |
CVE-2025-38293
|
| VCID-6mtf-81kk-yubm | kernel: i2c: cros-ec-tunnel: defer probe if parent EC is not present |
CVE-2025-37781
|
| VCID-6n32-z9u6-gfch | kernel: f2fs: fix to truncate first page in error path of f2fs_truncate() |
CVE-2025-40137
|
| VCID-6n9t-j5yh-8fec | kernel: Linux kernel (macintosh/mac_hid): Denial of Service via race condition in mac_hid_toggle_emumouse |
CVE-2025-68367
|
| VCID-6ndq-q638-wbbm | kernel: ACPICA: Avoid walking the Namespace if start_node is NULL |
CVE-2025-71118
|
| VCID-6nej-d2as-6qek | kernel: cifs: fix mid leak during reconnection after timeout threshold |
CVE-2023-53597
|
| VCID-6p2n-x24f-gud5 | kernel: drm/amd/display: Skip Recompute DSC Params if no Stream on Link |
CVE-2024-47683
|
| VCID-6pqs-2x2k-vyc5 | kernel: tcp: add accessors to read/set tp->snd_cwnd |
CVE-2022-49325
|
| VCID-6q4x-x6z9-mugs | kernel: ocfs2: remove unreasonable unlock in ocfs2_read_blocks |
CVE-2024-49965
|
| VCID-6r1j-pnmx-mkdm | kernel: Linux Kernel: Denial of Service in iwlwifi due to improper firmware error handling |
CVE-2025-38096
|
| VCID-6r4x-xaaf-b7ft | kernel: drm/scheduler: signal scheduled fence when kill job |
CVE-2025-38436
|
| VCID-6r7n-bx5b-tkdy | kernel: Integer Overflow in raid5_cache_count |
CVE-2024-23307
|
| VCID-6ru2-nvnu-e7as | kernel: net/smc: fix LGR and link use-after-free issue |
CVE-2024-56640
|
| VCID-6rw9-fs2b-f7bd | kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction |
CVE-2023-54048
|
| VCID-6syp-3js8-qudn | kernel: spi: fsl-qspi: use devm function instead of driver remove |
CVE-2025-37842
|
| VCID-6t6u-3hau-kbg6 | kernel: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket |
CVE-2024-42246
|
| VCID-6t8r-3wsm-ckgv | kernel: Bluetooth: 6lowpan: reset link-local header on ipv6 recv path |
CVE-2025-40282
|
| VCID-6tb9-nnj3-57gv | kernel: drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() |
CVE-2024-35951
|
| VCID-6td8-x2he-gbhg | kernel: net: defer final 'struct net' free in netns dismantle |
CVE-2024-56658
|
| VCID-6tqf-xx6h-mfhc | kernel: drm/amd/display: Fix memory leak |
CVE-2022-49135
|
| VCID-6trw-82f1-13ar | kernel: jfs: check if leafidx greater than num leaves per dmap tree |
CVE-2024-49902
|
| VCID-6u26-3zuf-xqee | kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats |
CVE-2025-68800
|
| VCID-6uwd-fbfd-p3b9 | kernel: incorrect return value for the error case in the tegra_xusb_find_port_node |
CVE-2023-23000
|
| VCID-6vd4-q7jm-zfcr | kernel: f2fs: fix to avoid updating compression context during writeback |
CVE-2025-68772
|
| VCID-6vrh-qer8-aqfa | kernel: hwmon: (adc128d818) Fix underflows seen when writing limit attributes |
CVE-2024-46759
|
| VCID-6w87-zmg7-nffm | kernel: usb: storage: Fix memory leak in USB bulk transport |
CVE-2025-68288
|
| VCID-6wrr-yr71-xuhk | kernel: tcp: secure_seq: add back ports to TS offset |
CVE-2026-23247
|
| VCID-6wt5-j8kf-w7ax | kernel: usb: gadget: f_tcm: Don't free command immediately |
CVE-2024-58055
|
| VCID-6wu1-5wuf-nyan | kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling |
CVE-2025-40322
|
| VCID-6x34-qm57-s7ca | kernel: drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table |
CVE-2025-38319
|
| VCID-6x7e-pew4-jkha | kernel: uprobes: fix kernel info leak via "[uprobes]" vma |
CVE-2024-49975
|
| VCID-6x9m-x6vn-8fbg | kernel: clk: imx: NULL pointer dereference in imx_register_uart_clocks() |
CVE-2022-3114
|
| VCID-6xdf-maze-17de | kernel: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset |
CVE-2024-56767
|
| VCID-6yjc-2kba-q3c3 | kernel: mfd: ene-kb3930: Fix a potential NULL pointer dereference |
CVE-2025-23146
|
| VCID-6z59-22gp-cuaw | kernel: net: phy: mscc: Fix memory leak when using one step timestamping |
CVE-2025-38148
|
| VCID-6za1-45fj-g3ej | kernel: media: uvcvideo: Remove dangling pointers |
CVE-2024-58002
|
| VCID-6zk8-j8jm-c3gw | kernel: apparmor: fix possible NULL pointer dereference |
CVE-2024-46721
|
| VCID-6zr9-dcw4-8yg9 | kernel: Linux kernel Open vSwitch: Denial of Service via malformed MPLS packets |
CVE-2025-38146
|
| VCID-7155-8p78-cfd2 | kernel: bnxt_en: Fix out-of-bound memcpy() during ethtool -w |
CVE-2025-37911
|
| VCID-719s-u3xc-gyas | kernel: media: dvbdev: prevent the risk of out of memory access |
CVE-2024-53063
|
| VCID-71m1-rn5c-k3hm | kernel: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects |
CVE-2025-39850
|
| VCID-71vz-93g8-fuez | kernel: MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a |
CVE-2024-56785
|
| VCID-724j-jc6b-5uba | kernel: block: fix resource leak in blk_register_queue() error path |
CVE-2025-37980
|
| VCID-72pd-9p33-9qhg | kernel: ceph: fix race condition validating r_parent before applying state |
CVE-2025-39927
|
| VCID-72px-huyw-r7fj | kernel: spi: fsl-cpm: Check length parity before switching to 16 bit mode |
CVE-2025-68773
|
| VCID-7319-t2pc-ufe9 | kernel: ftrace: Fix regression with module command in stack_trace_filter |
CVE-2024-56569
|
| VCID-73fa-zuvg-p3cu | kernel: bpf, cpumap: Make sure kthread is running before map update returns |
CVE-2023-53577
|
| VCID-73mg-3qys-3ubr | kernel: ice: fix Tx scheduler error handling in XDP callback |
CVE-2025-38127
|
| VCID-74ys-m19c-p7f3 | kernel: drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw |
CVE-2024-49915
|
| VCID-754k-suks-5ydu | kernel: bpf: Fix memory leaks in __check_func_call |
CVE-2022-49837
|
| VCID-754t-s81c-jbc7 | kernel: HID: appleir: Fix potential NULL dereference at raw event handle |
CVE-2025-21948
|
| VCID-75fw-e7zr-qufc | kernel: nvmet-tcp: don't restore null sk_state_change |
CVE-2025-38035
|
| VCID-76f2-7gkv-wkgu | kernel: usb: gadget: f_midi: fix MIDI Streaming descriptor lengths |
CVE-2025-21835
|
| VCID-76q3-xw8m-xyds | kernel: mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() |
CVE-2023-52939
|
| VCID-76tt-tbqf-5bfs | kernel: wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() |
CVE-2025-68362
|
| VCID-77wj-cztw-uqhf | kernel: scsi: megaraid_sas: Fix for a potential deadlock |
CVE-2024-57807
|
| VCID-7892-zv3s-xqhu | kernel: Linux kernel: Denial of Service in netfilter due to integer overflow |
CVE-2025-38162
|
| VCID-78ud-gtge-37h8 | kernel: firmware_loader: Block path traversal |
CVE-2024-47742
|
| VCID-791q-n1py-47ah | kernel: powerpc/rtas: Keep MSR[RI] set when calling RTAS |
CVE-2022-49440
|
| VCID-798e-hc82-7qcv | kernel: udp: Deal with race between UDP socket address change and rehash |
CVE-2024-57974
|
| VCID-79ee-xz7f-7yax | kernel: asix: fix uninit-value in asix_mdio_read() |
CVE-2021-47101
|
| VCID-7a5q-hn39-8kft | kernel: ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition |
CVE-2024-50059
|
| VCID-7a8k-qyf8-pffj | kernel: s390/ctcm: Fix double-kfree |
CVE-2025-40253
|
| VCID-7a9q-ppkr-53cx | kernel: Linux kernel: Double-free vulnerability in fsl-mc bus driver can lead to denial of service, information disclosure, or arbitrary code execution. |
CVE-2025-38313
|
| VCID-7avq-dq92-7bhg | kernel: mm/hugetlb: fix folio is still mapped when deleted |
CVE-2025-40006
|
| VCID-7b27-phbd-fqbq | In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-lpspi: fix teardown order issue (UAF) There is a teardown order issue in the driver. The SPI controller is registered using devm_spi_register_controller(), which delays unregistration of the SPI controller until after the fsl_lpspi_remove() function returns. As the fsl_lpspi_remove() function synchronously tears down the DMA channels, a running SPI transfer triggers the following NULL pointer dereference due to use after free: | fsl_lpspi 42550000.spi: I/O Error in DMA RX | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] | Call trace: | fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi] | fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi] | spi_transfer_one_message+0x49c/0x7c8 | __spi_pump_transfer_message+0x120/0x420 | __spi_sync+0x2c4/0x520 | spi_sync+0x34/0x60 | spidev_message+0x20c/0x378 [spidev] | spidev_ioctl+0x398/0x750 [spidev] [...] Switch from devm_spi_register_controller() to spi_register_controller() in fsl_lpspi_probe() and add the corresponding spi_unregister_controller() in fsl_lpspi_remove(). |
CVE-2026-31485
|
| VCID-7bbq-9ycy-c7cr | kernel: tracing: Fix overflow in get_free_elt() |
CVE-2024-43890
|
| VCID-7bqh-pzdg-bkez | kernel: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() |
CVE-2025-39742
|
| VCID-7bsu-23dg-qkaf | kernel: ocfs2: cancel dqi_sync_work before freeing oinfo |
CVE-2024-49966
|
| VCID-7c1y-w28c-ducn | kernel: jfs: Fix uninit-value access of imap allocated in the diMount() function |
CVE-2025-37742
|
| VCID-7c6j-nqp4-63b8 | kernel: Linux kernel: Denial of Service due to memory leak in netpoll during cleanup |
CVE-2025-68245
|
| VCID-7cnt-x96y-vqfy | kernel: can: peak_usb: fix shift-out-of-bounds issue |
CVE-2025-40020
|
| VCID-7cnv-qdcn-3qhq | kernel: xenbus: Use kref to track req lifetime |
CVE-2025-37949
|
| VCID-7cxt-kddr-tybw | kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE |
CVE-2025-40277
|
| VCID-7dfn-9f3w-5qej | kernel: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() |
CVE-2024-53042
|
| VCID-7egj-ffph-kyc2 | kernel: Bluetooth: SCO: Fix UAF on sco_sock_timeout |
CVE-2024-50125
|
| VCID-7eh9-dqkv-j3bm | kernel: dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn |
CVE-2025-38042
|
| VCID-7etb-wzrv-17ck | kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format |
CVE-2024-53104
|
| VCID-7fke-ahd3-e7ac | kernel: Bluetooth: hci_conn: Use disable_delayed_work_sync |
CVE-2024-56591
|
| VCID-7ghp-tjwd-guea | kernel: KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT |
CVE-2022-50224
|
| VCID-7gj4-ykce-dbfs | kernel: fou: Don't allow 0 for FOU_ATTR_IPPROTO |
CVE-2026-23083
|
| VCID-7gjp-jmwv-c3de | kernel: memcg: fix soft lockup in the OOM process |
CVE-2024-57977
|
| VCID-7gs3-vzmf-5qhq | kernel: drm/amdgpu: fix ucode out-of-bounds read warning |
CVE-2024-46723
|
| VCID-7gwx-sepa-nfh4 | kernel: af_packet: avoid erroring out after sock_init_data() in packet_create() |
CVE-2024-56606
|
| VCID-7h9m-8ra3-33ff | kernel: quota: flush quota_release_work upon quota writeback |
CVE-2024-56780
|
| VCID-7hmd-zbsv-qqcx | kernel: bus: mhi: host: Detect events pointing to unexpected TREs |
CVE-2025-39790
|
| VCID-7hnj-p4bx-73ac | kernel: btrfs: do not assert we found block group item when creating free space tree |
CVE-2025-40100
|
| VCID-7j4r-xx4w-d3dg | kernel: erofs: validate the extent length for uncompressed pclusters |
CVE-2022-50746
|
| VCID-7j6n-nqwg-qycj | kernel: powerpc/pseries: Fix scv instruction crash with kexec |
CVE-2024-42230
|
| VCID-7j8j-s3am-6bgv | kernel: Linux kernel: Denial of Service via double-increment of reference count in netfilter |
CVE-2025-39764
|
| VCID-7jee-ctd9-qkg8 | kernel: io_uring/rw: split io_read() into a helper |
CVE-2023-52926
|
| VCID-7jmm-2y4z-u3bj | kernel: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() |
CVE-2025-38061
|
| VCID-7key-3jrb-skg2 | kernel: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() |
CVE-2025-38399
|
| VCID-7kxd-yjnx-m7f2 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Before using sk pointer, check if it is null. Fix the following: KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267] CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025 Workqueue: events l2cap_info_timeout RIP: 0010:kasan_byte_accessible+0x12/0x30 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce veth0_macvtap: entered promiscuous mode RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0 PKRU: 55555554 Call Trace: <TASK> __kasan_check_byte+0x12/0x40 lock_acquire+0x79/0x2e0 lock_sock_nested+0x48/0x100 ? l2cap_sock_ready_cb+0x46/0x160 l2cap_sock_ready_cb+0x46/0x160 l2cap_conn_start+0x779/0xff0 ? __pfx_l2cap_conn_start+0x10/0x10 ? l2cap_info_timeout+0x60/0xa0 ? __pfx___mutex_lock+0x10/0x10 l2cap_info_timeout+0x68/0xa0 ? process_scheduled_works+0xa8d/0x18c0 process_scheduled_works+0xb6e/0x18c0 ? __pfx_process_scheduled_works+0x10/0x10 ? assign_work+0x3d5/0x5e0 worker_thread+0xa53/0xfc0 kthread+0x388/0x470 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x51e/0xb90 ? __pfx_ret_from_fork+0x10/0x10 veth1_macvtap: entered promiscuous mode ? __switch_to+0xc7d/0x1450 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- batman_adv: batadv0: Interface activated: batadv_slave_0 batman_adv: batadv0: Interface activated: batadv_slave_1 netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 RIP: 0010:kasan_byte_accessible+0x12/0x30 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce ieee80211 phy39: Selected rate control algorithm 'minstrel_ht' RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0 PKRU: 55555554 Kernel panic - not syncing: Fatal exception |
CVE-2026-31510
|
| VCID-7m1m-kbyr-fqgy | kernel: net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() |
CVE-2023-54237
|
| VCID-7mgd-4mg8-nkcc | kernel: net: ethernet: cortina: Use TOE/TSO on all TCP |
CVE-2025-38331
|
| VCID-7mrh-h913-hyc3 | kernel: ACPI: sysfs: validate return type of _STR method |
CVE-2024-49860
|
| VCID-7n75-gcnc-m3bs | kernel: lib: objagg: Fix general protection fault |
CVE-2024-43846
|
| VCID-7nkz-mvmc-h3bc | kernel: drm/msm: fix use-after-free on probe deferral |
CVE-2022-50492
|
| VCID-7nxb-qm5n-g7e2 | kernel: Linux kernel qla2xxx driver: Denial of Service via NULL pointer dereference during fabric async scan cleanup |
CVE-2025-71236
|
| VCID-7p9b-nj4u-bbak | kernel: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras |
CVE-2025-38540
|
| VCID-7pzg-z5p7-wuck | kernel: crypto: marvell/cesa - Handle zero-length skcipher requests |
CVE-2025-38173
|
| VCID-7q62-t5tn-2bd8 | kernel: io_uring: check if we need to reschedule during overflow flush |
CVE-2024-50060
|
| VCID-7qfh-k1qu-j7d4 | kernel: Linux kernel (vhost_vdpa): Denial of service via large memory unmap |
CVE-2022-50851
|
| VCID-7qqu-u862-47ay | kernel: um: ubd: Do not use drvdata in release |
CVE-2024-53184
|
| VCID-7r5z-yb83-7qg4 | kernel: NFSD: Fix crash in nfsd4_read_release() |
CVE-2025-40324
|
| VCID-7r8h-rr9v-7qht | kernel: ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. |
CVE-2025-38438
|
| VCID-7rz5-thve-fqeg | kernel: ethtool: Avoid overflowing userspace buffer on stats query |
CVE-2025-68795
|
| VCID-7s2j-fww7-qqd1 | kernel: net: sched: fix ordering of qlen adjustment |
CVE-2024-53164
|
| VCID-7s6v-sbud-ufbb | kernel: thermal: int340x: Add NULL check for adev |
CVE-2025-23136
|
| VCID-7snz-vnyt-b7fb | kernel: ext4: avoid OOB when system.data xattr changes underneath the filesystem |
CVE-2024-47701
|
| VCID-7sq6-1tjz-6qgh | kernel: usb: potential integer overflow in usbg_make_tpg() |
CVE-2025-68750
|
| VCID-7szt-j9ps-uqcj | kernel: NTB: fix possible name leak in ntb_register_device() |
CVE-2023-52652
|
| VCID-7t89-3m8t-1ydq | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix drm_edid leak in amdgpu_dm [WHAT] When a sink is connected, aconnector->drm_edid was overwritten without freeing the previous allocation, causing a memory leak on resume. [HOW] Free the previous drm_edid before updating it. (cherry picked from commit 52024a94e7111366141cfc5d888b2ef011f879e5) |
CVE-2026-31461
|
| VCID-7thm-a7w6-vbhe | kernel: Linux kernel: Buffer overflow in target_lu_gp_members_show can lead to arbitrary code execution |
CVE-2025-39998
|
| VCID-7thv-6jna-gkd1 | kernel: drm/amd/display: Check stream before comparing them |
CVE-2024-49896
|
| VCID-7tku-f2ed-s7b3 | kernel: bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() |
CVE-2022-49711
|
| VCID-7tue-dt6q-eqau | kernel: scsi: sg: Do not sleep in atomic context |
CVE-2025-40259
|
| VCID-7u2d-zbp4-y7ft | kernel: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference |
CVE-2025-40042
|
| VCID-7unb-n3v4-sya4 | kernel: drm/msm: fix workqueue leak on bind errors |
CVE-2023-53849
|
| VCID-7v4d-mrh9-hfah | kernel: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() |
CVE-2024-50304
|
| VCID-7v66-8w2u-duf9 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: Fix possible UAF This fixes the following trace caused by not dropping l2cap_conn reference when user->remove callback is called: [ 97.809249] l2cap_conn_free: freeing conn ffff88810a171c00 [ 97.809907] CPU: 1 UID: 0 PID: 1419 Comm: repro_standalon Not tainted 7.0.0-rc1-dirty #14 PREEMPT(lazy) [ 97.809935] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 [ 97.809947] Call Trace: [ 97.809954] <TASK> [ 97.809961] dump_stack_lvl (lib/dump_stack.c:122) [ 97.809990] l2cap_conn_free (net/bluetooth/l2cap_core.c:1808) [ 97.810017] l2cap_conn_del (./include/linux/kref.h:66 net/bluetooth/l2cap_core.c:1821 net/bluetooth/l2cap_core.c:1798) [ 97.810055] l2cap_disconn_cfm (net/bluetooth/l2cap_core.c:7347 (discriminator 1) net/bluetooth/l2cap_core.c:7340 (discriminator 1)) [ 97.810086] ? __pfx_l2cap_disconn_cfm (net/bluetooth/l2cap_core.c:7341) [ 97.810117] hci_conn_hash_flush (./include/net/bluetooth/hci_core.h:2152 (discriminator 2) net/bluetooth/hci_conn.c:2644 (discriminator 2)) [ 97.810148] hci_dev_close_sync (net/bluetooth/hci_sync.c:5360) [ 97.810180] ? __pfx_hci_dev_close_sync (net/bluetooth/hci_sync.c:5285) [ 97.810212] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810242] ? up_write (./arch/x86/include/asm/atomic64_64.h:87 (discriminator 5) ./include/linux/atomic/atomic-arch-fallback.h:2852 (discriminator 5) ./include/linux/atomic/atomic-long.h:268 (discriminator 5) ./include/linux/atomic/atomic-instrumented.h:3391 (discriminator 5) kernel/locking/rwsem.c:1385 (discriminator 5) kernel/locking/rwsem.c:1643 (discriminator 5)) [ 97.810267] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810290] ? rcu_is_watching (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/context_tracking.h:128 kernel/rcu/tree.c:752) [ 97.810320] hci_unregister_dev (net/bluetooth/hci_core.c:504 net/bluetooth/hci_core.c:2716) [ 97.810346] vhci_release (drivers/bluetooth/hci_vhci.c:691) [ 97.810375] ? __pfx_vhci_release (drivers/bluetooth/hci_vhci.c:678) [ 97.810404] __fput (fs/file_table.c:470) [ 97.810430] task_work_run (kernel/task_work.c:235) [ 97.810451] ? __pfx_task_work_run (kernel/task_work.c:201) [ 97.810472] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810495] ? do_raw_spin_unlock (./include/asm-generic/qspinlock.h:128 (discriminator 5) kernel/locking/spinlock_debug.c:142 (discriminator 5)) [ 97.810527] do_exit (kernel/exit.c:972) [ 97.810547] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810574] ? __pfx_do_exit (kernel/exit.c:897) [ 97.810594] ? lock_acquire (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:5870 (discriminator 6) kernel/locking/lockdep.c:5825 (discriminator 6)) [ 97.810616] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810639] ? do_raw_spin_lock (kernel/locking/spinlock_debug.c:95 (discriminator 4) kernel/locking/spinlock_debug.c:118 (discriminator 4)) [ 97.810664] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810688] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1)) [ 97.810721] do_group_exit (kernel/exit.c:1093) [ 97.810745] get_signal (kernel/signal.c:3007 (discriminator 1)) [ 97.810772] ? security_file_permission (./arch/x86/include/asm/jump_label.h:37 security/security.c:2366) [ 97.810803] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810826] ? vfs_read (fs/read_write.c:555) [ 97.810854] ? __pfx_get_signal (kernel/signal.c:2800) [ 97.810880] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810905] ? __pfx_vfs_read (fs/read_write.c:555) [ 97.810932] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 97.810960] arch_do_signal_or_restart (arch/ ---truncated--- |
CVE-2026-23462
|
| VCID-7v6v-p1fu-qbbf | kernel: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe |
CVE-2025-68241
|
| VCID-7vdf-qwa1-ubeg | kernel: smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) |
CVE-2025-39932
|
| VCID-7vhj-ptcf-cuc1 | kernel: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() |
CVE-2025-38458
|
| VCID-7vj5-mmz9-sqf4 | kernel: bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() |
CVE-2024-42068
|
| VCID-7wfs-maep-aybj | kernel: comedi: pcl726: Prevent invalid irq number |
CVE-2025-39685
|
| VCID-7xz9-7rne-cbfk | kernel: netdevsim: Fix memory leak of nsim_dev->fa_cookie |
CVE-2022-49803
|
| VCID-7yey-ku8y-bfdx | kernel: um: time-travel: fix time corruption |
CVE-2023-52633
|
| VCID-7zgg-nmhf-zuhx | kernel: netfilter: ipset: fix region locking in hash types |
CVE-2025-37997
|
| VCID-819w-xrbz-3yfy | kernel: powerpc/xive: Fix refcount leak in xive_spapr_init |
CVE-2022-49437
|
| VCID-82f3-bpp3-6fc7 | kernel: scsi: aic94xx: fix use-after-free in device removal path |
CVE-2025-71075
|
| VCID-82hh-jcu4-7uf7 | kernel: ovl: Filter invalid inodes with missing lookup function |
CVE-2024-56570
|
| VCID-82mh-nwfw-hqh9 | kernel: media: venus: fix use after free bug in venus_remove due to race condition |
CVE-2024-49981
|
| VCID-82py-ut98-qfb3 | kernel: iommu/amd/pgtbl: Fix possible race while increase page table level |
CVE-2025-39961
|
| VCID-833x-cbu8-3ybv | kernel: remoteproc: imx_rproc: Skip over memory region when node value is NULL |
CVE-2024-43860
|
| VCID-8387-uw37-nba5 | kernel: spufs: fix a leak in spufs_create_context() |
CVE-2025-22071
|
| VCID-84q5-3yq6-dubg | kernel: net: davicom: fix UAF in dm9000_drv_remove |
CVE-2025-21715
|
| VCID-84v2-zwrn-23gm | kernel: cgroup/cpuset: Prevent UAF in proc_cpuset_show() |
CVE-2024-43853
|
| VCID-856e-yngm-xbgq | kernel: spi: spi-sprd-adi: Fix double free in probe error path |
CVE-2026-23068
|
| VCID-868a-udb4-qfbm | kernel: ALSA: aloop: Fix racy access at PCM trigger |
CVE-2026-23191
|
| VCID-875b-q6hw-yqad | kernel: udp: skip L4 aggregation for UDP tunnel packets |
CVE-2021-47036
|
| VCID-879u-ejfc-xfes | kernel: mm/mempool: fix poisoning order>0 pages with HIGHMEM |
CVE-2025-68231
|
| VCID-87qv-cyxq-nqdj | kernel: drm/radeon: Fix encoder->possible_clones |
CVE-2024-50201
|
| VCID-87x6-9u47-dbgc | kernel: drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes |
CVE-2024-42310
|
| VCID-8859-uavn-xygj | kernel: xen: fix UAF in dmabuf_exp_from_pages() |
CVE-2025-38595
|
| VCID-886c-effz-qfcu | kernel: iio: pressure: zpa2326: fix information leak in triggered buffer |
CVE-2024-57912
|
| VCID-887n-3662-zfba | kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params |
CVE-2024-58012
|
| VCID-88uv-n88p-9feg | kernel: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo |
CVE-2025-37969
|
| VCID-88vg-k7j9-pbdx | kernel: i2c: npcm: disable interrupt enable bit before devm_request_irq |
CVE-2025-21878
|
| VCID-898p-2snh-juh7 | kernel: iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver |
CVE-2025-71199
|
| VCID-898p-crnv-w7cb | In the Linux kernel, the following vulnerability has been resolved: HID: apple: avoid memory leak in apple_report_fixup() The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller. |
CVE-2026-31520
|
| VCID-89ws-26sr-hfd2 | kernel: USB: core: Make do_proc_control() and do_proc_bulk() killable |
CVE-2021-47582
|
| VCID-8a96-gcx6-kucs | kernel: pm: cpupower: bench: Prevent NULL dereference on malloc failure |
CVE-2025-37841
|
| VCID-8aav-ad55-g3hq | kernel: net/mlx5e: kTLS, Fix incorrect page refcounting |
CVE-2024-53138
|
| VCID-8amw-qaqv-37c6 | kernel: perf/core: Exit early on perf_mmap() fail |
CVE-2025-38565
|
| VCID-8bmj-tczd-k7gm | kernel: bpf: Fix WARN() in get_bpf_raw_tp_regs |
CVE-2025-38285
|
| VCID-8bmx-4nbw-6qcn | kernel: ice: Fix memory leak in ice_set_ringparam() |
CVE-2026-23389
|
| VCID-8bn9-cmgw-nufm | kernel: mcb: fix a double free bug in chameleon_parse_gdd() |
CVE-2025-37817
|
| VCID-8dbn-tnsj-4bbe | kernel: Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() |
CVE-2025-38473
|
| VCID-8dq4-zu8p-xqgz | kernel: vfs: Don't evict inode under the inode lru traversing context |
CVE-2024-45003
|
| VCID-8dv1-u3pc-d7c9 | kernel: vfio/pci: Properly hide first-in-list PCIe extended capability |
CVE-2024-53214
|
| VCID-8e46-n9s3-jbgd | kernel: media: pci: cx23885: check cx23885_vdev_init() return |
CVE-2023-52918
|
| VCID-8edx-kmgw-jue5 | kernel: can: j1939: implement NETDEV_UNREGISTER notification handler |
CVE-2025-39925
|
| VCID-8egz-86bp-tfgj | kernel: rtnetlink: Allocate vfinfo size for VF GUIDs when supported |
CVE-2025-22075
|
| VCID-8f44-w8a5-9kbb | kernel: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map |
CVE-2025-39869
|
| VCID-8fue-j8hg-vfb2 | kernel: drm/gma500: Fix null dereference in hdmi teardown |
CVE-2025-40011
|
| VCID-8fy6-bzh4-4fhq | kernel: bus: fsl-mc: fix use-after-free in driver_override_show() |
CVE-2026-23221
|
| VCID-8gcb-cqxf-pqck | kernel: nvme: avoid double free special payload |
CVE-2024-41073
|
| VCID-8gys-qdsk-6qcz | kernel: tcp: Fix a data-race around sysctl_tcp_ecn_fallback. |
CVE-2022-49630
|
| VCID-8hht-ep2m-5kd5 | kernel: fbdev: pxafb: Fix possible use after free in pxafb_task() |
CVE-2024-49924
|
| VCID-8hqn-cmae-53dg | kernel: blk-mq: use quiesced elevator switch when reinitializing queues |
CVE-2022-50552
|
| VCID-8j8v-pfb1-j3e9 | kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address |
CVE-2025-71127
|
| VCID-8jdy-1rqx-bbgd | kernel: insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may lead to DoS |
CVE-2021-33061
|
| VCID-8juu-fmda-afdh | kernel: tee: optee: Fix supplicant wait loop |
CVE-2025-21871
|
| VCID-8ke9-myay-nyer | kernel: scsi: qla4xxx: Prevent a potential error pointer dereference |
CVE-2025-39676
|
| VCID-8m1a-k9as-euaj | kernel: tracing: Fix use-after-free in print_graph_function_flags during tracer switching |
CVE-2025-22035
|
| VCID-8m29-81p9-afeb | kernel: wifi: ath10k: Delay the unmapping of the buffer |
CVE-2022-50700
|
| VCID-8n6c-d6p3-2kad | kernel: wifi: rtlwifi: remove unused check_buddy_priv |
CVE-2024-58072
|
| VCID-8nby-7htg-j7cs | kernel: drm/amdgpu: Fix even more out of bound writes from debugfs |
CVE-2021-47489
|
| VCID-8nc7-7kj7-4qds | kernel: s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() |
CVE-2024-53210
|
| VCID-8pa6-1src-eub8 | kernel: block: fix overflow in blk_ioctl_discard() |
CVE-2024-36917
|
| VCID-8q1z-p2qp-nkbf | In the Linux kernel, the following vulnerability has been resolved: xfs: stop reclaim before pushing AIL during unmount The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes. Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling m_reclaim_work because the inodegc worker can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable. |
CVE-2026-31455
|
| VCID-8q25-bncz-2qcu | kernel: usb: gadget: core: Check for unset descriptor |
CVE-2024-44960
|
| VCID-8q49-pygk-33d1 | kernel: drm/amd/display: Check link_index before accessing dc->links[] |
CVE-2024-46813
|
| VCID-8q5e-qfej-wubt | kernel: riscv: mm: Fix the out of bound issue of vmemmap address |
CVE-2024-57945
|
| VCID-8qdb-6tpa-vkgm | kernel: x86/ioapic: Handle allocation failures gracefully |
CVE-2024-49927
|
| VCID-8qgv-5n2y-sfa7 | kernel: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() |
CVE-2024-50256
|
| VCID-8qva-q75v-y3b1 | kernel: fou: fix initialization of grc |
CVE-2024-46865
|
| VCID-8rfn-njaa-mkfh | kernel: firmware: arm_scpi: Check the DVFS OPP count returned by the firmware |
CVE-2024-53157
|
| VCID-8ry8-z6kv-jfgu | kernel: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats |
CVE-2024-26686
|
| VCID-8rze-hjx5-qyf9 | kernel: net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup |
CVE-2025-68192
|
| VCID-8sb2-qck7-ryet | kernel: vfs: fix race between evice_inodes() and find_inode()&iput() |
CVE-2024-47679
|
| VCID-8ssr-76q5-6kf4 | kernel: iomap: adjust read range correctly for non-block-aligned positions |
CVE-2025-68794
|
| VCID-8sv6-72c2-kybe | kernel: f2fs: don't reset unchangable mount option in f2fs_remount() |
CVE-2023-53447
|
| VCID-8sw8-s4yy-u7dk | kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too |
CVE-2025-38729
|
| VCID-8t35-ntfd-xfdk | kernel: media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() |
CVE-2025-68819
|
| VCID-8tea-h3pe-qqa3 | kernel: Bluetooth: btrtl: Prevent potential NULL dereference |
CVE-2025-37792
|
| VCID-8u9c-55ad-vucc | kernel: f2fs: compress: fix reserve_cblocks counting error when out of space |
CVE-2024-35844
|
| VCID-8uhq-7vkj-wbe8 | kernel: exec: Fix ToCToU between perm check and set-uid/gid usage |
CVE-2024-43882
|
| VCID-8vht-myyn-muaj | kernel: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() |
CVE-2025-21848
|
| VCID-8w6e-cn99-8yaz | kernel: Fix userfaultfd_api to return EINVAL as expected |
CVE-2024-41027
|
| VCID-8w7y-pzaz-zug3 | kernel: i40e: fix race condition by adding filter's intermediate sync state |
CVE-2024-53088
|
| VCID-8w8t-pnnc-1yc9 | kernel: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper |
CVE-2025-39681
|
| VCID-8w9r-p932-eygt | kernel: net: dsa: Avoid cross-chip syncing of VLAN filtering |
CVE-2022-49234
|
| VCID-8wtz-trvb-bybm | kernel: gpio: mvebu: fix irq domain leak |
CVE-2023-53579
|
| VCID-8x5z-wwqe-k3dk | kernel: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans |
CVE-2024-50264
|
| VCID-8xay-cepn-vfdd | In the Linux kernel, the following vulnerability has been resolved: ksmbd: do not expire session on binding failure When a multichannel session binding request fails (e.g. wrong password), the error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED. However, during binding, sess points to the target session looked up via ksmbd_session_lookup_slowpath() -- which belongs to another connection's user. This allows a remote attacker to invalidate any active session by simply sending a binding request with a wrong password (DoS). Fix this by skipping session expiration when the failed request was a binding attempt, since the session does not belong to the current connection. The reference taken by ksmbd_session_lookup_slowpath() is still correctly released via ksmbd_user_session_put(). |
CVE-2026-31476
|
| VCID-8xfy-gjv2-w7hv | kernel: media: i2c: et8ek8: Don't strip remove function when driver is builtin |
CVE-2024-38611
|
| VCID-8yd7-63kx-mqb5 | kernel: net/smc: check smcd_v2_ext_offset when receiving proposal msg |
CVE-2024-47408
|
| VCID-8zf2-xe9p-7kb1 | kernel: padata: fix UAF in padata_reorder |
CVE-2025-21727
|
| VCID-8zhx-68dt-1bbf | kernel: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() |
CVE-2025-37798
|
| VCID-8zpp-76tm-m3ce | kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices |
CVE-2024-53197
|
| VCID-8zy9-cpzf-q3be | kernel: KVM: arm64: Get rid of userspace_irqchip_in_use |
CVE-2024-53195
|
| VCID-91nj-wmpe-muam | kernel: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path |
CVE-2025-39911
|
| VCID-91w1-fn7d-cuhd | kernel: ALSA: ac97: fix a double free in snd_ac97_controller_register() |
CVE-2025-71192
|
| VCID-92j7-p476-97ca | kernel: f2fs: fix to do sanity check on direct node in truncate_dnode() |
CVE-2023-53846
|
| VCID-93ce-35w8-h7ef | kernel: nbd: fix incomplete validation of ioctl arg |
CVE-2023-53513
|
| VCID-93fb-qqv8-wyeb | kernel: eth: bnxt: always recalculate features after XDP clearing, fix null-deref |
CVE-2025-21682
|
| VCID-93h7-cr4j-sbfn | In the Linux kernel, the following vulnerability has been resolved: team: fix header_ops type confusion with non-Ethernet ports Similar to commit 950803f72547 ("bonding: fix type confusion in bond_setup_by_slave()") team has the same class of header_ops type confusion. For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops directly. When the team device later calls dev_hard_header() or dev_parse_header(), these callbacks can run with the team net_device instead of the real lower device, so netdev_priv(dev) is interpreted as the wrong private type and can crash. The syzbot report shows a crash in bond_header_create(), but the root cause is in team: the topology is gre -> bond -> team, and team calls the inherited header_ops with its own net_device instead of the lower device, so bond_header_create() receives a team device and interprets netdev_priv() as bonding private data, causing a type confusion crash. Fix this by introducing team header_ops wrappers for create/parse, selecting a team port under RCU, and calling the lower device callbacks with port->dev, so each callback always sees the correct net_device context. Also pass the selected lower device to the lower parse callback, so recursion is bounded in stacked non-Ethernet topologies and parse callbacks always run with the correct device context. |
CVE-2026-31502
|
| VCID-93yj-3vbb-3ub5 | kernel: bpf: Check the helper function is valid in get_helper_proto |
CVE-2025-39990
|
| VCID-946h-qfxp-yffe | kernel: net/mlx5e: Fix use-after-free of encap entry in neigh update handler |
CVE-2021-47247
|
| VCID-94e9-zqve-rkgf | kernel: ALSA: usb-mixer: us16x08: validate meter packet indices |
CVE-2025-68783
|
| VCID-94k1-ja9w-2fd2 |
CVE-2026-31421
|
|
| VCID-94rx-y389-xucu | kernel: firmware: arm_scmi: Fix double free in SMC transport cleanup path |
CVE-2024-26893
|
| VCID-95g7-p1fv-1ue3 | kernel: Linux kernel KVM: Host system hard lockup due to periodic HV timer mishandling after VM inactivity |
CVE-2025-71104
|
| VCID-9661-pt2m-2yeh | kernel: x86/coco: Require seeding RNG with RDRAND on CoCo systems |
CVE-2024-35875
|
| VCID-96w2-c4s3-sqet | kernel: netrom: fix double-free in nr_route_frame() |
CVE-2026-23098
|
| VCID-97nk-85yc-s7bt | kernel: drm/i915/gt: Cleanup partial engine discovery failures |
CVE-2022-48893
|
| VCID-98mp-5h68-73eg | kernel: Linux kernel: Denial of Service during UFS power down |
CVE-2025-68236
|
| VCID-995q-6nn5-ykgg | kernel: scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() |
CVE-2024-57872
|
| VCID-99hb-kbtz-vkhe | kernel: wifi: mac80211: reject TDLS operations when station is not associated |
CVE-2025-38644
|
| VCID-9a27-3tb5-sfa9 | kernel: riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context |
CVE-2024-40915
|
| VCID-9a71-kyv3-kudp | kernel: resource: fix region_intersects() vs add_memory_driver_managed() |
CVE-2024-49878
|
| VCID-9ag3-hqxf-xqgz | kernel: drm/amd/display: fix array index out of bound error in DCN32 DML |
CVE-2022-48979
|
| VCID-9anm-5pvp-tqez | kernel: ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref |
CVE-2026-23145
|
| VCID-9anm-p57g-dyfz | kernel: sctp: Prevent TOCTOU out-of-bounds write |
CVE-2025-40331
|
| VCID-9aq6-tyaw-nuck | kernel: x86/vmscape: Add conditional IBPB mitigation |
CVE-2025-40300
|
| VCID-9aru-svmf-kbfr | kernel: usb: gadget: f_ecm: Refactor bind path to use __free() |
CVE-2025-40093
|
| VCID-9ats-p2j3-qub2 | kernel: jfs: upper bound check of tree index in dbAllocAG |
CVE-2025-38697
|
| VCID-9axb-sz3w-ubcx | In the Linux kernel, the following vulnerability has been resolved: udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n When CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0 (success) without actually creating a socket. Callers such as fou_create() then proceed to dereference the uninitialized socket pointer, resulting in a NULL pointer dereference. The captured NULL deref crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764) [...] Call Trace: <TASK> genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114) genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209) [...] netlink_rcv_skb (net/netlink/af_netlink.c:2550) genl_rcv (net/netlink/genetlink.c:1219) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1)) __sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1)) __x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1)) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130) This patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so callers correctly take their error paths. There is only one caller of the vulnerable function and only privileged users can trigger it. |
CVE-2026-23439
|
| VCID-9axt-c2hy-63eb | kernel: net/sched: act_mirred: use the backlog for mirred ingress |
CVE-2024-26740
|
| VCID-9azr-qrcs-k7by | kernel: netfilter: nf_tables: fix memleak in map from abort path |
CVE-2024-27011
|
| VCID-9azs-bp6u-bbhy | kernel: ibmvnic: fix race between xmit and reset |
CVE-2022-49201
|
| VCID-9brg-t4ed-akbw | kernel: vsock: Do not allow binding to VMADDR_PORT_ANY |
CVE-2025-38618
|
| VCID-9bww-cw4h-2yhq | Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. |
CVE-2024-36331
|
| VCID-9cpj-kd98-33bz | kernel: net/sched: act_gate: snapshot parameters with RCU on replace |
CVE-2026-23245
|
| VCID-9d1v-c3ex-kfez | kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race |
CVE-2025-38085
|
| VCID-9d3k-s661-nud4 | kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping |
CVE-2025-40154
|
| VCID-9dfd-an6h-67gp | kernel: btrfs: do not strictly require dirty metadata threshold for metadata writepages |
CVE-2026-23157
|
| VCID-9dhj-xwca-sfew | kernel: drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr |
CVE-2024-43905
|
| VCID-9dwa-etzm-syhf | kernel: of/irq: Prevent device address out-of-bounds read in interrupt map walk |
CVE-2024-46743
|
| VCID-9dwf-wu39-sbev | kernel: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition |
CVE-2024-47747
|
| VCID-9e1d-geb3-suhq | kernel: VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify |
CVE-2025-38102
|
| VCID-9ea1-81c1-37g7 | kernel: netfilter: conntrack: fix wrong ct->timeout value |
CVE-2023-53635
|
| VCID-9ej7-7tra-zqcm | kernel: netfilter: nft_set_rbtree: validate open interval overlap |
CVE-2026-23333
|
| VCID-9esq-tfd3-4ff4 | kernel: parisc: Fix double SIGFPE crash |
CVE-2025-37991
|
| VCID-9ewq-11eq-z7ch | kernel: mailbox: bcm2835: Fix timeout during suspend mode |
CVE-2024-49963
|
| VCID-9f2j-4n6f-qua7 | kernel: ax25: fix incorrect dev_tracker usage |
CVE-2022-50163
|
| VCID-9f2m-pngc-jyf1 | kernel: erofs: handle NONHEAD !delta[1] lclusters gracefully |
CVE-2024-53234
|
| VCID-9fb9-btma-fbhu | kernel: team: fix check for port enabled in team_queue_override_port_prio_changed() |
CVE-2025-71091
|
| VCID-9fkj-rjq9-rydn | kernel: f2fs: fix to wait dio completion |
CVE-2024-47726
|
| VCID-9fn1-ytny-vke1 | kernel: drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit() |
CVE-2024-52559
|
| VCID-9fue-e3c2-x7e8 | kernel: dccp: Fix memory leak in dccp_feat_change_recv |
CVE-2024-56643
|
| VCID-9geu-b53r-kfek | kernel: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number |
CVE-2024-46724
|
| VCID-9gv8-4nrt-xken | kernel: NFSv4.0: Fix a use-after-free problem in the asynchronous open() |
CVE-2024-53173
|
| VCID-9gzx-uqjk-jbcn | kernel: batman-adv: fix panic during interface removal |
CVE-2025-21781
|
| VCID-9hk6-ttws-hkdw | kernel: drm/vmwgfx: Fix a null-ptr access in the cursor snooper |
CVE-2025-40110
|
| VCID-9hpn-bb61-m3c5 | kernel: usb: gadget : fix use-after-free in composite_dev_cleanup() |
CVE-2025-38555
|
| VCID-9hs8-jd7s-q7hs | kernel: Linux kernel: Denial of Service in the cdns3 USB driver due to improper spin lock handling |
CVE-2023-53287
|
| VCID-9je1-bsjy-tfh9 | kernel: Linux kernel (net: usb: pegasus): Denial of Service due to memory leak |
CVE-2026-23021
|
| VCID-9jq4-guvw-nqad | kernel: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device |
CVE-2024-56724
|
| VCID-9k11-ez7x-efcn | kernel: net: bridge: fix soft lockup in br_multicast_query_expired() |
CVE-2025-39773
|
| VCID-9khs-fwh9-cbdt | kernel: NFSD: free copynotify stateid in nfs4_free_ol_stateid() |
CVE-2025-40273
|
| VCID-9kuz-7fag-4qhv | kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() |
CVE-2026-23231
|
| VCID-9m2t-y1zb-hfar |
CVE-2026-31412
|
|
| VCID-9map-hxxc-r7hb | kernel: wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param |
CVE-2024-47712
|
| VCID-9mpd-j8a4-dkau | kernel: net: preserve skb_end_offset() in skb_unclone_keeptruesize() |
CVE-2022-49142
|
| VCID-9ns9-s6pf-d7hr | kernel: Linux kernel: Denial of Service via integer overflow in dm-stripe |
CVE-2025-39940
|
| VCID-9p1k-tkp9-6qat | kernel: mptcp: fix NULL pointer in can_accept_new_subflow |
CVE-2025-23145
|
| VCID-9p2w-b7vj-yya1 | kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done |
CVE-2025-38052
|
| VCID-9pfe-npnh-tugq | kernel: i40e: Fix potential invalid access when MAC list is empty |
CVE-2025-39853
|
| VCID-9pm2-v7hx-5uaq | kernel: initramfs: avoid filename buffer overrun |
CVE-2024-53142
|
| VCID-9pu9-gqtk-zkdj | kernel: scsi: qla1280: Fix kernel oops when debug level > 2 |
CVE-2025-21957
|
| VCID-9pw8-jc2e-n7b3 | kernel: block: fix rq-qos breakage from skipping rq_qos_done_bio() |
CVE-2022-49266
|
| VCID-9qcu-u3nr-mkb3 | kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare |
CVE-2025-39817
|
| VCID-9qhe-6xhk-hfhf | kernel: IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() |
CVE-2026-23289
|
| VCID-9qph-2r34-dyeb | kernel: btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount |
CVE-2024-57896
|
| VCID-9qpq-1fyf-ayhg | kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory |
CVE-2025-39883
|
| VCID-9qq3-mxee-ybh8 | kernel: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func |
CVE-2024-49911
|
| VCID-9r8d-nbn2-m3br | kernel: KVM: arm64: Don't retire aborted MMIO instruction |
CVE-2024-53196
|
| VCID-9rd2-p783-rbae | kernel: Linux kernel's ath9k_htc Wi-Fi driver: Denial of Service or information disclosure via malicious USB device input |
CVE-2025-38157
|
| VCID-9ruf-ttxw-2fa5 | kernel: ipmr: do not call mr_mfc_uses_dev() for unres entries |
CVE-2025-21719
|
| VCID-9s2u-2765-2ua4 | kernel: net: lapb: increase LAPB_HEADER_LEN |
CVE-2024-56659
|
| VCID-9sm6-shj5-cqh5 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure ieee80211_tx_prepare_skb() has three error paths, but only two of them free the skb. The first error path (ieee80211_tx_prepare() returning TX_DROP) does not free it, while invoke_tx_handlers() failure and the fragmentation check both do. Add kfree_skb() to the first error path so all three are consistent, and remove the now-redundant frees in callers (ath9k, mt76, mac80211_hwsim) to avoid double-free. Document the skb ownership guarantee in the function's kdoc. |
CVE-2026-23444
|
| VCID-9sqm-1ubb-zqhr | kernel: Linux kernel: Denial of Service in RDMA subsystem via repeated SRQ modification |
CVE-2025-68379
|
| VCID-9t4w-7npg-8kbt | kernel: sock_map: Add a cond_resched() in sock_hash_free() |
CVE-2024-47710
|
| VCID-9t5k-1w4u-8kep | kernel: RDMA/rxe: Remove the direct link to net_device |
CVE-2024-57795
|
| VCID-9tb7-5mp1-pkhc | kernel: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC |
CVE-2025-21894
|
| VCID-9trv-6m6q-5yae | kernel: net: dlink: handle copy_thresh allocation failure |
CVE-2025-40053
|
| VCID-9twf-hmmb-dqev | kernel: rose: fix dangling neighbour pointers in rose_rt_device_down() |
CVE-2025-38377
|
| VCID-9u71-fq7r-cbec | kernel: btrfs: fix race when deleting free space root from the dirty cow roots list |
CVE-2023-54067
|
| VCID-9uu4-3wds-1ffe | kernel: Linux kernel: Denial of Service in ext4 due to a race condition |
CVE-2025-68261
|
| VCID-9v2n-85hk-d3dh | kernel: media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe |
CVE-2025-39995
|
| VCID-9v9q-m348-3bcm | kernel: iommu: Fix error unwind in iommu_group_alloc() |
CVE-2023-53482
|
| VCID-9vkp-2v7f-ukg8 | kernel: uacce: fix cdev handling in the cleanup path |
CVE-2026-23096
|
| VCID-9w3f-zzee-qug6 | kernel: wifi: ath11k: decrease MHI channel buffer length to 8KB |
CVE-2024-35938
|
| VCID-9w88-du3c-qyc4 | kernel: scsi: lpfc: Use memcpy() for BIOS version |
CVE-2025-38332
|
| VCID-9w92-jwnf-tqab | kernel: drm/amd/display: Fix division by zero in setup_dsc_config |
CVE-2024-36969
|
| VCID-9wdj-482w-9kfq | kernel: ext4: dax: fix overflowing extents beyond inode size when partially writing |
CVE-2024-50015
|
| VCID-9wea-b236-ubav | kernel: wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures |
CVE-2024-53190
|
| VCID-9wfr-uf4a-27dq | kernel: arm64: errata: Add Cortex-A520 speculative unprivileged load workaround |
CVE-2023-52481
|
| VCID-9wmm-kn83-5kcy | kernel: blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() |
CVE-2023-53421
|
| VCID-9wrj-4ar3-6qh7 | kernel: iio: adc: rockchip_saradc: fix information leak in triggered buffer |
CVE-2024-57907
|
| VCID-9x6z-na1u-93bs | kernel: ice: arfs: fix use-after-free when freeing @rx_cpu_rmap |
CVE-2022-49063
|
| VCID-9x7c-98v1-hkdj | kernel: serial: 8250: fix panic due to PSLVERR |
CVE-2025-39724
|
| VCID-9xez-c573-nub8 | kernel: thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR |
CVE-2022-48703
|
| VCID-9ybb-bzq2-cueb | kernel: ceph: fix potential use-after-free bug when trimming caps |
CVE-2023-53867
|
| VCID-9yx2-sd94-v3bw | kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling |
CVE-2024-57849
|
| VCID-9z28-4dsw-kkff | kernel: Linux kernel: Denial of Service in btrfs due to out-of-memory condition |
CVE-2022-50293
|
| VCID-9zgh-r671-7ufw | kernel: start_kernel: Add __no_stack_protector function attribute |
CVE-2023-53491
|
| VCID-9zvx-ucpq-v3fv | kernel: soundwire: revisit driver bind/unbind and callbacks |
CVE-2022-50144
|
| VCID-9zxp-tyb1-ubg8 | kernel: md/dm-raid: don't call md_reap_sync_thread() directly |
CVE-2024-35808
|
| VCID-a12r-8uyz-tyem | kernel: Squashfs: fix uninit-value in squashfs_get_parent |
CVE-2025-40049
|
| VCID-a16t-4d1w-4fcv | kernel: drm/amd/display: Check NULL before accessing |
CVE-2025-68286
|
| VCID-a1ez-xh2w-7ba6 | In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after initialization ext4_inode_attach_jinode() publishes ei->jinode to concurrent users. It used to set ei->jinode before jbd2_journal_init_jbd_inode(), allowing a reader to observe a non-NULL jinode with i_vfs_inode still unset. The fast commit flush path can then pass this jinode to jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and may crash. Below is the crash I observe: ``` BUG: unable to handle page fault for address: 000000010beb47f4 PGD 110e51067 P4D 110e51067 PUD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 RIP: 0010:xas_find_marked+0x3d/0x2e0 Code: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02 RSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246 RAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003 RDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10 RBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec R10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000 R13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88 FS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> filemap_get_folios_tag+0x87/0x2a0 __filemap_fdatawait_range+0x5f/0xd0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __schedule+0x3e7/0x10c0 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? preempt_count_sub+0x5f/0x80 ? srso_alias_return_thunk+0x5/0xfbef5 ? cap_safe_nice+0x37/0x70 ? srso_alias_return_thunk+0x5/0xfbef5 ? preempt_count_sub+0x5f/0x80 ? srso_alias_return_thunk+0x5/0xfbef5 filemap_fdatawait_range_keep_errors+0x12/0x40 ext4_fc_commit+0x697/0x8b0 ? ext4_file_write_iter+0x64b/0x950 ? srso_alias_return_thunk+0x5/0xfbef5 ? preempt_count_sub+0x5f/0x80 ? srso_alias_return_thunk+0x5/0xfbef5 ? vfs_write+0x356/0x480 ? srso_alias_return_thunk+0x5/0xfbef5 ? preempt_count_sub+0x5f/0x80 ext4_sync_file+0xf7/0x370 do_fsync+0x3b/0x80 ? syscall_trace_enter+0x108/0x1d0 __x64_sys_fdatasync+0x16/0x20 do_syscall_64+0x62/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... ``` Fix this by initializing the jbd2_inode first. Use smp_wmb() and WRITE_ONCE() to publish ei->jinode after initialization. Readers use READ_ONCE() to fetch the pointer. |
CVE-2026-31450
|
| VCID-a1mj-at6s-8bh1 | kernel: smb: client: fix potential UAF in smb2_is_valid_oplock_break() |
CVE-2024-35865
|
| VCID-a1rd-xu94-9bad | kernel: amd/amdkfd: sync all devices to wait all processes being evicted |
CVE-2024-36949
|
| VCID-a1tm-fg3e-hkct | kernel: drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream |
CVE-2024-49913
|
| VCID-a1vr-1cg7-gqbg | kernel: tipc: fix kernel warning when sending SYN message |
CVE-2023-52700
|
| VCID-a1xg-dyn3-skb6 | kernel: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ |
CVE-2026-23395
|
| VCID-a29y-u4f3-nkfk | kernel: staging: most: remove broken i2c driver |
CVE-2025-68755
|
| VCID-a2jn-1xhp-9fg3 | kernel: drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() |
CVE-2025-68190
|
| VCID-a2n6-j9tf-1ke5 | kernel: ext4: fix infinite loop when replaying fast_commit |
CVE-2024-43828
|
| VCID-a36g-8fby-2kht | kernel: nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() |
CVE-2024-47699
|
| VCID-a3d8-8qvy-ykdr | kernel: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting |
CVE-2026-23371
|
| VCID-a3f2-zg7s-9ucw | kernel: tls: race between tx work scheduling and socket close |
CVE-2024-26585
|
| VCID-a3h8-cqsf-1bhk | kernel: Linux kernel mISDN: Denial of Service via data race |
CVE-2026-23121
|
| VCID-a3pz-z3y5-2fcb | kernel: HID: ignore non-functional sensor in HP 5MP Camera |
CVE-2025-21992
|
| VCID-a3yj-v3tu-d7ga | kernel: RDMA/mlx5: Move events notifier registration to be after device registration |
CVE-2024-53224
|
| VCID-a4cg-mjqd-qqcs | kernel: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() |
CVE-2025-21689
|
| VCID-a51v-ajen-u7et | kernel: wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change |
CVE-2024-46860
|
| VCID-a54e-qdsj-w3bq | kernel: fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var |
CVE-2025-38215
|
| VCID-a5sp-kz5x-xqeq | kernel: drm/amdgpu/vkms: fix a possible null pointer dereference |
CVE-2023-52815
|
| VCID-a5tz-dm6g-zqch | kernel: smb: client: Don't log plaintext credentials in cifs_set_cifscreds |
CVE-2026-23303
|
| VCID-a5uv-rab1-kkc7 | kernel: drm/amd/display: Skip wbscl_set_scaler_filter if filter is null |
CVE-2024-46714
|
| VCID-a5vr-pztj-qyfr | kernel: blk-cgroup: Fix class @block_class's subsystem refcount leakage |
CVE-2025-21745
|
| VCID-a6ke-6716-fker | kernel: netfilter: nft_ct: add seqadj extension for natted connections |
CVE-2025-68206
|
| VCID-a7fz-5z23-17ey | kernel: cyttsp4_core: use-after-free in cyttsp4_watchdog_work() |
CVE-2023-4134
|
| VCID-a7uu-hf55-2kfw | kernel: mtd: core: fix possible resource leak in init_mtd() |
CVE-2022-50304
|
| VCID-a89e-bca3-1qfg | kernel: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() |
CVE-2024-50282
|
| VCID-a8cp-9ykt-xbdx | kernel: bpf: support non-r10 register spill/fill to/from stack in precision tracking |
CVE-2023-52920
|
| VCID-a8d5-w4a7-7fe4 | kernel: jfs: fix uninitialized waitqueue in transaction manager |
CVE-2025-68168
|
| VCID-a8hd-q87b-sqej | kernel: caif_virtio: fix wrong pointer check in cfv_probe() |
CVE-2025-21904
|
| VCID-a8u6-m3s1-5fdx | kernel: mm/smaps: fix race between smaps_hugetlb_range and migration |
CVE-2025-39754
|
| VCID-a918-dphu-abaq | kernel: ocfs2: fix uninitialized value in ocfs2_file_read_iter() |
CVE-2024-53155
|
| VCID-a97s-ex9t-rkc3 | kernel: drm/dp_mst: Fix resetting msg rx state after topology removal |
CVE-2024-57876
|
| VCID-a9b9-28jw-23cj | kernel: tls: separate no-async decryption request handling from async |
CVE-2024-58240
|
| VCID-aa2q-cu55-w7g7 | kernel: phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode |
CVE-2025-38535
|
| VCID-ab16-n34c-eqb7 | kernel: mm: revert "mm: shmem: fix data-race in shmem_getattr()" |
CVE-2024-53136
|
| VCID-ab1j-9nu9-rueu | kernel: atm: clip: prevent NULL deref in clip_push() |
CVE-2025-38251
|
| VCID-abcd-nfuq-2kc6 | kernel: Linux kernel: Denial of Service via use-after-free in IMM SCSI host adapter |
CVE-2025-68324
|
| VCID-abga-1vvy-2bfw | kernel: do_change_type(): refuse to operate on unmounted/not ours mounts |
CVE-2025-38498
|
| VCID-abnb-231x-mugh | kernel: jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree |
CVE-2024-56595
|
| VCID-ad26-xf1q-e3g3 | kernel: bpf: Sync pending IRQ work before freeing ring buffer |
CVE-2025-40319
|
| VCID-ad3b-d8e6-t7ek | kernel: net: ethernet: bgmac: Fix refcount leak in bcma_mdio_mii_register |
CVE-2022-49342
|
| VCID-adr9-vryj-fqah | kernel: ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object |
CVE-2024-46798
|
| VCID-adwd-98zy-qqf7 | kernel: gpio: prevent potential speculation leaks in gpio_device_get_desc() |
CVE-2024-44931
|
| VCID-ae8w-75md-m7eh | kernel: net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX |
CVE-2023-54251
|
| VCID-aeed-k74z-67g3 | kernel: net: avoid race between device unregistration and ethnl ops |
CVE-2025-21701
|
| VCID-aepw-c8cg-y7bj | kernel: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() |
CVE-2024-47685
|
| VCID-afkx-cy3n-zkef | kernel: media: venus: Add a check for packet size after reading from shared memory |
CVE-2025-39710
|
| VCID-ag6b-2w7j-f7fr | kernel: tracing: Add down_write(trace_event_sem) when adding trace event |
CVE-2025-38539
|
| VCID-agn3-cwzk-kkfz | kernel: cifs: fix session state check in reconnect to avoid use-after-free issue |
CVE-2023-53794
|
| VCID-ah3a-9gpr-5ubt | kernel: icmp: change the order of rate limits |
CVE-2024-47678
|
| VCID-ah5f-a8ty-rfak | kernel: RDMA/mad: Improve handling of timed out WRs of mad agent |
CVE-2024-50095
|
| VCID-ahrp-h72y-cbbf | kernel: net: restrict SO_REUSEPORT to inet sockets |
CVE-2024-57903
|
| VCID-aj3p-9trr-87cz | kernel: net/ncsi: Disable the ncsi work before freeing the associated structure |
CVE-2024-49945
|
| VCID-ajrh-yrhu-6kbr | kernel: net: ch9200: fix uninitialised access during mii_nway_restart |
CVE-2025-38086
|
| VCID-ajrx-e8zb-t7e4 | kernel: x86/mm: Fix pti_clone_pgtable() alignment assumption |
CVE-2024-44965
|
| VCID-ak56-9snm-47h9 | kernel: netfilter: nf_tables: prefer nft_chain_validate |
CVE-2024-41042
|
| VCID-ak7d-8cgy-ckh2 | kernel: jfs: fix out-of-bounds in dbNextAG() and diAlloc() |
CVE-2024-47723
|
| VCID-akrr-rwd8-1qdg | kernel: Linux kernel: Denial of Service via NULL pointer dereference in raspberrypi_clk_register() |
CVE-2025-38160
|
| VCID-akyg-wxm3-23dm | kernel: Input: exc3000 - properly stop timer on shutdown |
CVE-2023-53651
|
| VCID-amka-68hb-hkes | kernel: mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() |
CVE-2025-39737
|
| VCID-an4t-6q1u-jbbq | kernel: romfs: check sb_set_blocksize() return value |
CVE-2026-23238
|
| VCID-an5c-5rea-u3aq | kernel: dlm: prevent NPD when writing a positive value to event_done |
CVE-2025-23131
|
| VCID-an95-d2f9-wkbc | kernel: md: fix soft lockup in status_resync |
CVE-2023-53620
|
| VCID-anes-8bc5-k7e8 | kernel: drm/amdgpu: fix ttm_bo calltrace warning in psp_hw_fini |
CVE-2023-53074
|
| VCID-ann8-xtng-bucz | kernel: net: sched: fix use-after-free in taprio_change() |
CVE-2024-50127
|
| VCID-ans1-wmuz-e3bw | kernel: memory leak in ubi driver |
CVE-2024-25740
|
| VCID-antz-3h6j-n7f6 | kernel: fbcon: fix integer overflow in fbcon_do_set_font |
CVE-2025-39967
|
| VCID-apaa-8wdp-cyfq | kernel: improper input validation may lead to privilege escalation |
CVE-2021-4204
|
| VCID-apfq-mqch-jkgr | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() sip_help_tcp() parses the SIP Content-Length header with simple_strtoul(), which returns unsigned long, but stores the result in unsigned int clen. On 64-bit systems, values exceeding UINT_MAX are silently truncated before computing the SIP message boundary. For example, Content-Length 4294967328 (2^32 + 32) is truncated to 32, causing the parser to miscalculate where the current message ends. The loop then treats trailing data in the TCP segment as a second SIP message and processes it through the SDP parser. Fix this by changing clen to unsigned long to match the return type of simple_strtoul(), and reject Content-Length values that exceed the remaining TCP payload length. |
CVE-2026-23457
|
| VCID-apj2-9k7k-tbgq | kernel: drm/amd/display: fix FCLK pstate change underflow |
CVE-2023-53780
|
| VCID-apkv-yj4f-yubb | kernel: drm/amdgpu: fix usage slab after free |
CVE-2024-56551
|
| VCID-aq43-mrqu-nqdb | kernel: NFSD: Limit the number of concurrent async COPY operations |
CVE-2024-49974
|
| VCID-aqmq-mvvg-uqde | kernel: i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition |
CVE-2024-50061
|
| VCID-aqzf-3kmq-zbe6 | kernel: media: i2c: tc358743: Fix crash in the probe error path when using polling |
CVE-2024-56576
|
| VCID-ar92-34ym-1qfm | kernel: net/smc: Fix possible access to freed memory in link clear |
CVE-2022-48673
|
| VCID-arnq-m294-hygb | kernel: leds: mlxreg: Use devm_mutex_init() for mutex initialization |
CVE-2024-42129
|
| VCID-artu-ugr9-9yax | kernel: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot |
CVE-2022-50016
|
| VCID-arw7-jrva-hbab | kernel: media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish() |
CVE-2023-53458
|
| VCID-as4s-97zw-x3bz | kernel: i40e: fix idx validation in config queues msg |
CVE-2025-39971
|
| VCID-asf4-6ay2-pkeh | kernel: phy: stm32-usphyc: Fix off by one in probe() |
CVE-2025-71196
|
| VCID-askw-fcsn-h7c5 | kernel: staging: iio: frequency: ad9834: Validate frequency parameter value |
CVE-2024-47663
|
| VCID-aspx-2ymv-vqhb | kernel: PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) |
CVE-2024-47667
|
| VCID-asy4-m48b-xydu | kernel: netfilter: nf_tables: release flowtable after rcu grace period on error |
CVE-2026-23392
|
| VCID-at2g-hnaw-w7ca | kernel: benet: fix BUG when creating VFs |
CVE-2025-38569
|
| VCID-at2g-xzwv-ubga | kernel: comedi: pcl812: Fix bit shift out of bounds |
CVE-2025-38530
|
| VCID-at5u-gf8n-yubr | kernel: wifi: rsi: Fix memory corruption due to not set vif driver data size |
CVE-2026-23073
|
| VCID-athk-9hu2-xbg8 | kernel: bpf: fix ktls panic with sockmap |
CVE-2025-38166
|
| VCID-ats5-jurz-y3cd | kernel: KVM: x86: Reset IRTE to host control if *new* route isn't postable |
CVE-2025-37885
|
| VCID-atux-q6hk-hfau | kernel: loop: Avoid updating block size under exclusive owner |
CVE-2025-38709
|
| VCID-aucw-cvc4-27fp | kernel: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree |
CVE-2025-38468
|
| VCID-aur9-31dd-wbcr | kernel: NFC: nci: uart: Set tty->disc_data only in success path |
CVE-2025-38416
|
| VCID-auub-amxt-43bv | kernel: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array |
CVE-2025-21785
|
| VCID-avdc-4xxg-vyej | kernel: drm/amdgpu: Reset IH OVERFLOW_CLEAR bit |
CVE-2024-26915
|
| VCID-avgg-1gdd-nuc2 | kernel: sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto |
CVE-2025-40281
|
| VCID-avpg-jad9-7uhy | kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX |
CVE-2025-21648
|
| VCID-awym-vhgr-sqfv | kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c |
CVE-2023-4569
|
| VCID-axkf-9eed-buf2 | kernel: Linux kernel: Information disclosure via uninitialized data in tcf_connmark_dump() |
CVE-2025-40279
|
| VCID-axp8-1myh-vqhv | kernel: platform/x86: intel: punit_ipc: fix memory corruption |
CVE-2025-68303
|
| VCID-axpb-mkxb-tfdv | kernel: mtd: rawnand: cadence: fix DMA device NULL pointer dereference |
CVE-2025-68238
|
| VCID-ayd4-2n7n-kkcc | kernel: ceph: give up on paths longer than PATH_MAX |
CVE-2024-53685
|
| VCID-ayru-t6ft-d7er | Linux/xen-netfront: Memory leak due to missing cleanup function |
CVE-2024-27393
|
| VCID-az8z-5q7k-2ye9 | kernel: RDMA/rxe: Return CQE error if invalid lkey was supplied |
CVE-2021-47076
|
| VCID-azt5-2nuy-qbcz | kernel: tracing: Do not let histogram values have some modifiers |
CVE-2023-53093
|
| VCID-b1an-t4b8-4bd1 | kernel: net: usb: pegasus: validate USB endpoints |
CVE-2026-23290
|
| VCID-b1um-w9u2-mkgb | kernel: net: cadence: macb: Fix a possible deadlock in macb_halt_tx. |
CVE-2025-38094
|
| VCID-b1ya-rv9e-37d4 | kernel: wifi: ath11k: Ignore frags from uninitialized peer in dp |
CVE-2023-53822
|
| VCID-b2at-va88-pud8 | kernel: memcg: protect concurrent access to mem_cgroup_idr |
CVE-2024-43892
|
| VCID-b2jn-5mkh-eyfy | kernel: media: ts2020: fix null-ptr-deref in ts2020_probe() |
CVE-2024-56574
|
| VCID-b2kt-hmz5-yuhb | kernel: mm: fix uprobe pte be overwritten when expanding vma |
CVE-2025-38207
|
| VCID-b2zq-g3yx-z7bm | kernel: wifi: iwlwifi: mvm: ensure offloading TID queue exists |
CVE-2024-27056
|
| VCID-b48k-8uke-7kgq | kernel: wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() |
CVE-2025-38348
|
| VCID-b4ct-fnbp-43a3 | kernel: cxgb4: use-after-free in ch_flower_stats_cb() |
CVE-2023-4133
|
| VCID-b4ge-ehkr-nqa9 | kernel: usb: storage: sddr55: Reject out-of-bound new_pba |
CVE-2025-40345
|
| VCID-b4jp-8epx-sycm | kernel: gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). |
CVE-2025-21865
|
| VCID-b4vj-yp4z-2kf7 | kernel: nbd: defer config unlock in nbd_genl_connect |
CVE-2025-68366
|
| VCID-b51x-3ss2-67ex | kernel: RDMA/siw: Fix potential NULL pointer dereference in header processing |
CVE-2026-23242
|
| VCID-b5nq-jbbw-8kfe | kernel: drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) |
CVE-2024-39497
|
| VCID-b5p8-njwq-sqhk | kernel: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx |
CVE-2025-40022
|
| VCID-b69x-rjc7-dugp | kernel: mm: /proc/pid/smaps_rollup: fix no vma's null-deref |
CVE-2022-50380
|
| VCID-b6hm-ab7p-h3eu | kernel: drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing |
CVE-2024-43904
|
| VCID-b6m4-8pkk-8kg5 | kernel: e1000: fix OOB in e1000_tbi_should_accept() |
CVE-2025-71093
|
| VCID-b6yd-s1sc-m3br | kernel: riscv: prevent pt_regs corruption for secondary idle threads |
CVE-2024-38667
|
| VCID-b7z7-vyad-b3a8 | kernel: irqchip/gic-v3-its: Avoid truncating memory addresses |
CVE-2026-23085
|
| VCID-b9tb-cyzp-c3am | kernel: jbd2: prevent softlockup in jbd2_log_do_checkpoint() |
CVE-2025-39782
|
| VCID-b9uq-ggy1-eyan | kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset |
CVE-2025-68745
|
| VCID-ba6k-mvxj-8udm | hw: amd: Instruction raise #VC exception at exit |
CVE-2024-25742
|
| VCID-bad9-4wfn-4ueu | kernel: ndisc: extend RCU protection in ndisc_send_skb() |
CVE-2025-21760
|
| VCID-baxv-8xcq-zqeq | kernel: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() |
CVE-2025-38694
|
| VCID-bb8d-akkd-q3gv | kernel: media: vidtv: Terminating the subsequent process of initialization failure |
CVE-2025-38227
|
| VCID-bbdg-m16m-nubu | kernel: dm array: fix releasing a faulty array block twice in dm_array_cursor_end |
CVE-2024-57929
|
| VCID-bbm4-ygwp-w3a1 | kernel: gpio: rcar: Use raw_spinlock to protect register access |
CVE-2025-21912
|
| VCID-bbne-7sxr-t3en | kernel: usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget |
CVE-2025-40314
|
| VCID-bbnt-p8e4-63c7 | kernel: drm/v3d: Ensure job pointer is set to NULL after job completion |
CVE-2025-21697
|
| VCID-bc95-1a99-yyfg | kernel: tracing: Consider the NULL character when validating the event length |
CVE-2024-50131
|
| VCID-bcd5-eesw-cuff | kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference |
CVE-2024-49929
|
| VCID-bck8-wa86-skgs | kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() |
CVE-2025-39902
|
| VCID-bdc1-fw6c-sbgj | kernel: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr |
CVE-2025-38701
|
| VCID-bds8-9r5f-77f1 | kernel: netfilter: ipset: add missing range check in bitmap_ip_uadt |
CVE-2024-53141
|
| VCID-behb-uty6-5fge | kernel: btrfs: fix use-after-free when COWing tree bock and tracing is enabled |
CVE-2024-56759
|
| VCID-bens-aw9k-xka2 | kernel: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy |
CVE-2025-21635
|
| VCID-beqz-y8h2-sbgs | kernel: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast |
CVE-2025-40140
|
| VCID-besd-5py2-47g2 | kernel: padata: use integer wrap around to prevent deadlock on seq_nr overflow |
CVE-2024-47739
|
| VCID-bf2p-tnj7-mydg | kernel: net: phy: leds: fix memory leak |
CVE-2025-37989
|
| VCID-bf5y-rqaa-afc9 | kernel: f2fs: fix to truncate meta inode pages forcely |
CVE-2024-26869
|
| VCID-bfjx-x5b3-53bg | kernel: of: unittest: Fix memory leak in unittest_data_add() |
CVE-2026-23137
|
| VCID-bfte-3vt5-pfab | kernel: Linux kernel: usb: cdc-acm: Memory corruption due to improper buffer size check |
CVE-2025-21704
|
| VCID-bgrh-gwqc-5khd | kernel: net/sched: sch_qfq: do not free existing class in qfq_change_class() |
CVE-2026-22999
|
| VCID-bguv-whnr-nfbn | kernel: scsi: target: Reset t_task_cdb pointer in error case |
CVE-2025-68782
|
| VCID-bha1-btf5-dfhf | kernel: usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error |
CVE-2024-26996
|
| VCID-bhmn-6amr-k3cm | kernel: drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func |
CVE-2024-47720
|
| VCID-bjwg-thks-73ab | kernel: wifi: ath11k: fix array out-of-bound access in SoC stats |
CVE-2024-49930
|
| VCID-bjza-jgxq-rqh4 | kernel: ocfs2: clear extent cache after moving/defragmenting extents |
CVE-2025-40233
|
| VCID-bkg7-9dm7-qycs | kernel: fbdev: fix potential buffer overflow in do_register_framebuffer() |
CVE-2025-38702
|
| VCID-bmk2-e92y-m3gd | kernel: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() |
CVE-2025-38706
|
| VCID-bmn2-92hv-duh6 | kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change |
CVE-2025-71066
|
| VCID-bmpn-zgd9-r3d6 | kernel: ELF: fix kernel.randomize_va_space double read |
CVE-2024-46826
|
| VCID-bn8r-uwxn-buan | kernel: octeontx2-af: Add validation for lmac type |
CVE-2023-54129
|
| VCID-bnb1-c293-gybq | kernel: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur |
CVE-2024-56779
|
| VCID-bnwu-jnuq-yyfn | kernel: Linux kernel: Denial of Service due to memory leak in netdevsim |
CVE-2022-50772
|
| VCID-bp5v-gncn-mqfa | kernel: nfsd: clear acl_access/acl_default after releasing them |
CVE-2025-21796
|
| VCID-bpcw-bjg1-q7a9 | kernel: ocfs2: fix recursive semaphore deadlock in fiemap call |
CVE-2025-39885
|
| VCID-bpdk-eh92-qffx | kernel: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 |
CVE-2024-46817
|
| VCID-bpmy-u7wr-kude | kernel: can: mcp251x: fix deadlock in error path of mcp251x_open |
CVE-2026-23357
|
| VCID-bpq4-z58k-f3cg | kernel: drm/amd/display: Check gpio_id before used as array index |
CVE-2024-46818
|
| VCID-bpsp-ef22-c7c3 | kernel: ipv6: Fix soft lockups in fib6_select_path under high next hop churn |
CVE-2024-56703
|
| VCID-bq5a-jeg3-9ua7 | kernel: nfc: pn533: properly drop the usb interface reference on disconnect |
CVE-2026-23291
|
| VCID-brga-v3np-afb1 | kernel: net/ipv6: release expired exception dst cached in socket |
CVE-2024-56644
|
| VCID-brwq-qcbd-c3ep | kernel: x86/mm: Randomize per-cpu entry area |
CVE-2023-0597
|
| VCID-bs5f-j2kr-93hq | kernel: jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error |
CVE-2024-49959
|
| VCID-bt9p-7uvr-5qgq | kernel: ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() |
CVE-2025-68364
|
| VCID-bu5s-venv-j3dw | kernel: bnxt: Do not read past the end of test names |
CVE-2023-53010
|
| VCID-bugz-qf2m-mqg5 | kernel: drm/vgem-fence: Fix potential deadlock on release |
CVE-2025-68757
|
| VCID-busk-3nt8-cfhm | kernel: drm/amd/display: Fix slab-use-after-free in hdcp |
CVE-2025-37903
|
| VCID-buv7-m3ks-fqfq | kernel: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() |
CVE-2024-53156
|
| VCID-bux2-amqe-vqc9 | kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime() |
CVE-2024-50195
|
| VCID-buyk-uqzj-e7am | kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released |
CVE-2025-40323
|
| VCID-bxaj-dwje-sbhe | kernel: drm/amd/display: Remove register from DCN35 DMCUB diagnostic collection |
CVE-2024-47662
|
| VCID-by9q-frk7-5qaj | kernel: Squashfs: sanity check symbolic link size |
CVE-2024-46744
|
| VCID-bza6-2aqf-ukbh | kernel: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() |
CVE-2025-40346
|
| VCID-bzf3-bpyy-2bh3 | kernel: drm/amdgpu: fix memory leak in mes self test |
CVE-2023-53370
|
| VCID-c1dm-4vd7-kfb1 | kernel: RDMA/hns: Fix soft lockup during bt pages loop |
CVE-2025-22010
|
| VCID-c1ew-u7aw-ebcz | kernel: net/iucv: fix use after free in iucv_sock_close() |
CVE-2024-42271
|
| VCID-c1u4-6ej2-tqa5 | kernel: sched: act_ct: take care of padding in struct zones_ht_key |
CVE-2024-42272
|
| VCID-c1xu-dybn-p7hb | kernel: net/mlx5e: CT, Fix multiple allocations and memleak of mod acts |
CVE-2021-47199
|
| VCID-c2me-ar1y-y7dw | kernel: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() |
CVE-2026-23004
|
| VCID-c2y9-myfb-s3f6 | kernel: x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client |
CVE-2024-53114
|
| VCID-c31r-c9qm-xuhe | kernel: drm/amdgpu/mes: fix use-after-free issue |
CVE-2024-38581
|
| VCID-c3dk-zkrf-x3fj | kernel: Linux kernel: Privilege escalation or Denial of Service via TCP Fast Open vulnerability |
CVE-2025-40186
|
| VCID-c3rn-zqxh-tqdt | kernel: powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe() |
CVE-2022-50635
|
| VCID-c3wk-9gm2-fkeq | kernel: drm/amd/display: Refactor DMCUB enter/exit idle interface |
CVE-2023-52625
|
| VCID-c3z1-ngn9-eycs | kernel: drm/amdgpu: use-after-free vulnerability |
CVE-2024-26656
|
| VCID-c42q-j659-e3gt | kernel: Linux kernel: PCI/ASPM use-after-free during hot-unplug |
CVE-2024-58093
|
| VCID-c45f-v3ye-57b5 | kernel: binder: fix UAF of alloc->vma in race with munmap() |
CVE-2023-54157
|
| VCID-c475-312h-kbb5 | kernel: dmaengine: omap-dma: fix dma_pool resource leak in error paths |
CVE-2026-23033
|
| VCID-c49r-knse-6bc5 | kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length |
CVE-2025-39933
|
| VCID-c4d2-twee-nuft | kernel: bnxt: avoid overflow in bnxt_get_nvram_directory() |
CVE-2023-53661
|
| VCID-c4f3-gpea-23dc | kernel: drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table |
CVE-2024-58052
|
| VCID-c4t9-wwnu-r7fv | kernel: virtio-blk: don't keep queue frozen during system suspend |
CVE-2024-57946
|
| VCID-c5a3-ahtj-abgm | kernel: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl |
CVE-2025-22044
|
| VCID-c5d3-vkmz-nqbv | kernel: ibmvnic: don't release napi in __ibmvnic_open() |
CVE-2022-48811
|
| VCID-c5ft-5ucn-qfd7 | kernel: crypto: null - Use spin lock instead of mutex |
CVE-2025-37808
|
| VCID-c5x3-74ek-uyfa | kernel: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume |
CVE-2024-49985
|
| VCID-c688-u4mw-pyc5 | kernel: cifs: fix small mempool leak in SMB2_negotiate() |
CVE-2022-49938
|
| VCID-c7j3-ey1x-d7gm | kernel: ALSA: usb-audio: fix null pointer dereference on pointer cs_desc |
CVE-2021-47211
|
| VCID-c7xf-x7d5-87gn |
CVE-2026-31418
|
|
| VCID-c83s-2hkq-v7dx | kernel: padata: do not leak refcount in reorder_work |
CVE-2025-38031
|
| VCID-c86j-dzs8-nuem | kernel: Bluetooth: MGMT: Protect mgmt_pending list with its own lock |
CVE-2025-38117
|
| VCID-c8h6-u5x4-y3ac | kernel: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE |
CVE-2025-39788
|
| VCID-c8nj-6r7j-cbdz | kernel: nfs: Fix KMSAN warning in decode_getfattr_attrs() |
CVE-2024-53066
|
| VCID-c8qb-kbef-8qg8 | kernel: Bluetooth: HCI: Remove HCI_AMP support |
CVE-2024-38620
|
| VCID-c8t3-zakp-jqe2 | kernel: drm/amd/display: increase max link count and fix link->enc NULL pointer access |
CVE-2025-40354
|
| VCID-c8xs-q7hr-uua8 | kernel: hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur |
CVE-2025-21656
|
| VCID-c8yu-g26s-gkhh | kernel: usb: renesas_usbhs: Reorder clock handling and power management in probe |
CVE-2025-38136
|
| VCID-c9h3-3nm5-jqcq | kernel: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings |
CVE-2024-42158
|
| VCID-c9xy-v5tb-puc8 | kernel: vfio/pci: fix potential memory leak in vfio_intx_enable() |
CVE-2024-38632
|
| VCID-ca8r-41sb-hbb1 | kernel: Linux kernel: Memory management flaw in ath10k Wi-Fi driver can lead to denial of service |
CVE-2026-23133
|
| VCID-cagg-3chu-vqbj | kernel: vlan: enforce underlying device type |
CVE-2025-21920
|
| VCID-cajd-2gva-7qgu | kernel: wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() |
CVE-2025-21744
|
| VCID-cap6-uxkj-93ey | kernel: drm/amd/display: Add NULL pointer check for kzalloc |
CVE-2024-42122
|
| VCID-carf-knme-xkb4 | kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB |
CVE-2024-46689
|
| VCID-cav5-5jpm-1fdt | kernel: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() |
CVE-2025-39684
|
| VCID-cayc-j15f-ekdv | kernel: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() |
CVE-2026-23279
|
| VCID-cb6r-zf3v-e7gn | kernel: net: hns3: fix oops when unload drivers paralleling |
CVE-2025-21802
|
| VCID-ccz1-rthk-7kf2 | kernel: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device |
CVE-2024-56691
|
| VCID-cd13-6z54-5kev | kernel: virtio/vsock: Fix accept_queue memory leak |
CVE-2024-53119
|
| VCID-cd2x-nzpw-1yee | kernel: blk_iocost: fix more out of bound shifts |
CVE-2024-49933
|
| VCID-cd8c-vv2j-r3hw | kernel: can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). |
CVE-2024-47709
|
| VCID-ce54-6eyp-ryd2 | kernel: pinctrl: single: fix potential NULL dereference in pcs_get_function() |
CVE-2024-46685
|
| VCID-cear-n94a-jqdq | kernel: KVM: arm64: Fix circular locking dependency |
CVE-2024-26691
|
| VCID-cecv-w1gr-qkbp | kernel: tracing: Fix crash on synthetic stacktrace field usage |
CVE-2026-23088
|
| VCID-cf8d-ma6m-c3g3 | kernel: btrfs: replace BUG_ON() with error handling at update_ref_for_cow() |
CVE-2024-46752
|
| VCID-cfh1-gaft-sqbs | kernel: gpio: aggregator: protect driver attr handlers against module unload |
CVE-2025-21943
|
| VCID-cfms-gd2h-v7gd | kernel: f2fs: fix to do sanity check on node footer for non inode dnode |
CVE-2025-40025
|
| VCID-cfpc-ekdt-sydy | kernel: f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode. |
CVE-2024-56586
|
| VCID-cfr1-1u57-d7b5 | kernel: ext4: update orig_path in ext4_find_extent() |
CVE-2024-49881
|
| VCID-cft7-4ymq-gfaw | kernel: drm/dp_mst: Fix MST sideband message body length check |
CVE-2024-56616
|
| VCID-cgb9-h21c-2khk | kernel: f2fs: fix to avoid panic in f2fs_evict_inode |
CVE-2025-38577
|
| VCID-cgj5-5hrz-e3b9 | kernel: Kernel: Denial of Service in virtio-crypto due to missing spinlock protection |
CVE-2026-23229
|
| VCID-cgqq-rjgb-2ybc | kernel: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow |
CVE-2024-50218
|
| VCID-chea-98c8-y7cx | kernel: can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak |
CVE-2026-23080
|
| VCID-chgp-ama8-5ycb | In the Linux kernel, the following vulnerability has been resolved: esp: fix skb leak with espintcp and async crypto When the TX queue for espintcp is full, esp_output_tail_tcp will return an error and not free the skb, because with synchronous crypto, the common xfrm output code will drop the packet for us. With async crypto (esp_output_done), we need to drop the skb when esp_output_tail_tcp returns an error. |
CVE-2026-31518
|
| VCID-chhk-jc2v-zyae | kernel: hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() |
CVE-2025-40244
|
| VCID-chvf-ktmf-pfht | kernel: slimbus: messaging: Free transaction ID in delayed interrupt scenario |
CVE-2025-21914
|
| VCID-cjka-26gb-bbb5 | kernel: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure |
CVE-2025-38695
|
| VCID-ck6a-dd1t-nba8 | kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit |
CVE-2025-39766
|
| VCID-ckhd-y6cb-e7dp | kernel: wifi: rtlwifi: fix memory leaks and invalid access at probe error path |
CVE-2024-58063
|
| VCID-ckqp-r5m2-j3fx | kernel: data races around sk->sk_prot |
CVE-2022-3567
|
| VCID-cm4u-6g3p-3ufh | kernel: net: openvswitch: fix race on port output |
CVE-2023-53188
|
| VCID-cmgf-3zzy-h7en | kernel: drm/amd/amdgpu: Check tbo resource pointer |
CVE-2024-46807
|
| VCID-cn4e-1qrr-akhk | kernel: i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler |
CVE-2023-52766
|
| VCID-cnqd-qt5r-8qas | kernel: cifs: avoid NULL pointer dereference in dbg call |
CVE-2025-37844
|
| VCID-cnvt-py2b-ruh3 | kernel: f2fs: prevent kernel warning due to negative i_nlink from corrupted image |
CVE-2025-38219
|
| VCID-cp52-z8dw-gfhf | kernel: rxrpc: Fix handling of received connection abort |
CVE-2024-58053
|
| VCID-cp6q-3tf3-uygg | kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl |
CVE-2024-56662
|
| VCID-cq8e-8f16-9kd4 | kernel: btrfs: do not WARN_ON() if we have PageError set |
CVE-2022-48902
|
| VCID-cq9b-x9dd-wydj | kernel: scsi: core: ufs: Fix a hang in the error handler |
CVE-2025-38119
|
| VCID-cqvu-5wzs-8ufk | kernel: drm/amdgpu: fix dereference after null check |
CVE-2024-46720
|
| VCID-cqye-p3y7-bfdp | kernel: mm/thp: fix deferred split unqueue naming and locking |
CVE-2024-53079
|
| VCID-cr57-qne6-eygu | kernel: net: inet6: do not leave a dangling sk pointer in inet6_create() |
CVE-2024-56600
|
| VCID-cr9w-8jsy-mfgh | kernel: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt |
CVE-2025-71131
|
| VCID-cs7h-d7vk-73ab | kernel: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend |
CVE-2025-71193
|
| VCID-csrk-w16v-93c8 | kernel: bpf: Prevent bpf program recursion for raw tracepoint probes |
CVE-2022-49764
|
| VCID-ct3y-3cw9-57dd | kernel: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() |
CVE-2025-40082
|
| VCID-ct5q-ah4j-xydf | kernel: HID: pidff: Fix null pointer dereference in pidff_find_fields |
CVE-2025-37862
|
| VCID-ctyg-mpnc-s7fd | kernel: virtiofs: add filesystem context source name check |
CVE-2025-37773
|
| VCID-cup4-9b5r-eqd2 | kernel: SUNRPC: make sure cache entry active before cache_show |
CVE-2024-53174
|
| VCID-cus3-rzk7-k3bu | kernel: wifi: ath11k: clear initialized flag for deinit-ed srng lists |
CVE-2025-38601
|
| VCID-cuup-1udp-7bdx | kernel: drm/amd/display: Check null-initialized variables |
CVE-2024-49898
|
| VCID-cv97-j139-vbfz | In the Linux kernel, the following vulnerability has been resolved: ext4: convert inline data to extents when truncate exceeds inline size Add a check in ext4_setattr() to convert files from inline data storage to extent-based storage when truncate() grows the file size beyond the inline capacity. This prevents the filesystem from entering an inconsistent state where the inline data flag is set but the file size exceeds what can be stored inline. Without this fix, the following sequence causes a kernel BUG_ON(): 1. Mount filesystem with inode that has inline flag set and small size 2. truncate(file, 50MB) - grows size but inline flag remains set 3. sendfile() attempts to write data 4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity) The crash occurs because ext4_write_inline_data() expects inline storage to accommodate the write, but the actual inline capacity (~60 bytes for i_block + ~96 bytes for xattrs) is far smaller than the file size and write request. The fix checks if the new size from setattr exceeds the inode's actual inline capacity (EXT4_I(inode)->i_inline_size) and converts the file to extent-based storage before proceeding with the size change. This addresses the root cause by ensuring the inline data flag and file size remain consistent during truncate operations. |
CVE-2026-31452
|
| VCID-cvps-1xf8-kqb5 | kernel: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits |
CVE-2025-71109
|
| VCID-cvw6-a674-zfa9 | kernel: drm/amd/display: Check null pointer before try to access it |
CVE-2024-49906
|
| VCID-cwk5-n1mq-kkd2 | In the Linux kernel, the following vulnerability has been resolved: driver core: platform: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] |
CVE-2026-31527
|
| VCID-cwnm-um2n-17cw | kernel: net: fix NULL pointer dereference in l3mdev_l3_rcv |
CVE-2025-22103
|
| VCID-cwvx-z13c-xkej | kernel: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() |
CVE-2024-43823
|
| VCID-cx7t-25fw-1bdu | kernel: usb: gadget: f_rndis: Refactor bind path to use __free() |
CVE-2025-40095
|
| VCID-cxck-7msm-zqd8 | kernel: media: vidtv: initialize local pointers upon transfer of memory ownership |
CVE-2025-68808
|
| VCID-cxtx-363a-ufhd | kernel: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() |
CVE-2024-36013
|
| VCID-cy84-7225-3yec | kernel: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated |
CVE-2025-38700
|
| VCID-cydx-ykad-7ke5 | kernel: drm/amdkfd: NULL pointer dereference in kfd_parse_subtype_iolink() |
CVE-2022-3108
|
| VCID-cyr4-fdka-abcd | kernel: drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error |
CVE-2024-47697
|
| VCID-cz3y-gxb5-yyew | kernel: hfs: validate record offset in hfsplus_bmap_alloc |
CVE-2025-40349
|
| VCID-cz93-fde8-pkcz | kernel: drm/rockchip: dw_hdmi: cleanup drm encoder during unbind |
CVE-2023-54047
|
| VCID-czkk-a14k-nfa1 | kernel: arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs |
CVE-2025-37948
|
| VCID-czy7-c6h9-aub4 | kernel: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() |
CVE-2022-50050
|
| VCID-d131-p16m-jqhd | kernel: drm/amdgpu: fix double free err_addr pointer warnings |
CVE-2024-42123
|
| VCID-d14h-dr7c-c3d9 | kernel: net: ravb: Fix missing rtnl lock in suspend/resume path |
CVE-2025-21801
|
| VCID-d178-8c3s-tkan | kernel: i40e: add validation for ring_len param |
CVE-2025-39973
|
| VCID-d1g5-afpz-d3em | kernel: SUNRPC: lock against ->sock changing during sysfs read |
CVE-2022-48816
|
| VCID-d1gu-5q4s-p7eq | kernel: net/smc: fix UAF on smcsk after smc_listen_out() |
CVE-2025-38734
|
| VCID-d1k1-2urz-h7bq | kernel: ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() |
CVE-2024-49962
|
| VCID-d1ke-rn87-f7ec | kernel: drm/amd/display: Fix handling of plane refcount |
CVE-2024-56775
|
| VCID-d1tp-anux-23c3 | kernel: serial: sc16is7xx: fix invalid FIFO access with special register set |
CVE-2024-44950
|
| VCID-d1uc-apk8-qked | kernel: concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources |
CVE-2022-1280
|
| VCID-d1x4-dmpq-qfct | kernel: ext4: fix slab-use-after-free in ext4_split_extent_at() |
CVE-2024-49884
|
| VCID-d2qm-raam-3yb9 | kernel: Linux kernel: Denial of Service in perf subsystem due to VMA split |
CVE-2025-38563
|
| VCID-d2xf-68nr-rqe2 | kernel: drm/amdgpu: Skip do PCI error slot reset during RAS recovery |
CVE-2024-35931
|
| VCID-d2zp-q8zz-u3b2 | kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts |
CVE-2025-21647
|
| VCID-d313-d7rr-1ufq | kernel: media: v4l2-tpg: prevent the risk of a division by zero |
CVE-2024-50287
|
| VCID-d3qa-cm7d-5ud8 | kernel: Linux kernel: Denial of Service in L2TP due to data-race during tunnel deletion |
CVE-2026-23120
|
| VCID-d3x6-8uek-qkgn | kernel: scsi: ufs: core: Fix handling of lrbp->cmd |
CVE-2023-53510
|
| VCID-d3y1-23vn-8bby | kernel: pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config() |
CVE-2025-37850
|
| VCID-d4e1-3wew-sbcc | kernel: drm/vc4: don't check if plane->state->fb == state->fb |
CVE-2024-35932
|
| VCID-d4fg-1ejk-pfhv | kernel: protect the fetch of ->fd[fd] in do_dup2() from mispredictions |
CVE-2024-42265
|
| VCID-d4fk-h32c-2bb5 | kernel: pwm: berlin: Fix wrong register in suspend/resume |
CVE-2025-40188
|
| VCID-d4u6-bzuu-dubz | kernel: dmaengine: lpc18xx-dmamux: fix device leak on route allocation |
CVE-2025-71188
|
| VCID-d52n-tszf-kbb6 | kernel: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() |
CVE-2025-40194
|
| VCID-d5cn-pnwu-u7be | kernel: Bluetooth: Fix hci_suspend_sync crash |
CVE-2023-53520
|
| VCID-d5e3-6wky-a7cp | kernel: ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() |
CVE-2024-47707
|
| VCID-d5ny-6ttq-1yhx | kernel: KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel |
CVE-2025-21779
|
| VCID-d693-z5hn-8uha | kernel: ext4: fix i_data_sem unlock order in ext4_ind_migrate() |
CVE-2024-50006
|
| VCID-d6qh-964p-cff9 | kernel: net, hsr: reject HSR frame if skb can't hold tag |
CVE-2025-39703
|
| VCID-d6zh-c1bm-fbem | kernel: habanalabs/gaudi: fix shift out of bounds |
CVE-2022-50026
|
| VCID-d76w-mrbc-53c3 | kernel: net: asix: add proper error handling of usb read errors |
CVE-2022-49226
|
| VCID-d798-sq84-a7bd | kernel: drm/scheduler: fix fence ref counting |
CVE-2022-49829
|
| VCID-d7du-rdej-nbh8 | kernel: bpf: Fix memleak due to fentry attach failure |
CVE-2023-53221
|
| VCID-d7mp-beeu-a3d8 | kernel: perf/x86/intel: Limit the period on Haswell |
CVE-2024-46848
|
| VCID-d7ns-tfg3-1qhm | kernel: nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame() |
CVE-2026-23150
|
| VCID-d83a-2h3p-9kbp | kernel: iommu: disable SVA when CONFIG_X86 is set |
CVE-2025-71089
|
| VCID-d83g-5tdr-7fd5 | kernel: gve: Account for stopped queues when reading NIC stats |
CVE-2024-42162
|
| VCID-d89j-ckxt-cyf2 | kernel: crypto: hisilicon/sec - Fix memory leak for sec resource release |
CVE-2024-41002
|
| VCID-d8ad-6vw9-b7f2 | kernel: drm/amd/display: fix a Null pointer dereference vulnerability |
CVE-2025-39705
|
| VCID-d8p5-xp3q-m7e9 | kernel: powerpc/64s: Don't use DSISR for SLB faults |
CVE-2022-49214
|
| VCID-d8tr-usd8-6yca | kernel: PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV |
CVE-2025-40219
|
| VCID-d9hm-npfq-e7c1 | kernel: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE |
CVE-2024-50192
|
| VCID-d9ty-7748-33a7 | kernel: net/smc: initialize close_work early to avoid warning |
CVE-2024-56641
|
| VCID-dav4-474s-33hg | kernel: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability |
CVE-2024-53051
|
| VCID-dbgh-p127-2kgs | kernel: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX |
CVE-2025-38201
|
| VCID-dbkn-c3ea-eqgy | kernel: scsi: bfa: Fix use-after-free in bfad_im_module_exit() |
CVE-2024-53227
|
| VCID-dbmb-ccjh-1fcj | kernel: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery |
CVE-2024-40977
|
| VCID-dbp3-snpt-bfh9 | kernel: wifi: ath11k: fix monitor mode bringup crash |
CVE-2022-50627
|
| VCID-dc47-7r56-tfhu | kernel: wifi: mt76: disable napi on driver removal |
CVE-2025-38009
|
| VCID-dcd5-4y9y-euf5 | kernel: drm/amd/display: Wake DMCUB before sending a command cause deadlock |
CVE-2023-52485
|
| VCID-dcda-4d74-vudh | kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling |
CVE-2025-40257
|
| VCID-dctm-k9ca-xfcf | kernel: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow |
CVE-2025-22086
|
| VCID-dcwa-n32k-73cm | kernel: Bluetooth: hci_event: call disconnect callback before deleting conn |
CVE-2023-53673
|
| VCID-dcwa-n5qs-qygc | kernel: udp_tunnel: use netdev_warn() instead of netdev_WARN() |
CVE-2025-68191
|
| VCID-dda8-c6rr-sqgq | kernel: hfs: fix general protection fault in hfs_find_init() |
CVE-2025-38716
|
| VCID-ddm7-5p27-3khg | kernel: io_uring/io-wq: Use set_bit() and test_bit() at worker->flags |
CVE-2024-39508
|
| VCID-ddw4-7kwf-6faq | kernel: RDMA/restrack: Fix potential invalid address access |
CVE-2024-42080
|
| VCID-deac-esj9-vbgd | kernel: tty: serial: imx: disable Ageing Timer interrupt request irq |
CVE-2023-54287
|
| VCID-dep6-8295-qbb6 | kernel: net: hv_netvsc: reject RSS hash key programming without RX indirection table |
CVE-2026-23054
|
| VCID-dfcs-t4fd-zqhe | kernel: net: tipc: fix refcount warning in tipc_aead_encrypt |
CVE-2025-38273
|
| VCID-dfhz-qgef-yyej | kernel: regulator: check that dummy regulator has been probed before using it |
CVE-2025-22008
|
| VCID-dfkb-bv5a-wfba | kernel: ipvlan: Make the addrs_lock be per port |
CVE-2026-23103
|
| VCID-dfzd-x7qm-rkh9 | kernel: btrfs: handle case when repair happens with dev-replace |
CVE-2023-54180
|
| VCID-dg1h-2nwv-cbgz | kernel: Linux kernel: Denial of Service in carl9170 Wi-Fi driver via ping to failed device |
CVE-2025-38420
|
| VCID-dgr2-7fpq-4bgv | In the Linux kernel, the following vulnerability has been resolved: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create We have recently observed a number of subvolumes with broken dentries. ls-ing the parent dir looks like: drwxrwxrwt 1 root root 16 Jan 23 16:49 . drwxr-xr-x 1 root root 24 Jan 23 16:48 .. d????????? ? ? ? ? ? broken_subvol and similarly stat-ing the file fails. In this state, deleting the subvol fails with ENOENT, but attempting to create a new file or subvol over it errors out with EEXIST and even aborts the fs. Which leaves us a bit stuck. dmesg contains a single notable error message reading: "could not do orphan cleanup -2" 2 is ENOENT and the error comes from the failure handling path of btrfs_orphan_cleanup(), with the stack leading back up to btrfs_lookup(). btrfs_lookup btrfs_lookup_dentry btrfs_orphan_cleanup // prints that message and returns -ENOENT After some detailed inspection of the internal state, it became clear that: - there are no orphan items for the subvol - the subvol is otherwise healthy looking, it is not half-deleted or anything, there is no drop progress, etc. - the subvol was created a while ago and does the meaningful first btrfs_orphan_cleanup() call that sets BTRFS_ROOT_ORPHAN_CLEANUP much later. - after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns -ENOENT, which results in a negative dentry for the subvolume via d_splice_alias(NULL, dentry), leading to the observed behavior. The bug can be mitigated by dropping the dentry cache, at which point we can successfully delete the subvolume if we want. i.e., btrfs_lookup() btrfs_lookup_dentry() if (!sb_rdonly(inode->vfs_inode)->vfs_inode) btrfs_orphan_cleanup(sub_root) test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) btrfs_search_slot() // finds orphan item for inode N ... prints "could not do orphan cleanup -2" if (inode == ERR_PTR(-ENOENT)) inode = NULL; return d_splice_alias(NULL, dentry) // NEGATIVE DENTRY for valid subvolume btrfs_orphan_cleanup() does test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) on the root when it runs, so it cannot run more than once on a given root, so something else must run concurrently. However, the obvious routes to deleting an orphan when nlinks goes to 0 should not be able to run without first doing a lookup into the subvolume, which should run btrfs_orphan_cleanup() and set the bit. The final important observation is that create_subvol() calls d_instantiate_new() but does not set BTRFS_ROOT_ORPHAN_CLEANUP, so if the dentry cache gets dropped, the next lookup into the subvolume will make a real call into btrfs_orphan_cleanup() for the first time. This opens up the possibility of concurrently deleting the inode/orphan items but most typical evict() paths will be holding a reference on the parent dentry (child dentry holds parent->d_lockref.count via dget in d_alloc(), released in __dentry_kill()) and prevent the parent from being removed from the dentry cache. The one exception is delayed iputs. Ordered extent creation calls igrab() on the inode. If the file is unlinked and closed while those refs are held, iput() in __dentry_kill() decrements i_count but does not trigger eviction (i_count > 0). The child dentry is freed and the subvol dentry's d_lockref.count drops to 0, making it evictable while the inode is still alive. Since there are two races (the race between writeback and unlink and the race between lookup and delayed iputs), and there are too many moving parts, the following three diagrams show the complete picture. (Only the second and third are races) Phase 1: Create Subvol in dentry cache without BTRFS_ROOT_ORPHAN_CLEANUP set btrfs_mksubvol() lookup_one_len() __lookup_slow() d_alloc_parallel() __d_alloc() // d_lockref.count = 1 create_subvol(dentry) // doesn't touch the bit.. d_instantiate_new(dentry, inode) // dentry in cache with d_lockref.c ---truncated--- |
CVE-2026-31519
|
| VCID-dh34-eegq-suf2 | kernel: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value |
CVE-2022-50327
|
| VCID-dhdb-gj1j-9ufk | kernel: btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() |
CVE-2024-46841
|
| VCID-djgy-muty-mygk | kernel: gpiolib: cdev: Fix use after free in lineinfo_changed_notify |
CVE-2024-36899
|
| VCID-djh8-dv3c-63d7 | kernel: platform/chrome: cros_ec_typec: zero out stale pointers |
CVE-2022-50642
|
| VCID-dk25-73pj-cqad | kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() |
CVE-2025-21844
|
| VCID-dkcw-azsb-4ker | kernel: mt76: mt7915: fix txrate reporting |
CVE-2021-47028
|
| VCID-dkk7-4gp5-qudp | kernel: ext4: xattr: fix null pointer deref in ext4_raw_inode() |
CVE-2025-68820
|
| VCID-dkn9-37zn-wucm | kernel: Bluetooth: Fix error code in chan_alloc_skb_cb() |
CVE-2025-22007
|
| VCID-dmjg-sqz8-9yb7 | kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() |
CVE-2025-39955
|
| VCID-dn8w-3zue-h3e8 | kernel: igb: Fix potential invalid memory access in igb_init_module() |
CVE-2024-52332
|
| VCID-dp4x-6duw-8yeh | kernel: wifi: rtw88: delete timer and free skb queue when unloading |
CVE-2023-53574
|
| VCID-dpc2-pmux-mqhm | kernel: ceph: remove the incorrect Fw reference check when dirtying pages |
CVE-2024-50179
|
| VCID-dpz3-aj6c-97de | kernel: tipc: fix NULL deref in cleanup_bearer() |
CVE-2024-56661
|
| VCID-dq4x-ybg5-53fh | kernel: net: fix data-races around sk->sk_forward_alloc |
CVE-2024-53124
|
| VCID-dqe1-cf2v-myes | kernel: ocfs2: Avoid touching renamed directory if parent does not change |
CVE-2023-52590
|
| VCID-dqth-c54y-e7fb | kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt |
CVE-2022-3566
|
| VCID-drf5-ur3k-gfee | kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction |
CVE-2025-38211
|
| VCID-drqe-npyk-5yfa | kernel: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper |
CVE-2025-38014
|
| VCID-ds3w-wph8-7kam | kernel: drm/gem: Acquire references on GEM handles for framebuffers |
CVE-2025-38449
|
| VCID-ds8k-thmg-73at | kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg |
CVE-2024-56633
|
| VCID-dsrd-nv6n-5ygq | kernel: scsi: core: Fix refcount leak for tagset_refcnt |
CVE-2026-23296
|
| VCID-dsyh-3m9c-gufx | kernel: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() |
CVE-2025-40187
|
| VCID-dtfh-gzr1-v3eu | kernel: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() |
CVE-2025-21993
|
| VCID-dtgn-6ykr-93ep | kernel: net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets |
CVE-2025-21629
|
| VCID-dva1-wfet-puc2 | kernel: RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert |
CVE-2025-38387
|
| VCID-dw93-w9aw-mue2 | kernel: Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event |
CVE-2022-49470
|
| VCID-dwbq-rw88-9kbq | kernel: nfsd: decrease sc_count directly if fail to queue dl_recall |
CVE-2025-37871
|
| VCID-dwes-ct77-juc8 | Kernel: A use-after-free due to race between scr24x_open() and scr24x_remove() |
CVE-2022-44034
|
| VCID-dwjy-g2uz-xqbt | kernel: drm/amd/pm: Prevent division by zero |
CVE-2025-37770
|
| VCID-dwk8-ffms-j7bj | kernel: ASoC: codecs: wcd9335: Fix missing free of regulator supplies |
CVE-2025-38259
|
| VCID-dwzr-3wdm-jbh6 | kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code execution |
CVE-2025-38024
|
| VCID-dykz-252m-jkcu | In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) Protect regulator operations with mutex The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions. However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex. Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker. Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset(). While at it, remove the unnecessary include of linux/of.h. |
CVE-2026-31486
|
| VCID-dyuh-jmvd-dkce | kernel: x86/mce: Work around an erratum on fast string copy instructions |
CVE-2022-49124
|
| VCID-dyun-rd3c-rke6 | kernel: drm/amd/display: Avoid overflow from uint32_t to uint8_t |
CVE-2024-47661
|
| VCID-dywv-cw4r-7kew | kernel: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() |
CVE-2024-35840
|
| VCID-dz3t-ymdq-pyg5 | kernel: powerpc/tm: Fix more userspace r13 corruption |
CVE-2022-49164
|
| VCID-dzhn-g8fd-4yg1 | kernel: fs: dlm: fix invalid derefence of sb_lvbptr |
CVE-2022-50516
|
| VCID-e12b-8uqz-a7c6 | kernel: vhost: fix hung thread due to erroneous iotlb entries |
CVE-2022-48862
|
| VCID-e1u1-77zf-zue5 | kernel: fbdev: rivafb: fix divide error in nv3_arb() |
CVE-2026-23266
|
| VCID-e227-daq9-ufa8 | kernel: driver core: fix potential null-ptr-deref in device_add() |
CVE-2023-54321
|
| VCID-e2mj-rcg8-eqar | kernel: remoteproc: imx_rproc: Fix refcount leak in imx_rproc_addr_init |
CVE-2022-50120
|
| VCID-e2vy-prvw-xkhq | kernel: bnxt_en: Fix memory corruption when FW resources change during ifdown |
CVE-2025-39810
|
| VCID-e2wu-3vmz-3yae | kernel: drm: zynqmp_kms: Unplug DRM device before removal |
CVE-2024-56538
|
| VCID-e41m-tu5y-97c4 | kernel: net: usb: lan78xx: Fix double free issue with interrupt buffer allocation |
CVE-2024-53213
|
| VCID-e4jw-y3k8-r7ec | kernel: net/mlx5e: Fix netif state handling |
CVE-2024-38608
|
| VCID-e4kc-nd41-ukaq | kernel: fs: relax assertions on failure to encode file handles |
CVE-2024-57924
|
| VCID-e4ks-d61v-cqgd | kernel: pcmcia: Add error handling for add_interval() in do_validate_mem() |
CVE-2025-39920
|
| VCID-e57d-cw7e-73an | kernel: media: av7110: fix a spectre vulnerability |
CVE-2024-50289
|
| VCID-e5h1-9rgs-dya6 | kernel: Linux kernel: Denial of Service in Xen grant table reclaim via memory leak |
CVE-2023-54081
|
| VCID-e5pz-yun5-nuex | kernel: ocfs2: free inode when ocfs2_get_init_inode() fails |
CVE-2024-56630
|
| VCID-e6b3-8s65-nbhj | kernel: KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS |
CVE-2024-46830
|
| VCID-e6c8-xx93-vbcx | kernel: mptcp: pm: Fix uaf in __timer_delete_sync |
CVE-2024-46858
|
| VCID-e6m4-2ub4-myh9 | kernel: drm/amd/display: Fix by adding FPU protection for dcn30_internal_validate_bw |
CVE-2022-49069
|
| VCID-e6pq-2v3a-rybk | kernel: wifi: cfg80211: Lock wiphy in cfg80211_get_station |
CVE-2024-40911
|
| VCID-e6th-hujj-6bby | kernel: drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags |
CVE-2024-49923
|
| VCID-e74q-w53m-vybc | kernel: Linux kernel (wifi): Information disclosure via uninitialized data in struct iw_point |
CVE-2026-22978
|
| VCID-e7ae-83vq-auf1 | kernel: btrfs: fix NULL dereference on root when tracing inode eviction |
CVE-2025-71184
|
| VCID-e85m-4vdu-2ycv | kernel: backlight: led-bl: Add devlink to supplier LEDs |
CVE-2025-68758
|
| VCID-e8j3-8h7n-6kd3 | kernel: udmabuf: fix a buf size overflow issue during udmabuf creation |
CVE-2025-37803
|
| VCID-e8ku-pxb2-wydk | kernel: icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr. |
CVE-2022-49632
|
| VCID-e8ky-fyhz-dqhc | In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() A malicious or compromised VIO server can return a num_written value in the discover targets MAD response that exceeds max_targets. This value is stored directly in vhost->num_targets without validation, and is then used as the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which is only allocated for max_targets entries. Indices at or beyond max_targets access kernel memory outside the DMA-coherent allocation. The out-of-bounds data is subsequently embedded in Implicit Logout and PLOGI MADs that are sent back to the VIO server, leaking kernel memory. Fix by clamping num_written to max_targets before storing it. |
CVE-2026-31464
|
| VCID-e965-zevp-rqgd | kernel: erofs: Fix detection of atomic context |
CVE-2023-53231
|
| VCID-e9k1-q54r-a7bg | kernel: drm/amd/pm: Prevent division by zero |
CVE-2025-37766
|
| VCID-e9ut-4ka7-nuhd | kernel: ASoC: rt7*-sdw: harden jack_detect_handler |
CVE-2022-49616
|
| VCID-ea36-7v42-fyfp | kernel: usb: typec: tipd: Free IRQ only if it was requested before |
CVE-2024-50057
|
| VCID-eak7-czh2-vyfj | kernel: mptcp: always handle address removal under msk socket lock |
CVE-2025-21875
|
| VCID-ebvf-tx9m-aued | kernel: Linux kernel: Denial of Service in wlcore due to insufficient skb headroom |
CVE-2025-71222
|
| VCID-ebx6-ep7x-4qeq | kernel: tracing/trigger: Fix to return error if failed to alloc snapshot |
CVE-2024-26920
|
| VCID-ecc5-64vs-ekgr | In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - Fix OOM ->tfm_count leak If memory allocation fails, decrement ->tfm_count to avoid blocking future reads. |
CVE-2026-31391
|
| VCID-ece9-tmr9-47fa | kernel: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() |
CVE-2024-56593
|
| VCID-ecue-nejt-4ubc | kernel: KVM: SVM: nested shutdown interception could lead to host crash |
CVE-2022-3344
|
| VCID-ecxb-qhqp-qqgr | kernel: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer |
CVE-2024-49991
|
| VCID-ed3p-sm1w-33am | kernel: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled |
CVE-2026-23293
|
| VCID-edhy-ptjn-1kbx | kernel: driver core: fix potential NULL pointer dereference in dev_uevent() |
CVE-2025-37800
|
| VCID-edst-7exd-zud8 | kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() |
CVE-2025-40168
|
| VCID-eehz-unnq-pbbd | kernel: media: wl128x: Fix atomicity violation in fmc_send_cmd() |
CVE-2024-56700
|
| VCID-efch-ennc-nqaw | kernel: Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet |
CVE-2024-55916
|
| VCID-eff6-c3rx-afhu | kernel: scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths |
CVE-2024-49891
|
| VCID-efty-j388-q3bq | kernel: erofs: fix pcluster use-after-free on UP platforms |
CVE-2022-48674
|
| VCID-eg4s-vt9f-x3at | kernel: fou: remove warn in gue_gro_receive on unsupported protocol |
CVE-2024-44940
|
| VCID-eg4x-aj4v-xqht | kernel: regmap: Fix race condition in hwspinlock irqsave routine |
CVE-2026-23071
|
| VCID-egnr-zs2r-93ew | kernel: Linux kernel: Denial of Service via improper pointer initialization |
CVE-2025-38408
|
| VCID-egud-t61c-k3g7 | Kernel: race when faulting a device private page in memory manager |
CVE-2022-3523
|
| VCID-ehs3-hezj-7yfe | kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() |
CVE-2024-53680
|
| VCID-ehtu-sncb-9qg6 | kernel: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() |
CVE-2025-38712
|
| VCID-ejhc-6yqt-gkgv | x86: Indirect Target Selection |
CVE-2024-28956
XSA-469 |
| VCID-ejpw-p94c-u3a9 | kernel: media: atomisp: prevent integer overflow in sh_css_set_black_frame() |
CVE-2022-50399
|
| VCID-ekaw-n5ug-4qgq | kernel: net: hsr: avoid potential out-of-bound access in fill_frame_info() |
CVE-2024-56648
|
| VCID-eknn-jcdu-8qg8 | kernel: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM |
CVE-2025-39770
|
| VCID-ekrb-1s2x-dufm | kernel: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device |
CVE-2023-53393
|
| VCID-ekzm-bmrq-tkdn | kernel: wifi: virt_wifi: avoid reporting connection success with wrong SSID |
CVE-2024-43841
|
| VCID-em75-cm2z-xkck | kernel: drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2) |
CVE-2024-49905
|
| VCID-em85-tye9-8bcu | kernel: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages |
CVE-2024-50208
|
| VCID-em9y-jv46-13aa | kernel: atm/fore200e: Fix possible data race in fore200e_open() |
CVE-2025-68339
|
| VCID-emdc-7k4g-67e5 | kernel: net: kcm: Fix race condition in kcm_unattach() |
CVE-2025-38717
|
| VCID-en51-ndg3-nya2 | kernel: uio_hv_generic: Let userspace take care of interrupt mask |
CVE-2025-40048
|
| VCID-end8-2vjb-z3gf | kernel: io_uring: ensure task_work gets run as part of cancelations |
CVE-2021-47504
|
| VCID-eng5-npdr-qbff | kernel: HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup |
CVE-2024-46747
|
| VCID-enns-kkdk-qufm | kernel: net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() |
CVE-2024-50168
|
| VCID-enr2-4j6n-jqf7 | kernel: Linux kernel: vsock vulnerability may lead to memory corruption |
CVE-2025-40248
|
| VCID-enyv-k9c5-bfe4 | kernel: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() |
CVE-2025-68188
|
| VCID-ep5k-5evd-2qhg | kernel: fs: udf: fix OOB read in lengthAllocDescs handling |
CVE-2025-40044
|
| VCID-ep5w-esa3-fbah | kernel: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq |
CVE-2025-39706
|
| VCID-epms-7dzu-6kaq | kernel: i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup |
CVE-2024-47665
|
| VCID-eq7n-phch-93du | kernel: scsi: qla2xxx: Complete command early within lock |
CVE-2024-42287
|
| VCID-ert1-ccux-83b1 | kernel: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() |
CVE-2024-42110
|
| VCID-es4k-7j4u-qyah | kernel: vsock: Fix transport_* TOCTOU |
CVE-2025-38461
|
| VCID-es4u-n31d-wkfm | kernel: pps: Fix a use-after-free |
CVE-2024-57979
|
| VCID-es8r-wvmz-gfe6 | kernel: net/sched: Fix backlog accounting in qdisc_dequeue_internal |
CVE-2025-39677
|
| VCID-es9x-2mxv-k3gw | kernel: usb: dwc3: st: fix probed platform device ref count on probe error path |
CVE-2024-46674
|
| VCID-eseh-574w-q7gs | kernel: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() |
CVE-2025-21703
|
| VCID-esv2-psjw-8yfs | kernel: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit |
CVE-2024-49938
|
| VCID-et3c-16tf-k3cj | kernel: f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes |
CVE-2026-23267
|
| VCID-etb2-844u-jfdu | kernel: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() |
CVE-2024-36968
|
| VCID-ete6-ycnw-7kgg | kernel: Input: alps - fix use-after-free bugs caused by dev3_register_work |
CVE-2025-68822
|
| VCID-evh2-ynnc-1fde | kernel: RDMA/bnxt_re: Add a check for memory allocation |
CVE-2024-50209
|
| VCID-evrz-zess-n3g1 | kernel: ixgbevf: fix mailbox API compatibility by negotiating supported features |
CVE-2025-40104
|
| VCID-ew57-csay-bube | kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() |
CVE-2025-38250
|
| VCID-ewd1-fsya-37ba | kernel: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices |
CVE-2024-56723
|
| VCID-ewj3-dyq9-r7f2 | kernel: drm/amd/pm: Disable MMIO access during SMU Mode 1 reset |
CVE-2026-23213
|
| VCID-ewxs-qt8g-7khc | kernel: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool |
CVE-2023-52811
|
| VCID-ex22-2qp4-fke8 | kernel: net: atm: fix use after free in lec_send() |
CVE-2025-22004
|
| VCID-ex4p-ftap-h7fe | kernel: net: annotate data-races around sk->sk_{data_ready,write_space} |
CVE-2026-23302
|
| VCID-ex8u-z3r8-cycq | In the Linux kernel, the following vulnerability has been resolved: ipv6: add NULL checks for idev in SRv6 paths __in6_dev_get() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER). Add NULL checks for idev returned by __in6_dev_get() in both seg6_hmac_validate_skb() and ipv6_srh_rcv() to prevent potential NULL pointer dereferences. |
CVE-2026-23442
|
| VCID-exh5-yp4u-eqcg | kernel: mt76: fix use-after-free by removing a non-RCU wcid pointer |
CVE-2022-49328
|
| VCID-exhn-kypt-2fbd | kernel: jfs: fix array-index-out-of-bounds read in add_missing_indices |
CVE-2025-38204
|
| VCID-exkc-gh4x-p3bh | kernel: drm/amd/display: Wake DMCUB before executing GPINT commands |
CVE-2023-52624
|
| VCID-exku-5gwx-gkfv | kernel: wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode |
CVE-2025-40321
|
| VCID-exur-8f1k-kqgs | kernel: cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path |
CVE-2025-37788
|
| VCID-ey68-cc97-duhz | kernel: drm/amd/display: Fix incorrect size calculation for loop |
CVE-2024-46729
|
| VCID-eyf5-2y8d-33hp | kernel: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC |
CVE-2022-48765
|
| VCID-eyg8-qhra-ukcj | kernel: RDMA/mlx5: Fix implicit ODP use after free |
CVE-2025-21714
|
| VCID-ezm4-88sz-j3g9 | kernel: team: better TEAM_OPTION_TYPE_STRING validation |
CVE-2025-21787
|
| VCID-ezrm-15ba-xybx | kernel: dm-crypt, dm-verity: disable tasklets |
CVE-2024-26718
|
| VCID-ezwh-qc41-pugn | kernel: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object |
CVE-2025-39851
|
| VCID-ezzy-1zx4-efbk | kernel: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() |
CVE-2025-40198
|
| VCID-f1ap-4atf-mubz | kernel: drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() |
CVE-2025-37930
|
| VCID-f1qx-m6tb-u7d2 | kernel: btrfs: reinitialize delayed ref list after deleting it from the list |
CVE-2024-50273
|
| VCID-f1r5-rt1y-jkd4 | kernel: rxrpc: Fix data-race warning and potential load/store tearing |
CVE-2026-23118
|
| VCID-f2ce-pung-aqgw | kernel: Linux kernel: Denial of Service in rxrpc due to prealloc collision |
CVE-2025-38544
|
| VCID-f322-swjz-4yhb | kernel: net: systemport: fix potential memory leak in bcm_sysport_xmit() |
CVE-2024-50171
|
| VCID-f35u-ajp9-aub7 | kernel: PCI: Add missing bridge lock to pci_bus_lock() |
CVE-2024-46750
|
| VCID-f3sv-pbfs-cqcc | kernel: um: work around sched_yield not yielding in time-travel mode |
CVE-2025-37880
|
| VCID-f46y-3euy-q7gg | kernel: RDMA/hns: Fix UAF for cq async event |
CVE-2024-38545
|
| VCID-f495-c3ug-wuhc | kernel: iavf: fix off-by-one issues in iavf_config_rss_reg() |
CVE-2025-71087
|
| VCID-f4tz-fc2t-97gc | kernel: x86/mtrr: Check if fixed MTRRs exist before saving them |
CVE-2024-44948
|
| VCID-f52d-y7km-9fhq | kernel: virtio-blk: fix implicit overflow on virtio_max_dma_size |
CVE-2023-52762
|
| VCID-f5cm-5jx1-x3hn | kernel: RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction |
CVE-2025-38161
|
| VCID-f5sw-8wup-nydf | kernel: cifs: fix underflow in parse_server_interfaces() |
CVE-2024-26828
|
| VCID-f5xt-m6qt-43ep | kernel: btrfs: fix deadlock with fiemap and extent locking |
CVE-2024-35784
|
| VCID-f616-emkd-g3hu | kernel: serial: mctrl_gpio: split disable_ms into sync and no_sync APIs |
CVE-2025-38040
|
| VCID-f6eb-asqa-5bg9 | kernel: um: vector: Do not use drvdata in release |
CVE-2024-53181
|
| VCID-f6uy-cc29-97c5 | kernel: net_sched: drr: Fix double list add in class with netem as child qdisc |
CVE-2025-37915
|
| VCID-f739-jh4k-q7dk | kernel: bpf: Fix issue in verifying allow_ptr_leaks |
CVE-2023-54181
|
| VCID-f76c-qhke-3bag | kernel: can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message |
CVE-2026-23307
|
| VCID-f7nv-pzr1-r3e7 | kernel: net: dpaa: Pad packets to ETH_ZLEN |
CVE-2024-46854
|
| VCID-f85j-ru6j-hfg5 | kernel: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() |
CVE-2025-38664
|
| VCID-f8mg-8m55-auav | kernel: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs |
CVE-2024-42285
|
| VCID-f8r8-spm9-fyhh | kernel: ocfs2: fix null-ptr-deref when journal load failed. |
CVE-2024-49957
|
| VCID-f8ta-wn7s-nfhc | kernel: mptcp: make fallback action and fallback decision atomic |
CVE-2025-38491
|
| VCID-f8wz-q9dp-ckbt | kernel: media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() |
CVE-2025-71136
|
| VCID-f9jh-ac4d-3ban | kernel: btrfs: fix double free of anonymous device after snapshot creation failure |
CVE-2024-26792
|
| VCID-f9tu-85g7-dqgm | kernel: soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() |
CVE-2025-23148
|
| VCID-f9zw-7sk6-vue5 | kernel: media: venus: hfi: add check to handle incorrect queue size |
CVE-2025-23158
|
| VCID-faua-wume-yyaa | kernel: ipvs: properly dereference pe in ip_vs_add_service |
CVE-2024-42322
|
| VCID-fbf1-uqgb-juat | kernel: wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() |
CVE-2025-38643
|
| VCID-fbqz-36nh-fkdd | kernel: riscv: move memblock_allow_resize() after linear mapping is ready |
CVE-2023-53699
|
| VCID-fbzf-k9uu-skct | kernel: netlink: terminate outstanding dump on socket close |
CVE-2024-53140
|
| VCID-fc1a-pvub-67bv | kernel: octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" |
CVE-2025-71137
|
| VCID-fcn8-fwuk-fuez | kernel: udf: fix uninit-value use in udf_get_fileshortad |
CVE-2024-50143
|
| VCID-fd45-feyz-tffr | kernel: drm/amd/display: Add null pointer check for get_first_active_display() |
CVE-2025-38362
|
| VCID-fdm7-kpv7-4khv | kernel: ALSA: wavefront: Fix integer overflow in sample size validation |
CVE-2025-68344
|
| VCID-fds5-x8be-47fj | kernel: net: do not delay dst_entries_add() in dst_release() |
CVE-2024-50036
|
| VCID-fdv3-1tts-uyay | kernel: qed: allow sleep in qed_mcp_trace_dump() |
CVE-2023-53509
|
| VCID-femt-rtxa-e7e3 | kernel: dm thin: make get_first_thin use rcu-safe list first function |
CVE-2025-21664
|
| VCID-fenv-712d-f7f5 | kernel: genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() |
CVE-2023-53332
|
| VCID-ff1s-taxm-xyc2 | kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition |
CVE-2025-39994
|
| VCID-ffag-yek5-sqb1 | kernel: RDMA/cxgb4: Added NULL check for lookup_atid |
CVE-2024-47749
|
| VCID-ffdb-88yu-3be1 | kernel: drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() |
CVE-2026-23356
|
| VCID-ffdj-ukfw-tqf2 | kernel: list: fix a data-race around ep->rdllist |
CVE-2022-49443
|
| VCID-ffjq-6qe6-mkbb | kernel: um: line: always fill *error_out in setup_one_line() |
CVE-2024-46844
|
| VCID-fg13-4tjf-tyce | kernel: drm/client: fix null pointer dereference in drm_client_modeset_probe |
CVE-2024-43894
|
| VCID-fgd8-hc11-u3g4 | kernel: sched: sch_cake: fix bulk flow accounting logic for host fairness |
CVE-2024-46828
|
| VCID-fhf4-drwe-eugu | kernel: Linux kernel: Use-After-Free vulnerability in MSI translation via IOMMU domain change during VFIO operation |
CVE-2025-38062
|
| VCID-fhxv-d8du-rbgk | kernel: btrfs: do proper folio cleanup when run_delalloc_nocow() failed |
CVE-2024-57975
|
| VCID-fj22-7wph-7fdf | kernel: dmaengine: stm32: dmamux: fix device leak on route allocation |
CVE-2025-71186
|
| VCID-fj6m-sefc-pyg1 | kernel: dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow |
CVE-2022-50541
|
| VCID-fjgq-ezdj-uyf4 | kernel: tracing: Prevent bad count for tracing_cpumask_write |
CVE-2024-56763
|
| VCID-fjrr-1q5f-qyh2 | kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem |
CVE-2025-38180
|
| VCID-fju4-ff8a-4bbr | kernel: PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() |
CVE-2025-21804
|
| VCID-fk6k-5wz9-k3hh | kernel: Linux kernel: Denial of Service due to memory leak in SMB client |
CVE-2025-39929
|
| VCID-fkge-aaw9-57c8 | kernel: usbnet: Prevents free active kevent |
CVE-2025-68312
|
| VCID-fknd-5trm-17aw | kernel: Improper lock operation in btrfs |
CVE-2021-4149
|
| VCID-fm5n-9nsj-s3at | kernel: USB: usbtmc: prevent kernel-usb-infoleak |
CVE-2024-47671
|
| VCID-fm6x-ca1m-wuhj | kernel: usb: dwc3: core: Prevent USB core invalid event buffer address access |
CVE-2024-46675
|
| VCID-fmh7-u2fr-tygw | kernel: espintcp: fix skb leaks |
CVE-2025-38057
|
| VCID-fnaw-jb9f-jkga | kernel: Linux kernel: Memory leak in ATM clip module can lead to denial of service |
CVE-2025-38546
|
| VCID-fntn-sb9v-17gj | kernel: x86/kexec: fix memory leak of elf header buffer |
CVE-2022-49546
|
| VCID-fnzx-7hvu-eybh | kernel: sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers |
CVE-2024-53128
|
| VCID-fp7e-5d7y-fbcr | kernel: powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. |
CVE-2024-42126
|
| VCID-fq2p-4m1f-qydc | kernel: drm/vc4: Stop the active perfmon before being destroyed |
CVE-2024-50187
|
| VCID-fqdn-y5zw-y3cd | kernel: bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error |
CVE-2024-47728
|
| VCID-fr3g-sbxx-s7er | kernel: media: rc: fix races with imon_disconnect() |
CVE-2025-39993
|
| VCID-fs4d-n4e2-j3b5 | kernel: Squashfs: check the inode number is not the invalid value of zero |
CVE-2024-26982
|
| VCID-fs6s-jdqw-kfch | In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations and a broken epilogue in the exception handlers. This will prevent crashes and ensure correct return values of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. |
CVE-2025-40112
|
| VCID-fs73-5ucn-qke1 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. After this change, the netdev_destroy() callback can proceed immediately to the call_rcu() invocation if the IFF_OVS_DATAPATH flag is already cleared on the netdev. The ovs_netdev_detach_dev() function clears the flag before completing the unregistration, and if it gets preempted after clearing the flag (as can happen on an -rt kernel), netdev_destroy() can complete and the device can be freed before the unregistration completes. This leads to a splat like: [ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI [ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT [ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025 [ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0 [ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90 [ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246 [ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000 [ 998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05 [ 998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000 [ 998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006 [ 998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000 [ 998.393931] FS: 00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000 [ 998.393936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0 [ 998.393944] PKRU: 55555554 [ 998.393946] Call Trace: [ 998.393949] <TASK> [ 998.393952] ? show_trace_log_lvl+0x1b0/0x2f0 [ 998.393961] ? show_trace_log_lvl+0x1b0/0x2f0 [ 998.393975] ? dp_device_event+0x41/0x80 [openvswitch] [ 998.394009] ? __die_body.cold+0x8/0x12 [ 998.394016] ? die_addr+0x3c/0x60 [ 998.394027] ? exc_general_protection+0x16d/0x390 [ 998.394042] ? asm_exc_general_protection+0x26/0x30 [ 998.394058] ? dev_set_promiscuity+0x8d/0xa0 [ 998.394066] ? ovs_netdev_detach_dev+0x3a/0x80 [openvswitch] [ 998.394092] dp_device_event+0x41/0x80 [openvswitch] [ 998.394102] notifier_call_chain+0x5a/0xd0 [ 998.394106] unregister_netdevice_many_notify+0x51b/0xa60 [ 998.394110] rtnl_dellink+0x169/0x3e0 [ 998.394121] ? rt_mutex_slowlock.constprop.0+0x95/0xd0 [ 998.394125] rtnetlink_rcv_msg+0x142/0x3f0 [ 998.394128] ? avc_has_perm_noaudit+0x69/0xf0 [ 998.394130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 998.394132] netlink_rcv_skb+0x50/0x100 [ 998.394138] netlink_unicast+0x292/0x3f0 [ 998.394141] netlink_sendmsg+0x21b/0x470 [ 998.394145] ____sys_sendmsg+0x39d/0x3d0 [ 998.394149] ___sys_sendmsg+0x9a/0xe0 [ 998.394156] __sys_sendmsg+0x7a/0xd0 [ 998.394160] do_syscall_64+0x7f/0x170 [ 998.394162] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 998.394165] RIP: 0033:0x7fad61bf4724 [ 998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 [ 998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724 [ 998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003 [ 998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f [ 998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2 ---truncated--- |
CVE-2026-31508
|
| VCID-fs84-tck8-jyes | kernel: scsi: target: core: Fix null-ptr-deref in target_alloc_device() |
CVE-2024-50153
|
| VCID-fsjs-fmwz-x3bd | kernel: md: suspend array while updating raid_disks via sysfs |
CVE-2025-71225
|
| VCID-ft5c-s985-cfek | kernel: race condition in the Android binder driver could lead to incorrect security checks |
CVE-2021-39686
|
| VCID-ftyf-gp3c-gyeg | kernel: soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() |
CVE-2024-53158
|
| VCID-fu8g-cmhp-vqfb | kernel: media: cx231xx: set device_caps for 417 |
CVE-2025-38044
|
| VCID-fubu-v8s9-yfc4 | kernel: net: stmmac: make sure that ptp_rate is not 0 before configuring EST |
CVE-2025-38125
|
| VCID-fufn-uqtv-wkas | kernel: f2fs: fix to avoid panic once fallocation fails for pinfile |
CVE-2025-23130
|
| VCID-fvam-jks7-jkbt | kernel: drm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update |
CVE-2024-46727
|
| VCID-fvhu-1xqw-fkbk | kernel: netfilter: nf_tables: restore set elements when delete set fails |
CVE-2024-27012
|
| VCID-fvvb-p7r7-zkbk |
CVE-2026-31422
|
|
| VCID-fw9k-a5nm-wke7 | kernel: ax25: Fix netdev refcount issue |
CVE-2024-36009
|
| VCID-fws4-y57e-c7a4 | kernel: nilfs2: protect references to superblock parameters exposed in sysfs |
CVE-2024-46780
|
| VCID-fx2q-84en-qyah | kernel: can: bcm: fix locking for bcm_op runtime updates |
CVE-2026-23362
|
| VCID-fxnd-53ca-1ugh | kernel: bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode |
CVE-2024-42063
|
| VCID-fxun-hz5a-dkhv | kernel: drm/v3d: Disable interrupts before resetting the GPU |
CVE-2025-38371
|
| VCID-fzak-rhfb-xfc3 | kernel: usb: gadget: u_serial: Fix race condition in TTY wakeup |
CVE-2025-38448
|
| VCID-fzfp-nqh6-c3ca | kernel: of: check previous kernel's ima-kexec-buffer against memory bounds |
CVE-2022-50159
|
| VCID-fzqk-e6m3-duh1 | kernel: drm/amd/display: Fix potential null dereference |
CVE-2023-53498
|
| VCID-g162-81ms-93g7 | kernel: ipv6: use RCU in ip6_output() |
CVE-2025-40158
|
| VCID-g27n-hpnr-ubd7 | kernel: Bluetooth: af_bluetooth: Fix deadlock |
CVE-2024-26886
|
| VCID-g2ge-t77f-8fdk | kernel: net: ks8851: Handle softirqs at the end of IRQ thread to fix hang |
CVE-2024-35971
|
| VCID-g2ry-tmd2-s3fq | kernel: drivers/rapidio/rio_cm.c: prevent possible heap overwrite |
CVE-2025-38090
|
| VCID-g2yr-d1ta-93g7 | In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol st_shndx is out of bounds The module loader doesn't check for bounds of the ELF section index in simplify_symbols(): for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) { const char *name = info->strtab + sym[i].st_name; switch (sym[i].st_shndx) { case SHN_COMMON: [...] default: /* Divert to percpu allocation if a percpu var. */ if (sym[i].st_shndx == info->index.pcpu) secbase = (unsigned long)mod_percpu(mod); else /** HERE --> **/ secbase = info->sechdrs[sym[i].st_shndx].sh_addr; sym[i].st_value += secbase; break; } } A symbol with an out-of-bounds st_shndx value, for example 0xffff (known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic: BUG: unable to handle page fault for address: ... RIP: 0010:simplify_symbols+0x2b2/0x480 ... Kernel panic - not syncing: Fatal exception This can happen when module ELF is legitimately using SHN_XINDEX or when it is corrupted. Add a bounds check in simplify_symbols() to validate that st_shndx is within the valid range before using it. This issue was discovered due to a bug in llvm-objcopy, see relevant discussion for details [1]. [1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/ |
CVE-2026-31521
|
| VCID-g3ku-5npc-v7gc | kernel: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock |
CVE-2026-23368
|
| VCID-g4fj-f718-v3eb | kernel: drm/i915: Fix potential context UAFs |
CVE-2023-52913
|
| VCID-g5e6-cd9d-2bac | kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths |
CVE-2025-68287
|
| VCID-g5xk-qhrt-yygt | kernel: net/sched: act_ct: fix skb leak and crash on ooo frags |
CVE-2023-52610
|
| VCID-g688-fq6a-abas | kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges |
CVE-2022-0500
|
| VCID-g6fv-3mkq-23dw | kernel: ALSA: caiaq: Use snd_card_free_when_closed() at disconnection |
CVE-2024-56531
|
| VCID-g74b-2azg-mfdw | kernel: bpf: avoid holding freeze_mutex during mmap operation |
CVE-2025-21853
|
| VCID-g7bh-e9xf-quf3 | kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info |
CVE-2024-35839
|
| VCID-g7rs-z62s-6qcn | kernel: usb: cdns3: fix random warning message when driver load |
CVE-2022-50151
|
| VCID-g7t7-tspv-fqdc | kernel: ipv6: Fix potential uninit-value access in __ip6_make_skb() |
CVE-2024-36903
|
| VCID-g8k1-wwq1-yka2 | In the Linux kernel, the following vulnerability has been resolved: xfrm: prevent policy_hthresh.work from racing with netns teardown A XFRM_MSG_NEWSPDINFO request can queue the per-net work item policy_hthresh.work onto the system workqueue. The queued callback, xfrm_hash_rebuild(), retrieves the enclosing struct net via container_of(). If the net namespace is torn down before that work runs, the associated struct net may already have been freed, and xfrm_hash_rebuild() may then dereference stale memory. xfrm_policy_fini() already flushes policy_hash_work during teardown, but it does not synchronize policy_hthresh.work. Synchronize policy_hthresh.work in xfrm_policy_fini() as well, so the queued work cannot outlive the net namespace teardown and access a freed struct net. |
CVE-2026-31516
|
| VCID-g8uj-2fkk-5ud6 | kernel: jfs: Fix uninit-value access of new_ea in ea_buffer |
CVE-2024-49900
|
| VCID-g9bb-sevz-e7c7 | kernel: net: rose: fix invalid array index in rose_kill_by_device() |
CVE-2025-71086
|
| VCID-g9dq-44yb-t7ak | kernel: f2fs: fix to do sanity check on sbi->total_valid_block_count |
CVE-2025-38163
|
| VCID-g9pr-amk5-4ya4 | kernel: xsk: fix OOB map writes when deleting elements |
CVE-2024-56614
|
| VCID-gb9d-fjxt-z7ht | kernel: fs/proc: fix softlockup in __read_vmcore (part 2) |
CVE-2025-21694
|
| VCID-gbkk-anun-a3ce |
CVE-2025-54505
XSA-488 |
|
| VCID-gbnr-uevp-jugj | kernel: uio_hv_generic: Fix another memory leak in error handling paths |
CVE-2021-47070
|
| VCID-gbsy-mmdt-y3hy | kernel: bpf: Use raw_spinlock_t in ringbuf |
CVE-2024-50138
|
| VCID-gc1b-rntq-dya3 | kernel: net/mlx5: Handle pairing of E-switch via uplink un/load APIs |
CVE-2023-53347
|
| VCID-gc82-5eyg-9qbb | kernel: drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() |
CVE-2025-39675
|
| VCID-gcbp-wvut-nkfm | kernel: ionic: Fix netdev notifier unregister on failure |
CVE-2024-56715
|
| VCID-gcff-16g5-t7ew | kernel: parisc: Do not reprogram affinitiy on ASP chip |
CVE-2025-71121
|
| VCID-gcqh-9wjd-7kcj | kernel: net: rose: convert 'use' field to refcount_t |
CVE-2025-39826
|
| VCID-gcqh-ytsa-f7g1 | kernel: drm/amd/display: Run DC_LOG_DC after checking link->link_enc |
CVE-2024-46776
|
| VCID-gdny-pbj7-cube | kernel: bpf: Fix invalid prog->stats access when update_effective_progs fails |
CVE-2025-68742
|
| VCID-gdt1-jgex-eug8 | kernel: nvmet-tcp: fix kernel crash if commands allocation fails |
CVE-2024-46737
|
| VCID-ge76-761p-tkdv | kernel: usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup |
CVE-2025-40116
|
| VCID-genh-642f-mfgz | kernel: mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer |
CVE-2025-39907
|
| VCID-genq-1u1r-1kbv | kernel: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer |
CVE-2025-39937
|
| VCID-gfe9-6z46-f7hs | kernel: nilfs2: do not force clear folio if buffer is referenced |
CVE-2025-21722
|
| VCID-gg4r-7tb8-rkha | kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. |
CVE-2025-40304
|
| VCID-gg5q-9kbc-67gb | kernel: firewire: net: fix use after free in fwnet_finish_incoming_packet() |
CVE-2023-53432
|
| VCID-ggdk-nz4f-5bdu | kernel: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg |
CVE-2024-49571
|
| VCID-ggtk-tamq-2qdy | kernel: drm/amdkfd: fix svm_migrate_fini warning |
CVE-2021-47410
|
| VCID-gh5z-xrgd-9bcs | kernel: net/mlx5: Fix bridge mode operations when there are no VFs |
CVE-2024-46857
|
| VCID-ghkf-f8r8-pygj | kernel: ACPI: CPPC: Use access_width over bit_width for system memory accesses |
CVE-2024-35995
|
| VCID-ghmv-y2s4-7fcp | kernel: drm/amd/display: Check denominator crb_pipes before used |
CVE-2024-46772
|
| VCID-gkap-5jhj-tbff | kernel: net/sched: act_ife: Fix metalist update behavior |
CVE-2026-23378
|
| VCID-gm3e-d4pv-53aq | kernel: drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()' |
CVE-2024-26661
|
| VCID-gm7v-6v2w-wygh | kernel: drm/amdgpu: SDMA update use unlocked iterator |
CVE-2022-50393
|
| VCID-gm9m-whjq-g3bg | kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc |
CVE-2025-71113
|
| VCID-gmpj-3qde-cbhm | kernel: comedi: Fix use of uninitialized data in insn_rw_emulate_bits() |
CVE-2025-38480
|
| VCID-gmun-zz47-suap | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: ensure we're polling a polled queue A user can change the polled queue count at run time. There's a brief window during a reset where a hipri task may try to poll that queue before the block layer has updated the queue maps, which would race with the now interrupt driven queue and may cause double completions. |
CVE-2026-31523
|
| VCID-gmyf-wrkm-77a8 | kernel: platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver |
CVE-2025-68804
|
| VCID-gn82-9qs1-37hs | kernel: drm/amdgpu: fix nullptr err of vm_handle_moved |
CVE-2025-40339
|
| VCID-gnvn-qhzr-dyfa | kernel: vsock: fix lock inversion in vsock_assign_transport() |
CVE-2025-40231
|
| VCID-gp1q-342y-rkcy | kernel: comedi: Flush partial mappings in error case |
CVE-2024-53148
|
| VCID-gpcp-4y8w-fka1 | kernel: nfc: nci: complete pending data exchange on device close |
CVE-2026-23330
|
| VCID-gpdn-rup2-7fey | kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context |
CVE-2022-40133
|
| VCID-gphn-mhbb-4qda | kernel: net/sctp: Prevent autoclose integer overflow in sctp_association_init() |
CVE-2024-57938
|
| VCID-gqbd-ybcp-jybq | kernel: drm/amd/pm: fix null pointer access |
CVE-2025-38705
|
| VCID-gqdm-2vw6-hucw | kernel: drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume |
CVE-2021-47421
|
| VCID-gqe8-fs68-9ygb | kernel: drm/v3d: Assign job pointer to NULL before signaling the fence |
CVE-2025-21688
|
| VCID-gqh6-7dyu-43an | kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling |
CVE-2025-37797
|
| VCID-gqr9-19jt-qfds | kernel: net: use dst_dev_rcu() in sk_setup_caps() |
CVE-2025-40170
|
| VCID-gque-hhdb-ufey | kernel: drm/amd/display: added NULL check at start of dc_validate_stream |
CVE-2024-46802
|
| VCID-gsav-5b9s-hbdr | kernel: drm/amd/display: Check msg_id before processing transcation |
CVE-2024-46814
|
| VCID-gsm2-4mrp-nkcg | kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() |
CVE-2025-40252
|
| VCID-gspg-rx17-1qbw | kernel: drm/amd/display: Check link_res->hpo_dp_link_enc before using it |
CVE-2024-47704
|
| VCID-gstk-xrzv-s7af | kernel: drm/amd/display: Check phantom_stream before it is used |
CVE-2024-49897
|
| VCID-gt1u-1wns-53cz | kernel: net: fix crash when config small gso_max_size/gso_ipv4_max_size |
CVE-2024-50258
|
| VCID-gt6u-vdfu-hkek | kernel: hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() |
CVE-2025-40243
|
| VCID-gtbs-gkax-a3ag | kernel: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write |
CVE-2024-53052
|
| VCID-gtd6-f298-uubw | kernel: serial: imx: Introduce timeout when waiting on transmitter empty |
CVE-2024-40967
|
| VCID-gtzq-1g5y-tkh5 | kernel: nfsd: release svc_expkey/svc_export with rcu_work |
CVE-2024-53216
|
| VCID-gv16-egay-kufe | kernel: vfs: Don't leak disconnected dentries on umount |
CVE-2025-40105
|
| VCID-gvhj-cd4t-a3f9 | kernel: ubi: fastmap: Fix duplicate slab cache names while attaching |
CVE-2024-53172
|
| VCID-gvya-5wgk-j3cv | kernel: udf: refactor inode_bmap() to handle error |
CVE-2024-50211
|
| VCID-gw8y-j79e-cue7 | kernel: ethtool: check device is present when getting link settings |
CVE-2024-46679
|
| VCID-gwjq-s48w-e3aa | kernel: memcg_write_event_control(): fix a user-triggerable oops |
CVE-2024-45021
|
| VCID-gxz7-ye9d-3kaj | kernel: scsi: qla2xxx: Fix use after free on unload |
CVE-2024-56623
|
| VCID-gy8t-jfpr-efaj | kernel: netfilter: nft_socket: fix sk refcount leaks |
CVE-2024-46855
|
| VCID-gyhz-a9pm-zqav | Linux privcmd driver can circumvent kernel lockdown |
CVE-2026-31788
|
| VCID-gyzx-musu-83c4 | kernel: btrfs: insert tree mod log move in push_node_left |
CVE-2023-53538
|
| VCID-gz7v-f4bw-zqds | kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq |
CVE-2024-38540
|
| VCID-gzfh-c35y-2kh4 | kernel: wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() |
CVE-2024-46755
|
| VCID-h1d8-gyg4-63ex | kernel: dmaengine: ti: k3-udma: Add missing locking |
CVE-2025-38005
|
| VCID-h1e4-mhtd-wfbh | kernel: exfat: fix memory leak in exfat_load_bitmap() |
CVE-2024-50013
|
| VCID-h1mg-59vr-pqdz | kernel: net: usb: aqc111: fix error handling of usbnet read calls |
CVE-2025-38153
|
| VCID-h1w2-bbtg-qfaa | kernel: i40e: fix validation of VF state in get resources |
CVE-2025-39969
|
| VCID-h3e8-fux5-3fe2 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access l2cap_information_rsp() checks that cmd_len covers the fixed l2cap_info_rsp header (type + result, 4 bytes) but then reads rsp->data without verifying that the payload is present: - L2CAP_IT_FEAT_MASK calls get_unaligned_le32(rsp->data), which reads 4 bytes past the header (needs cmd_len >= 8). - L2CAP_IT_FIXED_CHAN reads rsp->data[0], 1 byte past the header (needs cmd_len >= 5). A truncated L2CAP_INFO_RSP with result == L2CAP_IR_SUCCESS triggers an out-of-bounds read of adjacent skb data. Guard each data access with the required payload length check. If the payload is too short, skip the read and let the state machine complete with safe defaults (feat_mask and remote_fixed_chan remain zero from kzalloc), so the info timer cleanup and l2cap_conn_start() still run and the connection is not stalled. |
CVE-2026-31393
|
| VCID-h3hf-6hcr-vkcg | kernel: platform/x86: classmate-laptop: Add missing NULL pointer checks |
CVE-2026-23237
|
| VCID-h3sy-9k3r-sug4 | kernel: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() |
CVE-2025-21761
|
| VCID-h3xz-s1bw-nuhg | kernel: Kernel: Denial of Service in perf due to user stack sampling during process exit |
CVE-2025-38424
|
| VCID-h4x3-q7ew-8qhk | kernel: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race |
CVE-2024-50082
|
| VCID-h5b9-yvze-nyc7 | kernel: espintcp: remove encap socket caching to avoid reference leak |
CVE-2025-38097
|
| VCID-h5js-e6kv-jbhm | kernel: of: overlay: Call of_changeset_init() early |
CVE-2023-53856
|
| VCID-h5ky-tm7y-u3gm | kernel: PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type |
CVE-2025-23161
|
| VCID-h5u7-a3tf-gyck | kernel: drm/vmwgfx: Fix a deadlock in dma buf fence polling |
CVE-2024-43863
|
| VCID-h65a-jkh3-p3dw | kernel: media: aspeed: Fix memory overwrite if timing is 1600x900 |
CVE-2023-52916
|
| VCID-h6dz-5pmy-mqhn | kernel: partitions: mac: fix handling of bogus partition table |
CVE-2025-21772
|
| VCID-h746-mjmu-ebck | kernel: ovl: Use "buf" flexible array for memcpy() destination |
CVE-2022-49743
|
| VCID-h7dx-k8ez-yqda | kernel: net: missing check virtio |
CVE-2024-43817
|
| VCID-h7ek-ruzp-q7ah | kernel: net: stmmac: Disable Tx queues when reconfiguring the interface |
CVE-2021-47558
|
| VCID-h7pm-dyef-1fan |
CVE-2026-31409
|
|
| VCID-h7t2-setw-3bhg | kernel: Linux kernel (i2c: qup): Denial of Service via improper I2C client timeout handling |
CVE-2025-38671
|
| VCID-h7tb-d7q2-pqcr | kernel: f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC |
CVE-2024-44942
|
| VCID-h7uj-6bvd-f3fq | kernel: mm/khugepaged: fix ->anon_vma race |
CVE-2023-52935
|
| VCID-h8tr-9qhx-8qat | kernel: media: mc: Clear minor number before put device |
CVE-2025-40197
|
| VCID-h8vw-cjj2-wfaf | kernel: KVM: x86: use array_index_nospec with indices that come from guest |
CVE-2025-39823
|
| VCID-h9pb-64h4-xuev | kernel: HID: uclogic: Correct devm device reference for hidinput input_dev name |
CVE-2023-54207
|
| VCID-h9y8-8zy1-aqfv | kernel: io_uring/tctx: work around xa_store() allocation error issue |
CVE-2024-56584
|
| VCID-ha2q-kr93-e7az | kernel: net: sched: Disallow replacing of child qdisc from one parent to another |
CVE-2025-21700
|
| VCID-ha6w-4v7c-nyfb | kernel: ext4: guard against EA inode refcount underflow in xattr update |
CVE-2025-40190
|
| VCID-haaz-25w4-wfg4 | kernel: nilfs2: fix missing cleanup on rollforward recovery error |
CVE-2024-46781
|
| VCID-hah2-fv7s-s7ay | kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer |
CVE-2025-21738
|
| VCID-hask-advn-tqgs | kernel: Linux kernel: Denial of Service due to generic power domain leak |
CVE-2025-68204
|
| VCID-hau9-6bnb-x3gy | kernel: f2fs: fix to avoid potential panic during recovery |
CVE-2024-27032
|
| VCID-hawy-rbjj-5bgt | IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard. |
CVE-2025-27558
|
| VCID-hb7v-bs3k-pfb7 | kernel: i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() |
CVE-2024-56562
|
| VCID-hbnp-3rst-9qbs | kernel: xen: Fix the issue of resource not being properly released in xenbus_dev_probe() |
CVE-2024-53198
|
| VCID-hbzk-b7gn-9bgz | kernel: riscv: save the SR_SUM status over switches |
CVE-2025-38261
|
| VCID-hc84-6ccr-dqbg | kernel: media: s5p-jpeg: prevent buffer overflows |
CVE-2024-53061
|
| VCID-hdev-8cux-gqf1 | kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry |
CVE-2025-37958
|
| VCID-hdu5-88qd-r7h7 | kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources |
CVE-2024-53150
|
| VCID-hegp-vr1e-kqez | kernel: net/9p: use a dedicated spinlock for trans_fd |
CVE-2022-49765
|
| VCID-hfag-cnjt-s3cx | kernel: net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE |
CVE-2024-42321
|
| VCID-hfq2-r9mw-p3cp | kernel: btrfs: fix double accounting race when btrfs_run_delalloc_range() failed |
CVE-2024-58089
|
| VCID-hfym-kukr-9qcf | kernel: usb: gadget: f_eem: Fix memory leak in eem_unwrap |
CVE-2025-68289
|
| VCID-hgk6-m1tz-z7da | kernel: iio: accel: bmc150: Fix irq assumption regression |
CVE-2025-68330
|
| VCID-hgpz-fqkr-x3ag | kernel: vt: prevent kernel-infoleak in con_font_get() |
CVE-2024-50076
|
| VCID-hh8n-gr5m-zqhd |
CVE-2026-23410
|
|
| VCID-hh8s-8fc8-pkgq | kernel: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase |
CVE-2026-23351
|
| VCID-hhdu-h17a-6uap | kernel: net: dsa: microchip: ksz_common: Fix refcount leak bug |
CVE-2022-49591
|
| VCID-hhn7-3hub-pbc7 | kernel: sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC |
CVE-2025-40126
|
| VCID-hj26-eqjg-xkbn | kernel: Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE |
CVE-2024-53144
|
| VCID-hjba-84bw-5kcs | kernel: drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() |
CVE-2024-57798
|
| VCID-hjfx-vv5v-ykgu | kernel: iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer |
CVE-2024-57911
|
| VCID-hjgh-pbhw-d3bm | kernel: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt |
CVE-2025-21792
|
| VCID-hjub-netx-m3f4 | kernel: nfc: nci: Fix race between rfkill and nci_unregister_device() |
CVE-2026-23167
|
| VCID-hk22-6w6w-pue3 | kernel: NFSD: Define a proc_layoutcommit for the FlexFiles layout type |
CVE-2025-40087
|
| VCID-hkgt-ar69-4bet | kernel: x86/apic: Don't disable x2APIC if locked |
CVE-2022-50720
|
| VCID-hkr5-jaj4-9qg8 | kernel: hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING |
CVE-2025-21816
|
| VCID-hm3d-5ktm-6bd1 | kernel: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory |
CVE-2024-50115
|
| VCID-hm6c-rmfx-sfav | kernel: HID: core: do not bypass hid_hw_raw_request |
CVE-2025-38494
|
| VCID-hmmv-61tn-nkc2 | kernel: mm: clear uffd-wp PTE/PMD state on mremap() |
CVE-2025-21696
|
| VCID-hmsk-xsy5-syad | kernel: wifi: iwlwifi: mvm: pause TCM when the firmware is stopped |
CVE-2024-47673
|
| VCID-hn2x-k1gc-gyc5 | kernel: ASoC: mt6359: Fix refcount leak bug |
CVE-2022-50111
|
| VCID-hn73-fnds-xugf | kernel: nilfs2: prevent use of deleted inode |
CVE-2024-53690
|
| VCID-hnjx-xyr7-n3ak | kernel: dma-debug: fix a possible deadlock on radix_lock |
CVE-2024-47143
|
| VCID-hnrs-f1mv-akb4 | kernel: drm/amd/display: Check null pointers before using dc->clk_mgr |
CVE-2024-49907
|
| VCID-hpjn-8ky9-yugh | kernel: nfc: pn533: Add poll mod list filling check |
CVE-2024-46676
|
| VCID-hpqq-mr4h-gbcj | In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false A UAF issue occurs when the virtio_net driver is configured with napi_tx=N and the device's IFF_XMIT_DST_RELEASE flag is cleared (e.g., during the configuration of tc route filter rules). When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack expects the driver to hold the reference to skb->dst until the packet is fully transmitted and freed. In virtio_net with napi_tx=N, skbs may remain in the virtio transmit ring for an extended period. If the network namespace is destroyed while these skbs are still pending, the corresponding dst_ops structure has freed. When a subsequent packet is transmitted, free_old_xmit() is triggered to clean up old skbs. It then calls dst_release() on the skb associated with the stale dst_entry. Since the dst_ops (referenced by the dst_entry) has already been freed, a UAF kernel paging request occurs. fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release the dst reference before the skb is queued in virtio_net. Call Trace: Unable to handle kernel paging request at virtual address ffff80007e150000 CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT ... percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P) dst_release+0xe0/0x110 net/core/dst.c:177 skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177 sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255 dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469 napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527 __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net] free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net] start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net] ... Reproduction Steps: NETDEV="enp3s0" config_qdisc_route_filter() { tc qdisc del dev $NETDEV root tc qdisc add dev $NETDEV root handle 1: prio tc filter add dev $NETDEV parent 1:0 \ protocol ip prio 100 route to 100 flowid 1:1 ip route add 192.168.1.100/32 dev $NETDEV realm 100 } test_ns() { ip netns add testns ip link set $NETDEV netns testns ip netns exec testns ifconfig $NETDEV 10.0.32.46/24 ip netns exec testns ping -c 1 10.0.32.1 ip netns del testns } config_qdisc_route_filter test_ns sleep 2 test_ns |
CVE-2026-31469
|
| VCID-hq39-2qnw-v3dw | In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix circular locking dependency in nci_close_device nci_close_device() flushes rx_wq and tx_wq while holding req_lock. This causes a circular locking dependency because nci_rx_work() running on rx_wq can end up taking req_lock too: nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete -> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target -> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock) Move the flush of rx_wq after req_lock has been released. This should safe (I think) because NCI_UP has already been cleared and the transport is closed, so the work will see it and return -ENETDOWN. NIPA has been hitting this running the nci selftest with a debug kernel on roughly 4% of the runs. |
CVE-2026-31509
|
| VCID-hq3g-bdce-uydf | kernel: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() |
CVE-2024-58083
|
| VCID-hq7x-1csm-p3bv | kernel: driver core: bus: Fix double free in driver API bus_register() |
CVE-2024-50055
|
| VCID-hqpz-xjuf-vfa8 | kernel: Linux kernel (openvswitch): Denial of Service and limited data exposure via improper key length validation |
CVE-2025-37789
|
| VCID-hqza-kea9-zyb3 | kernel: wifi: wl1251: fix memory leak in wl1251_tx_work |
CVE-2025-37982
|
| VCID-hrfs-afba-23d3 | kernel: afs: Fix the maximum cell name length |
CVE-2025-21646
|
| VCID-hrt2-d16s-tfay | kernel: fbdev: omapfb: Add 'plane' value check |
CVE-2025-37851
|
| VCID-hs28-3xmc-z7gj | kernel: block, bfq: fix possible UAF for bfqq->bic with merge chain |
CVE-2024-47706
|
| VCID-hs97-693z-mqhk | kernel: cpufreq/longhaul: handle NULL policy in longhaul_exit |
CVE-2025-68177
|
| VCID-hsbj-gdmg-vuat | kernel: net: ethernet: ti: am65-cpsw: Fix PM runtime leakage in am65_cpsw_nuss_ndo_slave_open() |
CVE-2022-50461
|
| VCID-hspq-25gx-wugp | kernel: leds: led-class: Only Add LED to leds_list when it is fully ready |
CVE-2026-23101
|
| VCID-ht91-mhhg-63e1 | kernel: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv |
CVE-2024-57892
|
| VCID-htnj-8ner-hkcp | kernel: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group |
CVE-2024-35790
|
| VCID-htqg-96nd-1bfa | kernel: drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails |
CVE-2024-44982
|
| VCID-htyr-jnu7-e3gf | kernel: drm/msm/dpu: Add mutex lock in control vblank irq |
CVE-2023-52586
|
| VCID-hu4f-e8qk-8fbz | kernel: fs: quota: create dedicated workqueue for quota_release_work |
CVE-2025-40196
|
| VCID-hucp-gu2u-97e1 | hw: amd: Instruction raise #VC exception at exit |
CVE-2024-25743
|
| VCID-hv12-tgt6-rub5 | kernel: sched/deadline: Fix task_struct reference leak |
CVE-2024-41023
|
| VCID-hvmc-h5fr-nqg3 | kernel: mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable() |
CVE-2024-42319
|
| VCID-hvqy-8srw-mybs | kernel: nfsd: put dl_stid if fail to queue dl_recall |
CVE-2025-22025
|
| VCID-hwat-fnmq-vydn | kernel: userfaultfd: fix checks for huge PMDs |
CVE-2024-46787
|
| VCID-hwcn-bnd9-e7c7 | kernel: cgroup: split cgroup_destroy_wq into 3 workqueues |
CVE-2025-39953
|
| VCID-hwgj-auch-vbb7 | kernel: ima: Fix use-after-free on a dentry's dname.name |
CVE-2024-39494
|
| VCID-hwqf-vtx4-jycu | kernel: Bluetooth: qca: add missing firmware sanity checks |
CVE-2024-36880
|
| VCID-hwzq-uha1-xyh2 | kernel: net/mlx5e: Avoid field-overflowing memcpy() |
CVE-2022-48744
|
| VCID-hx3m-yvh9-tbf3 | kernel: scsi: target: iscsi: Fix a race condition between login_work and the login thread |
CVE-2022-50350
|
| VCID-hx57-qb6n-bfba | kernel: PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init() |
CVE-2024-43824
|
| VCID-hxdv-tgyq-pkg5 | kernel: net: atlantic: eliminate double free in error handling logic |
CVE-2023-52664
|
| VCID-hxj2-cvvc-tqec | kernel: cgroup/cpuset: remove kernfs active break |
CVE-2025-21634
|
| VCID-hxjx-3the-x3ff | kernel: use-after-free in smb2_is_status_io_timeout() |
CVE-2023-1192
|
| VCID-hxx1-r138-1bbh | kernel: usb: typec: displayport: Fix potential deadlock |
CVE-2025-38404
|
| VCID-hxys-7j8y-aqft | kernel: cifs: fix potential memory leaks in session setup |
CVE-2023-53008
|
| VCID-hybu-7279-dqg8 | Backend can crash Linux netfront |
CVE-2024-53240
|
| VCID-hzhd-xvw4-g3hv | kernel: NFSD: fix race between nfsd registration and exports_proc |
CVE-2025-38232
|
| VCID-hzmg-udjd-5kfg | kernel: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() |
CVE-2025-40115
|
| VCID-j12u-u3h9-7kay | kernel: dm cache: fix out-of-bounds access to the dirty bitset when resizing |
CVE-2024-50279
|
| VCID-j167-3jme-h7d6 | kernel: dm cache: prevent BUG_ON by blocking retries on failed device resumes |
CVE-2025-38066
|
| VCID-j1d8-n694-wfc6 | kernel: dm: fix NULL pointer dereference in __dm_suspend() |
CVE-2025-40134
|
| VCID-j1gx-dp1w-7fct | kernel: drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling |
CVE-2025-38467
|
| VCID-j1um-9nym-muh4 | kernel: efi: Don't map the entire mokvar table to determine its size |
CVE-2025-21872
|
| VCID-j22f-mbqe-a7dk | x86: Transitive Scheduler Attacks |
CVE-2024-36350
|
| VCID-j2ub-8bz4-4kfj | kernel: kcsan: Avoid READ_ONCE() in read_instrumented_memory() |
CVE-2023-53742
|
| VCID-j2ya-2dnx-3qd9 | kernel: bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers |
CVE-2023-52621
|
| VCID-j4pn-ck3q-byb7 | kernel: macvlan: fix error recovery in macvlan_common_newlink() |
CVE-2026-23209
|
| VCID-j5qv-wuw6-2yah | kernel: Linux kernel (btrfs): Denial of Service due to unexpected metadata generation |
CVE-2025-39800
|
| VCID-j5tn-m58h-vbfz | kernel: mtd: rawnand: brcmnand: fix PM resume warning |
CVE-2025-37840
|
| VCID-j76y-m4es-4yej | kernel: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change |
CVE-2024-50044
|
| VCID-j7c3-n2w7-fbg4 | kernel: f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode |
CVE-2025-38626
|
| VCID-j7gm-3zmx-bfd4 | kernel: calipso: Don't call calipso functions for AF_INET sk. |
CVE-2025-38147
|
| VCID-j7pj-y7rh-qka3 | kernel: ionic: catch failure from devlink_alloc |
CVE-2023-53470
|
| VCID-j7ve-nvz1-jqd1 | kernel: drm/i915/gem: Fix Virtual Memory mapping boundaries calculation |
CVE-2024-42259
|
| VCID-j8st-m7m5-7kbg | kernel: i2c: dev: check return value when calling dev_set_name() |
CVE-2022-49046
|
| VCID-j9gx-qj2u-z3e8 | kernel: f2fs: invalidate dentry cache on failed whiteout creation |
CVE-2025-71069
|
| VCID-j9tf-d5qg-6fgq | kernel: gfs2: Fix unlikely race in gdlm_put_lock |
CVE-2025-40242
|
| VCID-jakw-x3hg-u3b2 | kernel: netfilter: nf_tables: skip netdev events generated on netns removal |
CVE-2021-47452
|
| VCID-jamx-hf6t-bfcd | kernel: Linux kernel: Denial of service and memory corruption in RDMA umad |
CVE-2026-23243
|
| VCID-japp-mkvp-5qcj | kernel: usb: typec: altmodes/displayport: do not index invalid pin_assignments |
CVE-2025-38391
|
| VCID-jb7c-wux6-jkfh | kernel: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free |
CVE-2024-49983
|
| VCID-jbcp-t4z6-huep | kernel: HID: core: zero-initialize the report buffer |
CVE-2024-50302
|
| VCID-jbk8-b5z4-kuhq | kernel: r8169: add tally counter fields added with RTL8125 |
CVE-2024-49973
|
| VCID-jbkc-8tms-33g8 | kernel: sch/netem: fix use after free in netem_dequeue |
CVE-2024-46800
|
| VCID-jbs2-t7yr-rqh3 | kernel: pktgen: use cpus_read_lock() in pg_net_init() |
CVE-2024-46681
|
| VCID-jbyd-zxvz-mkf2 | kernel: bpf: check changes_pkt_data property for extension programs |
CVE-2024-58100
|
| VCID-jc5k-3959-q3bd | kernel: f2fs: fix return value of f2fs_recover_fsync_data() |
CVE-2025-68769
|
| VCID-jcb6-a7sq-wbef | kernel: spufs: fix gang directory lifetimes |
CVE-2025-22072
|
| VCID-jcja-9xpd-gqb5 | kernel: usbnet: Fix using smp_processor_id() in preemptible code warnings |
CVE-2025-40164
|
| VCID-jd9b-ge7g-6yfz | kernel: fsnotify: do not generate ACCESS/MODIFY events on child for special files |
CVE-2025-68788
|
| VCID-jda2-k7b7-eyfb | kernel: octeontx2-pf: Fix SQE threshold checking |
CVE-2022-49858
|
| VCID-jdjk-pv6p-skct | kernel: scsi: qla2xxx: Fix crash during module load unload test |
CVE-2022-49160
|
| VCID-jdvy-dtyx-ykd9 | kernel: drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices |
CVE-2025-40288
|
| VCID-jdy5-6s2h-d7ad | kernel: neighbour: use RCU protection in __neigh_notify() |
CVE-2025-21763
|
| VCID-je4j-ksj2-hqb3 | kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. |
CVE-2025-40271
|
| VCID-jfhr-2499-83ag | kernel: powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC |
CVE-2025-21866
|
| VCID-jfqx-caab-tqcr | kernel: media: venus: hfi_parser: refactor hfi packet parsing logic |
CVE-2025-23156
|
| VCID-jfrf-qe3s-gbax | kernel: drm/amd/display: Check stream_status before it is used |
CVE-2024-49893
|
| VCID-jftr-apzy-rkdh | kernel: bpf: Prevent tail call between progs attached to different hooks |
CVE-2024-50063
|
| VCID-jfyb-pwuz-8qh9 | kernel: net: openvswitch: fix middle attribute validation in push_nsh() action |
CVE-2025-68785
|
| VCID-jgaw-mgbm-sfaf | kernel: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop |
CVE-2025-40180
|
| VCID-jgke-4yqg-s7g7 | kernel: drm/amd/display: Check null pointers before used |
CVE-2024-49921
|
| VCID-jgkq-gyu6-byhk | kernel: mptcp: fix possible stall on recvmsg() |
CVE-2021-47448
|
| VCID-jh9c-runn-wufe | kernel: net: enetc: deny offload of tc-based TSN features on VF interfaces |
CVE-2022-48645
|
| VCID-jhvu-tacv-vugb | kernel: drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation |
CVE-2024-49895
|
| VCID-jhz4-z9f5-4ka3 | kernel: parisc: Avoid crash due to unaligned access in unwinder |
CVE-2025-68322
|
| VCID-jj1e-5cxb-qffe | kernel: Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" |
CVE-2024-53127
|
| VCID-jj1y-6xej-qkck | kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw |
CVE-2025-38200
|
| VCID-jj78-a4gk-wudp | kernel: uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind |
CVE-2024-46739
|
| VCID-jkh3-5rm3-8bh7 | kernel: net/mlx5: Check device memory pointer before usage |
CVE-2025-38645
|
| VCID-jkjc-cybb-c7fw | kernel: kprobes: Fix check for probe enabled in kill_kprobe() |
CVE-2022-50266
|
| VCID-jkyn-ks16-8bew | kernel: net: dsa: seville: register the mdiobus under devres |
CVE-2022-48814
|
| VCID-jme4-kexy-v3fw | kernel: memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() |
CVE-2024-58034
|
| VCID-jnrk-j45s-5bf4 | kernel: NFSD: NFSv4 file creation neglects setting ACL |
CVE-2025-68803
|
| VCID-jnsp-4jt9-aqas | kernel: dm cache: fix potential out-of-bounds access on the first resume |
CVE-2024-50278
|
| VCID-jnth-yxuv-mbfs | kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() |
CVE-2025-22121
|
| VCID-jnyg-gn1n-u3fy | kernel: jfs: array-index-out-of-bounds fix in dtReadFirst |
CVE-2024-56598
|
| VCID-jp27-uba5-mkfu |
CVE-2026-23403
|
|
| VCID-jq5d-nnun-afh5 | kernel: xtensa: simdisk: add input size check in proc_write_simdisk |
CVE-2025-40193
|
| VCID-jqce-dpfy-wkgd | kernel: drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check |
CVE-2024-56777
|
| VCID-jqj4-v13b-2beq | kernel: net: usb: lan78xx: Limit packet length to skb->len |
CVE-2023-53068
|
| VCID-jqm5-psje-myf1 | kernel: ext4: fix timer use-after-free on failed mount |
CVE-2024-49960
|
| VCID-jry6-1zmd-rbdq | kernel: net: marvell: prestera: fix NULL dereference on devlink_alloc() failure |
CVE-2026-23019
|
| VCID-jsmv-a8gz-1bfn | kernel: smb: client: fix potential UAF in smb2_is_valid_lease_break() |
CVE-2024-35864
|
| VCID-jta8-3kg4-8yce | kernel: mac802154: check local interfaces before deleting sdata list |
CVE-2024-57948
|
| VCID-jtfa-c7ay-vfh9 | kernel: jfs: reject on-disk inodes of an unsupported type |
CVE-2025-37925
|
| VCID-jtzh-kcck-e3bq | kernel: Input: MT - limit max slots |
CVE-2024-45008
|
| VCID-jupy-x3sh-vqcp | kernel: bpf: Remove tst_run from lwt_seg6local_prog_ops. |
CVE-2024-46754
|
| VCID-juqm-qh8k-bugz | kernel: xfs: don't walk off the end of a directory data block |
CVE-2024-41013
|
| VCID-jv56-nqp5-3bas | kernel: iommu/amd: Avoid stack buffer overflow from kernel cmdline |
CVE-2025-38676
|
| VCID-jvv4-j5x1-dbd6 | kernel: bpf: track changes_pkt_data property for global functions |
CVE-2024-58098
|
| VCID-jw48-xea4-mkdt | kernel: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links |
CVE-2024-46816
|
| VCID-jw6e-24ag-3ucs | kernel: can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open |
CVE-2024-46791
|
| VCID-jwwm-wmzm-wuaz | kernel: net: let net.core.dev_weight always be non-zero |
CVE-2025-21806
|
| VCID-jx72-vpup-p3gk | kernel: f2fs: fix potential deadloop in prepare_compress_overwrite() |
CVE-2025-22127
|
| VCID-jx77-wef2-n3hz | kernel: net/sched: ets: Remove drr class from the active list if it changes to strict |
CVE-2025-68815
|
| VCID-jxkv-jbh3-9fhj | kernel: drm/amd/display: add null check |
CVE-2025-39762
|
| VCID-jxqg-n8d6-pkd9 | kernel: pps: fix warning in pps_register_cdev when register device fail |
CVE-2025-40070
|
| VCID-jymf-yew4-9bdw | kernel: media: venus: fix use after free in vdec_close |
CVE-2024-42313
|
| VCID-jz2j-4jqz-8fdg | kernel: btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids() |
CVE-2024-50217
|
| VCID-jzdj-2xqf-dbhp | kernel: parisc: Fix random data corruption from exception handler |
CVE-2024-26706
|
| VCID-jzfn-k82f-s3fw | kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl |
CVE-2023-31083
|
| VCID-jzxs-k6k4-vqhw | kernel: nilfs2: Fix potential block overflow that cause system hang |
CVE-2025-71237
|
| VCID-k133-xqmd-vqhr | x86: Cross-Thread Return Address Predictions |
CVE-2022-27672
XSA-426 |
| VCID-k1an-7f75-abcv | kernel: hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() |
CVE-2024-42311
|
| VCID-k1v3-945q-47eh | kernel: macvlan: observe an RCU grace period in macvlan_common_newlink() error path |
CVE-2026-23273
|
| VCID-k248-wexm-7kcq | kernel: s390/idle: mark arch_cpu_idle() noinstr |
CVE-2023-53859
|
| VCID-k27q-9kcv-3fgh | kernel: f2fs: don't set RO when shutting down f2fs |
CVE-2024-40969
|
| VCID-k29n-spa9-uqdz | kernel: ethtool: fail closed if we can't get max channel used in indirection tables |
CVE-2024-46834
|
| VCID-k2sk-kzzt-77gj | kernel: net/sched: act_ife: avoid possible NULL deref |
CVE-2026-23064
|
| VCID-k4ed-hzk1-mfe9 | kernel: ipv6: reject malicious packets in ipv6_gso_segment() |
CVE-2025-38572
|
| VCID-k4sb-bps3-tkha | kernel: wifi: rtl818x: Kill URBs before clearing tx status queue |
CVE-2025-38604
|
| VCID-k68k-tnns-mkga | kernel: ipv4: start using dst_dev_rcu() |
CVE-2025-40074
|
| VCID-k6b5-6xca-v7b5 | kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() |
CVE-2025-21861
|
| VCID-k6fe-6ykb-4ffu | kernel: crypto: qat - add param check for RSA |
CVE-2022-49563
|
| VCID-k71s-34m9-73gh | kernel: usb: cdns3: Fix deadlock when using NCM gadget |
CVE-2025-37812
|
| VCID-k756-peeq-efeg | kernel: most: usb: hdm_probe: Fix calling put_device() before device initialization |
CVE-2025-68249
|
| VCID-k7bs-2d35-tya2 | kernel: mtd: inftlcore: Add error check for inftl_read_oob() |
CVE-2025-37892
|
| VCID-k7h8-fsse-9kes | kernel: smb: client: Fix refcount leak for cifs_sb_tlink |
CVE-2025-40103
|
| VCID-k8g1-evfe-33e3 | kernel: Linux kernel (media: b2c2): Use-after-free vulnerability in flexcop_pci_remove leading to denial of service. |
CVE-2025-39996
|
| VCID-k8y7-5aj8-pbdq | kernel: software node: Correct a OOB check in software_node_get_reference_args() |
CVE-2025-38342
|
| VCID-k9e5-ykzu-qyew | kernel: drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe |
CVE-2024-49914
|
| VCID-k9sg-urdd-ukby | In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer that gets written out. If this bit is set using commands like "sg_write_same --ndob" we will crash in target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because its NULL. This patch adds a check for the NDOB bit in the common WRITE SAME code because we don't support it. And, it adds a check for zero SG elements in each handler in case the initiator tries to send a normal WRITE SAME with no data buffer. |
CVE-2022-21546
|
| VCID-k9uk-dme2-qkah | kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation |
CVE-2026-23105
|
| VCID-k9ux-pe12-87h5 | kernel: USB: dwc3: fix memory leak with using debugfs_lookup() |
CVE-2023-53415
|
| VCID-k9yz-p7ch-vua1 | kernel: s390/qeth: Fix kernel panic after setting hsuid |
CVE-2024-36928
|
| VCID-ka3s-uc76-6kaj | kernel: f2fs: fix to avoid updating zero-sized extent in extent cache |
CVE-2025-68796
|
| VCID-ka48-d7h2-kkbj | kernel: drm/tegra: Fix a possible null pointer dereference |
CVE-2025-38363
|
| VCID-ka7q-cx4u-rkar | kernel: nvme-fabrics: use reserved tag for reg read/write command |
CVE-2024-41082
|
| VCID-kaa6-ay3m-aydg | kernel: scsi: hisi_sas: Add cond_resched() for no forced preemption model |
CVE-2024-56589
|
| VCID-kag7-2z1b-83a7 | kernel: rcu: Protect ->defer_qs_iw_pending from data race |
CVE-2025-39749
|
| VCID-kbc5-2ek1-gfbd | kernel: trace/fgraph: Fix the warning caused by missing unregister notifier |
CVE-2025-39829
|
| VCID-kbnx-47cx-f3eq | kernel: gtp: fix a potential NULL pointer dereference |
CVE-2024-46677
|
| VCID-kc2h-81ye-mfdk | kernel: drm/amd/display: fix double free issue during amdgpu module unload |
CVE-2024-49989
|
| VCID-kcca-um99-4ugp | kernel: dlm: fix possible lkb_resource null dereference |
CVE-2024-47809
|
| VCID-kcce-wptw-myd5 | kernel: Input: ti_am335x_tsc - fix off-by-one error in wire_order validation |
CVE-2025-68777
|
| VCID-kcmk-1zxh-2yhv | kernel: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs |
CVE-2026-23340
|
| VCID-kd42-ujcf-wucd | kernel: HSI: ssi_protocol: fix potential resource leak in ssip_pn_open() |
CVE-2022-50708
|
| VCID-kdec-c9h3-7fb8 | kernel: xfs: do not propagate ENODATA disk errors into xattr code |
CVE-2025-39835
|
| VCID-kdf1-9mq7-2ue6 | kernel: i2c: lpi2c: Avoid calling clk_get_rate during transfer |
CVE-2024-40965
|
| VCID-kdmz-w6db-7ue2 | In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check cdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE entries fit within the skb. The first check correctly accounts for ndpoffset: if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) > skb_in->len) but the second check omits it: if ((sizeof(struct usb_cdc_ncm_ndp16) + ret * (sizeof(struct usb_cdc_ncm_dpe16))) > skb_in->len) This validates the DPE array size against the total skb length as if the NDP were at offset 0, rather than at ndpoffset. When the NDP is placed near the end of the NTB (large wNdpIndex), the DPE entries can extend past the skb data buffer even though the check passes. cdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating the DPE array. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. |
CVE-2026-23448
|
| VCID-kdvm-b3gx-dqhq | kernel: ARM: tegra: Use I/O memcpy to write to IRAM |
CVE-2025-39794
|
| VCID-kg68-d4bz-p3gp | kernel: net/smc: Forward wakeup to smc socket waitqueue after fallback |
CVE-2022-48721
|
| VCID-kg8v-183b-33ce | kernel: rxrpc: Fix delayed ACKs to not set the reference serial number |
CVE-2024-26677
|
| VCID-kg9t-9mf7-4bgc | kernel: locking/spinlock/debug: Fix data-race in do_raw_write_lock |
CVE-2025-68336
|
| VCID-kgk8-s2nb-vyey | kernel: media: mediatek: vcodec: prevent kernel crash when rmmod mtk-vcodec-dec.ko |
CVE-2022-49496
|
| VCID-kgsp-pkj4-s7bb | kernel: regmap: slimbus: fix bus_context pointer in regmap init calls |
CVE-2025-40317
|
| VCID-kgv3-f25s-ckd5 | kernel: Linux kernel KVM: Denial of Service due to uninitialized vCPU event handling |
CVE-2025-40102
|
| VCID-kh7e-94ey-c7bm | kernel: net: af_can: do not leave a dangling sk pointer in can_create() |
CVE-2024-56603
|
| VCID-khjv-e1th-muhd | kernel: bpf: Do not let BPF test infra emit invalid GSO types to stack |
CVE-2025-68725
|
| VCID-khrd-ya2n-rygv | kernel: net/sched: flower: Fix chain template offload |
CVE-2024-26669
|
| VCID-khxv-7jjh-8ua6 | kernel: parport: Proper fix for array out-of-bounds access |
CVE-2024-50074
|
| VCID-kj4q-41ch-2bdx | kernel: Linux kernel: uvcvideo Denial of Service from invalid UVC entity IDs |
CVE-2025-40016
|
| VCID-kj93-nwk2-sbd9 | kernel: nilfs2: propagate directory read errors from nilfs_find_entry() |
CVE-2024-50202
|
| VCID-kje2-4fqw-57gh | kernel: net_sched: ets: Fix double list add in class with netem as child qdisc |
CVE-2025-37914
|
| VCID-kjn8-9h7n-dfab | kernel: net: phy: phy_device: Prevent nullptr exceptions on ISR |
CVE-2024-35945
|
| VCID-kjpr-c6d7-d3dt | kernel: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() |
CVE-2025-38680
|
| VCID-kk6m-vhxv-y3fw | kernel: NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() |
CVE-2024-50046
|
| VCID-kkc5-qny7-7bgx | kernel: blk-iocost: do not WARN if iocg was already offlined |
CVE-2024-36908
|
| VCID-km8c-x3g5-fkhb | kernel: team: prevent adding a device which is already a team device lower |
CVE-2024-58071
|
| VCID-kmmf-ztaw-bkay | kernel: sctp: sysctl: rto_min/max: avoid using current->nsproxy |
CVE-2025-21639
|
| VCID-kn25-f6gk-93fd | kernel: drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401 |
CVE-2024-43901
|
| VCID-kn32-aqhq-k7c5 | In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: serialize lock/unlock against other NAND operations nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area without holding the NAND device lock. On controllers that implement SET_FEATURES via multiple low-level PIO commands, these can race with concurrent UBI/UBIFS background erase/write operations that hold the device lock, resulting in cmd_pending conflicts on the NAND controller. Add nand_get_device()/nand_release_device() around the lock/unlock operations to serialize them against all other NAND controller access. |
CVE-2026-23434
|
| VCID-kn3f-5wuh-4bfq | kernel: Linux kernel: Denial of Service via unchecked return value in mmc_add_host() |
CVE-2022-50267
|
| VCID-kn6p-6kay-zybr | kernel: iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer |
CVE-2024-56557
|
| VCID-kn7r-e31k-abbz | kernel: gve: Fix stats report corruption on queue count change |
CVE-2026-23262
|
| VCID-knpf-c5j6-tfd2 | kernel: uaccess: fix integer overflow on access_ok() |
CVE-2022-49289
|
| VCID-kns4-65da-v3bc | In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix cache_request leak in cache_release When a reader's file descriptor is closed while in the middle of reading a cache_request (rp->offset != 0), cache_release() decrements the request's readers count but never checks whether it should free the request. In cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the cache_request is removed from the queue and freed along with its buffer and cache_head reference. cache_release() lacks this cleanup. The only other path that frees requests with readers == 0 is cache_dequeue(), but it runs only when CACHE_PENDING transitions from set to clear. If that transition already happened while readers was still non-zero, cache_dequeue() will have skipped the request, and no subsequent call will clean it up. Add the same cleanup logic from cache_read() to cache_release(): after decrementing readers, check if it reached 0 with CACHE_PENDING clear, and if so, dequeue and free the cache_request. |
CVE-2026-31400
|
| VCID-kp46-11g7-uybk | kernel: bpf: fix potential 32-bit overflow when accessing ARRAY map element |
CVE-2022-50167
|
| VCID-kpa1-ugme-37g7 | kernel: nfsd: make sure exp active before svc_export_show |
CVE-2024-56558
|
| VCID-kpkx-qwue-bff4 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the netlink dump callback ctnetlink_exp_ct_dump_table(), but drops the conntrack reference immediately after netlink_dump_start(). When the dump spans multiple rounds, the second recvmsg() triggers the dump callback which dereferences the now-freed conntrack via nfct_help(ct), leading to a use-after-free on ct->ext. The bug is that the netlink_dump_control has no .start or .done callbacks to manage the conntrack reference across dump rounds. Other dump functions in the same file (e.g. ctnetlink_get_conntrack) properly use .start/.done callbacks for this purpose. Fix this by adding .start and .done callbacks that hold and release the conntrack reference for the duration of the dump, and move the nfct_help() call after the cb->args[0] early-return check in the dump callback to avoid dereferencing ct->ext unnecessarily. BUG: KASAN: slab-use-after-free in ctnetlink_exp_ct_dump_table+0x4f/0x2e0 Read of size 8 at addr ffff88810597ebf0 by task ctnetlink_poc/133 CPU: 1 UID: 0 PID: 133 Comm: ctnetlink_poc Not tainted 7.0.0-rc2+ #3 PREEMPTLAZY Call Trace: <TASK> ctnetlink_exp_ct_dump_table+0x4f/0x2e0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 ? aa_sk_perm+0x184/0x450 sock_recvmsg+0xde/0xf0 Allocated by task 133: kmem_cache_alloc_noprof+0x134/0x440 __nf_conntrack_alloc+0xa8/0x2b0 ctnetlink_create_conntrack+0xa1/0x900 ctnetlink_new_conntrack+0x3cf/0x7d0 nfnetlink_rcv_msg+0x48e/0x510 netlink_rcv_skb+0xc9/0x1f0 nfnetlink_rcv+0xdb/0x220 netlink_unicast+0x3ec/0x590 netlink_sendmsg+0x397/0x690 __sys_sendmsg+0xf4/0x180 Freed by task 0: slab_free_after_rcu_debug+0xad/0x1e0 rcu_core+0x5c3/0x9c0 |
CVE-2026-23458
|
| VCID-kpmu-3eea-g3ac | kernel: scsi: core: Fix scsi_mode_sense() buffer length handling |
CVE-2021-47182
|
| VCID-kptu-sm1d-kuae | kernel: drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer |
CVE-2024-49919
|
| VCID-kqv9-ss23-efhp | kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() |
CVE-2025-68285
|
| VCID-kr5h-tdtm-7uaa | kernel: drbd: add missing kref_get in handle_write_conflicts |
CVE-2025-38708
|
| VCID-ksaf-6va1-a3cd | kernel: xsk: Fix race at socket teardown |
CVE-2022-49215
|
| VCID-ksjz-df96-hyar | kernel: wifi: iwlwifi: mvm: Fix a memory corruption issue |
CVE-2023-52531
|
| VCID-kt32-zwc3-qycb | kernel: intel_th: fix device leak on output open() |
CVE-2026-23091
|
| VCID-ktqu-3423-eyaj | kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path |
CVE-2025-39841
|
| VCID-ktsr-nq3s-33gt | kernel: wifi: rtw88: Fix memory leak in rtw88_usb |
CVE-2023-53529
|
| VCID-ku1z-m6v1-n3dn | kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb |
CVE-2025-71082
|
| VCID-ku4g-w17j-xfe6 | kernel: Linux kernel: Denial of Service in btrfs due to use-after-free vulnerability |
CVE-2022-50300
|
| VCID-kuce-ewwr-pbf1 | kernel: wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() |
CVE-2023-52593
|
| VCID-kukb-wvwk-h7ab | kernel: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() |
CVE-2024-47713
|
| VCID-kv4f-h7zy-2yhd | kernel: rxrpc: Fix recv-recv race of completed call |
CVE-2025-38524
|
| VCID-kvbv-df49-gyaj | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size was calculated based on OPEN responses and does not account for LOCK denied responses, which include the conflicting lock owner as a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT). When a LOCK operation is denied due to a conflict with an existing lock that has a large owner, nfsd4_encode_operation() copies the full encoded response into the undersized replay buffer via read_bytes_from_xdr_buf() with no bounds check. This results in a slab-out-of-bounds write of up to 944 bytes past the end of the buffer, corrupting adjacent heap memory. This can be triggered remotely by an unauthenticated attacker with two cooperating NFSv4.0 clients: one sets a lock with a large owner string, then the other requests a conflicting lock to provoke the denial. We could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full opaque, but that would increase the size of every stateowner, when most lockowners are not that large. Instead, fix this by checking the encoded response length against NFSD4_REPLAY_ISIZE before copying into the replay buffer. If the response is too large, set rp_buflen to 0 to skip caching the replay payload. The status is still cached, and the client already received the correct response on the original request. |
CVE-2026-31402
|
| VCID-kvhw-dg66-8kh1 | kernel: bpf: fix recursive lock when verdict program return SK_PASS |
CVE-2024-56694
|
| VCID-kvhw-j7bk-kfhn | kernel: virtio-net: ensure the received length does not exceed allocated size |
CVE-2025-38375
|
| VCID-kw45-zrzn-d7bd | kernel: ALSA: asihpi: Fix potential OOB array access |
CVE-2024-50007
|
| VCID-kwrf-5vwg-f3am | kernel: exfat: fix potential deadlock on __exfat_get_dentry_set |
CVE-2024-42315
|
| VCID-kwsw-kd2b-buet | kernel: team: Move team device type change at the end of team_port_add |
CVE-2025-68340
|
| VCID-kwym-cw3g-9bb3 | kernel: serial: Fix potential null-ptr-deref in mlb_usio_probe() |
CVE-2025-38135
|
| VCID-kx41-d7dc-vqdk | kernel: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc |
CVE-2024-58009
|
| VCID-kx5p-87fs-9kgw | kernel: drm/amdgpu: Add basic validation for RAS header |
CVE-2025-38426
|
| VCID-kx7x-apxf-zkd8 | kernel: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() |
CVE-2025-37829
|
| VCID-ky39-4h4a-qbgb | kernel: net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write |
CVE-2025-71079
|
| VCID-kyr3-h9z5-1ugx | kernel: fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref |
CVE-2025-38630
|
| VCID-kyru-d7tb-hyf3 | kernel: rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow |
CVE-2024-38577
|
| VCID-kys7-kwvw-tkfg | kernel: static_call: Handle module init failure correctly in static_call_del_module() |
CVE-2024-50002
|
| VCID-kz32-nscg-zyan | kernel: btrfs: fix reservation leak in some error paths when inserting inline extent |
CVE-2025-71268
|
| VCID-kzc2-uaxs-f7an | kernel: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() |
CVE-2025-21780
|
| VCID-kzjr-zfse-mfag | kernel: drm/sti: avoid potential dereference of error pointers |
CVE-2024-56776
|
| VCID-kzsr-8hjr-gkf1 | kernel: drm/amd/display: Do not return negative stream id for array |
CVE-2024-42118
|
| VCID-m17u-x4qf-rber | kernel: f2fs: use spin_lock to avoid hang |
CVE-2022-49169
|
| VCID-m1k4-4aj5-g3ae | kernel: net/sched: ets: use old 'nbands' while purging unused classes |
CVE-2025-38684
|
| VCID-m1xb-9sru-bfch | kernel: nbd: defer config put in recv_work |
CVE-2025-68372
|
| VCID-m21d-1mj4-3bbn | kernel: drm/msm: Fix pgtable prealloc error path |
CVE-2025-40247
|
| VCID-m28d-uyxy-ukds | kernel: net: dsa: mv88e6xxx: Fix out-of-bound access |
CVE-2024-44988
|
| VCID-m2cm-t3tr-g3f1 | kernel: bpf: Scrub packet on bpf_redirect_peer |
CVE-2025-37959
|
| VCID-m2f1-4sgc-tuhv | kernel: macvlan: fix possible UAF in macvlan_forward_source() |
CVE-2026-23001
|
| VCID-m2f8-snwn-ekfj | kernel: tipc: Fix use-after-free of kernel socket in cleanup_bearer(). |
CVE-2024-56642
|
| VCID-m2rw-a6jq-cubv | kernel: RDMA/rtrs: Ensure 'ib_sge list' is accessible |
CVE-2024-36476
|
| VCID-m315-kf4r-5yg6 | kernel: net: dsa: qca8k: reset cpu port on MTU change |
CVE-2022-49654
|
| VCID-m3ch-q8dr-xkay | In the Linux kernel, the following vulnerability has been resolved: HID: asus: avoid memory leak in asus_report_fixup() The asus_report_fixup() function was returning a newly allocated kmemdup()-allocated buffer, but never freeing it. Switch to devm_kzalloc() to ensure the memory is managed and freed automatically when the device is removed. The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a pointer whose lifetime is at least that of the input buffer. Also fix a harmless out-of-bounds read by copying only the original descriptor size. |
CVE-2026-31524
|
| VCID-m3sr-b1me-4qa8 | kernel: tty: serial: uartlite: register uart driver in init |
CVE-2025-38262
|
| VCID-m3w2-9um2-tkev | kernel: drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() |
CVE-2025-37852
|
| VCID-m47a-avym-8ugx | kernel: sh: intc: Fix use-after-free bug in register_intc_controller() |
CVE-2024-53165
|
| VCID-m4hv-ynp2-hyh1 | kernel: comedi: c6xdigio: Fix invalid PNP driver unregistration |
CVE-2025-68332
|
| VCID-m4y2-16uk-wkdg | kernel: exfat: add cluster chain loop check for dir |
CVE-2025-38692
|
| VCID-m5bk-s7pe-cbd8 | kernel: drm/amd/display: Fix out-of-bound accesses |
CVE-2025-21985
|
| VCID-m5q1-e33e-83dy | kernel: ARM: 9170/1: fix panic when kasan and kprobe are enabled |
CVE-2021-47618
|
| VCID-m5y8-f4mw-ebdv | kernel: Linux kernel (jffs2): Denial of Service via invalid pointer dereference |
CVE-2025-38328
|
| VCID-m61j-cd51-9ff7 | kernel: can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow |
CVE-2025-39985
|
| VCID-m6h1-8erq-dqb8 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop l2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED state to support L2CAP reconfiguration (e.g. MTU changes). However, since both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from the initial configuration, the reconfiguration path falls through to l2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and retrans_list without freeing the previous allocations and sets chan->sdu to NULL without freeing the existing skb. This leaks all previously allocated ERTM resources. Additionally, l2cap_parse_conf_req() does not validate the minimum value of remote_mps derived from the RFC max_pdu_size option. A zero value propagates to l2cap_segment_sdu() where pdu_len becomes zero, causing the while loop to never terminate since len is never decremented, exhausting all available memory. Fix the double-init by skipping l2cap_ertm_init() and l2cap_chan_ready() when the channel is already in BT_CONNECTED state, while still allowing the reconfiguration parameters to be updated through l2cap_parse_conf_req(). Also add a pdu_len zero check in l2cap_segment_sdu() as a safeguard. |
CVE-2026-31498
|
| VCID-m6yv-nu11-ayg2 | kernel: drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue |
CVE-2024-26913
|
| VCID-m74c-j5a5-8ygw | kernel: netfilter: socket: Lookup orig tuple for IPv6 SNAT |
CVE-2025-22021
|
| VCID-m768-7wax-e3g9 | kernel: ipv6: Fix signed integer overflow in __ip6_append_data |
CVE-2022-49728
|
| VCID-m79p-1b2a-qub2 | kernel: bpf: Fix helper writes to read-only maps |
CVE-2024-49861
|
| VCID-m7cd-jefr-4ydy | kernel: exfat: fix out-of-bounds access of directory entries |
CVE-2024-53147
|
| VCID-m7k6-bz5t-e7h9 | kernel: net: nfc: nci: Add parameter validation for packet data |
CVE-2025-40043
|
| VCID-m8n7-j86u-7ugj | kernel: drm/amdkfd: range check cp bad op exception interrupts |
CVE-2024-36951
|
| VCID-m995-b8rn-tkgk | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation(). If the encoded length is 0, the decrement wraps to -1, which is then passed as a large value to the decoder, leading to an out-of-bounds read. Add a check to ensure len is positive after the decrement. |
CVE-2026-23455
|
| VCID-m9gn-tm7d-5yez | kernel: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() |
CVE-2025-39828
|
| VCID-m9us-wuhh-7fat | kernel: atm: idt77252: prevent use after free in dequeue_rx() |
CVE-2024-44998
|
| VCID-m9xm-6722-nyfd | kernel: jfs: validate AG parameters in dbMount() to prevent crashes |
CVE-2025-38230
|
| VCID-ma5j-14y6-6yeh | kernel: usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() |
CVE-2025-37881
|
| VCID-mabd-wtw3-v7g9 | kernel: comedi: multiq3: sanitize config options in multiq3_attach() |
CVE-2025-68258
|
| VCID-madz-x835-s7cy | In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: avoid memory leak in magicmouse_report_fixup() The magicmouse_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() does not take ownership of the returned pointer, but it *is* permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller. |
CVE-2026-31522
|
| VCID-maj4-mzfk-ufcs | kernel: ASoC: Intel: sof_sdw: handle errors on card registration |
CVE-2022-49617
|
| VCID-majy-fwzb-4uez | kernel: drop_monitor: fix incorrect initialization order |
CVE-2025-21862
|
| VCID-mawz-x44q-dub5 | kernel: drm/bridge: sii902x: Fix probing race issue |
CVE-2024-26607
|
| VCID-mdgm-tgef-1ycd | kernel: fsnotify: clear PARENT_WATCHED flags lazily |
CVE-2024-47660
|
| VCID-mdqz-89en-g3am | kernel: Linux kernel: Denial of service due to null pointer dereference in CALIPSO SYN cookie handling |
CVE-2025-38181
|
| VCID-mds2-9cem-5fg4 | kernel: proc: fix UAF in proc_get_inode() |
CVE-2025-21999
|
| VCID-merm-72uz-vbgk | kernel: Race condition in lpfc_unregister_fcf_rescan() in scsi/lpfc/lpfc_hbadisc.c |
CVE-2024-24855
|
| VCID-mew4-u7k6-r3ds | kernel: drm/amd: Guard against bad data for ATIF ACPI method |
CVE-2024-50117
|
| VCID-mgdk-1kyz-nubh | kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error |
CVE-2024-42284
|
| VCID-mgjc-55mm-kffq | kernel: mISDN: hfcpci: Fix warning when deleting uninitialized timer |
CVE-2025-39833
|
| VCID-mgk4-pwpy-zbhg | kernel: scsi: ufs: bsg: Set bsg_queue to NULL after removal |
CVE-2024-54458
|
| VCID-mhh3-rkn6-wbaf | kernel: mm/swapfile: skip HugeTLB pages for unuse_vma |
CVE-2024-50199
|
| VCID-mhs7-jens-j3ex | kernel: slimbus: core: fix device reference leak on report present |
CVE-2026-23090
|
| VCID-mhz3-9c5a-rbex | kernel: ocfs2: fix kernel BUG in ocfs2_find_victim_chain |
CVE-2025-68771
|
| VCID-mjff-dett-s3a6 | kernel: KVM: x86/mmu: Don't advance iterator after restart due to yielding |
CVE-2021-47094
|
| VCID-mjg7-gpnt-jbga | kernel: NFS: Fix the setting of capabilities when automounting a new filesystem |
CVE-2025-39798
|
| VCID-mjm9-b4xc-h3fj | kernel: 9p/xen: fix release of IRQ |
CVE-2024-56704
|
| VCID-mjmu-rtay-zqgx | kernel: KVM: s390: vsie: fix race during shadow creation |
CVE-2023-52639
|
| VCID-mky8-b7sf-xbb6 | kernel: clk: samsung: Fix UBSAN panic in samsung_clk_init() |
CVE-2025-39728
|
| VCID-mkzp-92f7-dkar | kernel: net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error |
CVE-2025-68220
|
| VCID-mm1u-nfnt-nkaf | kernel: net: enetc: fix the deadlock of enetc_mdio_lock |
CVE-2025-40347
|
| VCID-mmn7-wx55-cybj | kernel: net: rose: lock the socket in rose_bind() |
CVE-2025-21749
|
| VCID-mmsk-hbs4-mfd1 | kernel: powerpc/pseries: Fix use after free in remove_phb_dynamic() |
CVE-2022-49196
|
| VCID-mnqd-esg1-ybhz | kernel: rxrpc: Fix oops due to non-existence of prealloc backlog struct |
CVE-2025-38514
|
| VCID-mnrs-3agf-kbbr | kernel: usb: gadget: f_fs: Remove WARN_ON in functionfs_bind |
CVE-2024-57913
|
| VCID-mp87-833h-4uag | kernel: net: ibmveth: make veth_pool_store stop hanging |
CVE-2025-22053
|
| VCID-mpr2-avzs-zuhg | Xen hypercall page unsafe against speculative attacks |
CVE-2024-53241
|
| VCID-mpvz-us67-gkec | kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length |
CVE-2025-37810
|
| VCID-mq19-zcg3-6bf8 | kernel: mlxsw: spectrum: Guard against invalid local ports |
CVE-2022-49134
|
| VCID-mq6v-tfg7-hben | kernel: nilfs2: handle errors that nilfs_prepare_chunk() may return |
CVE-2025-21721
|
| VCID-mqez-cf51-97h9 | kernel: ARM: 9317/1: kexec: Make smp stop calls asynchronous |
CVE-2023-53712
|
| VCID-mrar-z3r4-qqat | kernel: iio: adc: ina2xx: avoid NULL pointer dereference on OF device match |
CVE-2023-53834
|
| VCID-mrh8-akgh-ybby | kernel: btrfs: ensure no dirty metadata is written back for an fs with errors |
CVE-2025-40303
|
| VCID-mrpn-w76g-6bfy | kernel: tcp: Fix data-races around sysctl_tcp_migrate_req. |
CVE-2022-49588
|
| VCID-msbv-kmj8-b7e8 | kernel: nouveau: lock the client object tree. |
CVE-2024-27062
|
| VCID-mu3y-rdt2-x3g1 | kernel: net: hns3: don't auto enable misc vector |
CVE-2025-21651
|
| VCID-mu97-p4wb-5qck | kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion |
CVE-2025-38459
|
| VCID-mun9-22yj-eqbf | kernel: media: mtk-vcodec: potential null pointer deference in SCP |
CVE-2024-40973
|
| VCID-muwb-5r4x-aqch | kernel: PCI: Fix use-after-free of slot->bus on hot remove |
CVE-2024-53194
|
| VCID-mw1y-1bts-myc8 | kernel: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() |
CVE-2024-50265
|
| VCID-mw62-5y92-3ffv | kernel: sched/deadline: only set free_cpus for online runqueues |
CVE-2025-68780
|
| VCID-mwrn-2c7n-d3gm | kernel: net: ethernet: lantiq_etop: fix memory disclosure |
CVE-2024-49997
|
| VCID-mwv3-k49q-tfeu | kernel: net: Fix icmp host relookup triggering ip_rt_bug |
CVE-2024-56647
|
| VCID-mx6w-xjjf-vqfq | kernel: soc: imx8m: Probe the SoC driver as platform driver |
CVE-2024-56787
|
| VCID-mxat-6jxc-2ufn | kernel: Linux kernel: Denial of Service in ems_usb CAN USB driver due to memory leak |
CVE-2026-23058
|
| VCID-mxb7-a88f-wycr | kernel: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start |
CVE-2024-49944
|
| VCID-mxk2-r3bg-gkfd | kernel: ax25: rcu protect dev->ax25_ptr |
CVE-2025-21812
|
| VCID-myjf-uqfn-b7bs | kernel: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels |
CVE-2023-53254
|
| VCID-myzt-t2h1-ubav | kernel: binder: fix UAF caused by offsets overwrite |
CVE-2024-46740
|
| VCID-mz34-5n9x-mke4 | kernel: printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX |
CVE-2024-58017
|
| VCID-mzeu-zsfq-j3d8 | kernel: comedi: check device's attached status in compat ioctls |
CVE-2025-68257
|
| VCID-mzw8-vbmv-6yay | kernel: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug |
CVE-2023-52629
|
| VCID-n14w-qv71-zbh3 | kernel: clk: sunxi-ng: Unregister clocks/resets when unbinding |
CVE-2021-47205
|
| VCID-n1q7-m5wp-2khh | kernel: binfmt_flat: Fix integer overflow bug on 32 bit systems |
CVE-2024-58010
|
| VCID-n1tb-u9us-57bv | kernel: Kernel: Race condition in espintcp can lead to denial of service |
CVE-2026-23239
|
| VCID-n1x1-k7cx-4kdx | kernel: RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency |
CVE-2024-47696
|
| VCID-n2ac-dtm2-sqa9 | kernel: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race |
CVE-2026-23271
|
| VCID-n2hd-5f9v-wyf6 | kernel: drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 |
CVE-2023-53707
|
| VCID-n2m1-pw4d-sqbz | kernel: tpm: Change to kvalloc() in eventlog/acpi.c |
CVE-2024-58005
|
| VCID-n2t8-afcr-sffj | kernel: bpf: Forget ranges when refining tnum after JSET |
CVE-2025-39748
|
| VCID-n2zh-7pv9-rfgj | kernel: f2fs: fix to check readonly condition correctly |
CVE-2023-54182
|
| VCID-n35j-xquk-vkhc | kernel: venus: pm_helpers: Fix warning in OPP during probe |
CVE-2022-50011
|
| VCID-n3w2-nens-ffbd | kernel: mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path |
CVE-2024-26595
|
| VCID-n469-h7yw-vqds | kernel: Bluetooth: When HCI work queue is drained, only queue chained work |
CVE-2022-50166
|
| VCID-n4as-tgyn-tyg2 | kernel: misc: fastrpc: fix possible map leak in fastrpc_put_args |
CVE-2025-40036
|
| VCID-n4hs-s6e7-f7c1 | kernel: btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info() |
CVE-2024-46751
|
| VCID-n4p8-dgkk-3bfr | kernel: udmabuf: change folios array from kmalloc to kvmalloc |
CVE-2024-56544
|
| VCID-n4pz-sy78-y3e8 | kernel: drm/bridge: Add missing pm_runtime_put_sync |
CVE-2022-49128
|
| VCID-n53s-j16b-cyfa | kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg |
CVE-2025-39964
|
| VCID-n5a9-5xpu-fqgd | kernel: f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() |
CVE-2025-37739
|
| VCID-n5mn-zb6b-h3h8 | kernel: padata: avoid UAF for reorder_work |
CVE-2025-21726
|
| VCID-n626-69jp-77cz | kernel: tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork |
CVE-2025-39913
|
| VCID-n6zy-gwsy-d3en | kernel: geneve: Fix use-after-free in geneve_find_dev(). |
CVE-2025-21858
|
| VCID-n7aa-q3kx-3qgg | kernel: net: vlan: don't propagate flags on open |
CVE-2025-23163
|
| VCID-n7kt-3rsy-rkg2 | kernel: Linux kernel: Denial of Service in USB-audio MIDI driver due to improper timer shutdown |
CVE-2025-38105
|
| VCID-n843-w2xt-8uc8 | kernel: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec |
CVE-2026-22998
|
| VCID-n87g-a5nj-7qeu | kernel: md/raid5: avoid BUG_ON() while continue reshape after reassembling |
CVE-2024-43914
|
| VCID-n88t-yc67-r3f5 | In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registration is not cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout array. `packet_release()` does NOT zero `po->num` in its `bind_lock` section. After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex` still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)` that already found the socket in `sklist` can re-register the hook. For fanout sockets, this re-registration calls `__fanout_link(sk, po)` which adds the socket back into `f->arr[]` and increments `f->num_members`, but does NOT increment `f->sk_ref`. The fix sets `po->num` to zero in `packet_release` while `bind_lock` is held to prevent NETDEV_UP from linking, preventing the race window. This bug was found following an additional audit with Claude Code based on CVE-2025-38617. |
CVE-2026-31504
|
| VCID-n8k4-hnt2-sbfy | kernel: orangefs: fix xattr related buffer overflow.. |
CVE-2025-40306
|
| VCID-na32-un6z-7fcb | kernel: sched/smt: Fix unbalance sched_smt_present dec/inc |
CVE-2024-44958
|
| VCID-na8r-byxv-qbhj | kernel: blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx |
CVE-2025-40125
|
| VCID-nama-uedh-b3fg | kernel: sctp: sysctl: auth_enable: avoid using current->nsproxy |
CVE-2025-21638
|
| VCID-nbnz-q819-f7g8 | kernel: netfilter: nf_tables: avoid chain re-validation if possible |
CVE-2025-71160
|
| VCID-nbx4-c3ht-2ygh | kernel: bfs: Reconstruct file type when loading from disk |
CVE-2025-68266
|
| VCID-ncy9-6whk-ckep | kernel: ALSA: usb-audio: Prevent excessive number of frames |
CVE-2026-23208
|
| VCID-nd41-sf8a-yqe3 | kernel: netrom: Fix memory leak in nr_sendmsg() |
CVE-2025-68787
|
| VCID-ndfh-x9yx-jbb1 | kernel: drm/amd/display: Check null pointer before dereferencing se |
CVE-2024-50049
|
| VCID-ndg7-qfdw-v3dn | kernel: tipc: Fix use-after-free in tipc_conn_close() |
CVE-2025-38464
|
| VCID-ndvj-m6t4-f7df | kernel: Input: ims-pcu - check record size in ims_pcu_flash_firmware() |
CVE-2025-38428
|
| VCID-nec2-tce8-4fh5 | kernel: ipv6/sit: use DEV_STATS_INC() to avoid data-races |
CVE-2022-50764
|
| VCID-nek4-r2sc-ckfe | kernel: btrfs: reject invalid reloc tree root keys with stack dump |
CVE-2023-53618
|
| VCID-nfn9-5smv-37g4 | kernel: riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error() |
CVE-2024-42267
|
| VCID-nfqk-u8ys-pfet | kernel: xdp: fix invalid wait context of page_pool_destroy() |
CVE-2024-43834
|
| VCID-nfu4-2477-3bfv | kernel: dm-bufio: don't schedule in atomic context |
CVE-2025-37928
|
| VCID-nfue-k99d-j7gm | kernel: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() |
CVE-2024-50268
|
| VCID-ng3h-5h85-tkhw | kernel: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() |
CVE-2024-50008
|
| VCID-ngqm-wrgw-rkez | kernel: wifi: ath10k: Fix memory leak in management tx |
CVE-2024-50236
|
| VCID-ngvu-wb2e-fuga | kernel: ima: Handle error code returned by ima_filter_rule_match() |
CVE-2025-68740
|
| VCID-nh1c-h3td-tkc7 | kernel: nilfs2: fix state management in error path of log writing function |
CVE-2024-47669
|
| VCID-nh4c-h6n9-ykhj | kernel: net/sched: sch_qfq: Fix null-deref in agg_dequeue |
CVE-2025-40083
|
| VCID-njde-ttj4-ducs | kernel: media: venus: Fix OOB read due to missing payload bound check |
CVE-2025-38679
|
| VCID-njyw-sj3b-xycn | kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors |
CVE-2025-39757
|
| VCID-nkcs-9gka-nkbz | kernel: s390/sclp: Add check for get_zeroed_page() |
CVE-2025-37883
|
| VCID-nkgt-d94r-9fb4 | kernel: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up |
CVE-2025-21887
|
| VCID-nmgk-3hpz-g7ec | kernel: nfsd: don't ignore the return code of svc_proc_register() |
CVE-2025-22026
|
| VCID-nn8n-ssaq-ybc6 | kernel: Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers |
CVE-2020-24504
|
| VCID-nnfd-waxv-b3gt | kernel: Kernel: Memory leak in rocker component leads to denial of service |
CVE-2026-23164
|
| VCID-nnnt-9vn7-rfc1 | kernel: bpf: Fix accesses to uninit stack slots |
CVE-2023-52452
|
| VCID-np1g-g6wg-y7c6 | kernel: Deadlock in ksmbd_find_crypto_ctx() |
CVE-2023-32253
|
| VCID-np3t-m158-k7he | kernel: usb: typec: ucsi: Limit read size on v1.2 |
CVE-2024-35924
|
| VCID-npmk-ugrj-hkaf | kernel: Kernel: Denial of Service due to deadlock in btrfs during block group relocation with scrub |
CVE-2023-53348
|
| VCID-nqp5-djyf-5qcy | kernel: mISDN: Fix a use after free in hfcmulti_tx() |
CVE-2024-42280
|
| VCID-nqw9-f22j-rqhy | kernel: dmaengine: sf-pdma: pdma_desc memory leak fix |
CVE-2023-54020
|
| VCID-nr6b-wdnx-k7e6 | kernel: RDMA/hns: Fix soft lockup under heavy CEQE load |
CVE-2024-43872
|
| VCID-nraj-qr2a-pubu | kernel: Linux kernel dma-buf: Denial of Service via memory reordering |
CVE-2025-38095
|
| VCID-nrff-k45r-y7bj | kernel: f2fs: fix race in concurrent f2fs_stop_gc_thread |
CVE-2024-53218
|
| VCID-nrh4-hbmw-mbf1 |
CVE-2026-23406
|
|
| VCID-nrhg-f4a1-7qe3 | kernel: staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() |
CVE-2024-50233
|
| VCID-ns6g-c2p2-myf5 | kernel: PCI: imx6: Fix suspend/resume support on i.MX6QDL |
CVE-2024-57809
|
| VCID-nsa2-qgf5-xffq | kernel: fsl/fman: Fix refcount handling of fman-related devices |
CVE-2024-50166
|
| VCID-nsbf-fkcw-cbed |
CVE-2026-31407
|
|
| VCID-nsj4-2nrx-8qgc | kernel: tpm: Cap the number of PCR banks |
CVE-2025-71077
|
| VCID-nt4s-u8z2-73d7 | kernel: RDMA/efa: Fix wrong resources deallocation order |
CVE-2023-54201
|
| VCID-ntf6-jsa3-dfd1 | kernel: tipc: fix memory leak in tipc_link_xmit |
CVE-2025-37757
|
| VCID-ntqj-fmmb-b3g8 | kernel: md: Don't register sync_thread for reshape directly |
CVE-2024-26756
|
| VCID-nuhs-4sjq-dkcb | kernel: inet: frags: flush pending skbs in fqdir_pre_exit() |
CVE-2025-68768
|
| VCID-nuxt-ab88-w3a9 | kernel: Linux kernel: Denial of Service due to TOCTOU in `sk_is_readable()` |
CVE-2025-38112
|
| VCID-nuzn-h4hz-hyh4 | kernel: spi: nxp-fspi: fix the KASAN report out-of-bounds bug |
CVE-2024-46853
|
| VCID-nv4t-v11t-aucb | kernel: net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data |
CVE-2024-53058
|
| VCID-nv5d-ux4k-gbck | kernel: bonding: change ipsec_lock from spin lock to mutex |
CVE-2024-46678
|
| VCID-nv5y-jm2h-zkd6 | kernel: netfilter: ctnetlink: fix refcount leak on table dump |
CVE-2025-38721
|
| VCID-nvum-z9k5-sbff | kernel: staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw() |
CVE-2022-50469
|
| VCID-nvxv-7adg-hqbp | kernel: slip: make slhc_remember() more robust against malicious packets |
CVE-2024-50033
|
| VCID-nvz6-mdw9-g7g3 | kernel: module: ensure that kobject_put() is safe for module type kobjects |
CVE-2025-37995
|
| VCID-nw3c-5apn-zfhv | kernel: net: fix segmentation of forwarding fraglist GRO |
CVE-2026-23154
|
| VCID-nw8j-b8c8-vfa9 | kernel: blk-mq: Fix kmemleak in blk_mq_init_allocated_queue |
CVE-2022-49901
|
| VCID-nwe9-gm4x-x7bj | kernel: ipv4: Fix uninit-value access in __ip_make_skb() |
CVE-2024-36927
|
| VCID-nwjz-2g6n-5bhc | kernel: RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() |
CVE-2023-53335
|
| VCID-nwn5-d5f1-rkbr | kernel: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() |
CVE-2024-40998
|
| VCID-nx4j-stwh-mkdj | kernel: mm/swap: fix race when skipping swapcache |
CVE-2024-26759
|
| VCID-nx8k-p4wr-nkge | kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections |
CVE-2024-57986
|
| VCID-nxau-9u35-x3cc | kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets |
CVE-2025-22063
|
| VCID-nxqc-k9mq-pqd6 | kernel: uprobe: avoid out-of-bounds memory access of fetching args |
CVE-2024-50067
|
| VCID-nycd-g9sr-w3fh | kernel: comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() |
CVE-2025-68335
|
| VCID-nza5-qtd9-1fcf | kernel: net: 3com: 3c59x: fix possible null dereference in vortex_probe1() |
CVE-2026-23020
|
| VCID-nzbd-wgcm-5fdw | kernel: af_packet: fix vlan_get_tci() vs MSG_PEEK |
CVE-2024-57902
|
| VCID-nzbu-xaj7-duex | kernel: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition |
CVE-2025-37838
|
| VCID-nzs3-d5dq-u3a9 | kernel: x86/entry_32: Clear CPU buffers after register restore in NMI return |
CVE-2024-50193
|
| VCID-p1cj-v8rw-rqf4 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores the pointer in pipe_buffer.private. The pipe_buf_operations for these buffers used .get = generic_pipe_buf_get, which only increments the page reference count when tee(2) duplicates a pipe buffer. The smc_spd_priv pointer itself was not handled, so after tee() both the original and the cloned pipe_buffer share the same smc_spd_priv *. When both pipes are subsequently released, smc_rx_pipe_buf_release() is called twice against the same object: 1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct] 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF] KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which then escalates to a NULL-pointer dereference and kernel panic via smc_rx_update_consumer() when it chases the freed priv->smc pointer: BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0 Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x650 kasan_report+0xc6/0x100 smc_rx_pipe_buf_release+0x78/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> BUG: kernel NULL pointer dereference, address: 0000000000000020 RIP: 0010:smc_rx_update_consumer+0x8d/0x350 Call Trace: <TASK> smc_rx_pipe_buf_release+0x121/0x2a0 free_pipe_info+0xd4/0x130 pipe_release+0x142/0x160 __fput+0x1c6/0x490 __x64_sys_close+0x4f/0x90 do_syscall_64+0xa6/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Kernel panic - not syncing: Fatal exception Beyond the memory-safety problem, duplicating an SMC splice buffer is semantically questionable: smc_rx_update_cons() would advance the consumer cursor twice for the same data, corrupting receive-window accounting. A refcount on smc_spd_priv could fix the double-free, but the cursor-accounting issue would still need to be addressed separately. The .get callback is invoked by both tee(2) and splice_pipe_to_pipe() for partial transfers; both will now return -EFAULT. Users who need to duplicate SMC socket data must use a copy-based read path. |
CVE-2026-31507
|
| VCID-p1cz-e94f-57c2 | kernel: crypto: x86/aegis - Add missing error checks |
CVE-2025-39789
|
| VCID-p1hp-3ka5-jqad | kernel: Linux kernel: Denial of Service via improper access validation in bpf_sock_addr |
CVE-2025-40078
|
| VCID-p2bs-4z74-b7bx | kernel: comedi: fix race between polling and detaching |
CVE-2025-38687
|
| VCID-p2ew-45gs-97hj | kernel: vhost_vdpa: assign irq bypass producer token correctly |
CVE-2024-47748
|
| VCID-p414-u3fj-yqcq | kernel: netfilter: nf_tables: avoid skb access on nf_stolen |
CVE-2022-49622
|
| VCID-p4as-tvvw-ubcu | kernel: drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range |
CVE-2024-46808
|
| VCID-p4by-fm53-yybk |
CVE-2026-31425
|
|
| VCID-p4fx-yvs4-37hq | kernel: ipv6: mcast: add RCU protection to mld_newpack() |
CVE-2025-21758
|
| VCID-p4nk-v455-puaf | kernel: drm/amd/display: Check index for aux_rd_interval before using |
CVE-2024-46728
|
| VCID-p4s5-y8ck-ufad | kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc |
CVE-2025-37890
|
| VCID-p52d-jz35-3qh3 | kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() |
CVE-2025-39730
|
| VCID-p556-9gqy-vkhf | kernel: net/smc: check return value of sock_recvmsg when draining clc data |
CVE-2024-57791
|
| VCID-p595-1qtr-tuae | kernel: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled |
CVE-2026-23381
|
| VCID-p5ag-55wv-e3bg | kernel: 9p/net: fix improper handling of bogus negative read/write replies |
CVE-2025-37879
|
| VCID-p5sm-fkgv-d3eu | kernel: net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts |
CVE-2026-22997
|
| VCID-p5t8-k4m7-23cx | kernel: nilfs2: fix kernel bug due to missing clearing of buffer delay flag |
CVE-2024-50116
|
| VCID-p5t8-mmup-p3de | kernel: wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() |
CVE-2024-43879
|
| VCID-p5ux-ufw5-1uhx | kernel: ftrace: Fix softlockup in ftrace_module_enable |
CVE-2025-68173
|
| VCID-p64n-3pb8-rfgs | kernel: KVM: arm64: Tear down vGIC on failed vCPU creation |
CVE-2025-37849
|
| VCID-p64w-vsxs-2qc8 | kernel: netlink: Fix wraparounds of sk->sk_rmem_alloc. |
CVE-2025-38465
|
| VCID-p665-8j9c-nqfk | kernel: IB/mad: Don't call to function that might sleep while in atomic context |
CVE-2022-50472
|
| VCID-p6g1-5fsy-ebck | kernel: skmsg: Skip zero length skb in sk_msg_recvmsg |
CVE-2024-41048
|
| VCID-p6su-6w2e-qqh4 | kernel: regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex |
CVE-2025-68354
|
| VCID-p6x9-a9ps-vuf8 | kernel: mm: resolve faulty mmap_region() error path behaviour |
CVE-2024-53096
|
| VCID-p72b-szhh-wyd6 | kernel: rxrpc: Make it so that a waiting process can be aborted |
CVE-2023-53218
|
| VCID-p772-utu4-sbhu | kernel: be2net: fix potential memory leak in be_xmit() |
CVE-2024-50167
|
| VCID-p789-6xk9-4faj | kernel: comedi: das6402: Fix bit shift out of bounds |
CVE-2025-38482
|
| VCID-p7k7-1jab-jked | kernel: thunderbolt: Mark XDomain as unplugged when router is removed |
CVE-2024-46702
|
| VCID-p7ry-9uut-vugf | kernel: drm/amd/pm: Prevent division by zero |
CVE-2025-37768
|
| VCID-p8vu-d7uq-zqgc | kernel: ceph: fix possible deadlock when holding Fwb to get inline_data |
CVE-2022-49296
|
| VCID-p9na-xvkr-zycm | kernel: bcache: avoid oversized read request in cache missing code path |
CVE-2021-47275
|
| VCID-p9py-ngdp-3feh | kernel: md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime |
CVE-2025-21712
|
| VCID-pa83-ecsd-qybn | kernel: pinctrl: check the return value of pinmux_ops::get_function_name() |
CVE-2025-40030
|
| VCID-pa8u-zdsm-w7ec | kernel: pinctrl: qcom: msm: mark certain pins as invalid for interrupts |
CVE-2025-38516
|
| VCID-paq6-d6fg-fbaa | kernel: ASoC: meson: axg-card: fix 'use-after-free' |
CVE-2024-46849
|
| VCID-pawr-xr9h-zbh9 | kernel: Bluetooth: fix use-after-free in device_for_each_child() |
CVE-2024-53237
|
| VCID-pbby-yjrv-23hc | kernel: media: vimc: skip .s_stream() for stopped entities |
CVE-2025-22028
|
| VCID-pc2d-n2v8-13f4 | kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove |
CVE-2025-22020
|
| VCID-pcd4-tpbr-33bu | kernel: net: tls: explicitly disallow disconnect |
CVE-2025-37756
|
| VCID-pcek-ba5f-b7gc | kernel: fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() |
CVE-2025-38312
|
| VCID-pcke-venj-r3hw | kernel: ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd |
CVE-2025-40275
|
| VCID-pd4y-jpvd-13gk | kernel: um: virtio_uml: Fix use-after-free after put_device in probe |
CVE-2025-39951
|
| VCID-pd9u-evp2-abh9 | kernel: nilfs2: reject invalid file types when reading inodes |
CVE-2025-38663
|
| VCID-pdgf-mzr7-k3bq | kernel: usb: atm: cxacru: fix a flaw in existing endpoint checks |
CVE-2025-21916
|
| VCID-pdwv-vay9-juhg | kernel: net_sched: prio: fix a race in prio_tune() |
CVE-2025-38083
|
| VCID-pe5c-3hjd-8bh2 | kernel: Input: imx_sc_key - fix memory corruption on unload |
CVE-2025-40262
|
| VCID-peam-hpha-p7f2 | kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() |
CVE-2024-58014
|
| VCID-pee9-b5mt-dkft | kernel: rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). |
CVE-2024-26865
|
| VCID-pepq-cqcb-dkdm | kernel: net: add xmit recursion limit to tunnel xmit functions |
CVE-2026-23276
|
| VCID-perg-z9pk-2kew | kernel: ice: Fix memory corruption in VF driver |
CVE-2022-49722
|
| VCID-pf2n-nudq-pbb6 | kernel: drm/amd/display: Check dce_hwseq before dereferencing it |
CVE-2025-38361
|
| VCID-pf99-4tzm-7yde | kernel: block: initialize integrity buffer to zero before writing it to media |
CVE-2024-43854
|
| VCID-pfaz-renw-kuar | kernel: mmc: mmc_test: Fix NULL dereference on allocation failure |
CVE-2024-45028
|
| VCID-pfjc-p4kx-s3ej | kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number |
CVE-2024-58007
|
| VCID-pfwu-he58-x3d6 | kernel: Bluetooth: bnep: fix wild-memory-access in proto_unregister |
CVE-2024-50148
|
| VCID-pg2a-j1hc-83hr | kernel: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg |
CVE-2024-49568
|
| VCID-pg4x-rssj-ufep | kernel: netfilter: x_tables: fix percpu counter block leak on error path when creating new netns |
CVE-2023-53200
|
| VCID-pgm5-vku1-q7em | kernel: fbdev: sisfb: Fix strbuf array overflow |
CVE-2024-50180
|
| VCID-phhw-7zbq-47du | kernel: staging: pi433: fix memory leak with using debugfs_lookup() |
CVE-2023-53355
|
| VCID-phsj-7pww-d7ce | kernel: btrfs: use latest_dev in btrfs_show_devname |
CVE-2021-47599
|
| VCID-phz2-pvsb-8ycm | kernel: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error |
CVE-2025-23140
|
| VCID-pjak-5gwh-43hn | kernel: drm/amdgpu: set the right AMDGPU sg segment limitation |
CVE-2024-56594
|
| VCID-pjfz-m1u2-tqhv | kernel: media: venus: hfi_parser: add check to avoid out of bound access |
CVE-2025-23157
|
| VCID-pjq6-wrqu-5be3 | kernel: qibfs: fix _another_ leak |
CVE-2025-37983
|
| VCID-pk38-kgnt-vbh2 | kernel: crypto: essiv - Check ssize for decryption and in-place encryption |
CVE-2025-40019
|
| VCID-pk74-dafk-e3gj | kernel: drm/amdgpu: change vm->task_info handling |
CVE-2024-41008
|
| VCID-pkp5-pas3-5kc3 | kernel: hugetlbfs: don't delete error page from pagecache |
CVE-2022-49828
|
| VCID-pkwq-ttcn-8bcx | kernel: ext4: make sure the first directory block is not a hole |
CVE-2024-42304
|
| VCID-pkys-5922-skeg | kernel: Linux kernel: Denial of Service via mprotect() on huge transparent huge pages |
CVE-2025-40153
|
| VCID-pm4x-2r7d-guhz | kernel: netlink: Bounds-check struct nlmsgerr creation |
CVE-2022-49766
|
| VCID-pmn9-t8by-myhb | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly. |
CVE-2026-31431
|
| VCID-pn8n-sdus-57ct | kernel: ftrace: Avoid potential division by zero in function_stat_show() |
CVE-2025-21898
|
| VCID-pn9c-d4an-ska6 | kernel: xfrm: delete x->tunnel as we delete x |
CVE-2025-40215
|
| VCID-pnfa-xm28-w3bk | kernel: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() |
CVE-2026-23304
|
| VCID-pnjm-mpfu-vfak | kernel: net: mvpp2: Prevent parser TCAM memory corruption |
CVE-2025-22060
|
| VCID-pnqz-df9d-eue7 | kernel: regulator: core: fix NULL dereference on unbind due to stale coupling data |
CVE-2025-38668
|
| VCID-ppf4-65p3-f7gq | kernel: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress |
CVE-2023-52975
|
| VCID-ppgp-v6th-y3ar | kernel: smb: client: Fix use-after-free of network namespace. |
CVE-2024-53095
|
| VCID-pppy-mje4-7qdz | kernel: backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() |
CVE-2025-23144
|
| VCID-ppx8-bg8y-83a4 | kernel: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer |
CVE-2025-38184
|
| VCID-ppyy-4rvt-gydv | kernel: KVM: arm64: Check the untrusted offset in FF-A memory share |
CVE-2025-40266
|
| VCID-pqb4-968d-jbfe | kernel: thunderbolt: Do not double dequeue a configuration request |
CVE-2025-38174
|
| VCID-pqcm-qtw9-nybs | kernel: nvme-pci: fix freeing of the HMB descriptor table |
CVE-2024-56756
|
| VCID-pqmt-bpje-nfd7 | kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id |
CVE-2025-68724
|
| VCID-pqmu-mjc4-cufb | kernel: net: dsa: free routing table on probe failure |
CVE-2025-37786
|
| VCID-prby-tqfv-subs | kernel: mlxsw: spectrum_acl_erp: Fix object nesting warning |
CVE-2024-43880
|
| VCID-prwa-6p4v-gfdz | kernel: can: j1939: make j1939_session_activate() fail if device is no longer registered |
CVE-2025-71182
|
| VCID-pssk-5jda-g3b2 | kernel: scsi: lpfc: Fix link down processing to address NULL pointer dereference |
CVE-2021-47183
|
| VCID-psxp-hb42-yub5 | kernel: dma: fix call order in dmam_free_coherent |
CVE-2024-43856
|
| VCID-pt63-dj94-qyek | kernel: RDMA: Verify port when creating flow rule |
CVE-2021-47265
|
| VCID-ptjq-k3sd-mbg9 | kernel: net/mlx5: Fix error path in multi-packet WQE transmit |
CVE-2024-50001
|
| VCID-ptyj-1y6d-dud1 | kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg |
CVE-2026-23066
|
| VCID-puhc-5h95-13ff | kernel: Kernel: Bluetooth HCI local DoS |
CVE-2024-58241
|
| VCID-pva7-b7rk-ykam |
CVE-2026-31410
|
|
| VCID-pvfh-earf-aqdj | kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing |
CVE-2025-39760
|
| VCID-pvn8-quxc-xkbr | kernel: scsi: ufs: core: Improve SCSI abort handling |
CVE-2021-47188
|
| VCID-pvna-jeau-u7fm | kernel: ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit |
CVE-2024-53171
|
| VCID-pvug-mryy-97fx | kernel: i3c: Add NULL pointer check in i3c_master_queue_ibi() |
CVE-2025-23147
|
| VCID-pwsz-e7j6-nbch | kernel: mptcp: use the workqueue to destroy unaccepted sockets |
CVE-2023-53072
|
| VCID-pwt4-em7t-4qfb | kernel: USB: hub: Ignore non-compliant devices with too many configs or interfaces |
CVE-2025-21776
|
| VCID-pxkf-h3mj-sfch | kernel: arm64: probes: Fix uprobes for big-endian kernels |
CVE-2024-50194
|
| VCID-pxt2-nr7c-5kcz | kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses |
CVE-2023-24023
|
| VCID-pxv6-4d92-gbdv | kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop |
CVE-2025-21839
|
| VCID-py5a-zb4r-9fe6 | kernel: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() |
CVE-2024-56605
|
| VCID-pymq-pcau-s3cv | kernel: cpufreq: governor: Use kobject release() method to free dbs_data |
CVE-2022-49513
|
| VCID-pytf-9ehq-ykc5 | In the Linux kernel, the following vulnerability has been resolved: ext4: reject mount if bigalloc with s_first_data_block != 0 bigalloc with s_first_data_block != 0 is not supported, reject mounting it. |
CVE-2026-31447
|
| VCID-pyy2-vrpz-yfbk | kernel: scsi: qla2xxx: Delay module unload while fabric scan in progress |
CVE-2025-71235
|
| VCID-pzpa-289h-17ea | kernel: scsi: ufs: Fix a deadlock in the error handler |
CVE-2021-47622
|
| VCID-pzqw-hf31-mba1 | kernel: ext4: detect invalid INLINE_DATA + EXTENTS flag combination |
CVE-2025-40167
|
| VCID-pzx9-1ck1-kygq | kernel: f2fs: fix out-of-bounds access in sysfs attribute read/write |
CVE-2026-23235
|
| VCID-q1ts-48c2-xkgb | kernel: l2tp: prevent possible tunnel refcount underflow |
CVE-2024-49940
|
| VCID-q1yz-yhqf-ukgt | kernel: Linux kernel: Denial of Service in stmmac network driver due to division by zero during PTP timestamping configuration |
CVE-2025-38126
|
| VCID-q2am-tq5t-gybe | kernel: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} |
CVE-2025-40183
|
| VCID-q2ez-zz3u-xfg6 | kernel: fuse: Initialize beyond-EOF page contents before setting uptodate |
CVE-2024-44947
|
| VCID-q2hs-ferx-fuds | kernel: udf: Avoid excessive partition lengths |
CVE-2024-46777
|
| VCID-q2nc-hdcj-gfdm | kernel: btrfs: do not BUG_ON() when freeing tree block after error |
CVE-2024-44963
|
| VCID-q32q-tj94-tye1 | kernel: fs/buffer: fix use-after-free when call bh_read() helper |
CVE-2025-39691
|
| VCID-q3cj-np4m-fudq | kernel: ocfs2: add bounds checking to ocfs2_xattr_find_entry() |
CVE-2024-47670
|
| VCID-q3ee-s8tk-vqag | kernel: Linux kernel: Denial of Service due to stack memory use-after-return in raid1_reshape |
CVE-2025-38445
|
| VCID-q3gj-wsey-87fr | kernel: ext4: fix OOB read when checking dotdot dir |
CVE-2025-37785
|
| VCID-q3hg-ug68-cffr | kernel: can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data |
CVE-2025-68342
|
| VCID-q43k-2kyw-1kbu | kernel: blk-throttle: Set BIO_THROTTLED when bio has been throttled |
CVE-2022-49465
|
| VCID-q48f-2umw-e7at |
CVE-2026-23407
|
|
| VCID-q4nf-ncj8-2yg1 | kernel: sctp: linearize cloned gso packets in sctp_rcv |
CVE-2025-38718
|
| VCID-q4rs-2237-g7gj | kernel: ice: fix memory leak in aRFS after reset |
CVE-2025-21981
|
| VCID-q4te-es12-7ucz | kernel: f2fs: fix to account dirty data in __get_secs_required() |
CVE-2024-53220
|
| VCID-q4u3-9g62-wydw | kernel: caif: fix integer underflow in cffrml_receive() |
CVE-2025-68799
|
| VCID-q55w-hud9-9ydw | kernel: ptp: Fix possible memory leak in ptp_clock_register() |
CVE-2021-47455
|
| VCID-q57a-mh4r-gye8 | kernel: netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext |
CVE-2024-54031
|
| VCID-q5ae-fyj5-4yey | kernel: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() |
CVE-2023-52752
|
| VCID-q5jt-zx7c-fqd4 | kernel: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA |
CVE-2024-50134
|
| VCID-q5ky-7fqu-efcs | kernel: kvm: s390: Reject memory region operations for ucontrol VMs |
CVE-2024-43819
|
| VCID-q5rc-6rpf-1ff1 | kernel: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() |
CVE-2025-39876
|
| VCID-q5s8-uf9p-w7hv | kernel: wifi: iwlwifi: limit printed string from FW file |
CVE-2025-21905
|
| VCID-q5uw-z4sr-9ud3 | kernel: ata: libata-core: Fix null pointer dereference on error |
CVE-2024-41098
|
| VCID-q5vb-3w1k-d7gy | kernel: ASoC: SOF: Fix DSP oops stack dump output contents |
CVE-2021-47381
|
| VCID-q682-t17w-kyhz | kernel: iio: imu: kmx61: fix information leak in triggered buffer |
CVE-2024-57908
|
| VCID-q6ez-rrgj-p3ht | kernel: can: bcm: Remove proc entry when dev is unregistered. |
CVE-2024-46771
|
| VCID-q6g3-zqxy-myhx | kernel: drm/amd/pm: ensure the fw_info is not null before using it |
CVE-2024-49890
|
| VCID-q6jz-c462-skdz | kernel: drm/radeon: check bo_va->bo is non-NULL before using it |
CVE-2024-41060
|
| VCID-q7a3-cm2m-ayga | kernel: smc: Fix use-after-free in __pnet_find_base_ndev() |
CVE-2025-40064
|
| VCID-q8dv-2j4e-5khk | kernel: Linux kernel: Denial of Service in crypto random number generator due to missing set_ent |
CVE-2025-40109
|
| VCID-q8pu-ntg5-myfj | kernel: HID: core: Harden s32ton() against conversion to 0 bits |
CVE-2025-38556
|
| VCID-q8t8-hf6h-7qh3 | kernel: can: j1939: j1939_session_new(): fix skb reference counting |
CVE-2024-56645
|
| VCID-q9du-ypfr-sygy | kernel: sysctl: always initialize i_uid/i_gid |
CVE-2024-42312
|
| VCID-q9rm-e46v-gqce | kernel: Linux kernel: Denial of Service in vsock due to TOCTOU race condition |
CVE-2025-38462
|
| VCID-qa1s-pr21-cycs | kernel: Kernel: Denial of Service via DVB DVR ringbuffer reinitialization flaw |
CVE-2026-23253
|
| VCID-qadn-y5ta-j7eq | kernel: f2fs: fix to wait on block writeback for post_read case |
CVE-2023-52682
|
| VCID-qb49-dkqp-gbgw | kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid |
CVE-2025-68349
|
| VCID-qb4u-38pz-q3gn | kernel: net: stmmac: Fix zero-division error when disabling tc cbs |
CVE-2024-49977
|
| VCID-qb6d-ruan-qkc7 | kernel: ipv4: Fix data-races around sysctl_fib_multipath_hash_policy. |
CVE-2022-49579
|
| VCID-qbj9-4wfm-9qfn | kernel: Bluetooth: hci_event: Ignore multiple conn complete events |
CVE-2022-49138
|
| VCID-qc1g-k892-rbac | kernel: net/sched: accept TCA_STAB only for root qdisc |
CVE-2024-50039
|
| VCID-qca4-fqr3-vkgx | kernel: net: annotate races around sk->sk_bound_dev_if |
CVE-2022-49420
|
| VCID-qcsy-1sn3-z3b6 | kernel: netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed |
CVE-2022-50500
|
| VCID-qd2p-jfnt-eyey | kernel: ext4: fix double brelse() the buffer of the extents path |
CVE-2024-49882
|
| VCID-qd52-fc7u-skaf | kernel: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt |
CVE-2024-38544
|
| VCID-qd7c-769p-gkeh | kernel: phonet/pep: fix racy skb_queue_empty() use |
CVE-2024-27402
|
| VCID-qdd1-rxsn-ruan | kernel: erofs: fix order >= MAX_ORDER warning due to crafted negative i_size |
CVE-2022-50313
|
| VCID-qdm4-4868-efez | kernel: net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup |
CVE-2026-23257
|
| VCID-qdxg-kymb-mqdb | kernel: net: decrease cached dst counters in dst_release |
CVE-2025-22057
|
| VCID-qe24-fwf6-6bes | kernel: nfsd: map the EBADMSG to nfserr_io to avoid warning |
CVE-2024-49875
|
| VCID-qeqf-a36m-2fea | kernel: net: nexthop: Initialize all fields in dumped nexthops |
CVE-2024-42283
|
| VCID-qffu-7n92-bbhy | In the Linux kernel, the following vulnerability has been resolved: mtd: Avoid boot crash in RedBoot partition table parser Given CONFIG_FORTIFY_SOURCE=y and a recent compiler, commit 439a1bcac648 ("fortify: Use __builtin_dynamic_object_size() when available") produces the warning below and an oops. Searching for RedBoot partition table in 50000000.flash at offset 0x7e0000 ------------[ cut here ]------------ WARNING: lib/string_helpers.c:1035 at 0xc029e04c, CPU#0: swapper/0/1 memcmp: detected buffer overflow: 15 byte read of buffer size 14 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0 #1 NONE As Kees said, "'names' is pointing to the final 'namelen' many bytes of the allocation ... 'namelen' could be basically any length at all. This fortify warning looks legit to me -- this code used to be reading beyond the end of the allocation." Since the size of the dynamic allocation is calculated with strlen() we can use strcmp() instead of memcmp() and remain within bounds. |
CVE-2026-23474
|
| VCID-qfge-zawt-qyb3 | kernel: net: atlantic: fix fragment overflow handling in RX path |
CVE-2025-68301
|
| VCID-qfqe-emax-f3ax | kernel: riscv: Sync efi page table's kernel mappings before switching |
CVE-2022-49004
|
| VCID-qfs4-nvav-gye2 | kernel: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes |
CVE-2025-21991
|
| VCID-qfxj-zqq9-r7ag | kernel: Bluetooth: L2CAP: Fix not validating setsockopt user input |
CVE-2024-35965
|
| VCID-qg8t-cx91-c7e3 | kernel: f2fs: fix to shrink read extent node in batches |
CVE-2024-41935
|
| VCID-qgyt-826f-wuhy | kernel: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice |
CVE-2025-38001
|
| VCID-qhc3-ffew-q7at | kernel: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock |
CVE-2022-49536
|
| VCID-qhny-aasp-bybf | kernel: fs/jfs: Prevent integer overflow in AG size calculation |
CVE-2025-37858
|
| VCID-qhvm-ct47-jfe4 | kernel: hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() |
CVE-2025-40351
|
| VCID-qhw2-rvza-tyas | kernel: bpf: Send signals asynchronously if !preemptible |
CVE-2025-21728
|
| VCID-qjbb-7826-y7bz | kernel: via_wdt: fix critical boot hang due to unnamed resource allocation |
CVE-2025-71114
|
| VCID-qje4-3svy-5kg8 | kernel: net: stmmac: move the EST lock to struct stmmac_priv |
CVE-2024-38594
|
| VCID-qjhv-ejtw-2yc8 | kernel: ip6_gre: make ip6gre_header() robust |
CVE-2025-71098
|
| VCID-qk2m-qzes-qfhu | kernel: leds: an30259a: Use devm_mutex_init() for mutex initialization |
CVE-2024-42128
|
| VCID-qk9e-n69y-zkdz | kernel: dma-buf/dma-resv: check if the new fence is really later |
CVE-2022-49935
|
| VCID-qku6-hwk7-mqbp | kernel: usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal |
CVE-2025-68781
|
| VCID-qm6d-bk6t-1qgv | kernel: mtk-sd: Prevent memory corruption from DMA map failure |
CVE-2025-38401
|
| VCID-qmdc-y1c4-u7dj | kernel: usb: vhci-hcd: Do not drop references before new references are gained |
CVE-2024-43883
|
| VCID-qmp7-favx-muhv | kernel: drm/radeon: delete radeon_fence_process in is_signaled, no deadlock |
CVE-2025-68223
|
| VCID-qmt9-fadf-h3gs | kernel: wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit |
CVE-2023-53466
|
| VCID-qmuk-1txu-z3da | kernel: Squashfs: check metadata block offset is within range |
CVE-2026-23388
|
| VCID-qn1v-p7x8-mkdq | kernel: netfilter: br_netfilter: fix panic with metadata_dst skb |
CVE-2024-50045
|
| VCID-qnhn-4nfe-rucq | kernel: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c |
CVE-2024-56728
|
| VCID-qpn3-gx5a-y3a6 | kernel: aoe: clean device rq_list in aoedev_downdev() |
CVE-2025-38326
|
| VCID-qpvc-e3h5-rfb3 | kernel: net/mlx5: Always drain health in shutdown callback |
CVE-2024-43866
|
| VCID-qqpd-3f4k-yyes | kernel: vsock/virtio: discard packets if the transport changes |
CVE-2025-21669
|
| VCID-qqzx-u8uc-4bdc | kernel: btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer |
CVE-2022-50766
|
| VCID-qrsb-4ya6-h3c7 | kernel: net: hns3: fix kernel crash when uninstalling driver |
CVE-2024-50296
|
| VCID-qrtk-7826-2bcp | kernel: missing check for return value of hashmap__new() in the function expr__ctx_new |
CVE-2023-23003
|
| VCID-qrxx-cx5t-9kgh | kernel: RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() |
CVE-2024-53226
|
| VCID-qsdm-cyzs-aufy |
CVE-2026-31414
|
|
| VCID-qset-pchd-eqcj | kernel: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted |
CVE-2025-68337
|
| VCID-qsy1-z86z-3qbj | kernel: fuse: fix livelock in synchronous file put from fuseblk workers |
CVE-2025-40220
|
| VCID-qt2g-3cyh-3bbc | kernel: uprobes: Reject the shared zeropage in uprobe_write_opcode() |
CVE-2025-21881
|
| VCID-qtb6-udqg-n3dr | kernel: net: avoid potential underflow in qdisc_pkt_len_init() with UFO |
CVE-2024-49949
|
| VCID-qtrw-1w6f-mfgz | kernel: Linux kernel: Use-after-free in USB gadget driver due to race condition during teardown |
CVE-2025-68282
|
| VCID-qug8-uav9-abd6 | kernel: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write |
CVE-2023-53282
|
| VCID-qunx-79yy-tqhb | kernel: orangefs: Do not truncate file size |
CVE-2025-38065
|
| VCID-quzd-ynfb-eqcc | kernel: nbd: don't allow reconnect after disconnect |
CVE-2025-21731
|
| VCID-qv1x-3j1e-8ugg | kernel: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() |
CVE-2024-56739
|
| VCID-qvnj-rkxf-ukas | kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation |
CVE-2025-38415
|
| VCID-qw5g-hukq-kfb1 | kernel: filemap: Fix bounds checking in filemap_read() |
CVE-2024-50272
|
| VCID-qweq-8dcb-x7eb | kernel: gfs2: Validate i_depth for exhash directories |
CVE-2025-38710
|
| VCID-qwt2-d9kn-xueb | kernel: drm/amd/pm: Fix negative array index read |
CVE-2024-46821
|
| VCID-qwvj-8fku-6ug4 | kernel: firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle |
CVE-2023-53250
|
| VCID-qwxr-s4uj-tfcc | kernel: x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() |
CVE-2025-22090
|
| VCID-qx21-w7wn-tqap | kernel: f2fs: fix to do sanity check on node footer in {read,write}_end_io |
CVE-2026-23265
|
| VCID-qx4c-ftxg-mkaj | kernel: fscrypt: destroy keyring after security_sb_delete() |
CVE-2023-53055
|
| VCID-qxth-4ftd-s3ac | kernel: media: mediatek: vcodec: Only free buffer VA that is not NULL |
CVE-2023-52888
|
| VCID-qy76-6s3f-n7cw | kernel: netfilter: nf_set_pipapo: fix initial map fill |
CVE-2024-57947
|
| VCID-qyu2-kw7b-1kg1 | kernel: riscv: VMAP_STACK overflow detection thread-safe |
CVE-2023-52761
|
| VCID-qz49-w66v-5yam | kernel: bpf: Fix out-of-bounds write in trie_get_next_key() |
CVE-2024-50262
|
| VCID-qzb2-2zd9-5kf4 | kernel: drm/amd/display: Disable DMCUB timeout for DCN35 |
CVE-2024-46870
|
| VCID-qzy8-dgxc-2kgd | kernel: dm cache: fix flushing uninitialized delayed_work on cache_ctr error |
CVE-2024-50280
|
| VCID-r213-hutj-m7er | kernel: serial: core: check uartclk for zero to avoid divide by zero |
CVE-2024-43893
|
| VCID-r23v-vjat-6qdk | kernel: ice: protect XDP configuration with a mutex |
CVE-2024-46765
|
| VCID-r28f-qryg-b3e4 | kernel: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() |
CVE-2024-56604
|
| VCID-r2cs-474j-63g9 | kernel: Linux kernel: Denial of Service in BPF due to improper context access |
CVE-2025-38591
|
| VCID-r2gb-pmbg-f3cr | kernel: drm/amd/display: Initialize get_bytes_per_element's default to 1 |
CVE-2024-49892
|
| VCID-r3u8-3w6a-eqh1 | kernel: drm/amd/display: Do not set DRR on pipe Commit |
CVE-2023-53042
|
| VCID-r4k1-m7wn-5ugx | kernel: btrfs: free exchange changeset on failures |
CVE-2021-47508
|
| VCID-r4uw-g3ry-bqe5 | kernel: ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() |
CVE-2023-52674
|
| VCID-r6aq-b146-vufp | kernel: drm/stm: Avoid use-after-free issues with crtc and plane |
CVE-2024-49992
|
| VCID-r6fn-8vuv-j7bg | kernel: ASoC: mediatek: Fix error handling in mt8183_da7219_max98357_dev_probe |
CVE-2022-49161
|
| VCID-r76g-d7px-hqff | kernel: net/sched: ets: fix divide by zero in the offload path |
CVE-2026-23379
|
| VCID-r7fp-rb7m-b7gs |
CVE-2026-31427
|
|
| VCID-r88u-7yc5-87au | kernel: netfilter: x_tables: fix LED ID check in led_tg_check() |
CVE-2024-56650
|
| VCID-r89h-js19-77dr | In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in update_super_work when racing with umount Commit b98535d09179 ("ext4: fix bug_on in start_this_handle during umount filesystem") moved ext4_unregister_sysfs() before flushing s_sb_upd_work to prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups reads during unmount. However, this introduced a use-after-free because update_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which accesses the kobject's kernfs_node after it has been freed by kobject_del() in ext4_unregister_sysfs(): update_super_work ext4_put_super ----------------- -------------- ext4_unregister_sysfs(sb) kobject_del(&sbi->s_kobj) __kobject_del() sysfs_remove_dir() kobj->sd = NULL sysfs_put(sd) kernfs_put() // RCU free ext4_notify_error_sysfs(sbi) sysfs_notify(&sbi->s_kobj) kn = kobj->sd // stale pointer kernfs_get(kn) // UAF on freed kernfs_node ext4_journal_destroy() flush_work(&sbi->s_sb_upd_work) Instead of reordering the teardown sequence, fix this by making ext4_notify_error_sysfs() detect that sysfs has already been torn down by checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call in that case. A dedicated mutex (s_error_notify_mutex) serializes ext4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs() to prevent TOCTOU races where the kobject could be deleted between the state_in_sysfs check and the sysfs_notify() call. |
CVE-2026-31446
|
| VCID-r8df-7maq-aqdd | kernel: nvme-multipath: defer partition scanning |
CVE-2024-53093
|
| VCID-r8h4-cj9c-r7f4 | kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() |
CVE-2025-21928
|
| VCID-r99q-4cst-dbem | kernel: md/raid1,raid10: don't ignore IO flags |
CVE-2025-22125
|
| VCID-r9x8-j8e6-pqbk | kernel: btrfs: fix anon_dev leak in create_subvol() |
CVE-2022-49469
|
| VCID-raxr-6p97-t7hk | kernel: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode |
CVE-2025-38665
|
| VCID-rayk-m71k-pkd5 | kernel: drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw |
CVE-2024-49916
|
| VCID-rbnp-jzg1-jfc3 | kernel: iavf: use internal state to free traffic IRQs |
CVE-2023-53850
|
| VCID-rbua-nn9a-kfb9 | kernel: drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP |
CVE-2023-54263
|
| VCID-rd2f-x1xw-mbat | kernel: bpf: fix OOB devmap writes when deleting elements |
CVE-2024-56615
|
| VCID-rd2g-en5y-6fbf | kernel: pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv |
CVE-2024-46761
|
| VCID-rd5t-rgsc-rudg | kernel: nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net |
CVE-2024-50121
|
| VCID-rdch-b3ck-qugc | kernel: drm/amd/display: Fix hang/underflow when transitioning to ODM4:1 |
CVE-2023-52671
|
| VCID-rdds-4kdk-qkcm | kernel: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() |
CVE-2024-56619
|
| VCID-rde7-z1g5-jbfh | kernel: Linux kernel: Denial of Service in ATM subsystem due to a race condition |
CVE-2025-38245
|
| VCID-rdhz-m3pf-8ydr | kernel: sfc/siena: fix null pointer dereference in efx_hard_start_xmit |
CVE-2022-48646
|
| VCID-rdyx-hae6-vbbn | kernel: gtp: Destroy device along with udp socket's netns dismantle. |
CVE-2025-21678
|
| VCID-re11-k3xf-e3b3 | kernel: bonding: limit BOND_MODE_8023AD to Ethernet devices |
CVE-2026-23099
|
| VCID-re3v-xm9c-ffb1 | kernel: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() |
CVE-2025-38714
|
| VCID-re81-2yac-zbc2 | kernel: drm/vmwgfx: Remove rcu locks from user resources |
CVE-2022-48887
|
| VCID-rej2-k4rf-97h9 | kernel: ppp: fix ppp_async_encode() illegal access |
CVE-2024-50035
|
| VCID-rekt-2vyj-z7g8 | kernel: dm: fix a race condition in retrieve_deps |
CVE-2023-54324
|
| VCID-rf3z-q8ur-a7dx | kernel: drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream' |
CVE-2024-49912
|
| VCID-rffh-vskt-b7ga | kernel: net/mlx5e: Remove skb secpath if xfrm state is not found |
CVE-2025-38590
|
| VCID-rgm2-pra9-7faj | kernel: drivers: base: Free devm resources when unregistering a device |
CVE-2023-53596
|
| VCID-rgt3-asgv-8be3 | kernel: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() |
CVE-2025-38000
|
| VCID-rgvu-bner-sfbj | kernel: drm/msm: Make .remove and .shutdown HW shutdown consistent |
CVE-2022-50260
|
| VCID-rh4e-sbew-nkbm | kernel: virtio: break and reset virtio devices on device_shutdown() |
CVE-2025-38064
|
| VCID-rh4u-kh34-aucx | kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN |
CVE-2024-53135
|
| VCID-rhs7-avgn-e7dr | kernel: drm: bridge: adv7511: unregister cec i2c device after cec adapter |
CVE-2022-50412
|
| VCID-rj6m-ff39-duec | kernel: orangefs: Fix kmemleak in orangefs_sysfs_init() |
CVE-2022-50316
|
| VCID-rj99-p8mt-pqg9 | kernel: netfilter: flowtable: fix stuck flows on cleanup due to pending work |
CVE-2022-50000
|
| VCID-rjc6-ebaq-jbfe | kernel: pinctrl: at91: Fix possible out-of-boundary access |
CVE-2025-38286
|
| VCID-rjgp-ta5t-vqge | kernel: xfrm: Duplicate SPI Handling |
CVE-2025-39797
|
| VCID-rjuh-7kkv-3qch | kernel: btrfs: do proper folio cleanup when cow_file_range() failed |
CVE-2024-57976
|
| VCID-rkqz-erqh-dfh4 | In the Linux kernel, the following vulnerability has been resolved: btrfs: log new dentries when logging parent dir of a conflicting inode If we log the parent directory of a conflicting inode, we are not logging the new dentries of the directory, so when we finish we have the parent directory's inode marked as logged but we did not log its new dentries. As a consequence if the parent directory is explicitly fsynced later and it does not have any new changes since we logged it, the fsync is a no-op and after a power failure the new dentries are missing. Example scenario: $ mkdir foo $ sync $rmdir foo $ mkdir dir1 $ mkdir dir2 # A file with the same name and parent as the directory we just deleted # and was persisted in a past transaction. So the deleted directory's # inode is a conflicting inode of this new file's inode. $ touch foo $ ln foo dir2/link # The fsync on dir2 will log the parent directory (".") because the # conflicting inode (deleted directory) does not exists anymore, but it # it does not log its new dentries (dir1). $ xfs_io -c "fsync" dir2 # This fsync on the parent directory is no-op, since the previous fsync # logged it (but without logging its new dentries). $ xfs_io -c "fsync" . <power failure> # After log replay dir1 is missing. Fix this by ensuring we log new dir dentries whenever we log the parent directory of a no longer existing conflicting inode. A test case for fstests will follow soon. |
CVE-2026-23465
|
| VCID-rkw3-v9m8-hbdd | kernel: ath11k: pci: fix crash on suspend if board file is not found |
CVE-2022-49132
|
| VCID-rkwn-d95a-zycg | kernel: ipvs: Defer ip_vs_ftp unregister during netns cleanup |
CVE-2025-40018
|
| VCID-rm9y-dg1r-53fg | kernel: USB: gadget: f_midi: f_midi_complete to call queue_work |
CVE-2025-21859
|
| VCID-rmbp-bnk7-7ffk | kernel: usb: gadget: core: flush gadget workqueue after device removal |
CVE-2025-21838
|
| VCID-rmct-nky3-kyew | kernel: sch_hfsc: make hfsc_qlen_notify() idempotent |
CVE-2025-38177
|
| VCID-rme2-8rzj-4fhs | kernel: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() |
CVE-2025-37820
|
| VCID-rmjh-44j9-xyhq | kernel: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot |
CVE-2022-50015
|
| VCID-rmn5-2z8k-x3aj | kernel: objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() |
CVE-2025-37937
|
| VCID-rmrs-en7k-v7h2 | kernel: bpf: sync_linked_regs() must preserve subreg_def |
CVE-2024-53125
|
| VCID-rmuw-t9j1-sygw | kernel: blk-mq: fix potential deadlock while nr_requests grown |
CVE-2025-40146
|
| VCID-rmyf-afy7-8fcx | kernel: scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() |
CVE-2025-68229
|
| VCID-rn7e-unsj-4khr | kernel: drm/amd/display: Fix system hang while resume with TBT monitor |
CVE-2024-50003
|
| VCID-rn7v-jp3y-7udf | kernel: can: bcm: add missing rcu read protection for procfs content |
CVE-2025-38003
|
| VCID-rnum-qw5t-5uby | kernel: usb: typec: altmode should keep reference to parent |
CVE-2024-50150
|
| VCID-rnxe-gcej-4kax | kernel: tipc: Fix use-after-free in tipc_mon_reinit_self() |
CVE-2025-40280
|
| VCID-rp3z-zrwp-kfc8 | kernel: tcp: check skb is non-NULL in tcp_rto_delta_us() |
CVE-2024-47684
|
| VCID-rph2-j8pr-qbfj | kernel: ibmvnic: Don't reference skb after sending to VIOS |
CVE-2025-21855
|
| VCID-rq2w-njse-nbhf | kernel: NFSD: Prevent NULL dereference in nfsd4_process_cb_update() |
CVE-2024-53217
|
| VCID-rq7t-xsnu-vydq | kernel: ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered |
CVE-2025-39763
|
| VCID-rqk9-ym9a-zydh | kernel: net/sched: sch_qfq: Fix race condition on qfq_aggregate |
CVE-2025-38477
|
| VCID-rqsj-t9nu-ufbf | kernel: block: don't allow the same type rq_qos add more than once |
CVE-2022-50086
|
| VCID-rr33-wc85-c7bf | kernel: pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking |
CVE-2024-57889
|
| VCID-rrxa-r3j8-ubh3 | In the Linux kernel, the following vulnerability has been resolved: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports. We already serialize request queueing against STREAMON/OFF with req_queue_mutex. Extend that serialization to REQBUFS, and also take the same mutex in media_request_ioctl_reinit() so REINIT is in the same exclusion domain. This keeps request cleanup and queue cancellation from running in parallel for request-capable devices. |
CVE-2026-31473
|
| VCID-rs22-m7ff-eyc9 | kernel: dmaengine: tegra-adma: Fix use-after-free |
CVE-2025-71162
|
| VCID-rsnz-px63-87hu | kernel: mm: call the security_mmap_file() LSM hook in remap_file_pages() |
CVE-2024-47745
|
| VCID-rsxp-payr-kuer | kernel: parisc: Revise __get_user() to probe user read access |
CVE-2025-39716
|
| VCID-rsz2-6qtp-s3a5 | kernel: crypto: bcm - add error check in the ahash_hmac_init function |
CVE-2024-56681
|
| VCID-rsz5-e5fc-syh2 | kernel: ax25: Remove broken autobind |
CVE-2025-22109
|
| VCID-rt2t-mzr3-nkae | kernel: ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process |
CVE-2023-53584
|
| VCID-rttw-c714-93gm | kernel: net: hns3: add VLAN id validation before using |
CVE-2025-71112
|
| VCID-ru4t-7413-7kay | kernel: tcp_bpf: fix return value of tcp_bpf_sendmsg() |
CVE-2024-46783
|
| VCID-rudf-s931-1qct | kernel: nvme-tcp: sanitize request list handling |
CVE-2025-38264
|
| VCID-rumh-3xbj-kbgt | kernel: drm/amdgpu/pm: Fix the null pointer dereference for smu7 |
CVE-2024-43909
|
| VCID-rup3-z1qu-j3hr | kernel: thermal: core: Reference count the zone in thermal_zone_get_by_id() |
CVE-2024-50028
|
| VCID-rv7g-3bjt-qkgc | In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix memory leak when a wq is reset idxd_wq_disable_cleanup() which is called from the reset path for a workqueue, sets the wq type to NONE, which for other parts of the driver mean that the wq is empty (all its resources were released). Only set the wq type to NONE after its resources are released. |
CVE-2026-31441
|
| VCID-rv81-mqxn-sqf6 | kernel: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() |
CVE-2025-40081
|
| VCID-rvxd-bgpj-8kdp | kernel: net: hns3: fix a deadlock problem when config TC during resetting |
CVE-2024-44995
|
| VCID-rw71-ued5-jfg4 | kernel: net: stmmac: Correctly handle Rx checksum offload errors |
CVE-2025-40337
|
| VCID-rwbc-c9p4-77ek | kernel: net/mlx5: handle errors in mlx5_chains_create_table() |
CVE-2025-21975
|
| VCID-rwfc-mzfg-akft | kernel: pNFS: Fix a deadlock when returning a delegation during open() |
CVE-2026-23050
|
| VCID-rwjd-764p-fbg3 | kernel: jfs: fix shift-out-of-bounds in dbSplit |
CVE-2024-56597
|
| VCID-rwkr-bxpr-qug1 | kernel: smack: fix bug: unprivileged task can create labels |
CVE-2025-68733
|
| VCID-rxej-y11f-tbca | kernel: bpf: Fix stackmap overflow check in __bpf_get_stackid() |
CVE-2025-68378
|
| VCID-rxqf-rzau-zqgs | kernel: udp: Fix memory accounting leak. |
CVE-2025-22058
|
| VCID-ry17-gncr-s3af | kernel: net: atm: add lec_mutex |
CVE-2025-38323
|
| VCID-ry36-vrr3-fyf8 | kernel: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint |
CVE-2024-53131
|
| VCID-rynr-zz6f-jfay | kernel: usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer |
CVE-2024-56670
|
| VCID-ryvc-scc9-9kf6 | kernel: ext4: update s_journal_inum if it changes after journal replay |
CVE-2023-53091
|
| VCID-rzpy-3smb-d3hb | kernel: net: sxgbe: fix potential NULL dereference in sxgbe_rx() |
CVE-2025-68302
|
| VCID-rzvj-774t-cqf8 | kernel: drm/amdgpu: variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()' |
CVE-2024-26672
|
| VCID-s11g-4uc7-77ar | kernel: Linux kernel: LZO compression buffer overrun due to insufficient output buffer checks |
CVE-2025-38068
|
| VCID-s19j-vvyp-8fgn | kernel: btrfs: skip reserved bytes warning on unmount after log cleanup failure |
CVE-2022-48833
|
| VCID-s1k5-hnrc-yffd | kernel: media: usbtv: Remove useless locks in usbtv_video_free() |
CVE-2024-27072
|
| VCID-s1ny-ed8s-n7fw | kernel: usb: dwc3: gadget: Fix looping of queued SG entries |
CVE-2024-56698
|
| VCID-s1s6-ekvg-yuer | kernel: vrf: use RCU protection in l3mdev_l3_out() |
CVE-2025-21791
|
| VCID-s2ym-tkmq-bbad | kernel: cifs: parse_dfs_referrals: prevent oob on malformed input |
CVE-2025-40099
|
| VCID-s39x-t73a-xkfh | kernel: drm/amd/display: Check if modulo is 0 before dividing. |
CVE-2022-49294
|
| VCID-s3k4-ss2m-d3d9 | kernel: mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() |
CVE-2025-68765
|
| VCID-s3rn-q6hw-q7ck | kernel: media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal() |
CVE-2024-56572
|
| VCID-s4ef-pbn6-9kgw | kernel: ftrace: Add cond_resched() to ftrace_graph_set_hash() |
CVE-2025-37940
|
| VCID-s4mb-5w9t-y7e4 | kernel: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() |
CVE-2025-21996
|
| VCID-s4uv-qjv6-n7b8 | kernel: net/tls: tls_is_tx_ready() checked list_entry |
CVE-2023-1075
|
| VCID-s4vq-5qdu-9qej | kernel: fbdev: efifb: Register sysfs groups through driver core |
CVE-2024-49925
|
| VCID-s6ps-vsn4-n7c7 | kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() |
CVE-2026-22990
|
| VCID-s6vz-c2gs-nfax | kernel: net: usb: rtl8150: enable basic endpoint checking |
CVE-2025-21708
|
| VCID-s73j-mzkp-cydx | kernel: tracing: Fix memory leak in tracing_read_pipe() |
CVE-2022-49801
|
| VCID-s7ax-ksqw-9kac | kernel: scsi: bfa: Double-free fix |
CVE-2025-38699
|
| VCID-s7ht-qu2s-y7bg | kernel: smb: client: fix memory leak in cifs_construct_tcon() |
CVE-2025-68295
|
| VCID-s8y8-cbx2-s7ff | kernel: scsi: qla2xxx: validate nvme_local_port correctly |
CVE-2024-42286
|
| VCID-s9c9-e4qk-pbb4 | kernel: drm/msm: Fix null ptr access msm_ioctl_gem_submit() |
CVE-2021-47610
|
| VCID-s9gw-1g91-7khp | kernel: netfilter: nft_limit: reject configurations that cause integer overflow |
CVE-2024-26668
|
| VCID-s9mp-wsn8-cycf | kernel: accel/habanalabs: support mapping cb with vmalloc-backed coherent memory |
CVE-2025-40311
|
| VCID-sasb-nznc-5qdp | kernel: ext4: fix i_disksize exceeding i_size problem in paritally written case |
CVE-2023-53270
|
| VCID-sct2-rhk9-v7dj | kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation. |
CVE-2025-71238
|
| VCID-sd5x-98z1-e7at | kernel: drm/amd/display: fix mapping to non-allocated address |
CVE-2023-53753
|
| VCID-sddc-2m3p-mbgh | kernel: gpio: grgpio: Add NULL check in grgpio_probe |
CVE-2024-56634
|
| VCID-sduq-4eqy-subt | kernel: media: cx24116: prevent overflows on SNR calculus |
CVE-2024-50290
|
| VCID-seka-a2vc-k3dh | kernel: uacce: implement mremap in uacce_vm_ops to return -EPERM |
CVE-2026-23056
|
| VCID-sep5-m6q9-tbhc | kernel: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation |
CVE-2025-71185
|
| VCID-sf8v-byyk-3fgd | kernel: Memory leak via ksmbd session setup request with unknown NTLMSSP message type |
CVE-2023-32255
|
| VCID-sfc8-792k-n3ea | kernel: net: inet: do not leave a dangling sk pointer in inet_create() |
CVE-2024-56601
|
| VCID-sfwc-7h4k-ybcj | kernel: power: supply: gpio-charger: Fix set charge current limits |
CVE-2024-57792
|
| VCID-sfzt-9fyh-sqgg | kernel: tomoyo: don't emit warning in tomoyo_write_control() |
CVE-2024-58085
|
| VCID-sg4a-ymhq-5ye3 | kernel: PCI: pnv_php: Fix surprise plug detection and recovery |
CVE-2025-38623
|
| VCID-sg5f-9ycp-7ybk | kernel: hwmon: (corsair-cpro) Validate the size of the received input buffer |
CVE-2025-38548
|
| VCID-sgmg-wyp2-yfdr | kernel: blk-iolatency: Fix memory leak on add_disk() failures |
CVE-2022-50550
|
| VCID-sh6x-y76e-kqa7 | kernel: rpl: Fix use-after-free in rpl_do_srh_inline() |
CVE-2025-38476
|
| VCID-sj86-kqy5-aba5 | kernel: jfs: Prevent copying of nlink with value 0 from disk inode |
CVE-2025-37741
|
| VCID-sjam-bp41-27f4 | kernel: net: usb: kalmia: validate USB endpoints |
CVE-2026-23365
|
| VCID-sjcs-9pv3-vyb2 | kernel: net: usb: qmi_wwan: fix memory leak for not ip packets |
CVE-2024-43861
|
| VCID-sjxw-b1nn-z7ck | kernel: nvmet: always initialize cqe.result |
CVE-2024-41079
|
| VCID-skb6-pp5p-bqc3 | kernel: i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data. |
CVE-2023-52763
|
| VCID-skfy-8ydc-pbbp | kernel: netfilter: ctnetlink: use helper function to calculate expect ID |
CVE-2024-44944
|
| VCID-sks3-c5kz-zbbk | kernel: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak |
CVE-2025-40278
|
| VCID-sm3v-84rs-nyem | In the Linux kernel, the following vulnerability has been resolved: net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect syzkaller reported a bug [1], and the reproducer is available at [2]. ROSE sockets use four sk->sk_state values: TCP_CLOSE, TCP_LISTEN, TCP_SYN_SENT, and TCP_ESTABLISHED. rose_connect() already rejects calls for TCP_ESTABLISHED (-EISCONN) and TCP_CLOSE with SS_CONNECTING (-ECONNREFUSED), but lacks a check for TCP_SYN_SENT. When rose_connect() is called a second time while the first connection attempt is still in progress (TCP_SYN_SENT), it overwrites rose->neighbour via rose_get_neigh(). If that returns NULL, the socket is left with rose->state == ROSE_STATE_1 but rose->neighbour == NULL. When the socket is subsequently closed, rose_release() sees ROSE_STATE_1 and calls rose_write_internal() -> rose_transmit_link(skb, NULL), causing a NULL pointer dereference. Per connect(2), a second connect() while a connection is already in progress should return -EALREADY. Add this missing check for TCP_SYN_SENT to complete the state validation in rose_connect(). [1] https://syzkaller.appspot.com/bug?extid=d00f90e0af54102fb271 [2] https://gist.github.com/mrpre/9e6779e0d13e2c66779b1653fef80516 |
CVE-2026-23460
|
| VCID-smej-3muv-rfcj | kernel: ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 |
CVE-2025-38336
|
| VCID-smew-m4w8-t7cp | kernel: ASoC: q6afe-clocks: fix reprobing of the driver |
CVE-2021-47037
|
| VCID-smqr-atp7-bbd8 | kernel: crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() |
CVE-2025-38300
|
| VCID-sn9p-gz99-afhz | kernel: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag |
CVE-2025-21699
|
| VCID-sne8-13hq-mqan | kernel: netfilter: nf_tables: unconditionally bump set->nelems before insertion |
CVE-2026-23272
|
| VCID-spab-qnhh-vqap | kernel: irqchip/sifive-plic: Fix frozen interrupt due to affinity setting |
CVE-2026-23287
|
| VCID-spaf-z2nd-jkcw | kernel: crypto: hisilicon/debugfs - Fix debugfs uninit process issue |
CVE-2024-42147
|
| VCID-spzv-4u7n-y7b3 | kernel: RDMA/uverbs: Prevent integer overflow issue |
CVE-2024-57890
|
| VCID-sq1r-a4yr-sfff | kernel: libceph: make calc_target() set t->paused, not just clear it |
CVE-2026-23047
|
| VCID-sq9c-y7kc-1yga | kernel: f2fs: fix null-ptr-deref in f2fs_submit_page_bio() |
CVE-2024-53221
|
| VCID-sqf7-4e8r-7ken | kernel: wifi: mac80211: fix NULL deref in mesh_matches_local() |
CVE-2026-23396
|
| VCID-sr1c-nrmg-gba1 | kernel: dmaengine: bcm-sba-raid: fix device leak on probe |
CVE-2025-71190
|
| VCID-srta-uqkm-dbg7 | kernel: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() |
CVE-2024-41016
|
| VCID-sspu-bv8z-f7bx | kernel: smb: client: fix potential UAF in cifs_stats_proc_show() |
CVE-2024-35867
|
| VCID-ssqx-mgpz-97cd | kernel: drm/amd/display: Add check for granularity in dml ceil/floor helpers |
CVE-2024-57922
|
| VCID-ssxj-7m6b-nfah | kernel: nilfs2: fix potential deadlock with newly created symlinks |
CVE-2024-50229
|
| VCID-st2v-mdq3-9qbj | kernel: gpiolib: cdev: fix uninitialised kfifo |
CVE-2024-36898
|
| VCID-st59-ndz1-1yc5 | kernel: f2fs: fix to do sanity check on node blkaddr in truncate_node() |
CVE-2024-56692
|
| VCID-stkg-1cgz-1bc8 | kernel: xfs: add bounds checking to xlog_recover_process_data |
CVE-2024-41014
|
| VCID-stma-rnkr-c3ef | kernel: s390/pkey: Wipe copies of protected- and secure-keys |
CVE-2024-42155
|
| VCID-stny-634a-4ff3 | kernel: nfsd: call cache_put if xdr_reserve_space returns NULL |
CVE-2024-47737
|
| VCID-supp-ejnb-fyhu | kernel: Linux kernel: Denial of Service due to memory leak in hfcsusb_probe() |
CVE-2025-68734
|
| VCID-sv2x-sud7-9fcv | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Userspace can pass an arbitrary number of BO list entries via the bo_number field. Although the previous multiplication overflow check prevents out-of-bounds allocation, a large number of entries could still cause excessive memory allocation (up to potentially gigabytes) and unnecessarily long list processing times. Introduce a hard limit of 128k entries per BO list, which is more than sufficient for any realistic use case (e.g., a single list containing all buffers in a large scene). This prevents memory exhaustion attacks and ensures predictable performance. Return -EINVAL if the requested entry count exceeds the limit (cherry picked from commit 688b87d39e0aa8135105b40dc167d74b5ada5332) |
CVE-2026-23468
|
| VCID-sv8j-57vx-9ubs | kernel: drm/amd/display: Ensure array index tg_inst won't be -1 |
CVE-2024-46730
|
| VCID-svg5-zwdc-x7gb | kernel: Kernel: Denial of Service via NULL pointer dereference in drm/ttm |
CVE-2025-71083
|
| VCID-svm7-nyr5-kfa3 | kernel: atm: lec: fix null-ptr-deref in lec_arp_clear_vccs |
CVE-2026-23286
|
| VCID-sw22-xvt9-zfev | kernel: HID: multitouch: Add NULL check in mt_input_configured |
CVE-2024-58020
|
| VCID-swxd-qvb2-tfat | kernel: irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 |
CVE-2023-53383
|
| VCID-sx2x-9yj3-g7gs | kernel: nvmet-fc: avoid deadlock on delete association path |
CVE-2024-26769
|
| VCID-sx8c-2btf-d3ag | kernel: sched/core: Prevent rescheduling when interrupts are disabled |
CVE-2024-58090
|
| VCID-sxuq-3azc-fqa2 | kernel: iavf: Fix reset error handling |
CVE-2022-50053
|
| VCID-sy2r-ambc-tfhz | kernel: wifi: at76c50x: fix use after free access in at76_disconnect |
CVE-2025-37796
|
| VCID-sy3c-f5q7-qygm | kernel: icmp: fix NULL pointer dereference in icmp_tag_validation() |
CVE-2026-23398
|
| VCID-syfn-z7vm-qqh1 | kernel: Linux kernel: BPF verifier log truncation via crafted user input |
CVE-2023-54145
|
| VCID-sz8x-vw9h-27hq | kernel: comedi: Make insn_rw_emulate_bits() do insn->n samples |
CVE-2025-39686
|
| VCID-szdg-jd74-r7g1 | kernel: wifi: mac80211: don't WARN for connections on invalid channels |
CVE-2025-71227
|
| VCID-szsu-zzs2-k7a2 | kernel: ath11k: Fix frames flush failure caused by deadlock |
CVE-2022-49123
|
| VCID-t1e7-w1sa-d3fz | kernel: Kernel: Denial of Service via NULL pointer dereference in NFS unlock path |
CVE-2025-38023
|
| VCID-t1fp-4yag-afgu | kernel: virtio_net: Fix error unwinding of XDP initialization |
CVE-2023-53499
|
| VCID-t1t6-gbvh-wbee | kernel: f2fs: flush inode if atomic file is aborted |
CVE-2023-53829
|
| VCID-t2sv-vqq2-q7av | kernel: netfilter: nf_tables: always walk all pending catchall elements |
CVE-2026-23278
|
| VCID-t38a-a7y9-1yge | kernel: net: ppp: Add bound checking for skb data on ppp_sync_txmung |
CVE-2025-37749
|
| VCID-t3x3-9w7q-ube1 | kernel: netfilter: flowtable: initialise extack before use |
CVE-2024-45018
|
| VCID-t454-3ssr-9fhq | kernel: net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr |
CVE-2022-48859
|
| VCID-t48k-ayze-aqe2 | kernel: jfs: truncate good inode pages when hard link is 0 |
CVE-2025-39743
|
| VCID-t4hv-tdb7-hfee | kernel: btrfs: fix qgroup reserve leaks in cow_file_range |
CVE-2024-46733
|
| VCID-t4ja-urqj-1ycy | kernel: fbdev: smscufx: properly copy ioctl memory to kernelspace |
CVE-2026-23236
|
| VCID-t4wy-qqs7-pfgr | kernel: drm/amd/display: Check BIOS images before it is used |
CVE-2024-46809
|
| VCID-t53n-7sdf-kuag | kernel: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal |
CVE-2024-42302
|
| VCID-t5d6-k453-mug7 | kernel: rtmutex: Drop rt_mutex::wait_lock before scheduling |
CVE-2024-46829
|
| VCID-t5nr-dn7j-xub3 | kernel: clk: mediatek: Do a runtime PM get on controllers during probe |
CVE-2024-27002
|
| VCID-t5z7-w31u-j7gs | kernel: virtiofs: use pages instead of pointer for kernel direct IO |
CVE-2024-53219
|
| VCID-t5zg-bxuy-wbhk | kernel: NFSD: Prevent a potential integer overflow |
CVE-2024-53146
|
| VCID-t616-xdpb-dbd2 | kernel: spi: mpc52xx: Add cancel_work_sync before module remove |
CVE-2024-50051
|
| VCID-t645-suyd-n3ah | kernel: iio: light: veml6030: fix IIO device retrieval from embedded device |
CVE-2024-50198
|
| VCID-t6bd-fphy-7yfg | kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 |
CVE-2025-21702
|
| VCID-t6g3-n2fm-abg8 | kernel: mm: avoid leaving partial pfn mappings around in error case |
CVE-2024-47674
|
| VCID-t7j1-s8d2-vkf1 | kernel: Linux kernel: Denial of Service via device refcount leak in Appletalk protocol implementation |
CVE-2025-38542
|
| VCID-t7vb-497c-nfa4 | kernel: drm/i915/gt: Fix timeline left held on VMA alloc error |
CVE-2025-38389
|
| VCID-t7w9-ufkv-47fs | kernel: f2fs: initialize locks earlier in f2fs_fill_super() |
CVE-2022-49742
|
| VCID-t8d9-76jq-vqdc | kernel: of: module: add buffer overflow check in of_modalias() |
CVE-2024-38541
|
| VCID-t8hb-hxgq-mbac | kernel: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies |
CVE-2024-36915
|
| VCID-t8m1-asz6-syde | kernel: scsi: sg: Fix slab-use-after-free read in sg_release() |
CVE-2024-56631
|
| VCID-t8w7-3wf2-mucb | kernel: habanalabs: fix possible memory leak in MMU DR fini |
CVE-2022-49102
|
| VCID-t8we-jmxu-k3bf | kernel: sched/rt: Fix race in push_rt_task |
CVE-2025-38234
|
| VCID-t9e2-9f4f-6yed | kernel: tty: add the option to have a tty reject a new ldisc |
CVE-2024-40966
|
| VCID-t9gh-bzrr-w3bp | kernel: media: streamzap: fix race between device disconnection and urb callback |
CVE-2025-22027
|
| VCID-t9n3-kkm8-vue2 | kernel: scsi: lpfc: Inhibit aborts if external loopback plug is inserted |
CVE-2022-49504
|
| VCID-ta95-qfqs-cbbp | kernel: ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe() |
CVE-2024-50103
|
| VCID-tad5-rxb1-6yd7 | kernel: um: Fix potential integer overflow during physmem setup |
CVE-2024-53145
|
| VCID-tayp-ex4q-fbdh | kernel: jfs: Fix shift-out-of-bounds in dbDiscardAG |
CVE-2024-44938
|
| VCID-tb3q-ndrt-mkg3 | kernel: wifi: iwlwifi: read txq->read_ptr under lock |
CVE-2024-36922
|
| VCID-tbbd-s353-s3dn | kernel: usb: gadget: f_ncm: Refactor bind path to use __free() |
CVE-2025-40092
|
| VCID-tben-kwhv-dfea | kernel: hwmon: (xgene) Fix ioremap and memremap leak |
CVE-2023-53682
|
| VCID-tbh6-qan1-dfd1 | kernel: btrfs: remove BUG_ON()'s in add_new_free_space() |
CVE-2023-54185
|
| VCID-tcub-zdby-v3c9 | kernel: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() |
CVE-2024-44971
|
| VCID-td5e-4c6y-cyc9 | kernel: net: usb: kaweth: validate USB endpoints |
CVE-2026-23312
|
| VCID-tdbw-24ap-n7ec | kernel: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() |
CVE-2024-53203
|
| VCID-te8s-rb5h-87fd | kernel: Linux kernel: Information disclosure and denial of service in ntb_hw_switchtec module |
CVE-2023-53034
|
| VCID-tem5-juk6-uudj | kernel: usb: gadget: configfs: Fix OOB read on empty string write |
CVE-2025-38497
|
| VCID-texr-5weq-v3dw |
CVE-2026-31424
|
|
| VCID-tfe7-r6pk-mke3 | kernel: wifi: mac80211: check for station first in client probe |
CVE-2023-53588
|
| VCID-tfg7-cn7k-ffaj | kernel: drm/amd/display: Increase block_sequence array size |
CVE-2025-38080
|
| VCID-tg2v-3mym-hkcg | kernel: sctp: Fix null-ptr-deref in reuseport_add_sock(). |
CVE-2024-44935
|
| VCID-tga5-z7cd-fbf3 | kernel: drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ |
CVE-2024-46810
|
| VCID-tgxg-qapv-gfb5 | kernel: media: i2c: max9286: fix kernel oops when removing module |
CVE-2022-49509
|
| VCID-th3e-y2nm-u7eh | kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() |
CVE-2026-23193
|
| VCID-thga-2ttg-vbbt | kernel: media: davinci: vpif: fix use-after-free on driver unbind |
CVE-2021-47653
|
| VCID-thgd-2ee4-sqcm | kernel: ALSA: seq: oss: Fix races at processing SysEx messages |
CVE-2024-57893
|
| VCID-thxg-my7b-afcw | kernel: wifi: wfx: fix memory leak when starting AP |
CVE-2024-26896
|
| VCID-tj5a-2jkt-tkde | kernel: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc |
CVE-2024-42228
|
| VCID-tksa-uevv-47du | kernel: ice: xsk: return xsk buffers back to pool when cleaning the ring |
CVE-2021-47105
|
| VCID-tm2x-8gjx-33dv | kernel: drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback() |
CVE-2022-49309
|
| VCID-tmap-v72a-jydg | kernel: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref |
CVE-2025-38034
|
| VCID-tn72-dts1-n7eh | kernel: spi: cadence-qspi: fix pointer reference in runtime PM hooks |
CVE-2024-26807
|
| VCID-tncf-t15m-dya8 | kernel: Linux kernel: Denial of Service in ACPICA due to missing method arguments |
CVE-2025-38386
|
| VCID-tnns-pu2w-nbah | kernel: Linux kernel: Denial of Service via out-of-bounds read in EDAC/skx_common module reload |
CVE-2025-38298
|
| VCID-tnq3-smtx-dfh6 | kernel: wifi: mac80211: don't use rate mask for offchannel TX either |
CVE-2024-47738
|
| VCID-tnur-avf1-sybe | kernel: bpf: Call free_htab_elem() after htab_unlock_bucket() |
CVE-2024-56592
|
| VCID-tpet-vvg2-3qcb | kernel: drm/amdgpu: fix calltrace warning in amddrm_buddy_fini |
CVE-2023-53152
|
| VCID-tpga-cnnq-syfb | kernel: drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params |
CVE-2025-21941
|
| VCID-tpyv-xst5-vyd6 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: skip expectations in other netns via proc Skip expectations that do not reside in this netns. Similar to e77e6ff502ea ("netfilter: conntrack: do not dump other netns's conntrack entries via proc"). |
CVE-2026-31496
|
| VCID-tq2a-cuc2-37h4 | kernel: net_sched: Prevent creation of classes with TC_H_ROOT |
CVE-2025-21971
|
| VCID-tqfj-k95q-f7e5 | kernel: epoll: be better about file lifetimes |
CVE-2024-38580
|
| VCID-trc2-xkcv-dqe3 |
CVE-2026-23404
|
|
| VCID-tt18-fh9r-57c9 | kernel: nfc: nci: free skb on nci_transceive early error paths |
CVE-2026-23339
|
| VCID-tt65-bgtb-8ugr | kernel: s390/dasd: fix double module refcount decrement |
CVE-2024-27054
|
| VCID-tt8d-32cv-kuc9 | kernel: iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() |
CVE-2023-53476
|
| VCID-ttde-y49k-eqdw | kernel: exfat: validate cluster allocation bits of the allocation bitmap |
CVE-2025-40307
|
| VCID-tu5g-jnzs-33d4 | In the Linux kernel, the following vulnerability has been resolved: spi: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Also note that we do not enable the driver_override feature of struct bus_type, as SPI - in contrast to most other buses - passes "" to sysfs_emit() when the driver_override pointer is NULL. Thus, printing "\n" instead of "(null)\n". |
CVE-2026-31487
|
| VCID-tuag-p9ey-pucj | kernel: drm/nouveau: prime: fix ttm_bo_delayed_delete oops |
CVE-2025-37765
|
| VCID-tvc9-zhxc-pycb | kernel: fs: Fix uninitialized value issue in from_kuid and from_kgid |
CVE-2024-53101
|
| VCID-tvuc-hsys-v7fj | kernel: smb: client: fix OOBs when building SMB2_IOCTL request |
CVE-2024-50151
|
| VCID-tw2q-43an-pqb2 | kernel: Linux kernel: Information disclosure and denial of service via stack-out-of-bounds read |
CVE-2025-38320
|
| VCID-tw4g-9umx-a3bu | kernel: drm/amd/display: Skip on writeback when it's not applicable |
CVE-2024-36914
|
| VCID-twpr-8cxc-syd6 | kernel: Kernel: Denial of Service in network socket error handling |
CVE-2026-22977
|
| VCID-twy3-a6w2-7ugn | kernel: drm/amdkfd: don't allow mapping the MMIO HDP page with large pages |
CVE-2024-41011
|
| VCID-txbq-yc21-ebdx | kernel: parisc: Fix non-access data TLB cache flush faults |
CVE-2022-49172
|
| VCID-txxg-66tt-tqeb | kernel: batman-adv: Drop unmanaged ELP metric worker |
CVE-2025-21823
|
| VCID-ty4y-cv6r-fyh6 | kernel: usb: renesas_usbhs: Flush the notify_hotplug_work |
CVE-2025-21917
|
| VCID-tyvp-9xvj-7uax | kernel: drm/amd/display: Prevent crash when disable stream |
CVE-2024-35799
|
| VCID-tz3p-a6fh-3bg8 | kernel: arm64: probes: Remove broken LDR (literal) uprobe support |
CVE-2024-50099
|
| VCID-tzdq-wy6d-xbbx | kernel: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry |
CVE-2026-23361
|
| VCID-tzxw-3y28-h7ak | kernel: iommu/arm-smmu: Defer probe of clients after smmu device bound |
CVE-2024-56568
|
| VCID-u1ku-k252-nyem | kernel: libceph: make decode_pool() more resilient against corrupted osdmaps |
CVE-2025-71116
|
| VCID-u1ra-55vp-9ye5 | kernel: RDMA/hns: Fix cpu stuck caused by printings during reset |
CVE-2024-56722
|
| VCID-u1yt-tx4r-qken | kernel: usb: typec: ucsi: Handle incorrect num_connectors capability |
CVE-2025-71108
|
| VCID-u28n-uwtv-tyaj | kernel: netfilter: IDLETIMER: Fix for possible ABBA deadlock |
CVE-2024-54683
|
| VCID-u2dn-mnr7-m3hy | kernel: s390/ism: fix concurrency management in ism_cmd() |
CVE-2025-39726
|
| VCID-u2f9-867y-3yfb | kernel: Linux kernel: Denial of Service vulnerability in RDMA/rxe component |
CVE-2023-54028
|
| VCID-u2u5-me8u-pydu | kernel: powerpc/64s/slb: Fix SLB multihit issue during SLB preload |
CVE-2025-71078
|
| VCID-u2xt-yfpd-n3c2 | kernel: media: venus: hfi: add a check to handle OOB in sfr region |
CVE-2025-23159
|
| VCID-u3nr-jvw5-qqhh | kernel: net: sfc: add missing xdp queue reinitialization |
CVE-2022-49096
|
| VCID-u3td-2jk3-bbh2 | kernel: f2fs: avoid infinite loop to flush node pages |
CVE-2022-49317
|
| VCID-u3xh-m3py-ybgs | kernel: comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large |
CVE-2025-38481
|
| VCID-u3yu-4asz-dfea | kernel: usb: musb: sunxi: Fix accessing an released usb phy |
CVE-2024-50269
|
| VCID-u439-yjew-tkh8 | kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() |
CVE-2026-23003
|
| VCID-u43q-jeg9-n7bx | kernel: btrfs: fix use-after-free after failure to create a snapshot |
CVE-2022-48733
|
| VCID-u4xg-x55x-pyfk | kernel: Linux kernel (seg6): Information disclosure or denial of service via improper nexthop address validation |
CVE-2025-38310
|
| VCID-u58e-6ztz-5bcx | kernel: f2fs: fix to avoid overflow while left shift operation |
CVE-2025-40077
|
| VCID-u5m4-3rwx-k7fz | kernel: hv_netvsc: Fix panic during namespace deletion with VF |
CVE-2025-38683
|
| VCID-u666-tga8-2yhk | kernel: dma-direct: Leak pages on dma_set_decrypted() failure |
CVE-2024-35939
|
| VCID-u6wz-7q3t-cfam | kernel: batman-adv: fix OOB read/write in network-coding decode |
CVE-2025-39839
|
| VCID-u6zp-s6jd-n3hp | kernel: futex: Don't leak robust_list pointer on exec race |
CVE-2025-40341
|
| VCID-u7v1-r91f-wbhb | kernel: ACPI: battery: Fix possible crash when unregistering a battery hook |
CVE-2024-49955
|
| VCID-u825-z9zt-6bhn | kernel: scsi: aacraid: Fix double-free on probe failure |
CVE-2024-46673
|
| VCID-u892-96zg-9ke6 | In the Linux kernel, the following vulnerability has been resolved: udp: Fix wildcard bind conflict check when using hash2 When binding a udp_sock to a local address and port, UDP uses two hashes (udptable->hash and udptable->hash2) for collision detection. The current code switches to "hash2" when hslot->count > 10. "hash2" is keyed by local address and local port. "hash" is keyed by local port only. The issue can be shown in the following bind sequence (pseudo code): bind(fd1, "[fd00::1]:8888") bind(fd2, "[fd00::2]:8888") bind(fd3, "[fd00::3]:8888") bind(fd4, "[fd00::4]:8888") bind(fd5, "[fd00::5]:8888") bind(fd6, "[fd00::6]:8888") bind(fd7, "[fd00::7]:8888") bind(fd8, "[fd00::8]:8888") bind(fd9, "[fd00::9]:8888") bind(fd10, "[fd00::10]:8888") /* Correctly return -EADDRINUSE because "hash" is used * instead of "hash2". udp_lib_lport_inuse() detects the * conflict. */ bind(fail_fd, "[::]:8888") /* After one more socket is bound to "[fd00::11]:8888", * hslot->count exceeds 10 and "hash2" is used instead. */ bind(fd11, "[fd00::11]:8888") bind(fail_fd, "[::]:8888") /* succeeds unexpectedly */ The same issue applies to the IPv4 wildcard address "0.0.0.0" and the IPv4-mapped wildcard address "::ffff:0.0.0.0". For example, if there are existing sockets bound to "192.168.1.[1-11]:8888", then binding "0.0.0.0:8888" or "[::ffff:0.0.0.0]:8888" can also miss the conflict when hslot->count > 10. TCP inet_csk_get_port() already has the correct check in inet_use_bhash2_on_bind(). Rename it to inet_use_hash2_on_bind() and move it to inet_hashtables.h so udp.c can reuse it in this fix. |
CVE-2026-31503
|
| VCID-u8gh-ber8-q3dw | kernel: drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs |
CVE-2024-49901
|
| VCID-u9c5-g5k5-wyej | kernel: netfilter: nf_tables: reject duplicate device on updates |
CVE-2025-38678
|
| VCID-uahf-baq9-s3d5 | kernel: bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO |
CVE-2022-49961
|
| VCID-uaka-4bcz-77du | kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() |
CVE-2025-71085
|
| VCID-uax1-8dfp-sqed | kernel: s390/uv: Don't call folio_wait_writeback() without a folio reference |
CVE-2024-43832
|
| VCID-ub11-q416-xban | kernel: geneve: do not assume mac header is set in geneve_xmit_skb() |
CVE-2024-56636
|
| VCID-ub25-9y3n-hfc6 | kernel: Kernel: Denial of Service in 9p filesystem client via race condition |
CVE-2025-40027
|
| VCID-ub6v-8wt6-5fbg | kernel: PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 |
CVE-2025-21831
|
| VCID-ub6v-vb3r-83eh | kernel: x86/efi: defer freeing of boot services memory |
CVE-2026-23352
|
| VCID-ubtn-8mb7-huef | kernel: Input: lkkbd - disable pending work before freeing device |
CVE-2025-71073
|
| VCID-ubuz-ts2u-ufem | kernel: rcu: Fix rcu_read_unlock() deadloop due to IRQ work |
CVE-2025-39744
|
| VCID-ubyx-g9qc-x7dk | kernel: net/sched: Fix mirred deadlock on device recursion |
CVE-2024-27010
|
| VCID-uceb-eb41-eyed | kernel: ax25: properly unshare skbs in ax25_kiss_rcv() |
CVE-2025-39848
|
| VCID-ucsm-guzh-z7d2 | kernel: aoe: fix the potential use-after-free problem in more places |
CVE-2024-49982
|
| VCID-ucsz-fq2e-9ygk | kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() |
CVE-2026-23216
|
| VCID-udny-3t6r-fyhn | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: prevent immediate PASID reuse case PASID resue could cause interrupt issue when process immediately runs into hw state left by previous process exited with the same PASID, it's possible that page faults are still pending in the IH ring buffer when the process exits and frees up its PASID. To prevent the case, it uses idr cyclic allocator same as kernel pid's. (cherry picked from commit 8f1de51f49be692de137c8525106e0fce2d1912d) |
CVE-2026-31462
|
| VCID-udw2-zd4k-jbf8 | kernel: drm/amdkfd: fix potential kgd_mem UAFs |
CVE-2023-53816
|
| VCID-uedb-dybg-5udz | kernel: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec |
CVE-2026-23112
|
| VCID-uef9-22mb-7bhb | kernel: ipc: fix to protect IPCS lookups using RCU |
CVE-2025-38212
|
| VCID-uem4-47we-qua4 | kernel: f2fs: fix to cover read extent cache access with lock |
CVE-2024-44941
|
| VCID-ueyw-9v3y-zbfd | kernel: drm/amd/display: Atom Integrated System Info v2_2 for DCN35 |
CVE-2024-36897
|
| VCID-uf23-6wsu-2qer | kernel: RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds |
CVE-2024-47695
|
| VCID-ughm-c1ky-nkcu | kernel: IB/core: Fix ib_cache_setup_one error flow cleanup |
CVE-2024-47693
|
| VCID-ugs4-ynwn-ffcc | kernel: Linux kernel (IPv4): Denial of Service due to reference count leak in nexthop objects |
CVE-2025-71097
|
| VCID-ugzf-fz63-y3g9 | kernel: f2fs: fix to avoid out-of-boundary access in dnode page |
CVE-2025-38677
|
| VCID-uh15-7ty5-fubx | kernel: regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods |
CVE-2025-38395
|
| VCID-uh94-5nuu-w7fd | kernel: parisc: Try to fix random segmentation faults in package builds |
CVE-2024-40918
|
| VCID-uhbj-tg49-7yhc | kernel: xfrm: Reinject transport-mode packets through workqueue |
CVE-2022-50445
|
| VCID-uhng-dru9-7yht | In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Do not perform PM inside suspend callback syzbot reports "task hung in rpm_resume" This is caused by aqc111_suspend calling the PM variant of its write_cmd routine. The simplified call trace looks like this: rpm_suspend() usb_suspend_both() - here udev->dev.power.runtime_status == RPM_SUSPENDING aqc111_suspend() - called for the usb device interface aqc111_write32_cmd() usb_autopm_get_interface() pm_runtime_resume_and_get() rpm_resume() - here we call rpm_resume() on our parent rpm_resume() - Here we wait for a status change that will never happen. At this point we block another task which holds rtnl_lock and locks up the whole networking stack. Fix this by replacing the write_cmd calls with their _nopm variants |
CVE-2026-23446
|
| VCID-uj96-qpr6-jfh6 | kernel: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() |
CVE-2025-39860
|
| VCID-ujay-r4dd-37fh | kernel: net/sched: act_mirred: don't override retval if we already lost the skb |
CVE-2024-26739
|
| VCID-ujer-arz9-wkg7 | kernel: xhci: Handle TD clearing for multiple streams case |
CVE-2024-40927
|
| VCID-ujn5-yzfe-r7gj | kernel: media: rkisp1: Fix IRQ handling due to shared interrupts |
CVE-2023-52660
|
| VCID-ukr2-rp6y-rkf1 | kernel: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels |
CVE-2026-23274
|
| VCID-umfj-ak7h-rqfg | kernel: net: fix geneve_opt length integer overflow |
CVE-2025-22055
|
| VCID-umyr-w4sv-gkgd | kernel: pinmux: Use sequential access to access desc->pinmux data |
CVE-2024-47141
|
| VCID-unvx-5ua9-jfd5 | kernel: devres: Fix memory leakage caused by driver API devm_free_percpu() |
CVE-2024-43871
|
| VCID-upcd-ngpy-ekeu |
CVE-2026-31411
|
|
| VCID-upz7-dr6x-1qem | kernel: mm/hugetlb: unshare page tables during VMA split, not before |
CVE-2025-38084
|
| VCID-ur2p-jt6x-93bv | kernel: wifi: nl80211: disallow setting special AP channel widths |
CVE-2024-43912
|
| VCID-urnh-q2jd-27dj | kernel: netfilter: nf_tables: use timestamp to check for set element timeout |
CVE-2024-27397
|
| VCID-urpe-bn7v-ake7 | kernel: loop: Fix use-after-free issues |
CVE-2023-53111
|
| VCID-us8z-4623-abcj | kernel: ext4: turn quotas off if mount failed after enabling quotas |
CVE-2023-54153
|
| VCID-utvc-zd61-c3gk | kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD |
CVE-2026-23060
|
| VCID-utxt-24na-byf6 | kernel: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list |
CVE-2026-23084
|
| VCID-uuxb-2vuz-3kfx | kernel: ACPI: PAD: fix crash in exit_round_robin() |
CVE-2024-49935
|
| VCID-uv62-63nq-fkgc | kernel: s390/qeth: fix deadlock during failing recovery |
CVE-2021-47382
|
| VCID-uv8m-bj4c-8fes | x86: Transitive Scheduler Attacks |
CVE-2024-36357
XSA-471 |
| VCID-uvcv-xcdj-ufgy | kernel: virtio_pmem: Check device status before requesting flush |
CVE-2024-50184
|
| VCID-uvyu-va81-wbgj | In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use netlink policy range checks Replace manual range and mask validations with netlink policy annotations in ctnetlink code paths, so that the netlink core rejects invalid values early and can generate extack errors. - CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at policy level, removing the manual >= TCP_CONNTRACK_MAX check. - CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE (14). The normal TCP option parsing path already clamps to this value, but the ctnetlink path accepted 0-255, causing undefined behavior when used as a u32 shift count. - CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with CTA_FILTER_F_ALL, removing the manual mask checks. - CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding a new mask define grouping all valid expect flags. Extracted from a broader nf-next patch by Florian Westphal, scoped to ctnetlink for the fixes tree. |
CVE-2026-31495
|
| VCID-uwaa-gbex-n3fn | kernel: Squashfs: reject negative file sizes in squashfs_read_inode() |
CVE-2025-40200
|
| VCID-uwjv-xm1s-pbdq | kernel: arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL |
CVE-2024-57874
|
| VCID-uwqz-xtub-4qes | kernel: drm/i915: Fix a memory leak with reused mmap_offset |
CVE-2023-53002
|
| VCID-uwta-d7pe-8fe6 | kernel: smb: client: fix potential deadlock when releasing mids |
CVE-2023-52757
|
| VCID-uxsz-4fes-c7bv | kernel: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing |
CVE-2025-68185
|
| VCID-uyek-ttht-7kdw | kernel: hwmon: (w83791d) Convert macros to functions to avoid TOCTOU |
CVE-2025-71111
|
| VCID-uykq-n8rm-yfce | kernel: net: hns3: fix kernel crash problem in concurrent scenario |
CVE-2024-39507
|
| VCID-uypn-w7kp-13gb | kernel: blk-cgroup: Fix UAF in blkcg_unpin_online() |
CVE-2024-56672
|
| VCID-uz89-3jfw-ufbt | kernel: Linux kernel: Denial of Service in MPLS subsystem due to suspicious RCU usage |
CVE-2025-38324
|
| VCID-uzha-3vmp-97as | kernel: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails |
CVE-2025-38400
|
| VCID-uzp5-2r1y-wqe1 | kernel: KVM: Don't clobber irqfd routing type when deassigning irqfd |
CVE-2026-23198
|
| VCID-uzsb-9yx8-kua1 | kernel: wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() |
CVE-2025-39732
|
| VCID-v137-6nqk-v7c7 | kernel: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() |
CVE-2026-23089
|
| VCID-v1ka-ynm7-q3cw | kernel: drm/amd/display: Add null check for 'afb' in amdgpu_dm_update_cursor (v2) |
CVE-2024-49908
|
| VCID-v2ka-1q1b-nyh4 | kernel: drm/meson: reorder driver deinit sequence to fix use-after-free bug |
CVE-2022-50378
|
| VCID-v2rb-s1g7-1ub4 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd The /proc/fs/nfs/exports proc entry is created at module init and persists for the module's lifetime. exports_proc_open() captures the caller's current network namespace and stores its svc_export_cache in seq->private, but takes no reference on the namespace. If the namespace is subsequently torn down (e.g. container destruction after the opener does setns() to a different namespace), nfsd_net_exit() calls nfsd_export_shutdown() which frees the cache. Subsequent reads on the still-open fd dereference the freed cache_detail, walking a freed hash table. Hold a reference on the struct net for the lifetime of the open file descriptor. This prevents nfsd_net_exit() from running -- and thus prevents nfsd_export_shutdown() from freeing the cache -- while any exports fd is open. cache_detail already stores its net pointer (cd->net, set by cache_create_net()), so exports_release() can retrieve it without additional per-file storage. |
CVE-2026-31403
|
| VCID-v327-jqd3-hfgq | kernel: irqchip/imx-irqsteer: Handle runtime power management correctly |
CVE-2024-42290
|
| VCID-v3ba-uvsy-ybfv | kernel: dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() |
CVE-2025-71221
|
| VCID-v3m5-xj2s-5yef | kernel: s390/mm: Fix in_atomic() handling in do_secure_storage_access() |
CVE-2025-38359
|
| VCID-v3qm-f13v-fkhv | kernel: media: vivid: Change the siize of the composing |
CVE-2025-38226
|
| VCID-v3up-q48a-efhg | kernel: ice: Add netif_device_attach/detach into PF reset flow |
CVE-2024-46770
|
| VCID-v3yq-pmyj-uueb | kernel: usbnet: gl620a: fix endpoint checking in genelink_bind() |
CVE-2025-21877
|
| VCID-v41b-jva8-u7at | kernel: afs: Fix lock recursion |
CVE-2024-53090
|
| VCID-v4dn-p4q2-nyhb | kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY |
CVE-2024-56690
|
| VCID-v4rd-rrda-dkfj | kernel: RDMA/core: Silence oversized kvmalloc() warning |
CVE-2025-37867
|
| VCID-v52f-k7p2-qbcu | kernel: ipv6: fix possible UAF in ip6_finish_output2() |
CVE-2024-44986
|
| VCID-v55f-11y3-n7bf | kernel: wifi: iwlegacy: Clear stale interrupts before resuming device |
CVE-2024-50234
|
| VCID-v5bg-cqnz-43dd | kernel: iio: accel: mma8452: use the correct logic to get mma8452_data |
CVE-2022-49285
|
| VCID-v5et-qej6-7kaf | kernel: f2fs: fix to check atomic_file in f2fs ioctl interfaces |
CVE-2024-49859
|
| VCID-v5j9-r143-y7ad | kernel: orangefs: fix a oob in orangefs_debug_write |
CVE-2025-21782
|
| VCID-v65n-m4bz-3uc6 | kernel: KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits |
CVE-2022-49562
|
| VCID-v6qj-sywd-eyck | kernel: moxart: fix potential use-after-free on remove path |
CVE-2022-48626
|
| VCID-v7gh-5ztd-wufc | kernel: bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails |
CVE-2023-53103
|
| VCID-v893-rr8x-nyay | kernel: btrfs: send: check for inline extents in range_is_hole_in_parent() |
CVE-2026-23141
|
| VCID-v8xr-k446-8uar | kernel: Linux kernel: Denial of Service due to race condition in fbcon setup |
CVE-2025-68296
|
| VCID-v9h8-y6ak-pfgt | kernel: wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() |
CVE-2024-53059
|
| VCID-v9m7-887a-jqer | kernel: wifi: mac80211: Purge vif txq in ieee80211_do_stop() |
CVE-2025-37794
|
| VCID-v9p4-t339-t3g4 | kernel: net: dsa: properly keep track of conduit reference |
CVE-2025-71152
|
| VCID-v9q1-cbq6-9bbc | kernel: wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register() |
CVE-2022-50418
|
| VCID-v9uq-1unx-mug6 | kernel: bpf: cpumap: Fix memory leak in cpu_map_update_elem |
CVE-2023-53441
|
| VCID-v9vh-3bu7-q7cn | kernel: fou: Fix null-ptr-deref in GRO. |
CVE-2024-46763
|
| VCID-va7n-52az-mqbp | kernel: scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs |
CVE-2023-52808
|
| VCID-vaaz-21uq-gbc8 | kernel: interconnect: Fix locking for runpm vs reclaim |
CVE-2023-54013
|
| VCID-vaud-8ds2-qyfu | kernel: ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove |
CVE-2024-50292
|
| VCID-vavh-7yb6-rbg9 | kernel: ext4: do not create EA inode under buffer lock |
CVE-2024-40972
|
| VCID-vbj7-x5c1-sqca | kernel: ALSA: hda: intel-sdw-acpi: harden detection of controller |
CVE-2021-46926
|
| VCID-vbt5-crj4-yka2 | kernel: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop |
CVE-2025-68325
|
| VCID-vc77-dvcb-gfbb | kernel: usb: typec: ucsi: displayport: Fix NULL pointer access |
CVE-2025-37994
|
| VCID-vck1-emav-93gc | kernel: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger |
CVE-2024-38630
|
| VCID-vdnv-8h83-7kfs | kernel: ipv6: use RCU in ip6_xmit() |
CVE-2025-40135
|
| VCID-vdrf-93zk-7yhp | kernel: net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode |
CVE-2023-53733
|
| VCID-vegx-wnnb-37ce | kernel: fix 'struct pid' leaks in 'dbgfs_target_ids_write()' |
CVE-2021-46937
|
| VCID-vf1k-6dag-ufh4 | kernel: btrfs: fix deadlock when cloning inline extents and using qgroups |
CVE-2021-46987
|
| VCID-vffe-tb8s-eucn | kernel: can: mcp251xfd: fix infinite loop when xmit fails |
CVE-2024-41088
|
| VCID-vg8t-ypvc-mfer | kernel: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() |
CVE-2024-50205
|
| VCID-vgea-u817-jbg5 | kernel: platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses |
CVE-2024-46859
|
| VCID-vggd-je3f-57hw | kernel: drm/msm: Fix another leak in the submit error path |
CVE-2025-38409
|
| VCID-vgrw-6by1-zya8 | kernel: llc: do not use skb_get() before dev_queue_xmit() |
CVE-2025-21925
|
| VCID-vgzc-k8ue-5fh6 | kernel: ax25: Fix reference count leak issue of net_device |
CVE-2024-38554
|
| VCID-vgze-rbc5-bbc6 | kernel: netfilter: xt_CT: drop pending enqueued packets on template removal |
CVE-2026-23391
|
| VCID-vh61-db89-skas | kernel: mptcp: fix race condition in mptcp_schedule_work() |
CVE-2025-40258
|
| VCID-vhg1-bt9h-mfbb | kernel: i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock |
CVE-2024-43098
|
| VCID-vj31-9ycy-k7bd | kernel: ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping |
CVE-2025-40121
|
| VCID-vjks-s27v-x7er | kernel: netrom: check buffer length before accessing it |
CVE-2024-57802
|
| VCID-vjme-nqpq-j7f2 | kernel: wifi: cfg80211: ocb: don't leave if not joined |
CVE-2023-53992
|
| VCID-vk21-2de3-hqf9 | kernel: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() |
CVE-2025-37824
|
| VCID-vk6y-53us-13gy | kernel: net: rose: fix timer races against user threads |
CVE-2025-21718
|
| VCID-vm3p-zgmr-13gw | kernel: drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box |
CVE-2024-46811
|
| VCID-vmq8-67gh-cuds | kernel: ubifs: skip dumping tnc tree when zroot is null |
CVE-2024-58058
|
| VCID-vmts-4etq-hqh7 | kernel: gfs2: Fix potential glock use-after-free on unmount |
CVE-2024-38570
|
| VCID-vmvf-81ex-yug4 | kernel: nvme-rdma: unquiesce admin_q before destroy it |
CVE-2024-49569
|
| VCID-vn5r-b2j8-eufh | kernel: ath11k: Change max no of active probe SSID and BSSID to fw capability |
CVE-2022-49533
|
| VCID-vnvp-q4v4-kyew | kernel: bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() |
CVE-2023-53133
|
| VCID-vpps-6y8b-a7d6 | kernel: HID: wacom: fix when get product name maybe null pointer |
CVE-2024-56629
|
| VCID-vrpt-mbfc-7qef | kernel: Linux kernel: Denial of Service in SUNRPC via zero-length gss_token |
CVE-2025-71120
|
| VCID-vrz9-k2a3-4uep | kernel: scsi: hisi_sas: Create all dump files during debugfs initialization |
CVE-2024-56588
|
| VCID-vs9y-muth-dqgs | kernel: crypto: ccp - Fix crash when rebind ccp device for ccp.ko |
CVE-2025-38581
|
| VCID-vsyg-x46t-ayhz | kernel: net/sched: cls_u32: use skb_header_pointer_careful() |
CVE-2026-23204
|
| VCID-vsyr-1wh4-xbaj | kernel: f2fs: compress: fix to guarantee persisting compressed blocks by CP |
CVE-2024-27035
|
| VCID-vszv-8w4f-wqf1 | kernel: scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() |
CVE-2026-23087
|
| VCID-vt3e-tx5j-b7aq | kernel: reiserfs: Avoid touching renamed directory if parent does not change |
CVE-2023-52591
|
| VCID-vtgn-a3ts-nbf2 | kernel: nfsd: provide locking for v4_end_grace |
CVE-2026-22980
|
| VCID-vtp1-knbs-sqdw | kernel: drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration |
CVE-2024-46812
|
| VCID-vtud-2g7y-p7gt | kernel: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy |
CVE-2025-21640
|
| VCID-vtwb-e5mq-6bgq | kernel: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit |
CVE-2026-23277
|
| VCID-vu1c-8szw-2yhm | kernel: wifi: cfg80211: reject auth/assoc to AP with our address |
CVE-2023-53540
|
| VCID-vu46-d7jp-5kce | kernel: PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release |
CVE-2025-40032
|
| VCID-vu73-rhmm-kbas | kernel: ppp: Fix KMSAN uninit-value warning with bpf |
CVE-2025-21922
|
| VCID-vu79-tnhu-x7e6 | kernel: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() |
CVE-2025-39846
|
| VCID-vuhb-zw5k-vfdp | kernel: jfs: add sanity check for agwidth in dbMount |
CVE-2025-37740
|
| VCID-vuvt-vn89-nqef | kernel: ceph: drop messages from MDS when unmounting |
CVE-2022-48628
|
| VCID-vvgm-gt3j-7bg6 | kernel: octeontx2-af: Fix mcam entry resource leak |
CVE-2022-50060
|
| VCID-vvp1-hv9b-pubx | kernel: vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint |
CVE-2025-22083
|
| VCID-vw6j-sby6-dbh3 | In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free in teql_master_xmit Whenever a TEQL devices has a lockless Qdisc as root, qdisc_reset should be called using the seq_lock to avoid racing with the datapath. Failure to do so may cause crashes like the following: [ 238.028993][ T318] BUG: KASAN: double-free in skb_release_data (net/core/skbuff.c:1139) [ 238.029328][ T318] Free of addr ffff88810c67ec00 by task poc_teql_uaf_ke/318 [ 238.029749][ T318] [ 238.029900][ T318] CPU: 3 UID: 0 PID: 318 Comm: poc_teql_ke Not tainted 7.0.0-rc3-00149-ge5b31d988a41 #704 PREEMPT(full) [ 238.029906][ T318] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 238.029910][ T318] Call Trace: [ 238.029913][ T318] <TASK> [ 238.029916][ T318] dump_stack_lvl (lib/dump_stack.c:122) [ 238.029928][ T318] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 238.029940][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029944][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ 238.029957][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029969][ T318] kasan_report_invalid_free (mm/kasan/report.c:221 mm/kasan/report.c:563) [ 238.029979][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029989][ T318] check_slab_allocation (mm/kasan/common.c:231) [ 238.029995][ T318] kmem_cache_free (mm/slub.c:2637 (discriminator 1) mm/slub.c:6168 (discriminator 1) mm/slub.c:6298 (discriminator 1)) [ 238.030004][ T318] skb_release_data (net/core/skbuff.c:1139) ... [ 238.030025][ T318] sk_skb_reason_drop (net/core/skbuff.c:1256) [ 238.030032][ T318] pfifo_fast_reset (./include/linux/ptr_ring.h:171 ./include/linux/ptr_ring.h:309 ./include/linux/skb_array.h:98 net/sched/sch_generic.c:827) [ 238.030039][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ 238.030054][ T318] qdisc_reset (net/sched/sch_generic.c:1034) [ 238.030062][ T318] teql_destroy (./include/linux/spinlock.h:395 net/sched/sch_teql.c:157) [ 238.030071][ T318] __qdisc_destroy (./include/net/pkt_sched.h:328 net/sched/sch_generic.c:1077) [ 238.030077][ T318] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159) [ 238.030089][ T318] ? __pfx_qdisc_graft (net/sched/sch_api.c:1091) [ 238.030095][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030102][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030106][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030114][ T318] tc_get_qdisc (net/sched/sch_api.c:1529 net/sched/sch_api.c:1556) ... [ 238.072958][ T318] Allocated by task 303 on cpu 5 at 238.026275s: [ 238.073392][ T318] kasan_save_stack (mm/kasan/common.c:58) [ 238.073884][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5)) [ 238.074230][ T318] __kasan_slab_alloc (mm/kasan/common.c:369) [ 238.074578][ T318] kmem_cache_alloc_node_noprof (./include/linux/kasan.h:253 mm/slub.c:4542 mm/slub.c:4869 mm/slub.c:4921) [ 238.076091][ T318] kmalloc_reserve (net/core/skbuff.c:616 (discriminator 107)) [ 238.076450][ T318] __alloc_skb (net/core/skbuff.c:713) [ 238.076834][ T318] alloc_skb_with_frags (./include/linux/skbuff.h:1383 net/core/skbuff.c:6763) [ 238.077178][ T318] sock_alloc_send_pskb (net/core/sock.c:2997) [ 238.077520][ T318] packet_sendmsg (net/packet/af_packet.c:2926 net/packet/af_packet.c:3019 net/packet/af_packet.c:3108) [ 238.081469][ T318] [ 238.081870][ T318] Freed by task 299 on cpu 1 at 238.028496s: [ 238.082761][ T318] kasan_save_stack (mm/kasan/common.c:58) [ 238.083481][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5)) [ 238.085348][ T318] kasan_save_free_info (mm/kasan/generic.c:587 (discriminator 1)) [ 238.085900][ T318] __kasan_slab_free (mm/ ---truncated--- |
CVE-2026-23449
|
| VCID-vwnc-y4ve-nkhv | kernel: drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable() |
CVE-2024-45015
|
| VCID-vxwe-vwc8-jbeb | kernel: igb: Do not bring the device up after non-fatal error |
CVE-2024-50040
|
| VCID-vych-yxrw-6yak | kernel: pstore: inode: Only d_invalidate() is needed |
CVE-2024-27389
|
| VCID-vygz-ka85-w3h1 | kernel: jbd2: remove wrong sb->s_sequence check |
CVE-2025-37839
|
| VCID-vym6-gaeq-2yau | kernel: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() |
CVE-2025-21959
|
| VCID-vysr-bztb-yugx | kernel: i40e: remove read access to debugfs files |
CVE-2025-39901
|
| VCID-vyzk-3662-uqbh | kernel: mmc: sdhci-msm: pervent access to suspended controller |
CVE-2024-36029
|
| VCID-vz1n-7fbk-kyag | kernel: f2fs: fix to detect potential corrupted nid in free_nid_list |
CVE-2025-68315
|
| VCID-vz55-n2g2-zyfr | kernel: f2fs: fix to tag gcing flag on page during block migration |
CVE-2023-52588
|
| VCID-vz73-y2va-5kbw | In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB. Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly. Compile-tested only. |
CVE-2026-23447
|
| VCID-vz7d-4nje-nbh3 | kernel: octeontx2-af: Fix possible null pointer dereference. |
CVE-2021-47484
|
| VCID-vzkb-k69z-zbeb | kernel: jfs: Fix uaf in dbFreeBits |
CVE-2024-49903
|
| VCID-vzkt-5648-ukh7 |
CVE-2026-31415
|
|
| VCID-vzz7-k3dh-zqfh | kernel: f2fs: get rid of online repaire on corrupted directory |
CVE-2024-47690
|
| VCID-w1s6-1ac6-eken | kernel: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() |
CVE-2024-50251
|
| VCID-w1sf-m294-jke8 | kernel: fbdev: hyperv_fb: Allow graceful removal of framebuffer |
CVE-2025-21976
|
| VCID-w2fj-8dqr-gbcc | kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() |
CVE-2025-38352
|
| VCID-w2sf-3ncc-ayaf | kernel: netfilter: conntrack: revisit gc autotuning |
CVE-2022-49110
|
| VCID-w2uc-uqc2-7khf | kernel: media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg |
CVE-2024-56769
|
| VCID-w32w-1p9x-77dk | kernel: wifi: ath10k: avoid NULL pointer error during sdio remove |
CVE-2024-56599
|
| VCID-w3ew-gk84-akf7 | kernel: comedi: fix divide-by-zero in comedi_buf_munge() |
CVE-2025-40106
|
| VCID-w3s3-sh1w-8bdr | kernel: Linux kernel (btrfs): Use-after-free in qgroup due to race condition |
CVE-2025-39759
|
| VCID-w3vu-dmn5-1udd | kernel: firmware: stratix10-svc: fix bug in saving controller data |
CVE-2025-68328
|
| VCID-w49v-mffu-3kfa | kernel: tty: xilinx_uartps: split sysrq handling |
CVE-2025-21820
|
| VCID-w53c-hafw-6kbb | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case In decode_int(), the CONS case calls get_bits(bs, 2) to read a length value, then calls get_uint(bs, len) without checking that len bytes remain in the buffer. The existing boundary check only validates the 2 bits for get_bits(), not the subsequent 1-4 bytes that get_uint() reads. This allows a malformed H.323/RAS packet to cause a 1-4 byte slab-out-of-bounds read. Add a boundary check for len bytes after get_bits() and before get_uint(). |
CVE-2026-23456
|
| VCID-w5fz-8grc-g3h5 | kernel: btrfs: fix incorrect splitting in btrfs_drop_extent_map_range |
CVE-2023-54121
|
| VCID-w6cy-vhp9-kkbr |
CVE-2026-23408
|
|
| VCID-w6e2-1eqn-s3f7 | kernel: iio: light: vcnl4035: fix information leak in triggered buffer |
CVE-2024-57910
|
| VCID-w6ku-q9rr-57ht | kernel: net: lan743x: Fix memleak issue when GSO enabled |
CVE-2025-37909
|
| VCID-w71f-nskm-nyau | kernel: udmabuf: fix memory leak on last export_udmabuf() error path |
CVE-2024-56712
|
| VCID-w73q-zyg9-fkbc | kernel: mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() |
CVE-2025-38681
|
| VCID-w75k-uv9m-kuhm | kernel: smb: client: fix UAF in smb2_reconnect_server() |
CVE-2024-35870
|
| VCID-w79c-atgr-gkd9 | kernel: drm/amd/pm: fix the Out-of-bounds read warning |
CVE-2024-46731
|
| VCID-w8af-5n1k-ybag | kernel: Linux kernel: Denial of Service via NULL pointer dereference in HSR |
CVE-2025-68776
|
| VCID-w8cj-cmm9-kbbq | kernel: drm/amd/display: populate subvp cmd info only for the top pipe |
CVE-2023-53806
|
| VCID-w8r5-decj-vkem | kernel: io_uring: prevent opcode speculation |
CVE-2025-21863
|
| VCID-w96c-cvzd-tqbf | kernel: ksmbd brute force delay bypass via asynchronous requests |
CVE-2023-32251
|
| VCID-wace-ayvn-zucy | kernel: Linux kernel: Denial of Service in uprobes due to improper instruction validation |
CVE-2025-38466
|
| VCID-wanj-gu4w-2qaz | kernel: padata: Fix pd UAF once and for all |
CVE-2025-38584
|
| VCID-wbme-mwhe-tkc3 | kernel: ACPICA: fix acpi operand cache leak in dswstate.c |
CVE-2025-38345
|
| VCID-wbpu-dbk1-2bep | kernel: wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values |
CVE-2024-42114
|
| VCID-wc4k-86v7-ykh7 | kernel: accel/habanalabs: fix mem leak in capture user mappings |
CVE-2023-53367
|
| VCID-wc8v-rm8z-gfg5 | kernel: ARM: OMAP2+: omap4-common: Fix refcount leak bug |
CVE-2022-50539
|
| VCID-wc9d-a43m-7kda | kernel: usb: dwc3: Remove WARN_ON for device endpoint command timeouts |
CVE-2025-39801
|
| VCID-wcet-4wex-rfdy | kernel: MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed |
CVE-2024-46832
|
| VCID-wcvq-cqyr-p7c4 | kernel: wifi: ath11k: Fix qmi_msg_handler data structure initialization |
CVE-2022-50871
|
| VCID-wd2z-jnpt-3bd3 | kernel: f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread() |
CVE-2024-47691
|
| VCID-wd4m-swhu-wyay | kernel: hwrng: ks-sa - fix division by zero in ks_sa_rng_init |
CVE-2025-40127
|
| VCID-wdux-9a9h-eqc3 | kernel: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio |
CVE-2025-21931
|
| VCID-wemg-168r-d3hb | kernel: pid: Add a judgment for ns null in pid_nr_ns |
CVE-2025-40178
|
| VCID-wems-qvj9-gkbf | kernel: tracing: Fix reading strings from synthetic events |
CVE-2022-50255
|
| VCID-wevr-e27z-vuf2 | kernel: crypto: qat - fix memory leak in RSA |
CVE-2022-49566
|
| VCID-wf2e-p8u9-gbcn | kernel: f2fs: Require FMODE_WRITE for atomic write ioctls |
CVE-2024-47740
|
| VCID-wfpw-44ky-zkhk | kernel: watch_queue: fix pipe accounting mismatch |
CVE-2025-23138
|
| VCID-wga7-ag9q-h3gw | kernel: RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled |
CVE-2024-47735
|
| VCID-wgwf-u8hc-yuag |
CVE-2026-23409
|
|
| VCID-wja6-3qb9-c3bn | kernel: lib/generic-radix-tree.c: Don't overflow in peek() |
CVE-2021-47432
|
| VCID-wjeh-m3f2-tkbg | kernel: wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode |
CVE-2024-58096
|
| VCID-wjen-hhh1-eff5 | kernel: 9p: set req refcount to zero to avoid uninitialized usage |
CVE-2022-50335
|
| VCID-wjg9-f891-kudh | kernel: bus: fsl-mc: Check return value of platform_get_resource() |
CVE-2025-40029
|
| VCID-wjvu-p26y-qbha | kernel: bluetooth/l2cap: sync sock recv cb and release |
CVE-2024-41062
|
| VCID-wk3t-3jvn-quf1 | kernel: media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() |
CVE-2025-38237
|
| VCID-wkar-du5w-h7ac | kernel: drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes |
CVE-2024-42309
|
| VCID-wkhk-7x67-x7ec | kernel: clk: zynq: Prevent null pointer dereference caused by kmalloc failure |
CVE-2024-27037
|
| VCID-wkju-5p5k-z3g1 | kernel: mptcp: do not queue data on closed subflows |
CVE-2022-50070
|
| VCID-wkqf-ex7a-73ft | kernel: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses |
CVE-2024-26947
|
| VCID-wms1-e19s-buga | kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O |
CVE-2025-40026
|
| VCID-wn2n-ev3c-23ep | kernel: Linux kernel: Race condition in network scheduler can cause denial of service and data compromise. |
CVE-2025-38107
|
| VCID-wn9w-qz7u-1ybr | kernel: net: hns3: add vlan list lock to protect vlan list |
CVE-2022-49182
|
| VCID-wndk-9krb-yqcb | kernel: media: uvcvideo: Fix double free in error path |
CVE-2024-57980
|
| VCID-wnep-c9wf-hycp | kernel: Linux kernel: Memory leak in RDMA restrack leads to Denial of Service |
CVE-2022-50822
|
| VCID-wng4-rwvs-cfa4 | kernel: net: rose: include node references in rose_neigh refcount |
CVE-2025-39827
|
| VCID-wnh7-18vz-vbgn | kernel: drm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func |
CVE-2024-49910
|
| VCID-wnnc-9rg2-8ba3 | kernel: ACPICA: fix acpi parse and parseext cache leaks |
CVE-2025-38344
|
| VCID-wp1v-bqdp-t3ct | kernel: sctp: properly validate chunk size in sctp_sf_ootb() |
CVE-2024-50299
|
| VCID-wq4h-q7vt-23ex | In the Linux kernel, the following vulnerability has been resolved: nvdimm/bus: Fix potential use after free in asynchronous initialization Dingisoul with KASAN reports a use after free if device_add() fails in nd_async_device_register(). Commit b6eae0f61db2 ("libnvdimm: Hold reference on parent while scheduling async init") correctly added a reference on the parent device to be held until asynchronous initialization was complete. However, if device_add() results in an allocation failure the ref count of the device drops to 0 prior to the parent pointer being accessed. Thus resulting in use after free. The bug bot AI correctly identified the fix. Save a reference to the parent pointer to be used to drop the parent reference regardless of the outcome of device_add(). |
CVE-2026-31399
|
| VCID-wq75-bzh1-43d7 | kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime |
CVE-2025-38470
|
| VCID-wqey-aqa9-yud8 | kernel: um: net: Do not use drvdata in release |
CVE-2024-53183
|
| VCID-wqrb-v41r-y7bn | kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts |
CVE-2021-3669
|
| VCID-wqs9-utnj-2fgh | kernel: ocfs2: reserve space for inline xattr before attaching reflink tree |
CVE-2024-49958
|
| VCID-wqy6-8pvh-hfc8 | kernel: Linux kernel: Denial of Service in kvaser_usb CAN driver due to memory leak |
CVE-2026-23061
|
| VCID-wr73-m2yh-j3dh | kernel: net: atlantic: Fix DMA mapping for PTP hwts ring |
CVE-2024-26680
|
| VCID-wra1-cqzm-57gc | kernel: driver: iio: add missing checks on iio_info's callback access |
CVE-2024-46715
|
| VCID-wrk6-u3rh-7ucp | kernel: ALSA: line6: Fix racy access to midibuf |
CVE-2024-44954
|
| VCID-wrve-27vr-e7dj | kernel: can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header |
CVE-2025-68343
|
| VCID-wsnu-mj7t-fqck | kernel: media: usbtv: Lock resolution while streaming |
CVE-2025-39714
|
| VCID-wstb-4k78-gufv | kernel: drm/bridge: adv7511: fix crash on irq during probe |
CVE-2024-26876
|
| VCID-wtb4-91x5-6qbf | kernel: drm/nouveau: prime: fix refcount underflow |
CVE-2024-43867
|
| VCID-wtjw-5xm7-5ug6 | kernel: loop: implement ->free_disk |
CVE-2022-49531
|
| VCID-wtm8-vuaw-ufgj | kernel: ftrace: Also allocate and copy hash for reading of filter files |
CVE-2025-39689
|
| VCID-wu8n-dnxf-hqha | kernel: f2fs: Fix system crash due to lack of free space in LFS |
CVE-2023-54151
|
| VCID-wunv-tnmq-y7a6 | kernel: hfsplus: don't query the device logical block size multiple times |
CVE-2024-56548
|
| VCID-wur3-taza-rbh2 | kernel: Linux kernel: Local Denial of Service due to TIF_IO_BITMAP inconsistency |
CVE-2025-38100
|
| VCID-wv35-ucjn-3bb5 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously. The above causes ext4_xattr_block_set() to enter an infinite loop about "inserted" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1]. If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases: 1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case. 2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks. [1] INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline] |
CVE-2026-31448
|
| VCID-wvcr-8vpc-tyb7 | kernel: nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error |
CVE-2024-50096
|
| VCID-wvkq-z4mr-dqbg | kernel: tracing: Fix oob write in trace_seq_to_buffer() |
CVE-2025-37923
|
| VCID-wvp8-cst3-cuhr | kernel: xfrm: state: fix out-of-bounds read during lookup |
CVE-2024-57982
|
| VCID-wwax-w4gg-cuhy | kernel: functionfs: fix the open/removal races |
CVE-2025-71074
|
| VCID-wwma-hh9d-1qhb | kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled |
CVE-2025-38346
|
| VCID-wwn8-zp2y-ykep | kernel: rdma/cxgb4: Prevent potential integer overflow on 32bit |
CVE-2024-57973
|
| VCID-wwzp-ksz8-5ye3 | kernel: riscv: Check if the code to patch lies in the exit section |
CVE-2023-52677
|
| VCID-wxx7-3a43-h7gh |
CVE-2026-31408
|
|
| VCID-wy74-8292-87c8 | kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() |
CVE-2025-38724
|
| VCID-wy8p-gr1j-3yap | kernel: Bluetooth: bcsp: receive data only if registered |
CVE-2025-40308
|
| VCID-wy9s-ey4y-ubck | kernel: wifi: ath6kl: remove WARN on bad firmware input |
CVE-2025-38406
|
| VCID-wywg-zzur-cbep | kernel: atm: atmtcp: Free invalid length skb in atmtcp_c_send() |
CVE-2025-38185
|
| VCID-wyzb-1z24-dygv | kernel: netfilter: bridge: confirm multicast packets before passing them up the stack |
CVE-2024-27415
|
| VCID-wz3q-eezz-syej | kernel: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() |
CVE-2025-38103
|
| VCID-wzqx-1vmr-47gu | kernel: Linux kernel: Use-after-free vulnerability in page_pool_recycle_in_ring can lead to arbitrary code execution |
CVE-2025-38129
|
| VCID-wzy5-1p8z-5kfr | kernel: mptcp: handle consistently DSS corruption |
CVE-2024-50185
|
| VCID-x114-q3j2-aqf5 | kernel: eventpoll: Fix semi-unbounded recursion |
CVE-2025-38614
|
| VCID-x1m4-hf24-27hq | kernel: scsi: target: Fix recursive locking in __configfs_open_file() |
CVE-2026-23292
|
| VCID-x1mt-bfa7-ubfr | kernel: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() |
CVE-2025-38713
|
| VCID-x1qx-va9g-xufy | kernel: btrfs: always detect conflicting inodes when logging inode refs |
CVE-2025-71183
|
| VCID-x1vt-zrmm-17b8 | kernel: Linux kernel: Denial of Service in sch_qfq due to NULL pointer dereference |
CVE-2026-22976
|
| VCID-x2ap-8xew-wkaa | kernel: mlxsw: spectrum_router: Fix neighbour use-after-free |
CVE-2025-68801
|
| VCID-x2e5-f67v-q7hw | kernel: EDAC/bluefield: Fix potential integer overflow |
CVE-2024-53161
|
| VCID-x2wa-qayz-d7h9 | kernel: vfio/platform: check the bounds of read/write syscalls |
CVE-2025-21687
|
| VCID-x4ud-z68d-ckhj | kernel: drm/msm: Fix a fence leak in submit error path |
CVE-2025-38410
|
| VCID-x5c6-pbrm-x3h3 | kernel: net/mdiobus: Fix potential out-of-bounds read/write access |
CVE-2025-38111
|
| VCID-x5ec-vwcj-mbcy | kernel: drm/amd/display: Fix index out of bounds in DCN30 color transformation |
CVE-2024-49969
|
| VCID-x5jd-ruv2-1qac |
CVE-2026-31428
|
|
| VCID-x5k6-cx75-gfet | kernel: media: cxusb: no longer judge rbuf when the write fails |
CVE-2025-38229
|
| VCID-x6kd-y436-nbaw | kernel: wifi: rtw88: usb: schedule rx work after everything is set up |
CVE-2024-46760
|
| VCID-x7ch-ec75-7faz | kernel: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem |
CVE-2025-38022
|
| VCID-x7nf-hb2f-wkf2 | kernel: mm: hugetlb: independent PMD page table shared count |
CVE-2024-57883
|
| VCID-x85t-3pje-1uaa | kernel: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs |
CVE-2025-22045
|
| VCID-x8e2-hr3z-ubey | kernel: platform/x86: toshiba_haps: Fix memory leaks in add/remove routines |
CVE-2026-23176
|
| VCID-x8he-jwxh-s7bt | kernel: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() |
CVE-2024-47668
|
| VCID-x974-3nu3-83g8 | kernel: reset: uniphier-glue: Fix possible null-ptr-deref |
CVE-2022-49758
|
| VCID-x9a9-thjn-yya5 | In the Linux kernel, the following vulnerability has been resolved: xfs: save ailp before dropping the AIL lock in push callbacks In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is dropped to perform buffer IO. Once the cluster buffer no longer protects the log item from reclaim, the log item may be freed by background reclaim or the dquot shrinker. The subsequent spin_lock() call dereferences lip->li_ailp, which is a use-after-free. Fix this by saving the ailp pointer in a local variable while the AIL lock is held and the log item is guaranteed to be valid. |
CVE-2026-31454
|
| VCID-x9gz-mk6u-4fdv | kernel: bpf: Enforce expected_attach_type for tailcall compatibility |
CVE-2025-40123
|
| VCID-x9st-jeqc-7ucj | kernel: net: sched: fix ets qdisc OOB Indexing |
CVE-2025-21692
|
| VCID-x9x5-hefw-zuhk | kernel: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request |
CVE-2025-38430
|
| VCID-x9za-c2zz-rqfk | kernel: vhost-scsi: protect vq->log_used with vq->mutex |
CVE-2025-38074
|
| VCID-xa5q-5ask-c3gk | kernel: tracing: Do not register unsupported perf events |
CVE-2025-71125
|
| VCID-xaj7-9xgc-5fex | kernel: rapidio: fix an API misues when rio_add_net() fails |
CVE-2025-21934
|
| VCID-xaur-udbk-27cs | kernel: drm/amdgpu: install stub fence into potential unused fence pointers |
CVE-2023-53248
|
| VCID-xaye-wwt2-fkb2 | kernel: Bluetooth: RFCOMM: Fix not validating setsockopt user input |
CVE-2024-35966
|
| VCID-xbbm-hkmg-f3fm | kernel: ext4: improve error handling from ext4_dirhash() |
CVE-2023-53473
|
| VCID-xbme-vftn-97h5 | kernel: netlink: avoid infinite retry looping in netlink_unicast() |
CVE-2025-38727
|
| VCID-xbra-jtwd-6bhf | kernel: wifi: rtw88: fix memory leak in rtw_usb_probe() |
CVE-2023-53460
|
| VCID-xc63-72pt-4kh9 | kernel: macsec: fix UAF bug for real_dev |
CVE-2022-49390
|
| VCID-xc83-2865-7bgz | kernel: RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers |
CVE-2025-21885
|
| VCID-xd5n-h33h-xfa5 | kernel: riscv: Fix sleeping in invalid context in die() |
CVE-2024-57939
|
| VCID-xd76-s5yw-fyaq | kernel: drm/amdgpu: unmap and remove csa_va properly |
CVE-2023-53545
|
| VCID-xdde-euh1-dqfv | kernel: spi: cadence-quadspi: Implement refcount to handle unbind during busy |
CVE-2025-40005
|
| VCID-xdty-z9se-6ufj | kernel: Bluetooth: MGMT: Add error handling to pair_device() |
CVE-2024-43884
|
| VCID-xdw8-ms7r-bfc4 | kernel: net: add more sanity checks to qdisc_pkt_len_init() |
CVE-2024-49948
|
| VCID-xefy-hh5k-vbf5 | kernel: block: avoid possible overflow for chunk_sectors check in blk_stack_limits() |
CVE-2025-39795
|
| VCID-xejf-45r3-b7gd | kernel: staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() |
CVE-2025-38612
|
| VCID-xem5-ehrv-4qgk | kernel: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption |
CVE-2024-49858
|
| VCID-xf8w-1v5k-nyf7 | kernel: tcp_metrics: use dst_dev_net_rcu() |
CVE-2025-40075
|
| VCID-xfhf-gaaq-aff3 | kernel: scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() |
CVE-2024-56747
|
| VCID-xg91-u3fc-1bat | kernel: ASoC: stm32: sai: fix OF node leak on probe |
CVE-2025-71081
|
| VCID-xgje-4fmc-pydz | kernel: ax25: Fix reference count leak issues of ax25_dev |
CVE-2024-38602
|
| VCID-xgn2-cjg9-jkay | kernel: libnvdimm/labels: Fix divide error in nd_label_data_init() |
CVE-2025-38072
|
| VCID-xgu6-buty-uqcx | kernel: Linux kernel: Denial of Service due to page allocation failures |
CVE-2025-68321
|
| VCID-xh1w-u484-dbet | In the Linux kernel, the following vulnerability has been resolved: erofs: add GFP_NOIO in the bio completion if needed The bio completion path in the process context (e.g. dm-verity) will directly call into decompression rather than trigger another workqueue context for minimal scheduling latencies, which can then call vm_map_ram() with GFP_KERNEL. Due to insufficient memory, vm_map_ram() may generate memory swapping I/O, which can cause submit_bio_wait to deadlock in some scenarios. Trimmed down the call stack, as follows: f2fs_submit_read_io submit_bio //bio_list is initialized. mmc_blk_mq_recovery z_erofs_endio vm_map_ram __pte_alloc_kernel __alloc_pages_direct_reclaim shrink_folio_list __swap_writepage submit_bio_wait //bio_list is non-NULL, hang!!! Use memalloc_noio_{save,restore}() to wrap up this path. |
CVE-2026-31467
|
| VCID-xh5z-9tvc-kueq | kernel: nbd: restrict sockets to TCP and UDP |
CVE-2025-40080
|
| VCID-xhf2-ccs9-sbe6 | kernel: sched/psi: use kernfs polling functions for PSI trigger polling |
CVE-2023-54019
|
| VCID-xhfy-gkwq-afbr | kernel: wifi: libertas: fix use-after-free in lbs_free_adapter() |
CVE-2026-23281
|
| VCID-xhsu-dqfq-3fev | kernel: Linux kernel (CIFS): Use-after-free vulnerability allows data integrity compromise and denial of service |
CVE-2023-53751
|
| VCID-xhyg-uqfe-ufc3 | kernel: media: imon: make send_packet() more robust |
CVE-2025-68194
|
| VCID-xhyq-tmc3-8uct | kernel: btrfs: don't log conflicting inode if it's a dir moved in the current transaction |
CVE-2025-68778
|
| VCID-xjtu-3rs8-1be1 | kernel: nilfs2: fix kernel bug due to missing clearing of checked flag |
CVE-2024-50230
|
| VCID-xkg2-9n6y-5kan | kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration |
CVE-2026-23097
|
| VCID-xkqp-j73p-pbhp | kernel: usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer |
CVE-2025-68331
|
| VCID-xkwe-ybb2-tyew | kernel: can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds |
CVE-2023-52878
|
| VCID-xm3j-uguv-hyd4 | kernel: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint |
CVE-2024-53130
|
| VCID-xm4v-72mk-8qg1 | kernel: KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 |
CVE-2024-46707
|
| VCID-xm97-rb7w-37hm | kernel: PCI: Fix reference leak in pci_register_host_bridge() |
CVE-2025-37836
|
| VCID-xmur-2pys-5kb4 | kernel: net: drop UFO packets in udp_rcv_segment() |
CVE-2025-38622
|
| VCID-xncx-nvr7-k7d8 | kernel: x86/mm/ident_map: Use gbpages only where full GB page should be mapped. |
CVE-2024-50017
|
| VCID-xp6n-zuk6-pbbw | kernel: ftrace: Fix possible use-after-free issue in ftrace_location() |
CVE-2024-38588
|
| VCID-xpat-gan5-mfh6 | kernel: rseq: Fix segfault on registration when rseq_cs is non-zero |
CVE-2025-38067
|
| VCID-xq6w-4efm-ckhj | kernel: spi: fsi: Implement a timeout for polling status |
CVE-2022-49173
|
| VCID-xq7q-bzjv-17gu | kernel: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name |
CVE-2024-49934
|
| VCID-xs1y-xj8y-bkce | kernel: nilfs2: protect access to buffers with no active references |
CVE-2025-21811
|
| VCID-xs4a-ha3z-2bej | kernel: tracing: Add recursion protection in kernel stack trace recording |
CVE-2026-23138
|
| VCID-xt1x-hf7k-bkad | kernel: tracing: dynevent: Add a missing lockdown check on dynevent |
CVE-2025-40021
|
| VCID-xtbh-wee7-3qgj | kernel: dm rq: don't queue request to blk-mq during DM suspend |
CVE-2021-47498
|
| VCID-xtf5-mk4x-9uc4 | kernel: xsk: Fix race condition in AF_XDP generic RX path |
CVE-2025-37920
|
| VCID-xtmf-n68y-53cf | kernel: Improper IO-uring request cancellation operation allows local users to cause a crash |
CVE-2021-4023
|
| VCID-xuhf-kwk4-y3dx | kernel: can: bcm: add locking for bcm_op runtime updates |
CVE-2025-38004
|
| VCID-xvp8-qbsn-wuh5 | kernel: btrfs: fix use-after-free when attempting to join an aborted transaction |
CVE-2025-21753
|
| VCID-xw19-dwpb-wfd5 | kernel: ext4: check dot and dotdot of dx_root before making dir indexed |
CVE-2024-42305
|
| VCID-xwc5-xbwd-z3g7 | kernel: selinux,smack: don't bypass permissions check in inode_setsecctx hook |
CVE-2024-46695
|
| VCID-xxhg-up2k-yyhv | kernel: drm/amd/display: Implement bounds check for stream encoder creation in DCN401 |
CVE-2024-49970
|
| VCID-xxjc-pp3q-8bga | kernel: nexthop: Forbid FDB status change while nexthop is in a group |
CVE-2025-39980
|
| VCID-xy3c-wcfm-qyd2 | kernel: firmware: arm_scmi: Check mailbox/SMT channel for consistency |
CVE-2023-52608
|
| VCID-xyh2-tgkm-d3d9 | kernel: wifi: rtw88: always wait for both firmware loading attempts |
CVE-2024-47718
|
| VCID-xzc2-9tmc-7qey | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock btintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET and Intel exception-info retrieval) without holding hci_req_sync_lock(). This lets it race against hci_dev_do_close() -> btintel_shutdown_combined(), which also runs __hci_cmd_sync() under the same lock. When both paths manipulate hdev->req_status/req_rsp concurrently, the close path may free the response skb first, and the still-running hw_error path hits a slab-use-after-free in kfree_skb(). Wrap the whole recovery sequence in hci_req_sync_lock/unlock so it is serialized with every other synchronous HCI command issuer. Below is the data race report and the kasan report: BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined read of hdev->req_rsp at net/bluetooth/hci_sync.c:199 by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254 hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030 write/free by task ioctl/22580: btintel_shutdown_combined+0xd0/0x360 drivers/bluetooth/btintel.c:3648 hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246 hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526 BUG: KASAN: slab-use-after-free in sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202 Read of size 4 at addr ffff888144a738dc by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260 |
CVE-2026-31500
|
| VCID-xztu-wrk9-c7d4 | kernel: jffs2: check that raw node were preallocated before writing summary |
CVE-2025-38194
|
| VCID-y13n-jhsr-ryd2 | kernel: mm/vmscan: don't try to reclaim hwpoison folio |
CVE-2025-37834
|
| VCID-y1g8-yfaf-97ft | kernel: staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing |
CVE-2025-68254
|
| VCID-y1n6-njkj-6uhu | kernel: drm/amd/display: Fix MST Null Ptr for RV |
CVE-2024-26700
|
| VCID-y1sy-zm35-y7ch | kernel: kernel/resource: fix kfree() of bootmem memory again |
CVE-2022-49190
|
| VCID-y2ar-8v96-dqfq | kernel: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags |
CVE-2025-68764
|
| VCID-y2tb-nyra-5kf3 | kernel: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration |
CVE-2024-45006
|
| VCID-y3cb-qtwm-mfcj | kernel: netfilter: xtables: avoid NFPROTO_UNSPEC where needed |
CVE-2024-50038
|
| VCID-y3wu-za9p-yub1 | kernel: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() |
CVE-2025-21927
|
| VCID-y3yf-6uwt-b3gq | kernel: backlight: pm8941: Add NULL check in wled_configure() |
CVE-2025-38143
|
| VCID-y433-shnt-qbe4 | kernel: drm/gma500: Fix WARN_ON(lock-->magic != lock) error |
CVE-2022-48633
|
| VCID-y439-52f2-rfck | kernel: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop |
CVE-2026-23300
|
| VCID-y4jx-j1bj-qqhu | kernel: fpga: bridge: add owner module and take its refcount |
CVE-2024-36479
|
| VCID-y4ke-tenk-bycy | kernel: apparmor: Fix null pointer deref when receiving skb during sock creation |
CVE-2023-52889
|
| VCID-y4rv-zcef-zybh | kernel: bus: mhi: host: Add alignment check for event ring read pointer |
CVE-2023-52494
|
| VCID-y4w2-qru6-p3g4 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix krb5 mount with username option Customer reported that some of their krb5 mounts were failing against a single server as the client was trying to mount the shares with wrong credentials. It turned out the client was reusing SMB session from first mount to try mounting the other shares, even though a different username= option had been specified to the other mounts. By using username mount option along with sec=krb5 to search for principals from keytab is supported by cifs.upcall(8) since cifs-utils-4.8. So fix this by matching username mount option in match_session() even with Kerberos. For example, the second mount below should fail with -ENOKEY as there is no 'foobar' principal in keytab (/etc/krb5.keytab). The client ends up reusing SMB session from first mount to perform the second one, which is wrong. ``` $ ktutil ktutil: add_entry -password -p testuser -k 1 -e aes256-cts Password for testuser@ZELDA.TEST: ktutil: write_kt /etc/krb5.keytab ktutil: quit $ klist -ke Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- ---------------------------------------------------------------- 1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96) $ mount.cifs //w22-root2/scratch /mnt/1 -o sec=krb5,username=testuser $ mount.cifs //w22-root2/scratch /mnt/2 -o sec=krb5,username=foobar $ mount -t cifs | grep -Po 'username=\K\w+' testuser testuser ``` |
CVE-2026-31392
|
| VCID-y4xz-pxk6-dydc | kernel: gue: Fix skb memleak with inner IP protocol 0 |
CVE-2026-23095
|
| VCID-y57x-bth8-qbfd | kernel: net/rose: prevent integer overflows in rose_setsockopt() |
CVE-2025-21711
|
| VCID-y5bm-2fr5-8bbp | kernel: net: dsa: b53: do not enable EEE on bcm63xx |
CVE-2025-38272
|
| VCID-y5ds-5mpf-u3hz | kernel: ext4: avoid deadlock in fs reclaim with page writeback |
CVE-2023-53149
|
| VCID-y5eg-tvca-vkgu | kernel: ipv6: use RCU protection in ip6_default_advmss() |
CVE-2025-21765
|
| VCID-y5um-f82n-2yht | kernel: scsi: core: Wake up the error handler when final completions race against each other |
CVE-2026-23110
|
| VCID-y647-5dy7-73ce | kernel: iommu/mediatek: Fix crash on isr after kexec() |
CVE-2022-50236
|
| VCID-y7wh-qssq-cbg1 | kernel: drm/amd/display: Check null pointers before multiple uses |
CVE-2024-49920
|
| VCID-y7xz-taak-67f2 | kernel: btrfs: ref-verify: fix use-after-free after invalid ref action |
CVE-2024-56581
|
| VCID-y84g-be6t-4ygn | kernel: scsi: qla2xxx: During vport delete send async logout explicitly |
CVE-2024-42289
|
| VCID-y84k-pyqr-xkes | kernel: bonding: fix xfrm real_dev null pointer dereference |
CVE-2024-44989
|
| VCID-y8ej-kzxm-9bhs | kernel: kcm: Serialise kcm_sendmsg() for the same socket. |
CVE-2024-44946
|
| VCID-y8jw-xjf6-wycm | kernel: Linux kernel: Denial of Service in SMB client due to use-after-free in asynchronous crypto handling |
CVE-2025-38488
|
| VCID-ya16-qrwm-kkfs | kernel: Linux kernel: Denial of Service via NULL pointer dereference in blk-cgroup |
CVE-2023-54271
|
| VCID-ya59-ayvw-huaj | kernel: drm: omapdrm: Add missing check for alloc_ordered_workqueue |
CVE-2024-49879
|
| VCID-yagq-3yw6-rfhm | kernel: gtp: pull network headers in gtp_dev_xmit() |
CVE-2024-44999
|
| VCID-yam8-11x5-budv | kernel: dmaengine: nbpfaxi: Fix memory corruption in probe() |
CVE-2025-38538
|
| VCID-yany-k1my-fyge | kernel: ceph: blocklist the kclient when receiving corrupted snap trace |
CVE-2023-52732
|
| VCID-yasq-85v6-8bfv | kernel: powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() |
CVE-2024-46774
|
| VCID-yaz4-szyc-afg8 | kernel: drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free |
CVE-2026-23227
|
| VCID-yazv-63su-q3fc | kernel: bpf: Fix oob access in cgroup local storage |
CVE-2025-38502
|
| VCID-yb55-6g5g-z7fr | kernel: Linux kernel: be2net driver NULL pointer dereference leading to denial of service |
CVE-2025-40264
|
| VCID-ybku-jsxr-kbga | kernel: net: openvswitch: remove never-working support for setting nsh fields |
CVE-2025-40254
|
| VCID-ybpq-b26n-wqfd | kernel: gpiolib: fix memory leak in gpiochip_setup_dev() |
CVE-2022-48975
|
| VCID-yc5h-cxfk-yfdc | kernel: net/sched: Restrict conditions for adding duplicating netems to qdisc tree |
CVE-2025-38553
|
| VCID-yc6p-cqzt-pbby | kernel: crypto: algif_hash - fix double free in hash_accept |
CVE-2025-38079
|
| VCID-ycev-sqxs-13da | kernel: Kernel: Double free vulnerability in exFAT filesystem can lead to denial of service |
CVE-2025-38206
|
| VCID-ydd5-5x5y-sqeb | kernel: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock |
CVE-2025-39736
|
| VCID-ye4m-yv6w-wff1 | kernel: drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported |
CVE-2024-53060
|
| VCID-yec9-84hq-h3a9 | kernel: scsi: qla2xxx: Fix warning message due to adisc being flushed |
CVE-2022-49158
|
| VCID-yehk-tjrt-rbbe | kernel: dm-verity: disable recursive forward error correction |
CVE-2025-71161
|
| VCID-yekj-1715-eybs | kernel: crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly |
CVE-2026-23222
|
| VCID-yeww-6ybr-qye8 | kernel: f2fs: fix infinite loop in __insert_extent_tree() |
CVE-2025-40333
|
| VCID-yf35-bnx3-73fw | kernel: tick/broadcast: Move per CPU pointer access into the atomic section |
CVE-2024-44968
|
| VCID-yf5e-6ngk-ffek | kernel: drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle() |
CVE-2022-49311
|
| VCID-yf6e-3aw3-tqeg | kernel: net: clear the dst when changing skb protocol |
CVE-2025-38192
|
| VCID-yg28-ap29-tudc | kernel: dm: fix unconditional IO throttle caused by REQ_PREFLUSH |
CVE-2025-38063
|
| VCID-yh4d-1zzw-u7dc | kernel: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service |
CVE-2025-21690
|
| VCID-yhft-bm7y-jfde | kernel: mm/slub: Avoid list corruption when removing a slab from the full list |
CVE-2024-56566
|
| VCID-yhpg-snpu-dbe9 | kernel: Linux kernel: Denial of Service via null-pointer dereference in fb_videomode_to_var |
CVE-2025-38214
|
| VCID-yj28-va7b-3ug8 | kernel: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels |
CVE-2025-21768
|
| VCID-yj2k-bu54-2ufp | kernel: srcu: Tighten cleanup_srcu_struct() GP checks |
CVE-2022-49651
|
| VCID-yj3z-hvs9-47hj | In the Linux kernel, the following vulnerability has been resolved: PM: runtime: Fix a race condition related to device removal The following code in pm_runtime_work() may dereference the dev->parent pointer after the parent device has been freed: /* Maybe the parent is now able to suspend. */ if (parent && !parent->power.ignore_children) { spin_unlock(&dev->power.lock); spin_lock(&parent->power.lock); rpm_idle(parent, RPM_ASYNC); spin_unlock(&parent->power.lock); spin_lock(&dev->power.lock); } Fix this by inserting a flush_work() call in pm_runtime_remove(). Without this patch blktest block/001 triggers the following complaint sporadically: BUG: KASAN: slab-use-after-free in lock_acquire+0x70/0x160 Read of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081 Workqueue: pm pm_runtime_work Call Trace: <TASK> dump_stack_lvl+0x61/0x80 print_address_description.constprop.0+0x8b/0x310 print_report+0xfd/0x1d7 kasan_report+0xd8/0x1d0 __kasan_check_byte+0x42/0x60 lock_acquire.part.0+0x38/0x230 lock_acquire+0x70/0x160 _raw_spin_lock+0x36/0x50 rpm_suspend+0xc6a/0xfe0 rpm_idle+0x578/0x770 pm_runtime_work+0xee/0x120 process_one_work+0xde3/0x1410 worker_thread+0x5eb/0xfe0 kthread+0x37b/0x480 ret_from_fork+0x6cb/0x920 ret_from_fork_asm+0x11/0x20 </TASK> Allocated by task 4314: kasan_save_stack+0x2a/0x50 kasan_save_track+0x18/0x40 kasan_save_alloc_info+0x3d/0x50 __kasan_kmalloc+0xa0/0xb0 __kmalloc_noprof+0x311/0x990 scsi_alloc_target+0x122/0xb60 [scsi_mod] __scsi_scan_target+0x101/0x460 [scsi_mod] scsi_scan_channel+0x179/0x1c0 [scsi_mod] scsi_scan_host_selected+0x259/0x2d0 [scsi_mod] store_scan+0x2d2/0x390 [scsi_mod] dev_attr_store+0x43/0x80 sysfs_kf_write+0xde/0x140 kernfs_fop_write_iter+0x3ef/0x670 vfs_write+0x506/0x1470 ksys_write+0xfd/0x230 __x64_sys_write+0x76/0xc0 x64_sys_call+0x213/0x1810 do_syscall_64+0xee/0xfc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 4314: kasan_save_stack+0x2a/0x50 kasan_save_track+0x18/0x40 kasan_save_free_info+0x3f/0x50 __kasan_slab_free+0x67/0x80 kfree+0x225/0x6c0 scsi_target_dev_release+0x3d/0x60 [scsi_mod] device_release+0xa3/0x220 kobject_cleanup+0x105/0x3a0 kobject_put+0x72/0xd0 put_device+0x17/0x20 scsi_device_dev_release+0xacf/0x12c0 [scsi_mod] device_release+0xa3/0x220 kobject_cleanup+0x105/0x3a0 kobject_put+0x72/0xd0 put_device+0x17/0x20 scsi_device_put+0x7f/0xc0 [scsi_mod] sdev_store_delete+0xa5/0x120 [scsi_mod] dev_attr_store+0x43/0x80 sysfs_kf_write+0xde/0x140 kernfs_fop_write_iter+0x3ef/0x670 vfs_write+0x506/0x1470 ksys_write+0xfd/0x230 __x64_sys_write+0x76/0xc0 x64_sys_call+0x213/0x1810 |
CVE-2026-23452
|
| VCID-yj9y-qhak-t3ga | kernel: nilfs2: handle inconsistent state in nilfs_btnode_create_block() |
CVE-2024-42295
|
| VCID-ykfs-a9uu-mkaw | kernel: drm: adv7511: Fix use-after-free in adv7533_attach_dsi() |
CVE-2024-57887
|
| VCID-ykhw-k7xr-57hc | kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item |
CVE-2025-68211
|
| VCID-ykqh-u6eu-w3af | kernel: drm/amdgpu: Fix the null pointer dereference to ras_manager |
CVE-2024-43908
|
| VCID-ykvm-p41c-9fhq | kernel: NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN |
CVE-2025-38393
|
| VCID-ymdd-jpdx-43gw | kernel: Bluetooth: SCO: Fix UAF on sco_conn_free |
CVE-2025-40309
|
| VCID-ymdz-x8ab-kuat | kernel: ath11k: fix the warning of dev_wake in mhi_pm_disable_transition() |
CVE-2022-49543
|
| VCID-ymen-78sb-uuax | kernel: Kernel: Privilege escalation via uninitialized data in vmci transport packet |
CVE-2025-38403
|
| VCID-ymwr-jmku-q7cd | kernel: scsi: qla2xxx: Free sp in error path to fix system crash |
CVE-2025-71232
|
| VCID-yncv-kwk9-s3ak | kernel: can: hi311x: populate ndo_change_mtu() to prevent buffer overflow |
CVE-2025-39987
|
| VCID-yp6e-f5fp-7kbz | kernel: security/keys: fix slab-out-of-bounds in key_task_permission |
CVE-2024-50301
|
| VCID-yp8m-zttt-ffdt | kernel: Linux kernel: Denial of service due to a race condition in the TLS subsystem |
CVE-2026-23240
|
| VCID-ypb4-8p7q-pkdr | kernel: out-of-bounds read in arch/arm/mach-footbridge/personal-pci.c due to improper input validation |
CVE-2021-32078
|
| VCID-ypt7-tc1u-p3ev | kernel: btrfs: avoid NULL pointer dereference if no valid csum tree |
CVE-2025-38059
|
| VCID-yq39-cw12-5bec | kernel: missing platform_device_put() and kfree() calls in an error path in dwc3_qcom_acpi_register_core() in drivers/usb/dwc3/dwc3-qcom.c |
CVE-2023-22995
|
| VCID-yq6h-v56s-k7ez | kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race |
CVE-2024-42253
|
| VCID-yq9b-dpsh-cuhy | kernel: drm/amd/display: Disable idle reallow as part of command/gpint execution |
CVE-2024-36024
|
| VCID-yqcd-vygr-zug6 | kernel: vxlan: Annotate FDB data races |
CVE-2025-38037
|
| VCID-yqcj-27j2-tqb8 |
CVE-2026-31419
|
|
| VCID-yqma-nz5z-hkfc | kernel: mptcp: Fix proto fallback detection with BPF |
CVE-2025-68227
|
| VCID-yr2z-pe4g-8yhu | kernel: nfc: rawsock: cancel tx_work before socket teardown |
CVE-2026-23372
|
| VCID-yr5r-jem5-d7he | kernel: ASoC: atmel: Fix error handling in snd_proto_probe |
CVE-2022-49246
|
| VCID-yr9n-sx72-9ucd | kernel: btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations |
CVE-2024-35956
|
| VCID-yrka-zpny-hbd1 | kernel: Linux kernel: Denial of Service and information disclosure via undefined bit shift in drm/ttm |
CVE-2022-50390
|
| VCID-yrqj-a8yq-xffd | kernel: media: xc2028: avoid use-after-free in load_firmware_cb() |
CVE-2024-43900
|
| VCID-yrqn-7vxc-uuhz | kernel: USB: gadget: Fix use-after-free Read in usb_udc_uevent() |
CVE-2022-49980
|
| VCID-ysd2-zyt4-xybu | kernel: net/sched: netem: account for backlog updates from child qdisc |
CVE-2024-56770
|
| VCID-ysg3-gaus-nfca | kernel: btrfs: wait for fixup workers before stopping cleaner kthread during umount |
CVE-2024-49867
|
| VCID-ysr5-46f4-a7a4 | kernel: blk-mq: avoid double ->queue_rq() because of early timeout |
CVE-2022-50554
|
| VCID-ytcn-fxjj-efhj | kernel: selinux: avoid dereference of garbage after mount failure |
CVE-2024-35904
|
| VCID-ytxq-fc9h-vyfu | kernel: netfilter: nf_tables: fix underflow in chain reference counter |
CVE-2023-54035
|
| VCID-yu5u-ns56-f3a8 | kernel: Linux kernel: Denial of Service via resource leak in SMB2 compound operations |
CVE-2025-39819
|
| VCID-yuf4-s8bg-93bf | kernel: Linux kernel: Denial of Service due to NULL pointer dereference in iSCSI target NOPIN timer handling |
CVE-2025-38075
|
| VCID-yun1-p953-8udc | kernel: posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() |
CVE-2024-50210
|
| VCID-yuwc-h2qn-r7dv | kernel: drm/amd/display: Check denominator pbn_div before used |
CVE-2024-46773
|
| VCID-yuyy-u84g-1ufb | kernel: net: bridge: xmit: make sure we have at least eth header len bytes |
CVE-2024-38538
|
| VCID-yw2a-uaz1-b3ea | kernel: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() |
CVE-2025-38337
|
| VCID-ywnx-fxr4-cudy | kernel: Input: uinput - reject requests with unreasonable number of slots |
CVE-2024-46745
|
| VCID-yx1f-r3sr-rues | In the Linux kernel, the following vulnerability has been resolved: ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio Replace BUG_ON() with proper error handling when inline data size exceeds PAGE_SIZE. This prevents kernel panic and allows the system to continue running while properly reporting the filesystem corruption. The error is logged via ext4_error_inode(), the buffer head is released to prevent memory leak, and -EFSCORRUPTED is returned to indicate filesystem corruption. |
CVE-2026-31451
|
| VCID-yx8c-27pb-w3at | kernel: RDMA/cm: Fix leaking the multicast GID table reference |
CVE-2025-71084
|
| VCID-yy1p-8a2k-6kex | kernel: f2fs: fix to do sanity check on inline_dots inode |
CVE-2022-49428
|
| VCID-yyaw-vut2-mqac | kernel: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod |
CVE-2025-40118
|
| VCID-yycj-8x1k-suf3 | kernel: drm/amdgpu: avoid using null object of framebuffer |
CVE-2024-41093
|
| VCID-yymx-am61-b3h9 | kernel: bpf, sockmap: Fix race between element replace and close() |
CVE-2024-56664
|
| VCID-yyqa-ebcr-jbbm | kernel: vsock/virtio: cap TX credit to local buffer size |
CVE-2026-23086
|
| VCID-yywg-f8ye-3khx | kernel: isofs: Prevent the use of too small fid |
CVE-2025-37780
|
| VCID-yywy-krb7-3qcb | kernel: ppp: fix memory leak in pad_compress_skb |
CVE-2025-39847
|
| VCID-yyz5-c2xy-1kbe | kernel: atl1c: Work around the DMA RX overflow issue |
CVE-2023-52834
|
| VCID-yz3y-7akj-bygj | kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() |
CVE-2025-39866
|
| VCID-yz41-uqnc-xyhs | kernel: net: Fix an unsafe loop on the list |
CVE-2024-50024
|
| VCID-yzkj-wnhe-m7f2 | kernel: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users |
CVE-2025-37963
|
| VCID-yzmm-kkvg-ffaj | kernel: cifs: Fix connections leak when tlink setup failed |
CVE-2022-49822
|
| VCID-yzsh-2rk2-5yhq | kernel: RDMA/siw: Remove direct link to net_device |
CVE-2024-57857
|
| VCID-z1d3-8ypx-83bj | kernel: netfilter: nf_tables: prevent nf_skb_duplicated corruption |
CVE-2024-49952
|
| VCID-z1gu-rwfd-7yfa | kernel: f2fs: fix UAF issue in f2fs_merge_page_bio() |
CVE-2025-40054
|
| VCID-z1jv-1vmy-aqeq | kernel: Linux kernel (ASUS HID): Use-after-free vulnerability allows arbitrary code execution or denial of service |
CVE-2025-39824
|
| VCID-z1mn-yx43-4bgj | kernel: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() |
CVE-2025-68358
|
| VCID-z21j-y4ef-1fb3 | kernel: power: supply: cw2015: Fix potential null-ptr-deref in cw_bat_probe() |
CVE-2022-50634
|
| VCID-z24p-wtzg-a3gh | kernel: md: Don't ignore read-only array in md_check_recovery() |
CVE-2024-26757
|
| VCID-z27y-c26s-wuek | kernel: wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() |
CVE-2025-38513
|
| VCID-z2vb-4xtt-w7f1 | kernel: ipv4: use RCU protection in __ip_rt_update_pmtu() |
CVE-2025-21766
|
| VCID-z2z9-umm2-vkdt | kernel: ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate |
CVE-2024-49877
|
| VCID-z3qs-q6ce-aqbc | kernel: s390/pkey: Wipe copies of clear-key structures on failure |
CVE-2024-42156
|
| VCID-z423-786s-hyd2 | kernel: i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition |
CVE-2024-57984
|
| VCID-z449-wes7-mbfp | kernel: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] |
CVE-2025-21666
|
| VCID-z4f8-ybzd-r7dj | kernel: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() |
CVE-2025-40205
|
| VCID-z4vk-6hpp-9ug4 | kernel: ipv6: sr: fix missing sk_buff release in seg6_input_core |
CVE-2024-39490
|
| VCID-z4xx-msk4-k7bz | kernel: xen/events: Return -EEXIST for bound VIRQs |
CVE-2025-40160
|
| VCID-z4yz-sjm9-3ke4 | kernel: f2fs: fix to drop all discards after creating snapshot on lvm device |
CVE-2024-56565
|
| VCID-z5cz-xkzn-fbb6 | kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application |
CVE-2024-21823
|
| VCID-z5d6-d49x-7fay | kernel: Linux kernel: SCTP use-after-free due to race condition in sendmsg |
CVE-2025-23142
|
| VCID-z5xp-7eh5-pkhx | kernel: nvme-pci: add missing condition check for existence of mapped data |
CVE-2024-42276
|
| VCID-z62f-5fsk-rkgq | kernel: net: appletalk: Fix use-after-free in AARP proxy probe |
CVE-2025-38666
|
| VCID-z6xa-pf4r-4kbm | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows: CPU0 CPU1 deferred_split_scan() zap_nonpresent_ptes() lock folio split_folio() unmap_folio() change ptes to migration entries __split_folio_to_order() softleaf_to_folio() set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry)) smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio)) prep_compound_page() for tail pages In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags. This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio() because of the race between folio split and zap_nonpresent_ptes() leading to a folio incorrectly undergoing modification without a folio lock being held. This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"), which in merged in v6.19-rc1. To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page(). [tujinjiang@huawei.com: update function name and comments] |
CVE-2026-31466
|
| VCID-z72d-fsj4-mqeg | kernel: Linux kernel: Denial of Service in netdevsim due to race condition in BPF program list operations |
CVE-2026-23126
|
| VCID-z767-vnpz-37g8 | kernel: drm/amdgpu: Fix the warning division or modulo by zero |
CVE-2024-46806
|
| VCID-z84t-p3sj-1ub5 | kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns |
CVE-2025-38499
|
| VCID-z892-vg1d-jybu | kernel: Linux kernel: Denial of Service in ALSA ctxfi driver due to out-of-bounds access |
CVE-2026-23076
|
| VCID-z8bf-rebn-r7bm | kernel: comedi: Fix initialization of data for instructions that write to subdevice |
CVE-2025-38478
|
| VCID-z8rc-7t3w-yyd4 | kernel: jffs2: Prevent rtime decompress memory corruption |
CVE-2024-57850
|
| VCID-z8y6-gbv7-zudr | kernel: netem: fix return value if duplicate enqueue fails |
CVE-2024-45016
|
| VCID-z916-xdst-pka3 | kernel: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() |
CVE-2025-39808
|
| VCID-z99g-ehqe-hqhb | kernel: usb: xhci: Apply the link chain quirk on NEC isoc endpoints |
CVE-2025-22022
|
| VCID-z9yn-4b8y-t3er | kernel: SUNRPC: fix a memleak in gss_import_v2_context |
CVE-2023-52653
|
| VCID-za93-zh73-g3f4 | kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability |
CVE-2025-37819
|
| VCID-zamd-w45x-e3g5 | kernel: workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker |
CVE-2024-57888
|
| VCID-zbar-pb6y-t7ad | kernel: scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts |
CVE-2022-50098
|
| VCID-zc8p-pakr-q3b3 | kernel: nfsd: return -EINVAL when namelen is 0 |
CVE-2024-47692
|
| VCID-zcgb-68rg-ryhv | kernel: crypto: hisilicon/hpre - fix resource leak in remove process |
CVE-2022-50420
|
| VCID-zdgf-yw92-rfa2 | kernel: pmdomain: ti: Add a null pointer check to the omap_prm_domain_init |
CVE-2024-35943
|
| VCID-zetd-ekwe-uyf9 | kernel: drm/amd/display: Add null checker before passing variables |
CVE-2024-43902
|
| VCID-zex7-kjeu-4ugv | kernel: scsi: qla2xxx: Fix crash when I/O abort times out |
CVE-2022-50493
|
| VCID-zfp8-y9du-23fs | kernel: can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak |
CVE-2026-23108
|
| VCID-zfrz-jeew-tyea | kernel: net/sched: taprio: extend minimum interval restriction to entire cycle too |
CVE-2024-36244
|
| VCID-zfyh-4nmk-hbh6 | kernel: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar |
CVE-2025-38693
|
| VCID-zg45-ckv4-zbh5 | kernel: Linux kernel: Denial of Service in kvaser_usb CAN driver due to infinite loop |
CVE-2025-68308
|
| VCID-zgaq-z6bh-jkec | kernel: ALSA: dice: fix buffer overflow in detect_stream_formats() |
CVE-2025-68346
|
| VCID-zge5-hkpz-k3ax | kernel: drm/amdgpu: the warning dereferencing obj for nbio_v7_4 |
CVE-2024-46819
|
| VCID-zh6a-z135-ayeg | kernel: dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup |
CVE-2024-27408
|
| VCID-zh8h-914q-6ye3 | kernel: drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error |
CVE-2024-47698
|
| VCID-zhaf-5de2-tycd | In the Linux kernel, the following vulnerability has been resolved: net: macb: fix use-after-free access to PTP clock PTP clock is registered on every opening of the interface and destroyed on every closing. However it may be accessed via get_ts_info ethtool call which is possible while the interface is just present in the kernel. BUG: KASAN: use-after-free in ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426 Read of size 4 at addr ffff8880194345cc by task syz.0.6/948 CPU: 1 PID: 948 Comm: syz.0.6 Not tainted 6.1.164+ #109 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8d/0xba lib/dump_stack.c:106 print_address_description mm/kasan/report.c:316 [inline] print_report+0x17f/0x496 mm/kasan/report.c:420 kasan_report+0xd9/0x180 mm/kasan/report.c:524 ptp_clock_index+0x47/0x50 drivers/ptp/ptp_clock.c:426 gem_get_ts_info+0x138/0x1e0 drivers/net/ethernet/cadence/macb_main.c:3349 macb_get_ts_info+0x68/0xb0 drivers/net/ethernet/cadence/macb_main.c:3371 __ethtool_get_ts_info+0x17c/0x260 net/ethtool/common.c:558 ethtool_get_ts_info net/ethtool/ioctl.c:2367 [inline] __dev_ethtool net/ethtool/ioctl.c:3017 [inline] dev_ethtool+0x2b05/0x6290 net/ethtool/ioctl.c:3095 dev_ioctl+0x637/0x1070 net/core/dev_ioctl.c:510 sock_do_ioctl+0x20d/0x2c0 net/socket.c:1215 sock_ioctl+0x577/0x6d0 net/socket.c:1320 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x18c/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 </TASK> Allocated by task 457: kmalloc include/linux/slab.h:563 [inline] kzalloc include/linux/slab.h:699 [inline] ptp_clock_register+0x144/0x10e0 drivers/ptp/ptp_clock.c:235 gem_ptp_init+0x46f/0x930 drivers/net/ethernet/cadence/macb_ptp.c:375 macb_open+0x901/0xd10 drivers/net/ethernet/cadence/macb_main.c:2920 __dev_open+0x2ce/0x500 net/core/dev.c:1501 __dev_change_flags+0x56a/0x740 net/core/dev.c:8651 dev_change_flags+0x92/0x170 net/core/dev.c:8722 do_setlink+0xaf8/0x3a80 net/core/rtnetlink.c:2833 __rtnl_newlink+0xbf4/0x1940 net/core/rtnetlink.c:3608 rtnl_newlink+0x63/0xa0 net/core/rtnetlink.c:3655 rtnetlink_rcv_msg+0x3c6/0xed0 net/core/rtnetlink.c:6150 netlink_rcv_skb+0x15d/0x430 net/netlink/af_netlink.c:2511 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x6d7/0xa30 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x97e/0xeb0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg+0x14b/0x180 net/socket.c:730 __sys_sendto+0x320/0x3b0 net/socket.c:2152 __do_sys_sendto net/socket.c:2164 [inline] __se_sys_sendto net/socket.c:2160 [inline] __x64_sys_sendto+0xdc/0x1b0 net/socket.c:2160 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 938: kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1729 [inline] slab_free_freelist_hook mm/slub.c:1755 [inline] slab_free mm/slub.c:3687 [inline] __kmem_cache_free+0xbc/0x320 mm/slub.c:3700 device_release+0xa0/0x240 drivers/base/core.c:2507 kobject_cleanup lib/kobject.c:681 [inline] kobject_release lib/kobject.c:712 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1cd/0x350 lib/kobject.c:729 put_device+0x1b/0x30 drivers/base/core.c:3805 ptp_clock_unregister+0x171/0x270 drivers/ptp/ptp_clock.c:391 gem_ptp_remove+0x4e/0x1f0 drivers/net/ethernet/cadence/macb_ptp.c:404 macb_close+0x1c8/0x270 drivers/net/ethernet/cadence/macb_main.c:2966 __dev_close_many+0x1b9/0x310 net/core/dev.c:1585 __dev_close net/core/dev.c:1597 [inline] __dev_change_flags+0x2bb/0x740 net/core/dev.c:8649 dev_change_fl ---truncated--- |
CVE-2026-31396
|
| VCID-zj73-kpsf-5ufy | kernel: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport |
CVE-2024-56688
|
| VCID-zjyd-23m1-sug3 | kernel: net_sched: sch_sfq: reject invalid perturb period |
CVE-2025-38193
|
| VCID-zkc3-wk25-uue1 | kernel: RDMA/siw: Fix QP destroy to wait for all references dropped |
CVE-2022-50666
|
| VCID-zm1u-s4bs-ubhy | kernel: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor |
CVE-2024-46716
|
| VCID-zmch-s95m-gua2 | kernel: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute |
CVE-2025-21653
|
| VCID-zme1-paup-4bc9 | kernel: Linux kernel: Denial of Service in MDT loader due to improper ELF header validation |
CVE-2025-39787
|
| VCID-zmmj-4ed5-hkdu | kernel: Linux kernel: Memory leak in pnfs/flexfiles can lead to denial of service |
CVE-2026-23038
|
| VCID-zmp7-m12g-zuby | kernel: VMCI: Fix use-after-free when removing resource in vmci_resource_remove() |
CVE-2024-46738
|
| VCID-zms6-v69x-mue5 | kernel: virtio_net: Fix napi_skb_cache_put warning |
CVE-2024-43835
|
| VCID-zmwx-7zse-dbge | kernel: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust |
CVE-2024-53122
|
| VCID-zn5u-s9sp-eyb8 | kernel: jfs: fix null ptr deref in dtInsertEntry |
CVE-2024-44939
|
| VCID-zne9-m553-8bcs | kernel: powerpc/xive/spapr: correct bitmap allocation size |
CVE-2022-49623
|
| VCID-znrv-kg8b-67g7 | kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up |
CVE-2024-36952
|
| VCID-znv4-4dud-4qgd | kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() |
CVE-2024-56602
|
| VCID-zp24-pjju-tuez | kernel: parisc: fix a possible DMA corruption |
CVE-2024-44949
|
| VCID-zpt5-7cj5-aqc3 | kernel: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue |
CVE-2025-40001
|
| VCID-zpz8-8ahv-ayc2 | kernel: char: applicom: fix NULL pointer dereference in ac_ioctl |
CVE-2025-68797
|
| VCID-zq46-ub7q-6faw | kernel: f2fs: check validation of fault attrs in f2fs_build_fault_attr() |
CVE-2024-42160
|
| VCID-zqpt-es2k-hfg8 | kernel: drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX |
CVE-2024-46871
|
| VCID-zqxx-ygyx-vua7 | kernel: btrfs: fix race between balance and cancel/pause |
CVE-2023-54023
|
| VCID-zr8t-jazh-9qgs | kernel: scs: fix a wrong parameter in __scs_magic |
CVE-2025-71102
|
| VCID-zra7-3b97-euf6 | kernel: net_sched: skbprio: Remove overly strict queue assertions |
CVE-2025-38637
|
| VCID-zrf8-efng-gfd9 | kernel: drm/amd/display: fix incorrect mpc_combine array size |
CVE-2024-26914
|
| VCID-zrq8-mz6x-tya1 | kernel: drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag |
CVE-2024-35817
|
| VCID-zrun-c4af-bfen | kernel: mptcp: pm: only decrement add_addr_accepted for MPJ req |
CVE-2024-45009
|
| VCID-zs1j-hpbv-7qbz | kernel: ibmvnic: Use kernel helpers for hex dumps |
CVE-2025-22104
|
| VCID-zs6h-f21e-vked | kernel: hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer |
CVE-2024-53103
|
| VCID-zssu-1j3y-a3g2 | kernel: wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() |
CVE-2025-37990
|
| VCID-ztmx-nnk3-aqeu | kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() |
CVE-2025-40149
|
| VCID-zufu-pwxh-eqbw | kernel: PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops |
CVE-2025-38069
|
| VCID-zv2h-xb9r-t3e1 | kernel: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() |
CVE-2025-37830
|
| VCID-zv5y-qhxv-gyfh | kernel: libceph: replace BUG_ON with bounds check for map->max_osd |
CVE-2025-68283
|
| VCID-zvdg-jusw-7yet | kernel: btrfs: fix tree mod log mishandling of reallocated nodes |
CVE-2022-49898
|
| VCID-zvze-vhq4-rfdu | kernel: misc: fastrpc: Fix copy buffer page size |
CVE-2025-21734
|
| VCID-zw3p-4xxp-myck | kernel: media: i2c: dw9714: Disable the regulator when the driver fails to probe |
CVE-2022-49528
|
| VCID-zx9u-zu1f-gbf2 | kernel: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM |
CVE-2024-56611
|
| VCID-zxmw-r6pn-6fdt | kernel: scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list |
CVE-2023-53627
|
| VCID-zxx1-uwkj-23b8 | kernel: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again |
CVE-2024-48881
|
| VCID-zy69-efpr-cfcj | kernel: net/ip6_tunnel: Prevent perpetual tunnel growth |
CVE-2025-40173
|
| VCID-zy7z-8cv8-8bh4 | kernel: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures |
CVE-2024-43839
|
| VCID-zyeq-zp8w-zfba | kernel: iio: adc: ti-ads8688: fix information leak in triggered buffer |
CVE-2024-57906
|
| VCID-zz38-awwp-k3bw | kernel: ext4: avoid use-after-free in ext4_ext_show_leaf() |
CVE-2024-49889
|
| VCID-zzcb-yr5v-efg7 | kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length |
CVE-2025-21826
|
| VCID-zzjh-pm9k-4uej | kernel: Input: pegasus-notetaker - fix potential out-of-bounds access |
CVE-2025-68217
|