Advisories · Technology
Linux kernel.
Every CVE that names Linux kernel among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
ceph: bound xattr value length in __build_xattrs()
- Linux kernel
- CVSS 7.5 High
ceph: cap delegated inode count in ceph_parse_deleg_inos()
- Linux kernel
- CVSS 7.5 High
ceph: do not repeat ceph_trim_dentries() if no progress possible
- Linux kernel
- CVSS 7.8 High
ceph: fix leaked inode reference on writeback abort at umount
- Linux kernel
-
btrfs: drop recovered reloc root refs on recovery failure
- Linux kernel
-
btrfs: fix extent map leak in NOCOW direct I/O write
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
audit: avoid dropping live tree ref on fsnotify rule autoremove
- Linux kernel
-
cifs: call pagecache_isize_extended() in cifs_setsize() when extending
- Linux kernel
- CVSS 7.8 High
cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
- Linux kernel
- CVSS 7.1 High
cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
- Linux kernel
- CVSS 7.1 High
cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
- Linux kernel
- CVSS 7.8 High
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
smb: client: clear ce->tgthint in free_tgts()
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
ksmbd: only rebind the reopened file's own oplock on durable reconnect
- Linux kernel
- CVSS 9.1 CriticalCritical · CVSS 9+
smb: client: fix ALIGN() overflow in symlink_data() error context loop
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
- Linux kernel
- CVSS 8.2 High
smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
- Linux kernel
- CVSS 9.1 CriticalCritical · CVSS 9+
smb: client: reject a tree connect response whose byte count is too small
- Linux kernel
- CVSS 9.1 CriticalCritical · CVSS 9+
smb: client: restore the data_offset bound in is_valid_oplock_break()
- Linux kernel
-
HID: corsair-void: Check size of status and firmware events before reading them
- Linux kernel
-
HID: picolcd: clamp eeprom debugfs read to bytes actually received
- Linux kernel
-
HID: roccat: free buffered reports when destroying device
- Linux kernel
- CVSS 8.8 High
HID: sensor: custom: Fix field sysfs group cleanup on failure
- Linux kernel
-
HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
- Linux kernel
- CVSS 7.8 High
HID: universal-pidff: stop the device when force-feedback init fails
- Linux kernel
-
HID: mcp2221: stop device IO before hid_hw_stop
- Linux kernel
- CVSS 7.8 High
HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
- Linux kernel
-
HID: mcp2221: validate report size in mcp2221_raw_event()
- Linux kernel
- CVSS 7.8 High
HID: intel-thc-hid: intel-quickspi: validate report size before copy
- Linux kernel
- CVSS 7.8 High
HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
- Linux kernel
-
eventfs: Initialize ei->children and ei->list in init_ei()
- Linux kernel
- CVSS 7.8 High
fs/ntfs3: validate dirty page table on log replay
- Linux kernel
- CVSS 7.5 High
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
- Linux kernel
- CVSS 8.4 High
fs/ntfs3: bound page_lcns[] index by the log record
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
ntfs: bound the free-cluster bitmap scan to the volume
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
ntfs: reject invalid empty mapping pairs
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
ntfs: reject invalid MFT LCNs from boot sector
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
ntfs: validate non-resident attribute offsets
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
ntfs: verify run length exceeding volume boundary
- Linux kernel
- CVSS 7.8 High
ecryptfs: hold msg ctx list lock when cleaning daemon queue
- Linux kernel
- CVSS 7.1 High
ecryptfs: pass packet set buffer size to parser
- Linux kernel
- CVSS 7.8 High
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
- Linux kernel
- CVSS 7.8 High
ecryptfs: reject too-small tag 70 packets
- Linux kernel
- CVSS 7.8 High
ecryptfs: release message context on send failure
- Linux kernel
-
efivarfs: Rate limit statfs() handler
- Linux kernel
- CVSS 7.8 High
erofs: skip sufficiently large global buffers when resizing
- Linux kernel
- CVSS 8.8 High
ext2: Fix lost inode updates for IS_SYNC inodes
- Linux kernel
- CVSS 7.8 High
fanotify: fix use-after-free of file range info
- Linux kernel
- CVSS 8.4 High
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
- Linux kernel
-
fbdev: ssd1307fb: defer I2C transfers from damage callbacks
- Linux kernel
- CVSS 7.8 High
fbdev: uvesafb: unregister connector callback on init failure
- Linux kernel
- CVSS 7.1 High
forcedeth: fix off-by-one when saving/restoring non-PCI config space
- Linux kernel
-
fsnotify: Fix stale object mask after concurrent mark updates
- Linux kernel
- CVSS 7.8 High
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
- Linux kernel
- CVSS 7.1 High
hugetlb: only adjust reservation during unmapping if mapcount is 0
- Linux kernel
-
accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
- Linux kernel
-
accel/rocket: initialize job domain before cleanup paths
- Linux kernel
-
accel/rocket: Fix error path handling in rocket_job_run()
- Linux kernel
-
acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
- Linux kernel