Advisories · Technology
Linux kernel.
Every CVE that names Linux kernel among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.8 High
sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
- Linux kernel
- CVSS 7.8 High
smack: fix cred UAF in smack_file_send_sigiotask()
- Linux kernel
-
timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()
- Linux kernel
- CVSS 9.8 CriticalCritical · CVSS 9+
ksmbd: fix use-after-free in oplock break notification
- Linux kernel
-
vlan: fix skb_under_panic and races when toggling HW VLAN offload
- Linux kernel
- CVSS 7.5 High
crypto: krb5 - use kfree_sensitive() for derived key buffers
- Linux kernel
-
xhci: dbgtty: Fix unregister on tty_register_driver() failure
- Linux kernel
-
crypto: qcom-rng - Allow zero as a random number
- Linux kernel
- CVSS 8.8 High
KVM: s390: vsie: zero stale crypto bits
- Linux kernel
-
io_uring: defer eventfd signaling when queued from a wakeup handler
- Linux kernel
-
drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format
- Linux kernel
-
HID: core: fix number/pointer type confusion on long items
- Linux kernel
-
PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
- Linux kernel
-
kcov: fix data corruption and race conditions on PREEMPT_RT
- Linux kernel
-
drm/xe: Fix DPT allocation paths.
- Linux kernel
- CVSS 8.8 High
Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
- Linux kernel
-
selinux: require every boolean value to be defined
- Linux kernel
-
selinux: reject an unclaimed class value in security_get_classes()
- Linux kernel
-
ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
- Linux kernel
-
ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
- Linux kernel
-
drm/amdgpu: Reject UVD message with invalid number of h265 refs
- Linux kernel
-
drm/amdgpu: Reject UVD message with dimensions above 4096
- Linux kernel
-
drm/amdgpu: Fix UVD dpb min size calculation for H264
- Linux kernel
-
net: packet: fix wrong transport_header when sending VLAN-tagged frame
- Linux kernel
-
net: tap: fix wrong transport_header when sending VLAN-tagged frame
- Linux kernel
-
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
- Linux kernel
-
drm/xe/oa: Fix sync entry leak on OA config emit failure
- Linux kernel
-
dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
- Linux kernel
-
ipvs: fix the checksum validations
- Linux kernel
-
ASoC: SDCA: Make UMP message size check more robust
- Linux kernel
-
erofs: remove fscache backend entirely
- Linux kernel
-
netfs: clear PG_private_2 on copy-to-cache append failure
- Linux kernel
-
netfs: release readahead folios on iterator preparation failure
- Linux kernel
-
mshv: Fix race in mshv_irqfd_deassign
- Linux kernel
-
mshv: Order pt_vp_array publish against irqfd assertion path
- Linux kernel
-
iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
- Linux kernel
-
mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
- Linux kernel
-
erofs: cap LZMA stream pool size
- Linux kernel
-
KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
- Linux kernel
-
sctp: reject stale cookies with mismatched verification tags
- Linux kernel
-
can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
- Linux kernel
-
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
- Linux kernel
-
drm/vmwgfx: use check_add_overflow for shader size+offset bound
- Linux kernel
-
serial: msm: Disable DMA for kernel console UART
- Linux kernel
-
afs: Fix uncancelled rxrpc OOB message handler
- Linux kernel
-
ntb: Store original DMA address for future release
- Linux kernel
-
drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered
- Linux kernel
-
crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm
- Linux kernel
-
ocfs2: fix buffer head management in ocfs2_read_blocks()
- Linux kernel
-
IB/mlx5: Properly support implicit ODP rereg_mr
- Linux kernel
-
ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
- Linux kernel
-
afs: Fix leak of ungot volume
- Linux kernel
-
afs: Fix vllist leak
- Linux kernel
-
ring-buffer: Fix event length with forced 8-byte alignment
- Linux kernel
-
ipvs: use parsed transport offset in TCP state lookup
- Linux kernel
-
arm64: dts: renesas: ironhide: Describe inline ECC carveouts
- Linux kernel
-
KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
- Linux kernel
-
ALSA: hda/tas2781: Cancel async firmware request at unbind
- Linux kernel
-
crypto: xilinx-trng - Remove crypto_rng interface
- Linux kernel
-
drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
- Linux kernel