Linux Kernel vulnerabilities

CVE-2017-13715 [CRITICAL] CWE-665 CVE-2017-13715: The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thoff are initialized, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet.

CVE-2026-63887 [CRITICAL] CWE-122 CVE-2026-63887: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscs In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call si

CVE-2026-43037 [CRITICAL] CWE-787 CVE-2026-43037: In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo(), which interprets

CVE-2026-53151 [CRITICAL] CWE-125 CVE-2026-53151: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to ex In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmen

CVE-2016-4998 [HIGH] CWE-119 CVE-2016-4998: The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel befo The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob bou

CVE-2015-3290 [HIGH] CWE-264 CVE-2015-3290: arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.

CVE-2009-4067 [MEDIUM] CWE-120 CVE-2009-4067: Buffer overflow in the auerswald_probe function in the Auerswald Linux USB driver for the Linux kern Buffer overflow in the auerswald_probe function in the Auerswald Linux USB driver for the Linux kernel before 2.6.27 allows physically proximate attackers to execute arbitrary code, cause a denial of service via a crafted USB device, or take full control of the system.

CVE-2023-52440 [HIGH] CWE-119 CVE-2023-52440: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksm In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from client.

CVE-2004-0816 [HIGH] CWE-191 CVE-2004-0816: Integer underflow in the firewall logging rules for iptables in Linux before 2.6.8 allows remote att Integer underflow in the firewall logging rules for iptables in Linux before 2.6.8 allows remote attackers to cause a denial of service (application crash) via a malformed IP packet.

CVE-2026-64393 [CRITICAL] CVE-2026-64393: In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SET_INFO handlers call path-based VFS helpers after checking the access mask granted to the SMB handle. Those helpers perform their owner, inode permission and LSM checks using the current ksmbd worker credentials. Run the complete SET_IN

CVE-2022-43945 [HIGH] CWE-131 CVE-2022-43945: The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer ov The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP wit

CVE-2026-31433 [HIGH] CWE-125 CVE-2026-31433: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial OOB in get In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial OOB in get_file_all_info() for compound requests When a compound request consists of QUERY_DIRECTORY + QUERY_INFO (FILE_ALL_INFORMATION) and the first command consumes nearly the entire max_trans_size, get_file_all_info() would blindly call smbConvertToUTF16() wi

CVE-2018-5333 [MEDIUM] CWE-476 CVE-2018-5333: In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference.

CVE-2026-63888 [CRITICAL] CWE-415 CVE-2026-63888: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC ov In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1"): 1) DataDigest CRC buffe

CVE-2026-63886 [CRITICAL] CWE-122 CVE-2026-63886: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate C In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passes chap_r directly to chap_base64_decode() without checking whether the input length could

CVE-2026-64007 [CRITICAL] CWE-416 CVE-2026-64007: In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tc In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and ipv6_synproxy_ho

CVE-2026-64055 [CRITICAL] CVE-2026-64055: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry o In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry over frag counter The gmac_rx() NAPI poll function assembles packets in an SKB from a ring buffer. If the ring buffer gets completely emptied during a poll cycle, we exit gmac_rx(), but the packet is not yet completely assembled in the SKB, yet the fragment

CVE-2026-64397 [CRITICAL] CWE-416 CVE-2026-64397: In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTOR In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callback is st

CVE-2026-46325 [CRITICAL] CWE-190 CVE-2026-46325: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conver In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the

CVE-2026-31705 [CRITICAL] CWE-787 CVE-2026-31705: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires unconditionally afterward wit