Linux Kernel vulnerabilities

CVE-2026-43083 [CRITICAL] CWE-125 CVE-2026-43083: In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing lock When trace->type.bit6 is set: if (trace->type.bit6) { ... queue = skb_get_tx_queue(dev, skb); qdisc = rcu_dereference(queue->qdisc); This code can lead to an out-of-bounds access of the dev->_tx[] array when is_input is true. In such a case,

CVE-2026-64392 [CRITICAL] CVE-2026-64392: In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials f In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem

CVE-2026-46244 [CRITICAL] CWE-682 CVE-2026-46244: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (4

CVE-2023-32254 [HIGH] CWE-362 CVE-2023-32254: A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.

CVE-2026-64400 [HIGH] CVE-2026-64400: In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal b In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the share boundary using parent-directory components ('..'), vfs_path_parent_lookup() d

CVE-2026-63795 [CRITICAL] CWE-416 CVE-2026-63795: In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_ In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunk_fid, which currently calls p9_fid_put(fid) unconditio

CVE-2020-0009 [MEDIUM] CVE-2020-0009: In calc_vm_may_flags of ashmem In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-142938932

CVE-2026-43185 [CRITICAL] CWE-674 CVE-2026-43185: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, ...). A maliciously provided preferred_send_size of 0x8000

CVE-2019-10126 [CRITICAL] CWE-122 CVE-2019-10126: A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies fun A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences.

CVE-2026-43501 [CRITICAL] CWE-787 CVE-2026-43501: In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len head In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, then pulls the old header and pushes the new one plus the IPv6 header back. The recompress

CVE-2026-46195 [CRITICAL] CWE-476 CVE-2026-46195: In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffse In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parse_sec_desc(), build_sec_desc(), and the chown path in id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd before proving a DACL header fits inside the returned security descriptor. On 32-bit bui

CVE-2026-53221 [CRITICAL] CWE-20 CVE-2026-53221: In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel m In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels mat

CVE-2026-64355 [CRITICAL] CWE-125 CVE-2026-64355: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames i In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdp_frame data, while fragmented frames keep skb_shared_info in tailroom outside the linear area. Cloning

CVE-2026-43067 [CRITICAL] CWE-822 CVE-2026-43067: In the Linux kernel, the following vulnerability has been resolved: ext4: handle wraparound when se In the Linux kernel, the following vulnerability has been resolved: ext4: handle wraparound when searching for blocks for indirect mapped blocks Commit 4865c768b563 ("ext4: always allocate blocks only from groups inode can use") restricts what blocks will be allocated for indirect block based files to block numbers that fit within 32-bit block nu

CVE-2026-53216 [CRITICAL] CVE-2026-53216: In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame siz In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive th

CVE-2026-64232 [CRITICAL] CWE-667 CVE-2026-64232: In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_s In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_segments in blk_insert_cloned_request blk_insert_cloned_request() already recomputes nr_phys_segments against the bottom queue, because "the queue settings related to segment counting may differ from the original queue." The exact same reasoning appl

CVE-2014-2523 [CRITICAL] CWE-20 CVE-2014-2523: net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointe net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function.

CVE-2016-4558 [HIGH] CVE-2016-4558: The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local u The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted application on (1) a system with more than 32 Gb of memory, related to the program reference count or (2) a 1 Tb system, related to the map reference count.

CVE-2017-7895 [CRITICAL] CWE-119 CVE-2017-7895: The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks f The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.

CVE-2026-53043 [CRITICAL] CWE-787 CVE-2026-53043: In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregio In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()". In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION network message is used to drive loops over the qr_regions buffer without sufficient va