Linux Kernel vulnerabilities

CVE-2017-5897 [CRITICAL] CWE-125 CVE-2017-5897: The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have un The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access.

CVE-2026-43407 [CRITICAL] CWE-125 CVE-2026-43407: In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-b In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() This patch fixes an out-of-bounds access in ceph_handle_auth_reply() that can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In ceph_handle_auth_reply(), the value of the payload_len field of such a m

CVE-2026-53224 [CRITICAL] CWE-125 CVE-2026-53224: In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT ch In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A ma

CVE-2026-53225 [CRITICAL] CWE-908 CVE-2026-53225: In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sct In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the

CVE-2021-33909 [HIGH] CWE-190 CVE-2021-33909: fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq b fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.

CVE-2026-46266 [CRITICAL] CVE-2026-46266: In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, lead

CVE-2024-38605 [HIGH] CWE-476 CVE-2024-38605: In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix NULL module poi In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix NULL module pointer assignment at card init The commit 81033c6b584b ("ALSA: core: Warn on empty module") introduced a WARN_ON() for a NULL module pointer passed at snd_card object creation, and it also wraps the code around it with '#ifdef MODULE'. This works in most

CVE-2026-31450 [HIGH] CWE-476 CVE-2026-31450: In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after init In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after initialization ext4_inode_attach_jinode() publishes ei->jinode to concurrent users. It used to set ei->jinode before jbd2_journal_init_jbd_inode(), allowing a reader to observe a non-NULL jinode with i_vfs_inode still unset. The fast commit flush path can

CVE-2005-0815 [MEDIUM] CVE-2005-0815: Multiple "range checking flaws" in the ISO9660 filesystem handler in Linux 2.6.11 and earlier may al Multiple "range checking flaws" in the ISO9660 filesystem handler in Linux 2.6.11 and earlier may allow attackers to cause a denial of service or corrupt memory via a crafted filesystem.

CVE-2026-43490 [HIGH] CWE-787 CVE-2026-43490: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate inherited ACE S In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate inherited ACE SID length smb_inherit_dacl() walks the parent directory DACL loaded from the security descriptor xattr. It verifies that each ACE contains the fixed SID header before using it, but does not verify that the variable-length SID described by sid.num_subaut

CVE-2019-14897 [CRITICAL] CWE-121 CVE-2019-14897: A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary code, when a STA works in IBSS mode (allows connecting stations together without the use of an AP) and connects to another STA.

CVE-2018-7273 [MEDIUM] CWE-200 CVE-2018-7273: In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function show_floppy in drivers/block/floppy.c. An attacker can read this information from dmesg and use the addresses to find the locations of kernel code and data and bypass kernel security protections suc

CVE-2021-47274 [CRITICAL] CWE-125 CVE-2021-47274: In the Linux kernel, the following vulnerability has been resolved: tracing: Correct the length che In the Linux kernel, the following vulnerability has been resolved: tracing: Correct the length check which causes memory corruption We've suffered from severe kernel crashes due to memory corruption on our production environment, like, Call Trace: [1640542.554277] general protection fault: 0000 [#1] SMP PTI [1640542.554856] CPU: 17 PID: 26996 C

CVE-2026-43501 [CRITICAL] CWE-787 CVE-2026-43501: In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len head In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, then pulls the old header and pushes the new one plus the IPv6 header back. The recompress

CVE-2026-31405 [CRITICAL] CWE-125 CVE-2026-31405: In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handlers[] and ule_optional_ext_handlers[] tables in handle_one_ule_extension() are declared with 255 elements (valid indices 0-254), but the index htype is derived from network-controlled data as

CVE-2026-53046 [CRITICAL] CWE-416 CVE-2026-53046: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbd_crypt_message() sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return code from async hardware crypto engines like the Qualcomm Crypto Engine (QCE). When QCE returns

CVE-2026-43304 [CRITICAL] CVE-2026-43304: In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEP In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key, verify that the key material would fit into a fixed-size buffer in process_auth_done() and generally has a sane length. The new CEPH_MAX_KEY_LEN check replaces the existing check for a key with no key material which is

CVE-2026-31633 [CRITICAL] CWE-190 CVE-2026-31633: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix integer overflow in In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix integer overflow in rxgk_verify_response() In rxgk_verify_response(), there's a potential integer overflow due to rounding up token_len before checking it, thereby allowing the length check to be bypassed. Fix this by checking the unrounded value against len too (len i

CVE-2026-31649 [CRITICAL] CWE-190 CVE-2026-31649: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underf In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underflow in chain mode The jumbo_frm() chain-mode implementation unconditionally computes len = nopaged_len - bmax; where nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is BUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit() d

CVE-2026-43038 [CRITICAL] CWE-843 CVE-2026-43038: In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and passed to icmp6_send(), it uses IP6C