Linux Kernel vulnerabilities

CVE-2023-54094 net: prevent skb corruption on frag list segmentation net: prevent skb corruption on frag list segmentation In the Linux kernel, the following vulnerability has been resolved: net: prevent skb corruption on frag list segmentation Ian reported several skb corruptions triggered by rx-gro-list, collecting different oops alike: [ 62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0 [ 62.631083] #PF: supervisor read access in kernel mode [ 62.636312] #PF: erro

CVE-2010-1146 [MEDIUM] CWE-264 CVE-2010-1146: The Linux kernel 2.6.33.2 and earlier, when a ReiserFS filesystem exists, does not restrict read or The Linux kernel 2.6.33.2 and earlier, when a ReiserFS filesystem exists, does not restrict read or write access to the .reiserfs_priv directory, which allows local users to gain privileges by modifying (1) extended attributes or (2) ACLs, as demonstrated by deleting a file under .reiserfs_priv/xattrs/.

CVE-2026-53131 [CRITICAL] CWE-125 CVE-2026-53131: In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking onl

CVE-2026-43114 [CRITICAL] CWE-20 CVE-2026-43114: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipapo set with 'ipv4 . port' key, i.e. nft -f foo. This works. Then, it reloads the set aft

CVE-2007-4573 [HIGH] CWE-264 CVE-2007-4573: The IA32 system call emulation functionality in Linux kernel 2.4.x and 2.6.x before 2.6.22.7, when r The IA32 system call emulation functionality in Linux kernel 2.4.x and 2.6.x before 2.6.22.7, when running on the x86_64 architecture, does not zero extend the eax register after the 32bit entry path to ptrace is used, which might allow local users to gain privileges by triggering an out-of-bounds access to the system call table using the %RAX register.

CVE-2026-64024 [CRITICAL] CWE-401 CVE-2026-64024: In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_i In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is v

CVE-2017-12762 [CRITICAL] CWE-119 CVE-2017-12762: In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree, 4.12-stable tree, 3.18-stable tree, and 4.4-stable tree.

CVE-2026-53359 [HIGH] CWE-416 CVE-2026-53359: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outsi

CVE-2026-52999 [CRITICAL] CWE-125 CVE-2026-52999: In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix o In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once and passed by reference to nf_osf_match_one() for each fingerprint checked. During TCP option parsing, nf_osf_match_one() advances the shared ct

CVE-2026-46119 [CRITICAL] CWE-125 CVE-2026-46119: In the Linux kernel, the following vulnerability has been resolved: libceph: Fix slab-out-of-bounds In the Linux kernel, the following vulnerability has been resolved: libceph: Fix slab-out-of-bounds access in auth message processing If a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY contains a positive value in its result field, it is treated as an error code by ceph_handle_auth_reply() and returned to handle_auth_reply(). Therea

CVE-2026-46043 [CRITICAL] CWE-190 CVE-2026-46043: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the attacker-controlled BTH pad field and RXE_I

CVE-2024-47659 [HIGH] CVE-2024-47659: In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect labeling Currently, Smack mirrors the label of incoming tcp/ipv4 connections: when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'foo' in returned ipv4 packets. So, 1) returned packets are incorrectly labeled ('foo' instead of 'bar')

CVE-2026-63919 [HIGH] CWE-416 CVE-2026-63919: In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must stay valid until the deferred callback runs. Take a netns reference when queueing deferred r

CVE-2026-63796 [HIGH] CWE-125 CVE-2026-63796: In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group b In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2_validate_gd_parent() only bounds bg_bits against the parent allocator's chain geometry. A malicious descriptor can still claim a bg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in the group descriptor block

CVE-2026-53240 [HIGH] CWE-416 CVE-2026-53240: In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload __input_process_payload() stores first_skb into xtfs->ra_newskb under drop_lock when starting partial reassembly, then unlocks and breaks out of the processing loop. The post-loop check reads xtfs->ra_newskb with

CVE-2026-43187 [HIGH] CWE-191 CVE-2026-43187: In the Linux kernel, the following vulnerability has been resolved: xfs: delete attr leaf freemap e In the Linux kernel, the following vulnerability has been resolved: xfs: delete attr leaf freemap entries when empty Back in commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow"), Brian Foster observed that it's possible for a small freemap at the end of the end of the xattr entries array to experience a size underflow when subtr

CVE-2026-64390 [HIGH] CVE-2026-64390: In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection own In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths, however, remove the connection list entry while holding fp->con

CVE-2026-31717 [HIGH] CVE-2026-31717: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate owner of durabl In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate owner of durable handle on reconnect Currently, ksmbd does not verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. This allows any authenticated user to hijack an orphaned durable handle by predicting or brute-forcin

CVE-2005-0815 [MEDIUM] CVE-2005-0815: Multiple "range checking flaws" in the ISO9660 filesystem handler in Linux 2.6.11 and earlier may al Multiple "range checking flaws" in the ISO9660 filesystem handler in Linux 2.6.11 and earlier may allow attackers to cause a denial of service or corrupt memory via a crafted filesystem.

CVE-2026-31450 [HIGH] CWE-476 CVE-2026-31450: In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after init In the Linux kernel, the following vulnerability has been resolved: ext4: publish jinode after initialization ext4_inode_attach_jinode() publishes ei->jinode to concurrent users. It used to set ei->jinode before jbd2_journal_init_jbd_inode(), allowing a reader to observe a non-NULL jinode with i_vfs_inode still unset. The fast commit flush path can