Linux Kernel vulnerabilities

CVE-2026-53240 [HIGH] CWE-416 CVE-2026-53240: In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload __input_process_payload() stores first_skb into xtfs->ra_newskb under drop_lock when starting partial reassembly, then unlocks and breaks out of the processing loop. The post-loop check reads xtfs->ra_newskb with

CVE-2010-2521 [CRITICAL] CWE-119 CVE-2010-2521: Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Li Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel before 2.6.34-rc6 allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions.

CVE-2017-16994 [MEDIUM] CWE-200 CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call.

CVE-2018-11508 [MEDIUM] CWE-200 CVE-2018-11508: The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local user The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitive information from kernel memory via adjtimex.

CVE-2019-15505 [CRITICAL] CWE-125 CVE-2019-15505: drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds re drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via usbip or usbredir).

CVE-2024-42256 [CRITICAL] CVE-2024-42256: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server re-repick on s In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server re-repick on subrequest retry When a subrequest is marked for needing retry, netfs will call cifs_prepare_write() which will make cifs repick the server for the op before renegotiating credits; it then calls cifs_issue_write() which invokes smb2_async_writev() - which re

CVE-2026-53215 [CRITICAL] CVE-2026-53215: In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers b In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an sk

CVE-2026-45898 [CRITICAL] CWE-1341 CVE-2026-45898: In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list c In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removing work_list The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") changed the work submission logic to unconditionally call queue_work() with the expectation that queue_work() would have no effect if work was already pen

CVE-2026-46289 [CRITICAL] CWE-401 CVE-2026-46289: In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length cal In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length calculations in extract_kvec_to_sg Patch series "Fix bugs in extract_iter_to_sg()", v3. Fix bugs in the kvec and user variants of extract_iter_to_sg. This series is growing due to useful remarks made by sashiko.dev. The main bugs are: - The length fo

CVE-2026-45988 [CRITICAL] CVE-2026-45988: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix re-decryption of RES In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet gets a temporary failure during processing, it may end up in a partially decrypted state - and then get requeued for a retry. Fix this by just discarding the packet; we will send another CHALLENGE packet and thereby elici

CVE-2026-31436 [CRITICAL] CWE-476 CVE-2026-31436: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix possible w In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() At the end of this function, d is the traversal cursor of flist, but the code completes found instead. This can lead to issues such as NULL pointer dereferences, double completion, or descriptor leaks

CVE-2026-43402 [CRITICAL] CWE-416 CVE-2026-43402: In the Linux kernel, the following vulnerability has been resolved: kthread: consolidate kthread ex In the Linux kernel, the following vulnerability has been resolved: kthread: consolidate kthread exit paths to prevent use-after-free Guillaume reported crashes via corrupted RCU callback function pointers during KUnit testing. The crash was traced back to the pidfs rhashtable conversion which replaced the 24-byte rb_node with an 8-byte rhash_hea

CVE-2026-43376 [CRITICAL] CWE-416 CVE-2026-43376: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free by us In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free by using call_rcu() for oplock_info ksmbd currently frees oplock_info immediately using kfree(), even though it is accessed under RCU read-side critical sections in places like opinfo_get() and proc_show_files(). Since there is no RCU grace period delay

CVE-2026-31536 [CRITICAL] CVE-2026-31536: In the Linux kernel, the following vulnerability has been resolved: smb: server: let send_done hand In the Linux kernel, the following vulnerability has been resolved: smb: server: let send_done handle a completion without IB_SEND_SIGNALED With smbdirect_send_batch processing we likely have requests without IB_SEND_SIGNALED, which will be destroyed in the final request that has IB_SEND_SIGNALED set. If the connection is broken all requests are signale

CVE-2026-31718 [CRITICAL] CWE-416 CVE-2026-31718: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __ In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger When a durable file handle survives session disconnect (TCP close without SMB2_LOGOFF), session_fd_check() sets fp->conn = NULL to preserve the handle for later reconnection. However, it did not clean up the by

CVE-2015-4002 [CRITICAL] CWE-119 CVE-2015-4002: drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not e drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) oz_usb_rx and (2) oz_usb_handl

CVE-2026-52924 [CRITICAL] CWE-416 CVE-2026-52924: In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale C In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no

CVE-2026-53175 [CRITICAL] CWE-416 CVE-2026-53175: In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue

CVE-2005-1589 [HIGH] CVE-2005-1589: The pkt_ioctl function in the pktcdvd block device ioctl handler (pktcdvd.c) in Linux kernel 2.6.12- The pkt_ioctl function in the pktcdvd block device ioctl handler (pktcdvd.c) in Linux kernel 2.6.12-rc4 and earlier calls the wrong function before passing an ioctl to the block device, which crosses security boundaries by making kernel address space accessible from user space and allows local users to cause a denial of service and possibly execute arbitrary co

CVE-2007-1000 [HIGH] CVE-2007-1000: The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the Linux kernel before 2.6.20.2 The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the Linux kernel before 2.6.20.2 allows local users to read arbitrary kernel memory via certain getsockopt calls that trigger a NULL dereference.