Linux Kernel vulnerabilities

CVE-2019-15926 [CRITICAL] CWE-125 CVE-2019-15926: An issue was discovered in the Linux kernel before 5.2.3. Out of bounds access exists in the functio An issue was discovered in the Linux kernel before 5.2.3. Out of bounds access exists in the functions ath6kl_wmi_pstream_timeout_event_rx and ath6kl_wmi_cac_event_rx in the file drivers/net/wireless/ath/ath6kl/wmi.c.

CVE-2015-8104 [CRITICAL] CWE-399 CVE-2015-8104: The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS us The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.

CVE-2015-3331 [CRITICAL] CWE-119 CVE-2015-3331: The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel befo The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API

CVE-2019-15505 [CRITICAL] CWE-125 CVE-2019-15505: drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds re drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via usbip or usbredir).

CVE-2004-0077 [HIGH] CVE-2004-0077: The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.

CVE-2026-64268 [CRITICAL] CWE-787 CVE-2026-64268: In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response p In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accumulates wqe->processed, but it never checks the running total against t

CVE-2025-21796 [CRITICAL] CWE-416 CVE-2025-21796: In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_defa In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a pointer pointing to the released posix_acl, which will trigger a WARNING in nfs3svc_release_ge

CVE-2026-52924 [CRITICAL] CWE-416 CVE-2026-52924: In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale C In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no

CVE-2026-64439 [CRITICAL] CWE-416 CVE-2026-64439: In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL completion callback and treat any negative return from crypto_aead_{encrypt,decrypt

CVE-2024-35870 [CRITICAL] CWE-416 CVE-2024-35870: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in smb2_re In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in smb2_reconnect_server() The UAF bug is due to smb2_reconnect_server() accessing a session that is already being teared down by another thread that is executing __cifs_put_smb_ses(). This can happen when (a) the client has connection to the server but no se

CVE-2026-31637 [CRITICAL] CWE-754 CVE-2026-31637: In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxk In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_decrypt() succeeded. A malformed RESPONSE can therefore use a non-block-aligned ticket le

CVE-2026-43402 [CRITICAL] CWE-416 CVE-2026-43402: In the Linux kernel, the following vulnerability has been resolved: kthread: consolidate kthread ex In the Linux kernel, the following vulnerability has been resolved: kthread: consolidate kthread exit paths to prevent use-after-free Guillaume reported crashes via corrupted RCU callback function pointers during KUnit testing. The crash was traced back to the pidfs rhashtable conversion which replaced the 24-byte rb_node with an 8-byte rhash_hea

CVE-2026-64125 [CRITICAL] CVE-2026-64125: In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/RX error counters remain quiet. In that state the MAC

CVE-2026-52982 [CRITICAL] CWE-416 CVE-2026-52982: In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-afte In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit() when accessing skb->len for tx statistics after usb_submit_urb() has been called: BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x

CVE-2026-45898 [CRITICAL] CWE-1341 CVE-2026-45898: In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list c In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removing work_list The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") changed the work submission logic to unconditionally call queue_work() with the expectation that queue_work() would have no effect if work was already pen

CVE-2026-53384 [CRITICAL] CWE-416 CVE-2026-53384: In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 825 In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails dw8250_probe() registers the 8250 port via serial8250_register_8250_port() and then, if the device has a clock, registers a clock notifier. If clk_notifier_register() fails, probe returns the error but leaves

CVE-2026-64047 [CRITICAL] CWE-193 CVE-2026-64047: In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sg_ In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring When an sk_msg scatterlist ring wraps (sg.end sg.data[msg_pl->sg.start], MAX_SKB_FRAGS - msg_pl->sg.start + 1, msg_pl->sg.data); This places the chain pointer at sg_chain(data[start], (MAX_SKB_FRAGS - msg_

CVE-2026-64102 [CRITICAL] CWE-125 CVE-2026-64102: In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU lengt In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP

CVE-2026-64162 [CRITICAL] CWE-666 CVE-2026-64162: In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spi In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() In idpf_ptp_init(), read_dev_clk_lock is initialized after ptp_schedule_worker() had already been called (and after idpf_ptp_settime64() could reach the lock). The PTP aux worker fires immediately upon scheduling and ca

CVE-2026-64037 [CRITICAL] CWE-20 CVE-2026-64037: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: fix TSO seg In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled When the TLC notification disables AMSDU for a TID, the MLD driver sets max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in iwl_mld_tx_tso_segment() checks for zero but not for this senti