Linux Kernel vulnerabilities

CVE-2026-53055 [CRITICAL] CWE-416 CVE-2026-53055: In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - preven In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - prevent req used-after-free for sec During packet transmission, if the system is under heavy load, the hardware might complete processing the packet and free the request memory (req) before the transmission function finishes. If the software subsequently

CVE-2026-31659 [CRITICAL] CWE-190 CVE-2026-31659: In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized gl In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offse

CVE-2026-53002 [CRITICAL] CWE-787 CVE-2026-53002: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sp In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer size in mangle_content_len() while at it. BUG: KASAN: stack-out-of-bounds in vsnprintf

CVE-2026-43198 [CRITICAL] CWE-362 CVE-2026-43198: In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_ In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6

CVE-2019-9500 [HIGH] CWE-122 CVE-2019-9500: The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulner The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compr

CVE-2004-0186 [HIGH] CVE-2004-0186: smbmnt in Samba 2.x and 3.x on Linux 2.6, when installed setuid, allows local users to gain root pri smbmnt in Samba 2.x and 3.x on Linux 2.6, when installed setuid, allows local users to gain root privileges by mounting a Samba share that contains a setuid root program, whose setuid attributes are not cleared when the share is mounted.

CVE-2023-54090 ixgbe: Fix panic during XDP_TX with > 64 CPUs ixgbe: Fix panic during XDP_TX with > 64 CPUs In the Linux kernel, the following vulnerability has been resolved: ixgbe: Fix panic during XDP_TX with > 64 CPUs Commit 4fe815850bdc ("ixgbe: let the xdpdrv work with more than 64 cpus") adds support to allow XDP programs to run on systems with more than 64 CPUs by locking the XDP TX rings and indexing them using cpu % 64 (IXGBE_MAX_XDP_QS). Upon trying this out patch on a system with

CVE-2023-54258 CVE-2023-54258: In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential oops in cifs_oplock_break With deferred close we can have clos In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential oops in cifs_oplock_break With deferred close we can have closes that race with lease breaks, and so with the current checks for whether to send the lease response, oplock_response(), this can mean that an unmount (kill_sb) can oc

CVE-2025-68775 net/handshake: duplicate handshake cancellations leak socket net/handshake: duplicate handshake cancellations leak socket In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a handshake request is cancelled it is removed from the handshake_net->hn_requests list, but it is still present in the handshake_rhashtbl until it is destroyed. If a second cancellation request arrives for the same handshake

CVE-2023-54203 ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr When smb1 mount fails, KASAN detect slab-out-of-bounds in init_smb2_rsp_hdr like the following one. For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called. The issue occurs while handling smb1 negotiate as smb2 server operations. Add smb server op

CVE-2022-42896 [HIGH] CWE-416 CVE-2022-42896: There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_co There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim. We reco

CVE-2025-40212 nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd: fix refcount leak in nfsd_set_fh_dentry() In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the pseudo root fil

CVE-2014-7822 [HIGH] CWE-264 CVE-2014-7822: The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associa

CVE-2019-9503 [HIGH] CVE-2019-9503: The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver receives the firm

CVE-2026-63830 [CRITICAL] CWE-269 CVE-2026-63830: In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy ac In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writable BPF ctx->data. This protects entries backed by pages that are not

CVE-2026-46242 [HIGH] CWE-416 CVE-2026-46242: In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking th

CVE-2009-2767 [HIGH] CWE-119 CVE-2009-2767: The init_posix_timers function in kernel/posix-timers.c in the Linux kernel before 2.6.31-rc6 allows The init_posix_timers function in kernel/posix-timers.c in the Linux kernel before 2.6.31-rc6 allows local users to cause a denial of service (OOPS) or possibly gain privileges via a CLOCK_MONOTONIC_RAW clock_nanosleep call that triggers a NULL pointer dereference.

CVE-2026-63992 [CRITICAL] CWE-125 CVE-2026-63992: In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transpor In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-bound access, because (typeof(skb->transport_header))~0U is 65535. Access the icmp head

CVE-2026-53186 [CRITICAL] CWE-125 CVE-2026-53186: In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense c In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len).

CVE-2013-1828 [MEDIUM] CWE-20 CVE-2013-1828: The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does not validate a size value before proceeding to a copy_from_user operation, which allows local users to gain privileges via a crafted application that contains an SCTP_GET_ASSOC_STATS getsockopt system call.