Linux Kernel vulnerabilities

CVE-2026-64396 [HIGH] CWE-416 CVE-2026-64396: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_l In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into the connection's async_requests list via setup_async_work(). The cancel callback s

CVE-2026-31739 [HIGH] CWE-617 CVE-2026-31739: In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Add missing CRY In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Add missing CRYPTO_ALG_ASYNC The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its asynchronous algorithms, causing the crypto API to select them for users that request only synchronous algorithms. This causes crashes (at least). Fix this by adding the fla

CVE-2026-23246 [HIGH] CWE-129 CVE-2026-23246: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check li In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration link_id is taken from the ML Reconfiguration element (control & 0x000f), so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS (15) elements, so index 15 is out-of-bounds. Skip subelements with

CVE-2026-31773 [HIGH] CWE-287 CVE-2026-31773: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: derive legacy r In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: derive legacy responder STK authentication from MITM state The legacy responder path in smp_random() currently labels the stored STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH. That reflects what the local service requested, not what the pairing f

CVE-2026-53075 [HIGH] CWE-863 CVE-2026-53075: In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in t In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current->nsproxy->net_ns. As a result, a local unprivileged user can create a new user namespace wi

CVE-2014-5207 [MEDIUM] CWE-269 CVE-2014-5207: fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind mount, which allows local users to gain privileges, interfere with backups and auditing on systems that had atime enabled, or cause a denial of service (excessive filesystem

CVE-2023-6200 [HIGH] CWE-362 CVE-2023-6200: A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacke A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution.

CVE-2016-4578 [MEDIUM] CWE-200 CVE-2016-4578: sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, w sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.

CVE-2023-38426 [CRITICAL] CWE-125 CVE-2023-38426: An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_fi An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length.

CVE-2026-63924 [CRITICAL] CWE-822 CVE-2026-63924: In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh point In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up.

CVE-2026-63922 [CRITICAL] CWE-416 CVE-2026-63922: In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh n

CVE-2026-31414 [CRITICAL] CWE-476 CVE-2026-31414: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe. Use exp->master->helper in ctnetlink path if userspace does not provide an expli

CVE-2026-23240 [CRITICAL] CWE-362 CVE-2026-23240: In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_ In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit. After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result,

CVE-2019-17666 [HIGH] CWE-120 CVE-2019-17666: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow.

CVE-2026-63994 [CRITICAL] CWE-416 CVE-2026-63994: In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers a In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF b

CVE-2026-53045 [CRITICAL] CVE-2026-53045: In the Linux kernel, the following vulnerability has been resolved: memory: tegra124-emc: Fix dll_c In the Linux kernel, the following vulnerability has been resolved: memory: tegra124-emc: Fix dll_change check The code checking whether the specified memory timing enables DLL in the EMRS register was reversed. DLL is enabled if bit A0 is low. Fix the check.

CVE-2026-64067 [CRITICAL] CWE-667 CVE-2026-64067: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing barriers whe In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing barriers when accessing stream->subrequests locklessly The list of subrequests attached to stream->subrequests is accessed without locks by netfs_collect_read_results() and netfs_collect_write_results(), and then they access subreq->flags without taking a barri

CVE-2026-46115 [CRITICAL] CWE-20 CVE-2026-46115: In the Linux kernel, the following vulnerability has been resolved: block: add pgmap check to biove In the Linux kernel, the following vulnerability has been resolved: block: add pgmap check to biovec_phys_mergeable biovec_phys_mergeable() is used by the request merge, DMA mapping, and integrity merge paths to decide if two physically contiguous bvec segments can be coalesced into one. It currently has no check for whether the segments belong to

CVE-2026-31669 [CRITICAL] CWE-416 CVE-2026-31669: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side critical sections. Both tcp_prot and tcpv6_prot have their slab caches created with this flag

CVE-2026-64061 [CRITICAL] CWE-416 CVE-2026-64061: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink fo In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfs_read_gaps() Fix netfs_read_gaps() to release the sink page it uses after waiting for the request to complete. The way the sink page is used is that an ITER_BVEC-class iterator is created that has the gaps from the target folio at either