Linux Kernel vulnerabilities

CVE-2026-43384 [CRITICAL] CVE-2026-43384: In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: Fix MAC comparison In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

CVE-2026-31608 [CRITICAL] CWE-415 CVE-2026-31608: In the Linux kernel, the following vulnerability has been resolved: smb: server: avoid double-free In the Linux kernel, the following vulnerability has been resolved: smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() smb_direct_flush_send_list() already calls smb_direct_free_sendmsg(), so we should not call it again after post_sendmsg() moved it to the batch list.

CVE-2026-31609 [CRITICAL] CWE-415 CVE-2026-31609: In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() smbd_send_batch_flush() already calls smbd_free_send_io(), so we should not call it again after smbd_post_send() moved it to the batch list.

CVE-2026-43379 [CRITICAL] CWE-416 CVE-2026-43379: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sm In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is being accessed after rcu_read_unlock() has been called. This creates a race condition where the memory could be freed by a concurrent writer between the u

CVE-2026-53355 [CRITICAL] CWE-476 CVE-2026-53355: In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setu In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is written so it can run during partial startup and on repeated shutdown attempts. It uses NULL pointers to distinguish resources that are still owned from resources that have already been released. When

CVE-2026-53309 [CRITICAL] CWE-193 CVE-2026-53309: In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dl In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of qr_regions. The other loops in the same function correctly use '<'. Fix the loop condition

CVE-2026-52931 [CRITICAL] CVE-2026-52931: In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined b

CVE-2026-53006 [CRITICAL] CWE-416 CVE-2026-53006: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr when net_dbg_ratelimited() is called in the slow path.

CVE-2025-68192 CVE-2025-68192: In the Linux kernel, the following vulnerability has been resolved: net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup Raw IP packets In the Linux kernel, the following vulnerability has been resolved: net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup Raw IP packets have no MAC header, leaving skb->mac_header uninitialized. This can trigger kernel panics on ARM64 when xfrm or other subsystems access the offset due to strict alignm

CVE-2025-68285 libceph: fix potential use-after-free in have_mon_and_osd_map() libceph: fix potential use-after-free in have_mon_and_osd_map() In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both ceph_monc_handle_map() and handle_one_map() install a new map immediately aft

CVE-2008-5134 [CRITICAL] CWE-119 CVE-2008-5134: Buffer overflow in the lbs_process_bss function in drivers/net/wireless/libertas/scan.c in the liber Buffer overflow in the lbs_process_bss function in drivers/net/wireless/libertas/scan.c in the libertas subsystem in the Linux kernel before 2.6.27.5 allows remote attackers to have an unknown impact via an "invalid beacon/probe response."

CVE-2023-38430 [CRITICAL] CWE-125 CVE-2023-38430: An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request pr An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read.

CVE-2024-36896 [CRITICAL] CWE-476 CVE-2024-36896: In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in port.c:disable_store(): usb_hub_to_struct_hub() can return NULL if the hub that the port belongs to is concurrently removed, but the function does not check for this poss

CVE-2018-1000026 [HIGH] CWE-20 CVE-2018-1000026: Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very large, specially crafted packet to the bnx2

CVE-2022-42719 [HIGH] CWE-416 CVE-2022-42719: A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 th A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code.

CVE-2026-43071 [CRITICAL] CWE-125 CVE-2026-43071: In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal numbe In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two There is an OOB read problem on dentry_hashtable when user sets 'dhash_entries=1': BUG: unable to handle page fault for address: ffff888b30b774b0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present pag

CVE-2023-52798 [HIGH] CWE-416 CVE-2023-52798: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix dfs radar eve In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix dfs radar event locking The ath11k active pdevs are protected by RCU but the DFS radar event handling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a read-side critical section. Mark the code in question as an RCU read-side critical section to avoid

CVE-2015-1421 [CRITICAL] CVE-2015-1421: Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.

CVE-2024-43847 [HIGH] CVE-2024-43847: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix invalid memor In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix invalid memory access while processing fragmented packets The monitor ring and the reo reinject ring share the same ring mask index. When the driver receives an interrupt for the reo reinject ring, the monitor ring is also processed, leading to invalid memory access. Since

CVE-2026-43232 [HIGH] CWE-416 CVE-2026-43232: In the Linux kernel, the following vulnerability has been resolved: net: wan: farsync: Fix use-afte In the Linux kernel, the following vulnerability has been resolved: net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets When the FarSync T-series card is being detached, the fst_card_info is deallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task may still be running or pending, leading to use-after-free bugs wh