Linux Kernel vulnerabilities

CVE-2026-53248 [HIGH] CWE-416 CVE-2026-53248: In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix use-after-free In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix use-after-free in metadata dst teardown airoha_metadata_dst_free() runs metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the me

CVE-2026-46125 [HIGH] CWE-416 CVE-2026-46125: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since it's related to the link of the vif being removed. Delete an existing statio

CVE-2026-31408 [HIGH] CWE-416 CVE-2026-31408: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-f In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the

CVE-2022-2196 [HIGH] CWE-1188 CVE-2022-2196: A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution atta A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the hos

CVE-2026-53071 [HIGH] CWE-667 CVE-2026-53071: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing c In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfigura

CVE-2026-53360 [HIGH] CWE-125 CVE-2026-53360: In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scrat In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when using GHCB v2+ require the software scratch area to reside in the GHCB's shared buffer. Note, things like Page State Change (PSC) requests _rely_ on this behavior, as the guest can't provide a len

CVE-2026-31588 [HIGH] CWE-416 CVE-2026-31588: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use scratch field in In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use scratch field in MMIO fragment to hold small write values When exiting to userspace to service an emulated MMIO write, copy the to-be-written value to a scratch field in the MMIO fragment if the size of the data payload is 8 bytes or less, i.e. can fit in a single chunk,

CVE-2026-53354 [HIGH] CVE-2026-53354: In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Mitigate TLBI er In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Mitigate TLBI errata on various Arm CPUs A number of CPUs developed by Arm suffer from errata whereby a broadcast TLBI;DSB sequence may complete before the global observation of writes which are translated by an affected TLB entry. These errata ONLY affect the completion of m

CVE-2026-23457 [HIGH] CVE-2026-23457: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fi In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() sip_help_tcp() parses the SIP Content-Length header with simple_strtoul(), which returns unsigned long, but stores the result in unsigned int clen. On 64-bit systems, values exceeding UINT_MAX are silently trunc

CVE-2026-46273 [HIGH] CVE-2026-46273: In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packet In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packets with small MSS Some physical adapters on Power systems do not support segmentation offload when the MSS is less than 224 bytes. Attempting to send such packets causes the adapter to freeze, stopping all traffic until manually reset. Implement ndo_features_ch

CVE-2015-8787 [CRITICAL] CVE-2015-8787: The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604.

CVE-2008-3915 [CRITICAL] CWE-119 CVE-2008-3915: Buffer overflow in nfsd in the Linux kernel before 2.6.26.4, when NFSv4 is enabled, allows remote at Buffer overflow in nfsd in the Linux kernel before 2.6.26.4, when NFSv4 is enabled, allows remote attackers to have an unknown impact via vectors related to decoding an NFSv4 acl.

CVE-2007-6762 [CRITICAL] CWE-119 CVE-2007-6762: In the Linux kernel before 2.6.20, there is an off-by-one bug in net/netlabel/netlabel_cipso_v4.c wh In the Linux kernel before 2.6.20, there is an off-by-one bug in net/netlabel/netlabel_cipso_v4.c where it is possible to overflow the doi_def->tags[] array.

CVE-2012-6712 [CRITICAL] CWE-119 CVE-2012-6712: In the Linux kernel before 3.4, a buffer overflow occurs in drivers/net/wireless/iwlwifi/iwl-agn-sta In the Linux kernel before 3.4, a buffer overflow occurs in drivers/net/wireless/iwlwifi/iwl-agn-sta.c, which will cause at least memory corruption.

CVE-2013-2850 [HIGH] CWE-119 CVE-2013-2850: Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/ Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled duri

CVE-2026-43233 [HIGH] CWE-125 CVE-2026-43233: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: f In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`, which is still 0 from its initialization at the top of the function: unsigned int type, ext, len = 0; ... if (ext || (son->attr & OPEN)) { B

CVE-2025-21759 [HIGH] CWE-416 CVE-2025-21759: In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protect In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6_send() igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses

CVE-2026-45843 [HIGH] CVE-2026-45843: In the Linux kernel, the following vulnerability has been resolved: slip: bound decode() reads agai In the Linux kernel, the following vulnerability has been resolved: slip: bound decode() reads against the compressed packet length slhc_uncompress() parses a VJ-compressed TCP header by advancing a pointer through the packet via decode() and pull16(). Neither helper bounds-checks against isize, and decode() masks its return with & 0xffff so it can never ret

CVE-2008-1673 [CRITICAL] CWE-119 CVE-2008-1673: The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used The asn1 implementation in (a) the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ip_nat_snmp_basic modules; and (b) the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a

CVE-2023-4147 [HIGH] CWE-416 CVE-2023-4147: A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule wit A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.