Linux Kernel vulnerabilities

CVE-2026-31712 [HIGH] CWE-787 CVE-2026-31712: In the Linux kernel, the following vulnerability has been resolved: ksmbd: require minimum ACE size In the Linux kernel, the following vulnerability has been resolved: ksmbd: require minimum ACE size in smb_check_perm_dacl() Both ACE-walk loops in smb_check_perm_dacl() only guard against an under-sized remaining buffer, not against an ACE whose declared `ace->size` is smaller than the struct it claims to describe: if (offsetof(struct smb_ace, acce

CVE-2018-14633 [HIGH] CWE-121 CVE-2018-14633: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the vi

CVE-2017-9150 [MEDIUM] CWE-200 CVE-2017-9150: The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the a The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value available for restricting the output of the print_bpf_insn function, which allows local users to obtain sensitive address information via crafted bpf system calls.

CVE-2018-20836 [HIGH] CWE-362 CVE-2018-20836: An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timed An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free.

CVE-2018-18397 [MEDIUM] CWE-863 CVE-2018-18397: The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certa The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.

CVE-2026-64150 [CRITICAL] CVE-2026-64150: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: release l In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: release local_lock before re-enabling softirqs Quoting sashiko: In the error path, local_bh_enable() is called before local_unlock_nested_bh().

CVE-2026-63800 [CRITICAL] CWE-416 CVE-2026-63800: In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnf In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'

CVE-2026-53228 [CRITICAL] CWE-416 CVE-2026-53228: In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 he In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is

CVE-2026-52931 [CRITICAL] CWE-457 CVE-2026-52931: In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to und

CVE-2026-64000 [CRITICAL] CWE-125 CVE-2026-64000: In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB acc In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this, a truncated frame could cause an out-of-bounds access.

CVE-2026-64387 [CRITICAL] CWE-415 CVE-2026-64387: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query director In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_directory_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset res

CVE-2026-64384 [CRITICAL] CWE-415 CVE-2026-64384: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_notify_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookke

CVE-2026-53010 [CRITICAL] CWE-416 CVE-2026-53010: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sm In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_open during durable reconnect In smb2_open, the call to ksmbd_put_durable_fd(fp) drops the reference to the durable file descriptor early during the durable reconnect process. If an error occurs subsequently (eg, ksmbd_iov_pin_rsp fails) or a sca

CVE-2026-64160 [CRITICAL] CWE-362 CVE-2026-64160: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearin In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size. We need to make sure that netfslib and the filesystems that

CVE-2026-52993 [CRITICAL] CWE-415 CVE-2026-52993: In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_b In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was real

CVE-2026-53049 [CRITICAL] CWE-667 CVE-2026-53049: In the Linux kernel, the following vulnerability has been resolved: gfs2: add some missing log lock In the Linux kernel, the following vulnerability has been resolved: gfs2: add some missing log locking Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but these functions require exclusion against concurrent transactions. To fix that, add a n

CVE-2026-64136 [CRITICAL] CWE-362 CVE-2026-64136: In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count i In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around tc_count changes. There was missing lock around tc_count increment in

CVE-2026-52989 [CRITICAL] CWE-908 CVE-2026-52989: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_ In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the calle

CVE-2019-11815 [HIGH] CWE-362 CVE-2019-11815: An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. Ther An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.

CVE-2025-39975 smb: client: fix wrong index reference in smb2_compound_op() smb: client: fix wrong index reference in smb2_compound_op() In the Linux kernel, the following vulnerability has been resolved: smb: client: fix wrong index reference in smb2_compound_op() In smb2_compound_op(), the loop that processes each command's response uses wrong indices when accessing response bufferes. This incorrect indexing leads to improper handling of command results. Also, if incorrectly computed index